Smartest and Hardest BAT.Trojan

T

Tomboby8

New Member
Hello all,
Yesterday, 16/07/2010 i was struck down by a BAT.Trojan,
I spent many frustrated hours trying to remove it but with no gold.
I have given up on all my weak, failed attacks including scanning with software, internet search (no luck), file editing and a failed system restore.

The Virus slows my computer down alot; cpu reads 17%(normal), ram 70%(normal) but it takes 1-2min to open internet explorer and other programs (usually 3 sec), god knows what it is doing to my OS system files and i don't have a back up disk (came preinstalled by some internet market company). And i'm worried that it may cause identity theft.


My computer is a ASUS A41I series (beta model)
with:
1G ram
2.4ghz CPU
Nvidia Geforce 310M Cuda 512MB
Windows 7 Ultimate 32bit
and most importantly:
Norton 360 Premier Edition
IObit Security 360

The Virus that has infected my computer (i think) creates several files named "launchhh.**" in my windows32 directory, they were created on the day and time of infection. They are vbscripts and batch files, with a text logg.txt. Norton says that the file is launchh.vbs and blocks it, making not attempt to remove it and other files. A full sytem scan with iobit and norton turns up with nothing.

System restore says that norton is disallowing it to complete restore, but it i disable norton the virus may take full hold of the system.
The virus pop up also appears in safe boot (using msconfig) so it may be an error prompt.

Norton detects the virus and blocks it but the virus keeps on reappearing at each start up and during computer use as a error pop up (photo 1) the launch files are also replaced.

I have deleted the files but they are recreated by some hidden code. I have found that windows script.exe is used to execute the virus.

A hijackthis log has been run but I can't detect the virus, i hope u can.

There is an attached file of the "launch" files and some photo shoots with the hijack this log.
-launch files have been removed for safety


I hope u can analyze the virus.

Thank you so much for your help

P.S. How do you configure msconfig to boot using safe mode with minimal services and system restore ?
My computer does not allow safe mode as a option during boot only in msconfig.
This is my last try at removing the virus before i give up :)



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:54:47 p.m., on 17/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\IObit\IObit Security 360\is360tray.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Users\Administrator\Downloads\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe,
O1 - Hosts: ------ ÆÁ±ÎѸÀ׿´¿´¹ã¸æ ------
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Users\Administrator\Downloads\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: SRS Premium Sound.lnk = ?%SystemRoot%\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut4_E9C83B3EDF9141A39DA5EC05C79BBB91.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØ - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: ʹÓÃѸÀ×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???¡¥??¨¤¡Á5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???¡¥??¨¤¡Á5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Contrl Center of Storm Media (ccosm) - ±±¾©±©·çÍø¼Ê¿Æ¼¼ÓÐÏÞ¹«Ë¾ - C:\Program Files\StormII\stormliv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 7110 bytes
 

Attachments

  • Photo1.jpg
    Photo1.jpg
    21.3 KB · Views: 619
  • Photo2.jpg
    Photo2.jpg
    21 KB · Views: 676
Last edited:
Hey, I've just ran a scan with malware bytes (credits go to cwee1) and this poped up:

A error has occurred. Please report this error code to our support team.

MBAM_ERROR_ADD_TO_RESULTS (0,6)

Any clues? The program kept on scanning:

17 Threats (Trojan.Dropper, Trojan.BHO, Malware.Trace, Disabled.Security)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4321

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

17/07/2010 9:58:40 p.m.
mbam-log-2010-07-17 (21-58-40).txt

Scan type: Quick scan
Objects scanned: 128888
Time elapsed: 8 minute(s), 5 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe (Trojan.Dropper) -> No action taken.

Memory Modules Infected:
C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll (Trojan.BHO) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{988934a4-064b-11d3-bb80-00104b35e7f9} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a1dd29ed-2598-48e9-9793-64a9cd08ac94} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{87ca3845-37fe-414c-81cf-e08a7d0f6779} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{802f530b-a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{802f530b-a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Dropper) -> Data: c:\users\administrator\appdata\roaming\recyclerr\recyclerr.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll (Trojan.BHO) -> No action taken.
C:\autorun.inf (Trojan.Dropper) -> No action taken.
C:\ntldr.exe (Trojan.Dropper) -> No action taken.
C:\Windows\System32\drivers\tmpp.exe (Trojan.Dropper) -> No action taken.
C:\Windows\System32\launch.vbs (Malware.Trace) -> No action taken.
C:\Windows\System32\logg.txt (Malware.Trace) -> No action taken.

Which ones should I remove? malwarebytes seems like a too strong program that'll do damage
 
Last edited:
Malwarebytes will not do any damage to your system, please let it remove whatever it finds. Since you infected pretty bad, perform the following procedure after rerunning malwarebytes and removing whatever it found.

Download and Run ComboFix
If you already have Combofix, please delete this copy and download it again as it's being updated regularly.
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.


In your next reply please post:
  • The ComboFix log
  • A fresh HiJackThis log
  • An update on how your computer is running
 
The launch files in system32 still reappear so i will run a full sytem scan with malware bytes instead of a quick one that i did last time,

also norton has reported that unknown ping signals have been successfully sent from my computer?? Maybe the trojan.

I will reply when i have completed combo fix, scan, hijack log

thankyou for your continued help
 
Scan Results

Hey just finished the scan although i had to research the combofix program to find out where the log was stored (C:/Combofix/Combofix.txt/)

The malware bytes full scan turned up with 5 more viruses (trojans) which have all been removed.

The pop up has stopped showing and i can detect no trace of the launch files in system32.

Can you please look through the attached Just to be sure that the virus is removed
-Combofix.txt
-hijackthis.txt

Is it alright to delete the combofix folder which contains the program's files?

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:27:48 p.m., on 18/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5756 bytes

Thank you for your continued help
 
Last edited:
Your combofix log is not a complete log. I need you to post the whole log. If its too long to put into one post, break it up into smaller posts.

Do not attach your logs to a post, they are easier to read if you just copy and paste them in a reply.

May I ask what country you live in as the log contains weird characters. Just want to make sure they are pertaining to your countries language.
 
Log

This is the log, my computer is a beta model which i brought from china so the "weird characters is chinese" i live conterminous: Australia. I have changed the OS language to English using control panel, but driver install, Combofix seem to be in chinese. The annoying fact is that the bios is also chinese. The message "windows is shutting down" when u shut down is also in chinese. Oh well, it has never bothered me untill this point.:confused:


I shortened syteminfo parts of the log because of the attachment size limit and unfortunately didn't make a back up (not the scan results only time date system info ect.). I can redo the scan if you would like a full log. Sorry.:(
(Top part and bottom shortened not the middle with all the paths)

ComboFix 10-07-16.01 - Administrator 7/2010 Sun 15:01:02.2.2 - x86
Microsoft Windows 7 旗舰版 6.1.7600.0.936.86.2052.18.1023.386 [GMT 12:00]


C:\Users\Administrator\AppData\Roaming\recyclerr
C:\Windows\system32\Drivers\ywomt.sys
.
---- 早前运行的结果 -------
.
C:\Program Files\StormII\codec\264be.dll
C:\Program Files\StormII\codec\264dmmx.dll
C:\Program Files\StormII\codec\264dsse.dll
C:\Program Files\StormII\codec\264dsse2.dll
C:\Program Files\StormII\codec\264dsse3.dll
C:\Program Files\StormII\codec\aasc32.dll
C:\Program Files\StormII\codec\ac3filter.ax
C:\Program Files\StormII\codec\acelpdec.ax
C:\Program Files\StormII\codec\asusasv1.dll
C:\Program Files\StormII\codec\asusasv2.dll
C:\Program Files\StormII\codec\ativcr2.dll
C:\Program Files\StormII\codec\avcodec.dll
C:\Program Files\StormII\codec\avformat.dll
C:\Program Files\StormII\codec\avidavicodec.dll
C:\Program Files\StormII\codec\AviSplitter.ax
C:\Program Files\StormII\codec\avutil.dll
C:\Program Files\StormII\codec\bass.dll
C:\Program Files\StormII\codec\bass_aac.dll
C:\Program Files\StormII\codec\bass_alac.dll
C:\Program Files\StormII\codec\bass_ape.dll
C:\Program Files\StormII\codec\bass_flac.dll
C:\Program Files\StormII\codec\bass_mpc.dll
C:\Program Files\StormII\codec\bass_tta.dll
C:\Program Files\StormII\codec\bass_wv.dll
C:\Program Files\StormII\codec\binkw32.dll
C:\Program Files\StormII\codec\bw10.dll
C:\Program Files\StormII\codec\cddareader.ax
C:\Program Files\StormII\codec\cdxareader.ax
C:\Program Files\StormII\codec\ChpSrcFilter.ax
C:\Program Files\StormII\codec\CinemasterAudio.DLL
C:\Program Files\StormII\codec\cl264dec.ax
C:\Program Files\StormII\codec\CLNavX.ax
C:\Program Files\StormII\codec\CLRVIDDC.DLL
C:\Program Files\StormII\codec\clrviddd.dll
C:\Program Files\StormII\codec\CLVc1Dec.ax
C:\Program Files\StormII\codec\CLVSD.ax
C:\Program Files\StormII\codec\clvsdx.ax
C:\Program Files\StormII\codec\coreavc.ax
C:\Program Files\StormII\codec\CUVCcodc.dll
C:\Program Files\StormII\codec\DCBassSource.ax
C:\Program Files\StormII\codec\DECVW_32.DLL
C:\Program Files\StormII\codec\divxdec.ax
C:\Program Files\StormII\codec\DmoDec.dll
C:\Program Files\StormII\codec\DSMSplitter.ax
C:\Program Files\StormII\codec\empgdmx.ax
C:\Program Files\StormII\codec\ff_kernelDeint.dll
C:\Program Files\StormII\codec\ff_liba52.dll
C:\Program Files\StormII\codec\ff_libavcodec.dll
C:\Program Files\StormII\codec\ff_libdts.dll
C:\Program Files\StormII\codec\ff_libfaad2.dll
C:\Program Files\StormII\codec\ff_libmad.dll
C:\Program Files\StormII\codec\ff_libmpeg2.dll
C:\Program Files\StormII\codec\ff_libmplayer.dll
C:\Program Files\StormII\codec\ff_realaac.dll
C:\Program Files\StormII\codec\ff_samplerate.dll
C:\Program Files\StormII\codec\ff_theora.dll
C:\Program Files\StormII\codec\ff_TomsMoComp.dll
C:\Program Files\StormII\codec\ff_tremor.dll
C:\Program Files\StormII\codec\ff_unrar.dll
C:\Program Files\StormII\codec\ff_wmv9.dll
C:\Program Files\StormII\codec\ff_xvidcore.dll
C:\Program Files\StormII\codec\ffdshow.ax
C:\Program Files\StormII\codec\ffdshow.ax.manifest
C:\Program Files\StormII\codec\ffmpeg.dll
C:\Program Files\StormII\codec\ffsource.ax
C:\Program Files\StormII\codec\FLT_ffdshow.dll
C:\Program Files\StormII\codec\FLVSplitter.ax
C:\Program Files\StormII\codec\frapsvid.dll
C:\Program Files\StormII\codec\G722ADEC.dll
C:\Program Files\StormII\codec\GeoCodec.dll
C:\Program Files\StormII\codec\H264VDEC.dll
C:\Program Files\StormII\codec\HikAudioDec.ax
C:\Program Files\StormII\codec\HikFileSource.ax
C:\Program Files\StormII\codec\HikFileSplitter.ax
C:\Program Files\StormII\codec\HIKM4DEC.dll
C:\Program Files\StormII\codec\HikVideoDec.ax
C:\Program Files\StormII\codec\i263_32.drv
C:\Program Files\StormII\codec\icmw_32.dll
C:\Program Files\StormII\codec\iconv.dll
C:\Program Files\StormII\codec\kdh4.dll
C:\Program Files\StormII\codec\kdm4.dll
C:\Program Files\StormII\codec\keys.dat
C:\Program Files\StormII\codec\l3codecx.ax
C:\Program Files\StormII\codec\LCodcCMP.dll
C:\Program Files\StormII\codec\libavcodec.dll
C:\Program Files\StormII\codec\libmpeg2_ff.dll
C:\Program Files\StormII\codec\libmplayer.dll
C:\Program Files\StormII\codec\LMVRGBxf.dll
C:\Program Files\StormII\codec\LMVYUVxf.dll
C:\Program Files\StormII\codec\lsvxdec.dll
C:\Program Files\StormII\codec\mkunicode.dll
C:\Program Files\StormII\codec\mkx.dll
C:\Program Files\StormII\codec\mkzlib.dll
C:\Program Files\StormII\codec\mmamrdmx.ax
C:\Program Files\StormII\codec\MP3DMOD.DLL
C:\Program Files\StormII\codec\mp4.dll
C:\Program Files\StormII\codec\mp43dmod.dll
C:\Program Files\StormII\codec\mp4sdmod.dll
C:\Program Files\StormII\codec\MP4Splitter.ax
C:\Program Files\StormII\codec\MpaDecFilter.ax
C:\Program Files\StormII\codec\MpaSplitter.ax
C:\Program Files\StormII\codec\mpcvideodec.ax
C:\Program Files\StormII\codec\Mpeg2DecFilter.ax
C:\Program Files\StormII\codec\mpeg2dmx.ax
C:\Program Files\StormII\codec\MpegSplitter.ax
C:\Program Files\StormII\codec\mpg2splt.ax
C:\Program Files\StormII\codec\mpg4dmod.dll
C:\Program Files\StormII\codec\msdmo.dll
C:\Program Files\StormII\codec\msms001.vwp
C:\Program Files\StormII\codec\msvcr71.dll
C:\Program Files\StormII\codec\MZP4_DEC.DLL
C:\Program Files\StormII\codec\NDParser.ax
C:\Program Files\StormII\codec\NeMP4Splitter.ax
C:\Program Files\StormII\codec\nvviddec.ax
C:\Program Files\StormII\codec\OggSplitter.ax
C:\Program Files\StormII\codec\Plugins\nppl3260.dll
C:\Program Files\StormII\codec\Plugins\nppl3260.xpt
C:\Program Files\StormII\codec\Plugins\npqtplugin.dll
C:\Program Files\StormII\codec\Plugins\nprpjplug.dll
C:\Program Files\StormII\codec\Plugins\nsIQTScriptablePlugin.xpt
C:\Program Files\StormII\codec\Plugins\nsJSRealPlayerPlugin.xpt
C:\Program Files\StormII\codec\Plugins\QuickTimePlugin.class
C:\Program Files\StormII\codec\PmpSplt.ax
C:\Program Files\StormII\codec\pncrt.dll
C:\Program Files\StormII\codec\pndx5016.dll
C:\Program Files\StormII\codec\pndx5032.dll
C:\Program Files\StormII\codec\pthreadVC2.dll
C:\Program Files\StormII\codec\pvmjpg21.dll
C:\Program Files\StormII\codec\PVWV220.DLL
C:\Program Files\StormII\codec\qasf.dll
C:\Program Files\StormII\codec\QTSystem\CFCharacterSetBitmaps.bitmap
C:\Program Files\StormII\codec\QTSystem\CoreVideo.qtx
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\CoreVideo.qtr
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\en.lproj\CoreVideoLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\zh_CN.lproj\CoreVideoLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.qtp
C:\Program Files\StormII\codec\QTSystem\QuickTime.qts
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\QuickTime.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\QuickTime.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\en.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\QuickTime3GPP.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\zh_CN.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\QuickTimeAudioSupport.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\en.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\QuickTimeEssentials.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\zh_CN.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\en.lproj\QuickTimeH264Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\QuickTimeH264.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\zh_CN.lproj\QuickTimeH264Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\en.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\QuickTimeInternetExtras.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\zh_CN.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\en.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\QuickTimeMPEG4.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\zh_CN.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\QuickTimeStreaming.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\en.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\QuickTimeStreamingExtras.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\zh_CN.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\en.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\QuickTimeVR.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\zh_CN.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\StormII\codec\QuickTime.qts
C:\Program Files\StormII\codec\QuickTimeVR.qtx
C:\Program Files\StormII\codec\RadGtSplitter.ax
C:\Program Files\StormII\codec\Real\Codecs\14_43260.dll
C:\Program Files\StormII\codec\Real\Codecs\28_83260.dll
C:\Program Files\StormII\codec\Real\Codecs\atrc.dll
C:\Program Files\StormII\codec\Real\Codecs\cook.dll
C:\Program Files\StormII\codec\Real\Codecs\ddnt3260.dll
C:\Program Files\StormII\codec\Real\Codecs\dnet3260.dll
C:\Program Files\StormII\codec\Real\Codecs\drv1.dll
C:\Program Files\StormII\codec\Real\Codecs\drv2.dll
C:\Program Files\StormII\codec\Real\Codecs\drvc.dll
C:\Program Files\StormII\codec\Real\Codecs\hxltcolor.dll
C:\Program Files\StormII\codec\Real\Codecs\raac.dll
C:\Program Files\StormII\codec\Real\Codecs\ralf.dll
C:\Program Files\StormII\codec\Real\Codecs\rv10.dll
C:\Program Files\StormII\codec\Real\Codecs\rv20.dll
C:\Program Files\StormII\codec\Real\Codecs\rv30.dll
C:\Program Files\StormII\codec\Real\Codecs\rv40.dll
C:\Program Files\StormII\codec\Real\Codecs\sipr.dll
C:\Program Files\StormII\codec\Real\Common\objb3201.dll
C:\Program Files\StormII\codec\Real\Common\pnen3260.dll
C:\Program Files\StormII\codec\Real\Common\pngu3267.dll
C:\Program Files\StormII\codec\Real\Common\pnrs3260.dll
C:\Program Files\StormII\codec\Real\Common\rppr3260.dll
C:\Program Files\StormII\codec\Real\Plugins\audplin.dll
C:\Program Files\StormII\codec\Real\Plugins\authmgr.dll
C:\Program Files\StormII\codec\Real\Plugins\clbascauth.dll
C:\Program Files\StormII\codec\Real\Plugins\clntxres.dll
C:\Program Files\StormII\codec\Real\Plugins\ExtResources\coreres.xrs
C:\Program Files\StormII\codec\Real\Plugins\fpsechnd.dll
C:\Program Files\StormII\codec\Real\Plugins\httpfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\hxsdp.dll
C:\Program Files\StormII\codec\Real\Plugins\hxxml.dll
C:\Program Files\StormII\codec\Real\Plugins\imgrender.dll
C:\Program Files\StormII\codec\Real\Plugins\memfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\mp3fformat.dll
C:\Program Files\StormII\codec\Real\Plugins\mp3render.dll
C:\Program Files\StormII\codec\Real\Plugins\mp4arender.dll
C:\Program Files\StormII\codec\Real\Plugins\ntlmauth.dll
C:\Program Files\StormII\codec\Real\Plugins\oggfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\pacplin.dll
C:\Program Files\StormII\codec\Real\Plugins\plusplin.dll
C:\Program Files\StormII\codec\Real\Plugins\pxcb3210.dll
C:\Program Files\StormII\codec\Real\Plugins\ramfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\ramrender.dll
C:\Program Files\StormII\codec\Real\Plugins\rarender.dll
C:\Program Files\StormII\codec\Real\Plugins\rmfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\rmxfpln.dll
C:\Program Files\StormII\codec\Real\Plugins\rmxrend.dll
C:\Program Files\StormII\codec\Real\Plugins\rn5auth.dll
C:\Program Files\StormII\codec\Real\Plugins\rtfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\rtrender.dll
C:\Program Files\StormII\codec\Real\Plugins\rvrender.dll
C:\Program Files\StormII\codec\Real\Plugins\sdpplin.dll
C:\Program Files\StormII\codec\Real\Plugins\security.dll
C:\Program Files\StormII\codec\Real\Plugins\smlfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\smlrender.dll
C:\Program Files\StormII\codec\Real\Plugins\smmrender.dll
C:\Program Files\StormII\codec\Real\Plugins\smplfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\stubdrm.dll
C:\Program Files\StormII\codec\Real\Plugins\tfilesys.dll
C:\Program Files\StormII\codec\Real\Plugins\vidplin.dll
C:\Program Files\StormII\codec\Real\Plugins\vidsite.dll
C:\Program Files\StormII\codec\Real\Plugins\vorbisrend.dll
C:\Program Files\StormII\codec\Real\Plugins\vsrlocal.dll
C:\Program Files\StormII\codec\Real\rpplugins\cn\embed_cn.dll
C:\Program Files\StormII\codec\Real\rpplugins\cn\rpclsvc_cn.dll
C:\Program Files\StormII\codec\Real\rpplugins\embd3260.dll
C:\Program Files\StormII\codec\Real\rpplugins\rpcl3260.dll
C:\Program Files\StormII\codec\Real\rpplugins\rput3260.dll
C:\Program Files\StormII\codec\RLMPCDec.ax
C:\Program Files\StormII\codec\rmoc3260.dll
C:\Program Files\StormII\codec\RMSplt.ax
C:\Program Files\StormII\codec\Sc726dec.ax
C:\Program Files\StormII\codec\SCMPack.dll
C:\Program Files\StormII\codec\scsource.ax
C:\Program Files\StormII\codec\silverlight.exe
C:\Program Files\StormII\codec\smackw32.dll
C:\Program Files\StormII\codec\SonicLicenseManager9.dll
C:\Program Files\StormII\codec\splitter.ax
C:\Program Files\StormII\codec\TomsMoComp_ff.dll
C:\Program Files\StormII\codec\ts.dll
C:\Program Files\StormII\codec\tsccvid.dll
C:\Program Files\StormII\codec\TTL2Dec.dll
C:\Program Files\StormII\codec\v2k2_dec.dll
C:\Program Files\StormII\codec\v2kdspde.dll
C:\Program Files\StormII\codec\vc1dc.dll
C:\Program Files\StormII\codec\vc1dmmx.dll
C:\Program Files\StormII\codec\vc1dsse.dll
C:\Program Files\StormII\codec\vc1dsse2.dll
C:\Program Files\StormII\codec\vc1wp.ax
C:\Program Files\StormII\codec\VDODEC32.dll
C:\Program Files\StormII\codec\vdowave.drv
C:\Program Files\StormII\codec\VgmAudio.ax
C:\Program Files\StormII\codec\vgmbgr.ax
C:\Program Files\StormII\codec\VgmSplt.ax
C:\Program Files\StormII\codec\vgmv2k2.ax
C:\Program Files\StormII\codec\Vid1Dec.dll
C:\Program Files\StormII\codec\vmnc.dll
C:\Program Files\StormII\codec\voxmsdec.ax
C:\Program Files\StormII\codec\vp6vfw.dll
C:\Program Files\StormII\codec\vp7vfw.dll
C:\Program Files\StormII\codec\WMADMOD.dll
C:\Program Files\StormII\codec\wmpasf.dll
C:\Program Files\StormII\codec\wmsdmod.dll
C:\Program Files\StormII\codec\WMVDECOD.dll
C:\Program Files\StormII\codec\wmvdmod.dll
C:\Program Files\StormII\codec\xvid.ax
C:\Program Files\StormII\codec\xvidcore.dll
C:\Program Files\StormII\current.ecs
C:\Program Files\StormII\jscript.dll
C:\Program Files\StormII\keys.dat
C:\Program Files\StormII\media\def\def.flv
C:\Program Files\StormII\media\def\def.ini
C:\Program Files\StormII\media\empty.swf
C:\Program Files\StormII\media\media4in1.swf
C:\Program Files\StormII\media\mediabp.swf
C:\Program Files\StormII\media\others.xml
C:\Program Files\StormII\media\others.xml.ini
C:\Program Files\StormII\media\stcon.ini
C:\Program Files\StormII\media\toff.ini
C:\Program Files\StormII\media\video_material_list.xml
C:\Program Files\StormII\media\video_material_list.xml.ini
C:\Program Files\StormII\media\video_style_list.xml
C:\Program Files\StormII\media\video_style_list.xml.ini
C:\Program Files\StormII\Media2.dll
C:\Program Files\StormII\mee.db
C:\Program Files\StormII\MovieInfo.dll
C:\Program Files\StormII\mps.dll
C:\Program Files\StormII\msscript.ocx
C:\Program Files\StormII\msvcp60.dll
C:\Program Files\StormII\rndrmgr.dll
C:\Program Files\StormII\score.dll
C:\Program Files\StormII\sexpert.dll
C:\Program Files\StormII\Skin\AERO SKIS.zip
C:\Program Files\StormII\Skin\KMP_Black.zip
C:\Program Files\StormII\Skin\VistaAdvance.zip
C:\Program Files\StormII\Skin\WMP11_Black.zip
C:\Program Files\StormII\Skin\暴风1经典.zip
C:\Program Files\StormII\Skin\暴风2经典.zip
C:\Program Files\StormII\Skin\见龙卸甲.zip
C:\Program Files\StormII\spfa.dll
C:\Program Files\StormII\splayers.dll
C:\Program Files\StormII\sprobe.dll
C:\Program Files\StormII\Storm.exe
C:\Program Files\StormII\StormExcept.log
C:\Program Files\StormII\stormliv.exe
C:\Program Files\StormII\stormply.exe
C:\Program Files\StormII\StormRes.dll
C:\Program Files\StormII\subdecoder.dll
C:\Program Files\StormII\uninst.exe
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe
C:\Windows\system32\drivers\tmpp.exe
C:\Windows\system32\launch.bat
C:\Windows\system32\launch.vbs
C:\Windows\system32\logg.txt
C:\Windows\system32\net.vbs
C:\Windows\tmp.log
C:\Windows\tmpp.log
D:\Autorun.inf
E:\Autorun.inf
F:\autorun.inf

-------\Service_ccosm
-------\Service_ccosm

Storm Live came preinstalled and is a video player which i can't use (in chinese) i can uninstall.
 
Last edited:
I need to see the full log please. There is lots of information in that log that I need to see. Like I said, if the log is too long to put into 1 post then break it down into more than 1 post or upload the file to file hosting site and give me the link to it.
 
Sorry, I reran combo fix and this was the COMPLETE LOG AS I FIRST SAW IT WITHOUT ANY EDITS, as i said COMPLETE.
(very small?? why?)

ComboFix 10-07-16.01 - Administrator 7/2010 Mon 21:05:15.3.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.936.86.2052.18.1023.400 [GMT 12:00]
执行位置: C:\Users\Administrator\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- 早前运行的结果 -------
.
C:\Windows\system32\Drivers\ywomt.sys

.
((((((((((((((((((((((((((((((((((((((( 驱动/服务 )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ccosm
-------\Service_ccosm


Thank you for your continued help
 
Here it is:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/20/2010 at 08:43 PM

Application Version : 4.40.1002

Core Rules Database Version : 5233
Trace Rules Database Version: 3045

Scan type : Quick Scan
Total Scan Time : 00:14:25

Memory items scanned : 765
Memory threats detected : 0
Registry items scanned : 2626
Registry threats detected : 14
File items scanned : 7560
File threats detected : 65

Trojan.Agent/Gen-Sino[TAO]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01443AEC-0FD1-40fd-9C87-E93D1494C233}
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}#AppID
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\InprocServer32
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\InprocServer32#ThreadingModel
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\ProgID
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\Programmable
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\TypeLib
HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\VersionIndependentProgID
HKCR\XLF24.ThunderAtOnce.1
HKCR\XLF24.ThunderAtOnce
HKCR\TypeLib\{A3187009-B303-458C-9F01-0DAF932ECA17}
C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\COMDLLS\TDATONCE_NOW.DLL
HKU\S-1-5-21-1273124903-1408800724-415184003-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01443AEC-0FD1-40FD-9C87-E93D1494C233}

Adware.Tracking Cookie
ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.doubleclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.fastclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.fastclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.apmebf.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.realmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.realmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.googleadservices.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.xiti.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.at.atwola.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.at.atwola.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.mediaplex.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
ext-us.bestofmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adtech.de [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.tribalfusion.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.www.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.chitika.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
.microsoftsto.112.2o7.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
 
Next I need to see an uninstall list using hijackthis. Open hijackthis and click on open misc tools section, click on open uninstall manager, click on save list and save the file. Then copy and paste it back here.

Please delete the copy of combofix you have and download the latest version from here and run it. When the program is done it will bring up the log on your screen, just copy and paste the whole log into a reply back here.

After running combofix please rerun hijackthis and post its log as well.
 
Before.....

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:48:34 p.m., on 21/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Administrator\Downloads\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5653 bytes
 
Last edited:
ComboFix 10-07-16.01 - Administrator 7/2010 Wed 20:51:28.4.2 - x86
Microsoft Windows 7 旗舰版 6.1.7600.0.936.86.2052.18.1023.389 [GMT 12:00]
执行位置: C:\Users\Administrator\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( 驱动/服务 )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ccosm
-------\Service_ccosm


Oh and u have a mistake:

Please delete the copy of combofix you have and download the latest version from here and run it. When the program is done it will bring up the log on your screen, just copy and paste the whole log into a reply back here.

Yellow text: no link

Oh and i think this program may be unusable on my computer what do u think of this john??? CLICK ON THIS LINK COMBO FIX WIN 7 Discuss:
http://remove-malware.com/antimalware/anti-malware-news/using-combofix-on-windows-vista-and-windows-7-i-wouldnt/

But then again this guy has a full log??:

ComboFix 10-01-15.01 - Gary 01/15/2010 22:40:45.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.867 [GMT -5:00]
Running from: c:\users\Gary\Desktop\456out.com
http://forum.bullguard.com/forum/10/ComboFix-on-Windows-7-32-bit_81481.html
 
Last edited:
Latest combo fix from: http://www.bleepingcomputer.com/download/anti-virus/combofix

Hijack this.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:08:54 p.m., on 21/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5566 bytes
 
Combo fix Uninstalling

I this how u uninstall combo fix to run a new version?
 

Attachments

  • Combo fix question.jpg
    Combo fix question.jpg
    17.5 KB · Views: 96
Yes, just delete the file you have and redownload the new one as it updates almost daily.

I still need to see the uninstall list using hijackthis, you never posted it.

You said your machine was a beta? Not sure if that is what is causing the combofix issue.

Download and run Ccleaner from here.

http://www.filehippo.com/download_ccleaner/

Click up top right where it says download latest version and install the program. Then set it to the options that are checked in the attached image and then click on run cleaner.
 

Attachments

  • ccleaner.JPG
    ccleaner.JPG
    76.3 KB · Views: 152
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:35:07 p.m., on 22/07/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5598 bytes
 
Hey U sure this has to continue?
i have used CCleaner for years now and i also have professional registry/systemfiles/startupmanger/and system security hole fixer. Do u want to continue?
 
Thanks for all your help I will try to return in the future to help out with this fourm however my studies are catching up so will not be able to help out as much. Love to be part of this popular growing fourm.

Thanks again for all your help have a nice year and some. :):):):):):):):)
 
You must log in or register to reply here.
Back
Top