I have a big trojan problem that just started yesterday. I have avast for my antivirus and it keeps popping up messages that i have a virus called Win32:Klone-N [Trj. I have searched on google and found limited results. Can anyone please tell me how to get rid od this think Thanks

Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install Ewido Security Suite We will need this later in safe mode Be sure to update Ewido Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Logfile of HijackThis v1.99.1 Scan saved at 6:30:03 PM, on 10/8/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avast!\aswUpdSv.exe C:\Program Files\Avast!\ashServ.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Avast!\ashMaiSv.exe C:\Program Files\Avast!\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\PROGRA~1\Avast!\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Webshots\webshots.scr C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll O2 - BHO: (no name) - {255ABBF5-D626-44BD-8A4B-44F23CE96294} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\system32\hpxdhurq.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - Startup: Task Manager.lnk = C:\WINDOWS\system32\taskmgr.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\software\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: winmyy32 - C:\WINDOWS\SYSTEM32\winmyy32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - D:\Adobe Photoshop Elements\PhotoshopElementsFileAgent.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Windows Media Connect Service (WMConnectCDS) - Unknown owner - C:\Program Files\Windows Media Connect 2\wmccds.exe (file missing)

Rename hijackthis.exe as that sometime helps locate the baddies. Go to start> search> files and folders> type in the top space "hijackthis.exe" without the quotes> click search> when it is found in the right pane (looks like a pile of dynamite)>right click on it> click rename> rename it "show.exe" without the quotes> click a blank space on the screen. Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/SmitfraudFix.zip Then extract the contents to your desktop. !!!!!Only run option #1 as the other optioins will damage the desktop of an uninfected computer.!!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. Then post another Hijack This log please.

SmitFraudFix v2.106 Scan done at 19:31:24.57, Sun 10/08/2006 Run from E:\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\rajit »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\rajit\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\rajit\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~2\\GOEC62~1.DLL" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Logfile of HijackThis v1.99.1 Scan saved at 7:33:09 PM, on 10/8/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avast!\aswUpdSv.exe C:\Program Files\Avast!\ashServ.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Avast!\ashMaiSv.exe C:\Program Files\Avast!\ashWebSv.exe C:\PROGRA~1\Avast!\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\{8C8E1681-069D-1033-0928-010703010001}\Update.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Webshots\webshots.scr C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\War of the Ring Demo\_dxinst.exe C:\Program Files\Hijackthis\Show.exe C:\WINDOWS\system32\notepad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll O2 - BHO: (no name) - {255ABBF5-D626-44BD-8A4B-44F23CE96294} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {849B9523-785F-4014-9CAF-079FB4A74C61} - C:\WINDOWS\system32\hpxdhurq.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe O4 - Startup: Task Manager.lnk = C:\WINDOWS\system32\taskmgr.exe O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\software\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: winmyy32 - C:\WINDOWS\SYSTEM32\winmyy32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - D:\Adobe Photoshop Elements\PhotoshopElementsFileAgent.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing) O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Windows Media Connect Service (WMConnectCDS) - Unknown owner - C:\Program Files\Windows Media Connect 2\wmccds.exe (file missing)

Two more scans and we will begin removing it. Please download VundoFix.exe to your C:\. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer, click OK. Turn your computer back on. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Then post the log loacted at C:\Vundofix.txt. Please download ComboFix to the Desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log

ComboFix 06.09.28 - Running from: "E:\Pulkit Kakkar\Downloads" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Inetget2 C:\Program Files\Common Files\{3C8E1681-069D-1033-0928-010703010001} C:\Program Files\Common Files\{8C8E1681-069D-1033-0928-010703010001} ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Folders Quarantined: C:\QooBox\Purity\WINDOWS\ASEMBL~1 C:\QooBox\Purity\WINDOWS\PPATCH~1 ((((((((((((((((((((((((((((((( Files Created from 2006-09-08 to 2006-10-08 )))))))))))))))))))))))))))))))))) 2006-10-08 20:25 2 --a------ C:\WINDOWS\system32\wcpsvcc.exe 2006-10-08 20:22 18,944 --a------ C:\WINDOWS\system32\cool.exe 2006-10-08 20:16 93,696 --a------ C:\WINDOWS\system32\zvjostj.dll 2006-10-08 20:16 72,704 --a------ C:\WINDOWS\system32\acrbwi.dll 2006-10-08 20:16 40,973 ---hs---- C:\WINDOWS\system32\jkkhfcy.dll 2006-10-08 19:30 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-10-08 19:30 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-10-08 19:30 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-10-08 19:30 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-10-08 12:50 368,912 --a------ C:\WINDOWS\system32\vbar332.dll 2006-10-08 12:45 299,520 --a------ C:\WINDOWS\uninst.exe 2006-10-06 15:12 86,036 --a------ C:\WINDOWS\system32\hpxdhurq.dll 2006-10-06 10:18 40,973 ---hs---- C:\WINDOWS\system32\yayvsss.dll 2006-10-06 10:18 18,432 --a------ C:\WINDOWS\system32\winmyy32.dll 2006-09-18 14:11 778,240 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2006-09-18 14:11 778,240 --a------ C:\WINDOWS\system32\divx_xx07.dll 2006-09-18 14:11 761,856 --a------ C:\WINDOWS\system32\divx_xx11.dll 2006-09-18 14:11 620,180 --a------ C:\WINDOWS\system32\DivX.dll 2006-09-09 09:41 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-08 21:29 -------- d-------- C:\Program Files\Common Files 2006-10-08 21:00 -------- d-------- C:\Program Files\Hijackthis 2006-10-08 20:58 -------- d-------- C:\Program Files\Mozilla Firefox 2006-10-08 20:30 -------- d-------- C:\Program Files\SiteAdvisor 2006-10-08 19:37 -------- d-------- C:\Program Files\War of the Ring Demo 2006-10-08 19:32 -------- d-------- C:\Program Files\Liquid Entertainment 2006-10-08 16:18 -------- d-------- C:\Program Files\Spy Cleaner Gold 2006-10-08 12:51 -------- d-------- C:\Program Files\Sunbelt Software 2006-10-08 12:45 -------- d-------- C:\Documents and Settings\rajit\Application Data\WinPatrol 2006-10-08 12:27 -------- d-------- C:\Documents and Settings\rajit\Application Data\Adobe 2006-10-07 17:22 -------- d-------- C:\Program Files\Common Files\Adobe 2006-10-07 17:22 -------- d-------- C:\Program Files\Adobe 2006-10-07 15:27 -------- d-------- C:\Program Files\Java 2006-10-07 15:21 -------- d-------- C:\Program Files\Common Files\Java 2006-10-07 14:50 -------- d--h----- C:\Program Files\InstallShield Installation Information 2006-10-07 13:18 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared 2006-10-07 12:33 108544 --------- C:\WINDOWS\system32\pxcpyi64.exe 2006-10-06 22:25 -------- d-------- C:\Program Files\Picasa2 2006-10-06 22:18 -------- d-------- C:\Program Files\Google 2006-10-04 22:10 150 --a------ C:\Documents and Settings\rajit\Application Data\.googlewebacchosts 2006-10-03 18:23 -------- d-------- C:\Program Files\SpywareBlaster 2006-10-02 15:45 -------- d-------- C:\Program Files\Yahoo! 2006-09-30 19:13 -------- d-------- C:\Program Files\Windows Media Player 2006-09-30 16:22 -------- d-------- C:\Program Files\Ahead 2006-09-29 20:50 -------- d-------- C:\Program Files\DivX 2006-09-28 16:34 -------- d-------- C:\Documents and Settings\rajit\Application Data\Ahead 2006-09-27 17:57 -------- d---s---- C:\Documents and Settings\rajit\Application Data\Microsoft 2006-09-23 12:36 -------- d-------- C:\Documents and Settings\rajit\Application Data\Media Player Classic 2006-09-18 18:16 -------- d-------- C:\Program Files\MPIO 2006-09-11 19:12 -------- dr------- C:\Documents and Settings\rajit\Application Data\Brother 2006-09-08 18:29 -------- d-------- C:\Program Files\MSN Messenger 2006-09-08 18:23 -------- d-------- C:\Program Files\Brother 2006-09-06 13:03 -------- d-------- C:\Documents and Settings\rajit\Application Data\WinAmp Control 2006-09-06 12:07 -------- d-------- C:\Program Files\Common Files\InstallShield 2006-09-05 15:51 -------- d-------- C:\Program Files\AC3Filter 2006-09-03 21:06 -------- d-------- C:\Program Files\Digitalway 2006-09-03 20:40 -------- d-------- C:\Program Files\Common Files\scansoft shared 2006-09-03 20:29 -------- d-------- C:\Program Files\Common Files\System 2006-09-03 20:29 -------- d-------- C:\Program Files\Common Files\Microsoft Shared 2006-09-03 20:29 -------- d-------- C:\Program Files\Common Files\Designer 2006-09-03 20:28 -------- d-------- C:\Program Files\Microsoft Office 2006-09-03 20:28 -------- d-------- C:\Program Files\microsoft frontpage 2006-09-03 20:28 -------- d-------- C:\Documents and Settings\rajit\Application Data\Microsoft Web Folders 2006-08-30 16:30 -------- d-------- C:\Program Files\Common Files\Ahead 2006-08-29 17:14 -------- d-------- C:\Program Files\Sony 2006-08-29 16:45 -------- d-------- C:\Program Files\Avast! 2006-08-28 17:57 -------- d-------- C:\Program Files\Opera 2006-08-28 17:57 -------- d-------- C:\Documents and Settings\rajit\Application Data\Opera 2006-08-28 15:22 -------- d-------- C:\Program Files\Windows Defender 2006-08-27 20:37 -------- d-------- C:\Program Files\Internet Explorer 2006-08-27 19:32 164352 --a------ C:\WINDOWS\system32\SpoonUninstall.exe 2006-08-27 16:26 -------- d-------- C:\Program Files\Common Files\Sony Shared 2006-08-27 16:24 -------- d-------- C:\Documents and Settings\rajit\Application Data\Sony Corporation 2006-08-27 15:30 -------- d-------- C:\Program Files\WinZip 2006-08-26 17:43 -------- d-------- C:\Documents and Settings\rajit\Application Data\URSoft 2006-08-26 00:10 -------- d-------- C:\Documents and Settings\rajit\Application Data\SiteAdvisor 2006-08-24 14:09 -------- d-------- C:\Program Files\CCleaner 2006-08-23 20:27 23600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS 2006-08-22 21:00 -------- d-------- C:\Program Files\Common Files\xing shared 2006-08-22 21:00 -------- d-------- C:\Program Files\Common Files\Real 2006-08-22 10:07 -------- d-------- C:\Documents and Settings\rajit\Application Data\Help 2006-08-21 20:03 -------- d-------- C:\Documents and Settings\rajit\Application Data\AdobeUM 2006-08-21 18:09 -------- d-------- C:\Program Files\QuickTime 2006-08-21 18:09 -------- d-------- C:\Program Files\NetMeeting 2006-08-21 15:39 -------- d-------- C:\Program Files\OfficeUpdate11 2006-08-21 11:57 -------- dr-h----- C:\Documents and Settings\rajit\Application Data\yahoo! 2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-21 05:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-20 21:53 -------- d-------- C:\Documents and Settings\rajit\Application Data\Apple Computer 2006-08-20 19:37 -------- d-------- C:\Documents and Settings\rajit\Application Data\Google 2006-08-20 19:12 -------- d-------- C:\Documents and Settings\rajit\Application Data\Macromedia 2006-08-20 16:53 -------- d-------- C:\Program Files\Webshots 2006-08-20 16:53 -------- d-------- C:\Documents and Settings\rajit\Application Data\Webshots 2006-08-20 14:48 -------- d-------- C:\Program Files\Outlook Express 2006-08-20 13:19 -------- d-------- C:\Program Files\Winamp 2006-08-20 11:48 -------- d-------- C:\Program Files\Zone Labs 2006-08-20 11:20 -------- d-------- C:\Program Files\Lavasoft 2006-08-20 11:20 -------- d-------- C:\Documents and Settings\rajit\Application Data\Lavasoft 2006-08-19 16:15 -------- d-------- C:\Program Files\Movie Maker 2006-08-11 13:35 520192 --a------ C:\WINDOWS\system32\DivXsm.exe 2006-08-11 13:35 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2006-08-11 13:35 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2006-08-11 13:35 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2006-08-11 13:31 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2006-08-11 13:31 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2006-08-11 13:31 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2006-08-11 13:31 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2006-08-11 13:31 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2006-08-11 13:31 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2006-08-11 13:31 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2006-08-11 13:31 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2006-08-11 13:31 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2006-08-11 13:31 118784 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2006-08-08 12:53 635520 --a------ C:\WINDOWS\system32\aswBoot.exe 2006-08-05 02:18 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2006-07-28 09:30 62744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2006-07-28 09:30 236824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll 2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\\PROGRA~1\\Avast!\\ashDisp.exe" "Tweak UI"="RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "WinPatrol"="C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\winpatrol.exe" "zvjostj.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\zvjostj.dll,khmpyrc" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000000 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=dword:40000004 "OriginalStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=hex:91,00,00,00 "NoSMHelp"=hex:01,00,00,00 "NoRecentDocsMenu"=hex:01,00,00,00 "NoSMMyDocs"=hex:01,00,00,00 "NoSMMyPictures"=hex:01,00,00,00 "NoDrives"=hex:02,fe,ff,03 "NoRecentDocsHistory"=hex:01,00,00,00 "NoSharedDocuments"=hex:01,00,00,00 "NoDriveAutoRun"=hex:82,ff,ff,03 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Run Google Web Accelerator.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Run Google Web Accelerator.lnk" "backup"="C:\\WINDOWS\\pss\\Run Google Web Accelerator.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Google\\WEBACC~1\\GOOGLE~2.exe " "item"="Run Google Web Accelerator" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SmartUI.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\SmartUI.lnk" "backup"="C:\\WINDOWS\\pss\\SmartUI.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Brother\\SmartUI\\SmartUI.exe " "item"="SmartUI" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Adobe Photo Downloader] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="apdproxy" "hkey"="HKLM" "command"="\"D:\\Adobe Photoshop Elements\\apdproxy.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Google Desktop Search] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleDesktop" "hkey"="HKLM" "command"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\InCD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="InCD" "hkey"="HKLM" "command"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\IndexSearch] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="IndexSearch" "hkey"="HKLM" "command"="C:\\Program Files\\Brother\\IndexSearch.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KernelFaultCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="dumprep 0 -k" "hkey"="HKLM" "command"="%systemroot%\\system32\\dumprep 0 -k" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NBJ] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NBJ" "hkey"="HKCU" "command"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PaperPort PTD] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="pptd40nt" "hkey"="HKLM" "command"="C:\\Program Files\\Brother\\pptd40nt.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PP8 SE Reminder] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="navLoad" "hkey"="HKLM" "command"="\"C:\\Program Files\\Brother\\WebEreg\\NAVBrowser.exe\" -r \"C:\\Program Files\\Brother\\WebEreg\\navLoad.ini\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SetDefPrt] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="BrStDvPt" "hkey"="HKLM" "command"="C:\\Program Files\\Brother\\Brmfl03a\\BrStDvPt.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="jusched" "hkey"="HKLM" "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TkBellExe] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="realsched" "hkey"="HKLM" "command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Windows Defender] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="MSASCui" "hkey"="HKLM" "command"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "inimapping"="0" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="gnotify" "hkey"="HKLM" "command"="C:\\Program Files\\Google\\Gmail Notifier\\G001-1.0.25.0\\gnotify.exe" "inimapping"="0" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmyy32 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\MP Scheduled Scan.job Completion time: Sun 10/08/2006 21:30:39.79 ComboFix.txt