HELP PLEASE Downloader mislead app. infection!
 

I must have been infected by downloader mislead app.
Have run search & destroy, avg anti-spyware, hijackthis, spyware doctor, combofix, ad-aware and my norton security corporate edition...
As i see u need a hijack log...
So here it is..


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:28:42 μμ, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\SAV\DefWatch.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SAV\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\CONN-X SAGEM Fast 800\dslmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Συνδέσεις
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RCAutoLiveUpdate] C:\Program Files\Max Registry Cleaner\MaxLiveUpdateRC.exe -AUTO
O4 - HKLM\..\Run: [RCSystemTray] C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{71588D8A-6E6D-42CD-876B-18584BA2A830}: NameServer = 195.170.0.1 195.170.2.2
O21 - SSODL: zip - {7474b4ee-695c-4f54-9896-997c5e6d382c} - C:\WINDOWS\Installer\{7474b4ee-695c-4f54-9896-997c5e6d382c}\zip.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\SAV\DefWatch.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Reporting Agents (Reporting) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\SAV\Rtvscan.exe

--
End of file - 7100 bytes



After that i followerd the first step that crunchie suggested to another similar thread which was : http://www.daniweb.com/forums/thread100908.html
So, i run combo fix, and then hijack this, and these are the new logs...



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:45:38 μμ, on 1/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\SAV\DefWatch.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SAV\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\CONN-X SAGEM Fast 800\dslmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Συνδέσεις
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RCAutoLiveUpdate] C:\Program Files\Max Registry Cleaner\MaxLiveUpdateRC.exe -AUTO
O4 - HKLM\..\Run: [RCSystemTray] C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [win32] C:\WINDOWS\system32\winpack32.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{71588D8A-6E6D-42CD-876B-18584BA2A830}: NameServer = 195.170.0.1 195.170.2.2
O21 - SSODL: zip - {7474b4ee-695c-4f54-9896-997c5e6d382c} - C:\WINDOWS\Installer\{7474b4ee-695c-4f54-9896-997c5e6d382c}\zip.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\SAV\DefWatch.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Reporting Agents (Reporting) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\SAV\Rtvscan.exe

--
End of file - 7044 bytes



ComboFix 08-01-31.4 - despina 2008-02-01 15:34:48.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1253.1.1032.18.119 [GMT 2:00]
Running from: C:\Documents and Settings\despina\Επιφάνεια εργασίας\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-02-01 13:30 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-02-01 13:30 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-02-01 13:30 . 2007-12-10 14:53 41,864 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-02-01 13:30 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-02-01 13:29 . 2008-02-01 13:48 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-01 13:29 . 2008-02-01 13:29 <DIR> d-------- C:\Documents and Settings\despina\Application Data\PC Tools
2008-01-31 15:40 . 2008-01-31 16:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-31 13:32 . 2008-01-31 13:32 <DIR> d-------- C:\Documents and Settings\despina\Application Data\Grisoft
2008-01-31 13:32 . 2008-01-31 13:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-31 13:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-31 13:14 . 2008-02-01 14:44 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-31 12:36 . 2008-01-31 12:36 28,174 --a------ C:\Documents and Settings\despina\catchme.zip
2008-01-31 12:20 . 2008-01-31 12:20 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-26 13:15 . 2008-01-31 02:48 <DIR> d-------- C:\Program Files\Winamp Remote
2008-01-23 17:26 . 2008-01-23 17:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-23 05:45 . 2008-01-23 05:45 2,010,076 --a------ C:\WINDOWS\_detmp.1
2008-01-23 00:54 . 2008-01-23 00:54 <DIR> d-------- C:\Program Files\directx
2008-01-23 00:54 . 2008-01-23 00:54 0 --a------ C:\WINDOWS\DXT134.tmp
2008-01-23 00:54 . 2008-01-23 00:54 0 --a------ C:\WINDOWS\DXT133.tmp
2008-01-23 00:54 . 2008-01-23 00:54 0 --a------ C:\WINDOWS\DXT132.tmp
2008-01-23 00:54 . 2008-01-23 00:54 0 --a------ C:\WINDOWS\DXT131.tmp
2008-01-23 00:34 . 2008-01-23 00:34 <DIR> d-------- C:\WINDOWS\Cache
2008-01-22 15:56 . 2008-01-22 15:56 <DIR> d-------- C:\Documents and Settings\despina\Application Data\NeroDigital™
2008-01-22 14:56 . 2008-01-31 21:53 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-01-22 14:38 . 2008-01-22 14:38 <DIR> d-------- C:\Documents and Settings\despina\Application Data\Nero
2008-01-22 14:34 . 2008-01-31 19:02 <DIR> d-------- C:\Program Files\Nero
2008-01-22 14:34 . 2008-01-31 19:22 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-01-22 14:34 . 2008-01-31 19:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-01-09 16:43 . 2008-01-09 16:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-01-09 15:29 . 2008-01-09 15:29 <DIR> d-------- C:\Program Files\3B
2008-01-09 15:29 . 2008-01-09 16:09 <DIR> d-------- C:\Documents and Settings\despina\Application Data\3B
2008-01-09 15:29 . 2007-06-11 16:15 2,115,816 --a------ C:\WINDOWS\system32\NPSWF32.dll
2008-01-09 15:29 . 2007-06-11 16:15 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2008-01-07 14:26 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-01-07 14:26 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-01-07 14:26 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-01-07 14:26 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-01-07 14:26 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-01-07 14:26 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-01-07 14:26 . 2003-11-04 15:11 159,744 --a------ C:\WINDOWS\system32\lfpng13n.dll
2008-01-07 14:26 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-01-07 14:26 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-01-06 16:59 . 2007-10-11 01:49 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-06 16:59 . 2007-07-01 05:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-06 16:59 . 2007-07-01 05:36 1,118,208 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-06 16:59 . 2007-10-11 01:49 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-06 16:59 . 2007-10-11 01:49 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-06 16:59 . 2007-10-11 01:49 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-06 16:59 . 2007-10-11 01:49 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-06 16:59 . 2007-10-11 01:49 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-06 16:59 . 2007-10-10 12:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-06 16:58 . 2008-01-06 16:59 <DIR> d-------- C:\WINDOWS\system32\el-gr
2008-01-06 16:55 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-01 13:33 --------- d-----w C:\Program Files\mIRC
2008-02-01 12:51 --------- d-----w C:\Program Files\SAV
2008-02-01 09:49 --------- d-----w C:\Documents and Settings\despina\Application Data\uTorrent
2008-01-28 15:38 --------- d-----w C:\Program Files\DC++
2008-01-26 11:42 --------- d-----w C:\Program Files\Winamp
2008-01-23 13:39 --------- d-----w C:\Program Files\AVI ReComp
2008-01-23 11:49 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-22 17:35 --------- d-----w C:\Documents and Settings\despina\Application Data\dvdcss
2008-01-22 11:21 --------- d-----w C:\Program Files\Common Files\Ahead
2008-01-20 21:03 --------- d-----w C:\Program Files\Ahead
2008-01-20 20:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-20 20:38 --------- d-----w C:\Documents and Settings\despina\Application Data\Ahead
2008-01-09 14:43 --------- d-----w C:\Documents and Settings\despina\Application Data\ATI
2008-01-09 14:35 --------- d-----w C:\Program Files\ATI Technologies
2007-12-22 20:51 --------- d-----w C:\Program Files\Xvid
2007-12-22 20:50 --------- d-----w C:\Program Files\AviSynth 2.5
2007-12-22 20:40 --------- d-----w C:\Program Files\Gabest
2007-12-13 14:07 --------- d-----w C:\Program Files\Lionhead Studios
2007-12-13 14:06 --------- d-----w C:\Program Files\Common Files\EasyInfo
2007-12-13 12:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Innovative Solutions
2007-12-05 12:17 593,920 ----a-w C:\WINDOWS\system32\ati2sgag.exe
2007-12-05 05:26 2,782,208 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-05 03:05 368,640 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-12-05 03:04 269,312 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-12-05 02:56 147,456 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-12-05 02:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-12-05 02:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-12-05 02:55 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-12-05 02:54 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-12-05 02:53 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-12-05 02:53 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-12-05 02:48 9,535,488 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-12-05 02:44 3,175,584 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-12-05 02:33 1,640,192 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-12-05 02:19 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-12-05 02:19 385,024 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-12-05 02:17 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-12-05 02:16 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-05 02:14 180,224 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-12-05 02:11 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-12-03 12:42 --------- d-----w C:\Program Files\URUSoft
2007-12-02 16:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-12-02 16:41 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-01 22:23 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2007-12-01 20:18 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-12-01 20:18 --------- d--h--r C:\Documents and Settings\despina\Application Data\SecuROM
2007-11-07 09:27 730,112 ----a-w C:\WINDOWS\system32\lsasrv.dll
2001-11-23 04:08 712,704 -c--a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-04 05:45 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"win32"="C:\WINDOWS\system32\winpack32.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496]
"Cmaudio"="cmicnfg.cpl" []
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 10:50 204800]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 03:19 69632]
"win32"="C:\WINDOWS\system32\winpack32.exe" [ ]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [ ]
"RCAutoLiveUpdate"="C:\Program Files\Max Registry Cleaner\MaxLiveUpdateRC.exe" [ ]
"RCSystemTray"="C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-04 05:45 15360]

C:\Documents and Settings\All Users\Start Menu\¨¦š¨α££˜«˜\„΅΅ε¤ž©ž\
DSLMON.lnk - C:\Program Files\SAGEM\CONN-X SAGEM Fast 800\dslmon.exe [2007-05-12 19:34:51 839680]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{BED7C2B4-3DA5-4F4F-84F7-07CAB3418E5F}"= C:\WINDOWS\system32\gebbbxu.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"zip"= {7474b4ee-695c-4f54-9896-997c5e6d382c} - C:\WINDOWS\Installer\{7474b4ee-695c-4f54-9896-997c5e6d382c}\zip.dll [2008-01-31 12:04 38950]

R2 Reporting;Reporting Agents;"C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe" [2007-03-14 14:09]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 17:50]
R3 usbstor;Πρόγραμμα οδήγησης μαζικής αποθήκευσης USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 18:25]
S3 ewdmaudn;ewdmaudn;C:\DOCUME~1\despina\LOCALS~1\Temp\ewdmaudn.sys []
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);C:\WINDOWS\system32\DRIVERS\sea1bus.sys [2007-01-04 13:01]
S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\sea1mdfl.sys [2007-01-04 13:01]
S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\sea1mdm.sys [2007-01-04 13:01]
S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\sea1mgmt.sys [2007-01-04 13:01]
S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);C:\WINDOWS\system32\DRIVERS\sea1nd5.sys [2007-01-04 13:01]
S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\sea1obex.sys [2007-01-04 13:01]
S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);C:\WINDOWS\system32\DRIVERS\sea1unic.sys [2007-01-04 13:01]
S3 usbscan;Πρόγραμμα οδήγησης σαρωτή USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 13:00:00 C:\WINDOWS\Tasks\AAE8F11191C36F55.job"
- c:\docume~1\despina\applic~1\filmid~1\grim four phone.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 15:37:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-01 15:39:01
ComboFix-quarantined-files.txt 2008-02-01 13:38:40
ComboFix2.txt 2008-02-01 12:48:39
ComboFix3.txt 2008-01-31 15:01:12
ComboFix4.txt 2008-01-31 10:44:11
.
2008-01-23 15:31:13 --- E O F ---

Re: HELP PLEASE Downloader mislead app. infection!
 

Hi drakkana


ComboFix is a very powerful tool and should be run under the supervision of a trained analyst. Please do not run ComboFix unless asked to do so.

Click Start > Run and copy/paste the following txt into the run box and press enter:

"C:\qoobox\ComboFix4.txt"


post the contents of ComboFix4.txt

Next Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

Attachment 4977


Download the file & save it as its originally named, next to ComboFix.exe.



Attachment 4976


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

Re: HELP PLEASE Downloader mislead app. infection!
 

thanks..but unfortunately i had to do a format.. but i appreciate your help...is there any chance of it being still in the system after the format?

Re: HELP PLEASE Downloader mislead app. infection!
 

It's unlikely though not impossible, how did you format?

Are you still experiencing symptons?

Re: HELP PLEASE Downloader mislead app. infection!
 

I did the common type of format.. inserted windows xp cd...install etc etc.. from dos..
the only problem i got right now is that whenever i start my windows the resolution of my screen is set to the lowest.. i then define it to be at 1024x768 but when i restart the pc the resolution is once again low...i installed the drivers of my monitor..but don't know what's goin on.. is that a "mislead" symptom?

Re: HELP PLEASE Downloader mislead app. infection!
 

Hi drakkana

I had a similar problem on a customers computer. The graphics software would pop up at boot up but after changing the resolution and rebooting it would pop up again. After changing the resolution in the graphics app I then changed it via Desktop > Properties > Settings rebooted and the setting stuck. Does this help solve your problem?

Re: HELP PLEASE Downloader mislead app. infection!
 

nope..i have done it like a hundred times..
i installed the drivers to the monitor, to the graphic card..nothing.

Re: HELP PLEASE Downloader mislead app. infection!
 

Post new logs from HijackThis and ComboFix

Re: HELP PLEASE Downloader mislead app. infection!
 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:40:07 μμ, on 8/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\SAV\DefWatch.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
C:\Program Files\SAV\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\SAV\VPTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\CONN-X SAGEM Fast 800\dslmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Συνδέσεις
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Βοηθός εισόδου του Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SAV\VPTray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Reboot.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9CE5DDF0-EC01-4D7D-BAA0-7A8B9DEF9930}: NameServer = 195.170.0.1 195.170.2.2
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\SAV\DefWatch.exe
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Reporting Agents (Reporting) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\SAV\Rtvscan.exe

--
End of file - 7305 bytes



ComboFix 08-02.05.3 - drakkana 2008-02-08 12:41:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1253.1.1032.18.146 [GMT 2:00]
Running from: C:\Documents and Settings\drakkana\Επιφάνεια εργασίας\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://au
.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-08 12:39 . 2008-02-08 12:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-08 12:21 . 2008-02-08 12:21 268 --ah----- C:\sqmdata15.sqm
2008-02-08 12:21 . 2008-02-08 12:21 244 --ah----- C:\sqmnoopt15.sqm
2008-02-08 12:18 . 2008-02-08 12:18 268 --ah----- C:\sqmdata14.sqm
2008-02-08 12:18 . 2008-02-08 12:18 244 --ah----- C:\sqmnoopt14.sqm
2008-02-07 21:53 . 2008-02-07 21:53 268 --ah----- C:\sqmdata13.sqm
2008-02-07 21:53 . 2008-02-07 21:53 244 --ah----- C:\sqmnoopt13.sqm
2008-02-07 14:24 . 2008-02-07 15:13 <DIR> d-------- C:\Program Files\DC++
2008-02-06 15:16 . 2008-02-06 15:16 268 --ah----- C:\sqmdata12.sqm
2008-02-06 15:16 . 2008-02-06 15:16 244 --ah----- C:\sqmnoopt12.sqm
2008-02-06 15:06 . 2008-02-06 15:06 <DIR> d-------- C:\Documents and Settings\All Users\SonicStage
2008-02-06 15:03 . 2008-02-06 15:03 268 --ah----- C:\sqmdata11.sqm
2008-02-06 15:03 . 2008-02-06 15:03 244 --ah----- C:\sqmnoopt11.sqm
2008-02-06 15:02 . 2008-02-06 15:02 <DIR> d-------- C:\Program Files\Sony Corporation
2008-02-06 15:02 . 2001-09-13 02:15 90,112 --------- C:\WINDOWS\snymsico.dll
2008-02-06 15:02 . 2002-08-08 15:51 38,951 --------- C:\WINDOWS\system32\drivers\NETMDUSB.sys
2008-02-06 15:02 . 2005-10-31 10:46 36,679 --------- C:\WINDOWS\system32\drivers\NETMD052.sys
2008-02-06 15:02 . 2003-11-10 12:31 36,232 --------- C:\WINDOWS\system32\drivers\NETMD033.sys
2008-02-06 15:02 . 2003-04-01 18:55 35,319 --------- C:\WINDOWS\system32\drivers\NETMD031.sys
2008-02-06 15:02 . 2001-08-31 15:07 27,255 --------- C:\WINDOWS\system32\drivers\NWWMUSB.sys
2008-02-06 15:02 . 2002-09-11 10:20 11,510 --------- C:\WINDOWS\system32\drivers\VMCUSB.sys
2008-02-06 15:01 . 2008-02-06 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Corporation
2008-02-06 15:01 . 2005-09-08 10:22 765,952 --a------ C:\WINDOWS\system32\CDDBUISony.dll
2008-02-06 15:01 . 2005-10-11 21:46 598,016 --a------ C:\WINDOWS\system32\CDDBControlSony.dll
2008-02-06 15:01 . 2005-09-08 10:09 565,248 --a------ C:\WINDOWS\system32\CddbMusicIDSony.dll
2008-02-06 15:01 . 2005-09-08 10:21 73,728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll
2008-02-06 15:00 . 2008-02-06 15:02 <DIR> d-------- C:\Program Files\Sony
2008-02-06 14:59 . 2008-02-06 15:02 <DIR> d-------- C:\Program Files\Common Files\Sony Shared
2008-02-06 14:59 . 2008-02-06 15:06 <DIR> d-------- C:\Documents and Settings\drakkana\Application Data\Sony Corporation
2008-02-05 23:49 . 2008-02-05 23:49 268 --ah----- C:\sqmdata10.sqm
2008-02-05 23:49 . 2008-02-05 23:49 244 --ah----- C:\sqmnoopt10.sqm
2008-02-05 18:01 . 2008-02-05 18:01 268 --ah----- C:\sqmdata09.sqm
2008-02-05 18:01 . 2008-02-05 18:01 244 --ah----- C:\sqmnoopt09.sqm
2008-02-04 18:14 . 2008-02-04 18:14 268 --ah----- C:\sqmdata08.sqm
2008-02-04 18:14 . 2008-02-04 18:14 244 --ah----- C:\sqmnoopt08.sqm
2008-02-04 16:01 . 2008-02-04 16:01 268 --ah----- C:\sqmdata07.sqm
2008-02-04 16:01 . 2008-02-04 16:01 244 --ah----- C:\sqmnoopt07.sqm
2008-02-04 15:52 . 2008-02-04 15:52 268 --ah----- C:\sqmdata06.sqm
2008-02-04 15:52 . 2008-02-04 15:52 244 --ah----- C:\sqmnoopt06.sqm
2008-02-03 22:07 . 2008-02-03 22:07 268 --ah----- C:\sqmdata05.sqm
2008-02-03 22:07 . 2008-02-03 22:07 244 --ah----- C:\sqmnoopt05.sqm
2008-02-03 17:01 . 2008-02-03 19:30 <DIR> d-------- C:\Documents and Settings\drakkana\Application Data\Uniblue
2008-02-03 16:52 . 2008-02-03 16:52 <DIR> d-------- C:\WINDOWS\Sun
2008-02-03 15:03 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-03 15:02 . 2008-02-03 15:03 <DIR> d-------- C:\Program Files\Java
2008-02-03 15:00 . 2008-02-03 15:00 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-03 12:25 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-03 12:25 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-02-03 12:25 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-03 12:15 . 2008-02-03 12:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-03 12:04 . 2008-02-03 12:04 268 --ah----- C:\sqmdata04.sqm
2008-02-03 12:04 . 2008-02-03 12:04 244 --ah----- C:\sqmnoopt04.sqm
2008-02-03 11:57 . 2008-02-03 11:57 268 --ah----- C:\sqmdata03.sqm
2008-02-03 11:57 . 2008-02-03 11:57 244 --ah----- C:\sqmnoopt03.sqm
2008-02-03 11:38 . 2008-02-03 11:38 <DIR> d-------- C:\Program Files\SiS Monitor
2008-02-03 11:38 . 1997-11-03 21:10 277,776 --a------ C:\WINDOWS\system32\MSVCRT.1
2008-02-03 11:38 . 1999-03-31 09:55 11,200 --a------ C:\WINDOWS\system32\drivers\SiSMon.sys
2008-02-03 11:35 . 2008-02-03 11:35 <DIR> d-------- C:\Program Files\SiS7012
2008-02-03 11:35 . 2002-11-04 09:39 814,277 -ra------ C:\WINDOWS\system32\drivers\sis7012.sys
2008-02-03 11:34 . 2008-02-03 11:34 <DIR> d-------- C:\Program Files\IC Card Reader Driver v1.8e2
2008-02-03 11:34 . 2008-02-03 11:33 724,992 --a------ C:\WINDOWS\iun6002.exe
2008-02-03 11:32 . 2008-02-03 11:32 <DIR> d-------- C:\Program Files\SiSLan
2008-02-03 11:31 . 2008-02-03 11:31 <DIR> d-------- C:\WINDOWS\OPTIONS
2008-02-03 11:24 . 2008-02-03 11:24 <DIR> d-------- C:\NVIDIA
2008-02-03 11:24 . 2008-02-03 11:24 26 --a------ C:\WINDOWS\tsctv.ini
2008-02-03 01:41 . 2008-02-03 01:41 268 --ah----- C:\sqmdata02.sqm
2008-02-03 01:41 . 2008-02-03 01:41 244 --ah----- C:\sqmnoopt02.sqm
2008-02-03 00:12 . 2008-02-03 00:12 <DIR> d-------- C:\Documents and Settings\drakkana\Application Data\vlc
2008-02-03 00:09 . 2008-02-05 15:22 <DIR> d-------- C:\Documents and Settings\drakkana\Application Data\dvdcss
2008-02-02 23:58 . 2008-02-02 23:58 <DIR> d-------- C:\Program Files\X2CD
2008-02-02 23:58 . 2008-02-02 23:58 <DIR> d-------- C:\Program Files\VideoLAN
2008-02-02 20:25 . 2008-02-02 20:25 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-02-02 20:23 . 2008-02-02 20:23 268 --ah----- C:\sqmdata01.sqm
2008-02-02 20:23 . 2008-02-02 20:23 244 --ah----- C:\sqmnoopt01.sqm
2008-02-02 20:19 . 2008-02-02 20:19 268 --ah----- C:\sqmdata00.sqm
2008-02-02 20:19 . 2008-02-02 20:19 244 --ah----- C:\sqmnoopt00.sqm
2008-02-02 19:50 . 2007-10-11 01:49 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-02-02 19:50 . 2007-07-01 05:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-02-02 19:50 . 2007-07-01 05:36 1,118,208 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-02-02 19:50 . 2007-10-11 01:49 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-02-02 19:50 . 2007-10-11 01:49 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-02-02 19:50 . 2007-10-11 01:49 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-02-02 19:50 . 2007-10-11 01:49 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-02-02 19:50 . 2007-10-11 01:49 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-02-02 19:50 . 2007-10-10 12:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-02 19:48 . 2008-02-02 19:50 <DIR> d-------- C:\WINDOWS\system32\el-gr
2008-02-02 19:44 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-02-02 19:25 . 2003-02-28 18:26 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-02-02 19:25 . 2003-02-28 18:26 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-02-02 19:25 . 2003-02-28 16:54 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-02-02 19:25 . 2003-02-28 16:35 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-02-02 19:25 . 2003-02-28 16:38 113 --a------ C:\WINDOWS\system32\zonedon.reg
2008-02-02 19:25 . 2003-02-28 16:38 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2008-02-02 19:22 . 2006-08-21 11:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
2008-02-02 19:22 . 2006-08-21 11:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
2008-02-02 19:22 . 2006-08-21 14:27 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
2008-02-02 19:21 . 2008-02-03 16:37 <DIR> d-------- C:\Program Files\uTorrent
2008-02-02 19:21 . 2008-02-07 22:59 <DIR> d-------- C:\Documents and Settings\drakkana\Application Data\uTorrent
2008-02-02 19:05 . 2008-02-02 19:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-02-02 18:33 . 2008-02-02 18:33 <DIR> d-------- C:\Documents and Settings\drakkana\Contacts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 20:42 --------- d-----w C:\Documents and Settings\drakkana\Application Data\mIRC
2008-02-06 13:00 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-02 15:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-02 15:04 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-02-02 14:30 31 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg
2008-02-02 14:30 --------- d-----w C:\Program Files\SAGEM
2008-02-02 14:21 --------- d-----w C:\Program Files\SYMANTEC ANTIVIRUS CORPORATE EDITION v10.1.6.6000 - ARNiSO
2008-02-02 14:17 --------- d-----w C:\Program Files\DAEMON Tools
2008-02-02 14:15 682,232 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-02-02 14:12 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-02-02 14:11 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-02 14:07 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2008-02-02 14:07 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-02-02 12:49 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-02 12:48 558,142 ----a-w C:\WINDOWS\java\Packages\HJJD7N57.ZIP
2008-02-02 12:48 155,995 ----a-w C:\WINDOWS\java\Packages\AL3J9ZBJ.ZIP
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-04 06:45 15360]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29 165784]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"HTpatch"="C:\WINDOWS\htpatch.exe" [2002-10-30 11:40 28672]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12 90112]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 04:19 69632]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 10:50 204800]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 17:38 52840]
"vptray"="C:\PROGRA~1\SAV\VPTray.exe" [2007-03-14 19:49 125632]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 02:36 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-04 06:45 15360]

C:\Documents and Settings\drakkana\Start Menu\¨¦š¨α££˜«˜\„΅΅ε¤ž©ž\
Reboot.exe [2002-08-20 08:26:48 432128]

C:\Documents and Settings\All Users\Start Menu\¨¦š¨α££˜«˜\„΅΅ε¤ž©ž\
DSLMON.lnk - C:\Program Files\SAGEM\CONN-X SAGEM Fast 800\dslmon.exe [2008-02-02 16:30:14 839680]

R2 Reporting;Reporting Agents;"C:\Program Files\Common Files\Symantec Shared\Reporting Agents\Win32\ReporterSvc.exe" [2007-03-14 15:09]
R2 SiSMon;sismon;C:\WINDOWS\system32\drivers\sismon.sys [1999-03-31 09:55]
R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-04 18:50]
R3 SiS7012;Service for AC'97 Sample Driver (WDM);C:\WINDOWS\system32\drivers\sis7012.sys [2002-11-04 09:39]
R3 usbstor;Πρόγραμμα οδήγησης μαζικής αποθήκευσης USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]
S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-02 19:25]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 17:26:57 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-02-03 14:59:30 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 12:43:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = C:\WINDOWS\htpatch.exe?ows\CurrentVersion\Run???\???/??[?????? [?? [???????????????????[???[?L???? [$??????[????????????S??[????????m??[$??~????(?????:~???~??????:~???~???[????????d???b6?[%??[?? [d???"??[A??[???[??:~Z??[?3?[?3?[????st.I???????[????d???0=?[?K?[

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 12:43:55
ComboFix-quarantined-files.txt 2008-02-08 10:43:40
.
2008-02-03 20:08:36 --- E O F ---

Re: HELP PLEASE Downloader mislead app. infection!
 

Hi drakkana

I'm not seeing anything malicous in the logs. Try disabling all your Security programs and changing the resolution before re-enabling them.

If your not sure how to disable them then double-check against the list found >>>HERE<<<

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.