mayi help me see

• BenBenDeZhu

  24 Aug 07, 16:30

  i kena the online games trojan when i accidentally click on an ad in bitcomet. my com should be clean liao but i just wan to make sure coz i clean myself one
  
  Logfile of HijackThis v1.99.1
  Scan saved at 4:25:35 PM, on 8/24/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\WINDOWS\system32\spoolsv.exe
  D:\software\Grisoft\AVGFRE~1\avgamsvr.exe
  D:\software\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\System32\nvsvc32.exe
  D:\software\Panda Software\Panda Antivirus 2007\PsImSvc.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  D:\software\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\System32\RUNDLL32.EXE
  D:\software\Zone Labs\ZoneAlarm\zlclient.exe
  D:\software\Spybot - Search & Destroy\TeaTimer.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  F:\hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\software\BitComet\tools\BitCometBHO_1.1.6.14.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\software\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] D:\software\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\software\Zone Labs\ZoneAlarm\zlclient.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\software\Spybot - Search & Destroy\TeaTimer.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\software\BitComet\BitComet.exe/AddLink.htm
  O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\software\BitComet\BitComet.exe/AddVideo.htm
  O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\software\BitComet\BitComet.exe/AddAllLink.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\software\MICROS~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11598f9871002c52ec05/netzip/RdxIE601.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157084460640
  O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157084387046
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://my.levelupgames.ph/keycrypt/npkcx.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - AppInit_DLLs: MsgPlusLoader.dll
  O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
  O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\software\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\software\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - D:\software\Panda Software\Panda Antivirus 2007\PsImSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  
  
• mr_sotong

  24 Aug 07, 16:53

  bloody hell!!
• venny

  24 Aug 07, 17:07

  wah u got spybot, zonealarm, avg, panda... so many.... so kiasu.....
  
  looks clean to me atleast for those i understand. except this one lor....
  
  O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://my.levelupgames.ph/keycrypt/npkcx.cab
• Darkness_hacker99

  24 Aug 07, 17:12

  O16 are your ActiveX. Common ActiveX are Windows Updates, online virus scans and games.
• ndmmxiaomayi

  24 Aug 07, 18:37

  First thing first, uninstall one antivirus. You have 2 running. Either uninstall Panda or AVG and restart your computer.
  
  Next, can you please download L2MFix from either of these links:
  
  Atribune or Subratam
  
  Save it to your desktop, double click to run it.
  
  Read the license agreement, click Accept.
  
  Click on Install. By default, it install to your desktop.
  
  Double click on l2mfix.bat to run it.
  
  Press 1 and press Enter.
  
  It will create a log. Post back this log.
• ndmmxiaomayi

  24 Aug 07, 18:40

  Originally posted by venny:

  wah u got spybot, zonealarm, avg, panda... so many.... so kiasu.....
  
  looks clean to me atleast for those i understand. except this one lor....
  
  O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://my.levelupgames.ph/keycrypt/npkcx.cab

  Spybot - anti spyware, not antivirus nor firewall
  
  Panda and AVG - two antivirus, not good for PC health
  
  ZoneAlarm - firewall
  
  That O16 is related to anti-game piracy. Google INCA
  
  Each and every protection program does different things... it's not too kiasu to have them... but not all of them should be working in real time to avoid conflicts. At the most I would recommend one antivirus, one firewall and an antispyware guard running in real time.
• yiha093

  24 Aug 07, 20:14

  C:\WINDOWS\Explorer.EXE<-- virus
  
  
• BenBenDeZhu

  24 Aug 07, 20:44

  i dont have panda anti virus. i just use their active scan only when i suspect avg cannot detect
• BenBenDeZhu

  24 Aug 07, 21:03

  here's there log
  
  L2MFIX find log 032106
  These are the registry keys present
  **********************************************************************************
  Winlogon/notify:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
  "Asynchronous"=dword:00000000
  "DllName"=""
  "Impersonate"=dword:00000000
  "Logon"="WinLogon"
  "Logoff"="WinLogoff"
  "Shutdown"="WinShutdown"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avldr]
  "Asynchronous"=dword:00000000
  "DllName"=hex(2):61,00,76,00,6c,00,64,00,72,00,2e,00,64,00,6c,00,6c,00,00,00
  "Impersonate"=dword:00000000
  "Startup"="AvLdrStartupNotification"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OptimalLayout]
  "Asynchronous"=dword:00000000
  "Impersonate"=dword:00000000
  "Logon"="WinLogon"
  "Logoff"="WinLogoff"
  "Shutdown"="WinShutdown"
  
  **********************************************************************************
  useragent:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  "{7153F3F9-17CB-2380-0746-700340601385}"=""
  
  **********************************************************************************
  Shell Extension key:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
  "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
  "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
  "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
  "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
  "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
  "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
  "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
  "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
  "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
  "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
  "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
  "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
  "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
  "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
  "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
  "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
  "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
  "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
  "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
  "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
  "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
  "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
  "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
  "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
  "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
  "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
  "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
  "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
  "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
  "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
  "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
  "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
  "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
  "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
  "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
  "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
  "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
  "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
  "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
  "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
  "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
  "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
  "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
  "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
  "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
  "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
  "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
  "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
  "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
  "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
  "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
  "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
  "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
  "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
  "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
  "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
  "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
  "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
  "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
  "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
  "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
  "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
  "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
  "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
  "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
  "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
  "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
  "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
  "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
  "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
  "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
  "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
  "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
  "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
  "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
  "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
  "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
  "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
  "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
  "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
  "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
  "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
  "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
  "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
  "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
  "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
  "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
  "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
  "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
  "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
  "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
  "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
  "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
  "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
  "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
  "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
  "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
  "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
  "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
  "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
  "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
  "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
  "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
  "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
  "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
  "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
  "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
  "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
  "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
  "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
  "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
  "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
  "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
  "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
  "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
  "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
  "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
  "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
  "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
  "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
  "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
  "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
  "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
  "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
  "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
  "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
  "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
  "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
  "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
  "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
  "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
  "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
  "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
  "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
  "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
  "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
  "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
  "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
  "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
  "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
  "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
  "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
  "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
  "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
  "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
  "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
  "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
  "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
  "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
  "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
  "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
  "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
  "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
  "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
  "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
  "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
  "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
  "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
  "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
  "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
  "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
  "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
  "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
  "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
  "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
  "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
  "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
  "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
  "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
  "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
  "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
  "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
  "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
  "{516EC4D3-4AD9-11D5-AA6A-00E0189008B3}"="The Core Media Player Shell Extension"
  "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
  "{992ED2A0-064C-47B9-A727-9985A10AE5A0}"=""
  "{FDDCA075-BA9A-439D-9A73-54E7E09C2B21}"=""
  "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
  "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
  "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
  "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
  "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
  "{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References"
  "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References"
  "{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW"
  "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
  
  **********************************************************************************
  HKEY ROOT CLASSIDS:
  Windows Registry Editor Version 5.00
  
  [HKEY_CLASSES_ROOT\CLSID\{992ED2A0-064C-47B9-A727-9985A10AE5A0}]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{992ED2A0-064C-47B9-A727-9985A10AE5A0}\Implemented Categories]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{992ED2A0-064C-47B9-A727-9985A10AE5A0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{992ED2A0-064C-47B9-A727-9985A10AE5A0}\InprocServer32]
  "ThreadingModel"="Apartment"
  
  Windows Registry Editor Version 5.00
  
  [HKEY_CLASSES_ROOT\CLSID\{FDDCA075-BA9A-439D-9A73-54E7E09C2B21}]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{FDDCA075-BA9A-439D-9A73-54E7E09C2B21}\Implemented Categories]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{FDDCA075-BA9A-439D-9A73-54E7E09C2B21}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
  @=""
  
  [HKEY_CLASSES_ROOT\CLSID\{FDDCA075-BA9A-439D-9A73-54E7E09C2B21}\InprocServer32]
  "ThreadingModel"="Apartment"
  
  **********************************************************************************
  Files Found are not all bad files:
  
  C:\WINDOWS\SYSTEM32\
  bitcom~1.dll Tue Jul 17 2007 12:47:00p A.... 2,560 2.50 K
  cmdlin~2.dll Fri Jun 22 2007 8:10:36p A.... 43,520 42.50 K
  
  2 items found: 2 files, 0 directories.
  Total of file sizes: 46,080 bytes 45.00 K
  Locate .tmp files:
  
  No matches found.
  **********************************************************************************
  Directory Listing of system files:
  Volume in drive C has no label.
  Volume Serial Number is B4E0-7FCF
  
  Directory of C:\WINDOWS\System32
  
  08/20/2007 12:56 AM dllcache
  02/21/2006 01:28 AM Microsoft
  0 File(s) 0 bytes
  2 Dir(s) 4,499,922,944 bytes free
  
• BenBenDeZhu

  24 Aug 07, 22:47

  mayi go offline liao?
• ndmmxiaomayi

  25 Aug 07, 01:26

  Originally posted by BenBenDeZhu:

  i dont have panda anti virus. i just use their active scan only when i suspect avg cannot detect

  Have you installed Panda Security Suite before?
• ndmmxiaomayi

  25 Aug 07, 01:32

  Step 1
  
  Temporarily disable Teatimer
  
  

  [*]Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  [*]Click on Mode > Advanced Mode. When it prompts you, click Yes.
  [*]On the left hand side, click on Tools.
  [*]Check (tick) this box if it is not yet ticked: Resident.
  [*]You will notice that Resident is now added under Tools. Click on Resident.
  [*]Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  [*]Exit Spybot Search & Destroy.

  
  
  Step 2
  
  Open HijackThis and select Do a system scan only.
  
  Put a tick next to these lines:
  
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\
  
  Click Fix checked. Close HijackThis.
  
  Step 3
  
  

  [*]Please download AVG Anti-Spyware and save it to your desktop.
  [*]Double click on avgas-setup-7.5.0.50.exe to install AVG Anti-Spyware. Install it in the default location.
  [*]Once installed, start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]In the main screen, you should see Your Computer's Security.
  [*]Next to Resident Shield, click on Change state. It should now be Inactive.
  [*]Next to Automatic Updates, click on Change state. It should now be Inactive.
  [*]Next to Last Update, click on Update now. If your firewall prompts you, tell your firewall to allow it. Should you be unable to update it, download the updates from here. Save it to your desktop. Double click to run the installation and the updates will be installed. Make sure AVG Anti-Spyware is closed during the installation.
  [*]Right-click the AVG Anti-Spyware icon near the clock and uncheck (untick) Start with Windows. Confirm by clicking Yes.
  [*]Now click on the Scanner button at the top.
  [*]Select the Settings tab.
  [*]Under How to act?, click on Recommended actions and select Quarantine.
  [*]Under How to scan?, check (tick) all the boxes.
  [*]Under Possibly unwanted software:, check (tick) all the boxes.
  [*]Under Reports:, uncheck (untick) the Only if threats were found box and select Do not automatically generate report.
  [*]Under What to scan?, select Scan every file.

  Do not run a scan yet. You will run a scan later.
  
  Step 4
  
  Please download ATF Cleaner by Atribune.
  
  

  [*]Double-click ATF-Cleaner.exe to run the program.
  [*]Under Main choose: Select All.
  [*]Click the Empty Selected button.

  
  
  If you use Firefox browser
  
  

  [*]Click Firefox at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  If you use Opera browser
  
  

  [*]Click Opera at the top and choose: Select All.
  [*]Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

  
  
  Step 5
  
  Reboot into Safe Mode by following the instructions below:
  
  Restart your computer in Safe Mode.
  
  

  [*]When you see BIOS screen, start pressing F8.
  [*]A boot menu will appear shortly.
  [*]Using the up down arrows, select Safe Mode and press the Enter key.
  [*]Windows will now load.
  [*]Log in to your usual account.

  
  
  Step 6
  
  

  [*]Start AVG Anti-Spyware by going to Start > All Programs > AVG Anti-Spyware 7.5 > AVG Anti-Spyware.
  [*]Click on the Scanner button at the top.
  [*]Select the Scan tab.
  [*]Click on Complete System Scan to start the scan.
  [*]When the scan has finished, follow the instructions below.
  IMPORTANT: Don't click on the Save Scan Report button before you did hit the Apply all Actions button.
  
  [*]Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  [*]At the bottom of the window click on the Apply all Actions button. (3)
  
  
  [*]When done, click the Save Scan Report button. (4)
  
  [*]Click the Save Report as button.
  [*]Save the report to your Desktop.
  
  [*]Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

  Restart in Normal Mode and post back the AVG Antispyware scan report as well as a new HijackThis log.
• ndmmxiaomayi

  25 Aug 07, 01:38

  Originally posted by BenBenDeZhu:

  mayi go offline liao?

  Ya, went to take a nap.
• BenBenDeZhu

  25 Aug 07, 03:24

  Logfile of HijackThis v1.99.1
  Scan saved at 3:21:58 AM, on 8/25/2007
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\SYSTEM32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Ahead\InCD\InCDsrv.exe
  C:\WINDOWS\system32\spoolsv.exe
  D:\software\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  D:\software\Grisoft\AVGFRE~1\avgamsvr.exe
  D:\software\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\System32\nvsvc32.exe
  D:\software\Panda Software\Panda Antivirus 2007\PsImSvc.exe
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  D:\software\Grisoft\AVGFRE~1\avgcc.exe
  C:\WINDOWS\System32\RUNDLL32.EXE
  D:\software\Zone Labs\ZoneAlarm\zlclient.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  F:\hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\software\BitComet\tools\BitCometBHO_1.1.6.14.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\software\SPYBOT~1\SDHelper.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKLM\..\Run: [AVG7_CC] D:\software\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\software\Zone Labs\ZoneAlarm\zlclient.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\software\BitComet\BitComet.exe/AddLink.htm
  O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\software\BitComet\BitComet.exe/AddVideo.htm
  O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\software\BitComet\BitComet.exe/AddAllLink.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\software\MICROS~1\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11598f9871002c52ec05/netzip/RdxIE601.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157084460640
  O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157084387046
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - https://my.levelupgames.ph/keycrypt/npkcx.cab
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - AppInit_DLLs: MsgPlusLoader.dll
  O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\software\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\software\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\software\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
  O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - D:\software\Panda Software\Panda Antivirus 2007\PsImSvc.exe
  O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  
  ---------------------------------------------------------
  AVG Anti-Spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 3:09:46 AM 8/25/2007
  
  + Scan result:
  
  D:\System Volume Information\_restore{7D68FCE4-1175-4D9E-9829-F77E6EA06E79}\RP2\A0001069.exe -> Adware.ErrorNuker : Cleaned with backup (quarantined).
  D:\System Volume Information\_restore{7D68FCE4-1175-4D9E-9829-F77E6EA06E79}\RP2\A0001070.exe -> Adware.ErrorNuker : Cleaned with backup (quarantined).
  D:\games\illusion\Schoolmate\Schoolmate Trainer.exe -> Trojan.Delf.bcg : Cleaned with backup (quarantined).
  D:\games\illusion\Schoolmate\Schoolmate +12 Trainer.exe -> Trojan.Delf.bcg : Cleaned with backup (quarantined).
  
  ::Report end
  
  
• BenBenDeZhu

  25 Aug 07, 10:39

  nothing wrong le rite?
• ndmmxiaomayi

  25 Aug 07, 14:32

  Yup, nothing wrong liao. You need to reset your system restore though, it's infected.
  
  

  [*]Right click on My Computer and select Properties.
  [*]Select the System Restore tab.
  [*]Check (tick) Turn off system restore on all drives box.
  [*]Click OK.
  [*]Restart your computer.

  
  After restarting your computer, follow these steps:
  
  

  [*]Right click on My Computer and select Properties.
  [*]Select the System Restore tab.
  [*]Uncheck (untick) Turn off system restore on all drives box.
  [*]Click OK.
  [*]Restart your computer.

  
  Note: Do this only ONCE, don't flush it regularly.
• BenBenDeZhu

  25 Aug 07, 20:05

  i was surfing Sam Alfresco Coffee Shop then i kena another trojan svcipa.exe through an ad but this 1 i clear it already. avg detected it onced it went into my com.
  
  aniway thx ah