jaybb

July 20, 2008

Thanks Buddy... Appreciate all the help!!!

July 18, 2008

I just come across this in the forum, hope this will help

http://www.besttechie.net/forums/Removal-I...008-t14286.html

Cheers

July 18, 2008

I just come across this in the forum, hope this will help

http://www.besttechie.net/forums/Removal-I...008-t14286.html

Cheers

July 17, 2008

The scan shows that there is no malicious items detected, is the virus cleared?? Below is the report.

Malwarebytes' Anti-Malware 1.20

Database version: 960

Windows 6.0.6001 Service Pack 1

2:14:54 PM 17/7/2008

mbam-log-7-17-2008 (14-14-54).txt

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 131992

Time elapsed: 15 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

July 17, 2008

Hi MoNsTeReNeRgY22 ,

Glad that you will be helping me... thanks!! below are the results

Log from Step 1

Explorer killed successfully

C:\Users\acer\AppData\Local\Temp\RtkBtMnt.exe moved successfully.

File move failed. C:\Windows\BR040286.exe scheduled to be moved on reboot.

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BisonInst0402 >

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BisonInst0402\\ not found.

< EmptyTemp >

File delete failed. C:\Users\acer\AppData\Local\Temp\~DF8E9F.tmp scheduled to be deleted on reboot.

File delete failed. C:\Users\acer\AppData\Local\Temp\~DF8EC0.tmp scheduled to be deleted on reboot.

File delete failed. C:\Users\acer\AppData\Local\Temp\~DF91D4.tmp scheduled to be deleted on reboot.

File delete failed. C:\Users\acer\AppData\Local\Temp\~DF9315.tmp scheduled to be deleted on reboot.

Temp folders emptied.

IE temp folders emptied.

Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07172008_120923

Log from Step 2

Deckard's System Scanner v20071014.68

Run by acer on 2008-07-17 12:14:22

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --

35: 2008-07-16 16:47:30 UTC - RP101 - Restore Operation

34: 2008-07-16 14:23:04 UTC - RP100 - Restore Operation

33: 2008-07-14 10:17:40 UTC - RP99 - Windows Update

32: 2008-07-13 09:11:10 UTC - RP98 - Removed Orion

31: 2008-07-10 07:48:42 UTC - RP97 - Windows Update

-- First Restore Point --

1: 2008-06-25 05:23:43 UTC - RP63 - Removed Acer Crystal Eye Webcam

Backed up registry hives.

Performed disk cleanup.

-- HijackThis (run as acer.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:16:07 PM, on 17/7/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Acer\Empowering Technology\eAudio\eAudio.exe

C:\Users\acer\AppData\Local\Temp\RtkBtMnt.exe

C:\Program Files\Launch Manager\LManager.exe

C:\Windows\BR040286.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\PC Tools AntiVirus\PCTAV.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Acer\Acer VCM\AcerVCM.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE

C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

C:\Program Files\Acer\Acer VCM\acp2HID.exe

C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Users\acer\Desktop\dss.exe

C:\Windows\system32\DllHost.exe

C:\PROGRA~1\TRENDM~1\HIJACK~1\acer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.sg.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.sg.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [bisonInst0402] C:\Windows\BR040286.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog

O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: Orion.lnk = C:\Convesoft\Orion\Messenger.exe

O4 - Global Startup: Acer VCM.lnk = ?

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: Empowering Technology Launcher.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe

O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe

O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Raw Socket Service (RS_Service) - Acer Inc. - C:\Program Files\Acer\Acer VCM\RS_Service.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe

--

End of file - 9138 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 NTIDrvr (Upper Class Filter Driver) - c:\windows\system32\drivers\ntidrvr.sys <Not Verified; NewTech Infosystems, Inc.; >

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 eRecoveryService (eRecovery Service) - c:\acer\empowering technology\erecovery\erecoveryservice.exe <Not Verified; Acer Inc.; eRecoveryService>

R2 eSettingsService (eSettings Service) - c:\acer\empowering technology\esettings\service\capuserv.exe <Not Verified; ; Service>

R2 MobilityService - c:\acer\mobility center\mobilityservice.exe -p <Not Verified; ; app>

R2 o2flash (O2Micro Flash Memory Card Service) - "c:\program files\o2micro oz128 driver\o2flash.exe" <Not Verified; O2Micro International; O2 MS1/MP1 Service>

R2 RichVideo (Cyberlink RichVideo Service(CRVS)) - "c:\program files\cyberlink\shared files\richvideo.exe" <Not Verified; ; RichVideo Module>

R2 RS_Service (Raw Socket Service) - c:\program files\acer\acer vcm\rs_service.exe <Not Verified; Acer Inc.; Acer Video Conference Manager>

R2 WMIService (ePower Service) - c:\acer\empowering technology\epower\epowersvc.exe <Not Verified; acer; Acer ePower Management>

R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft ISATAP Adapter

Device ID: ROOT\*ISATAP000

Manufacturer: Microsoft

Name: Microsoft ISATAP Adapter

PNP Device ID: ROOT\*ISATAP000

Service: tunnel

-- Scheduled Tasks -------------------------------------------------------------

2008-07-16 15:35:32 416 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{52E9A177-A590-4754-A459-8C7D81B46D56}.job

-- Files created between 2008-06-17 and 2008-07-17 -----------------------------

2008-07-17 00:57:05 0 d-------- C:\Program Files\Trend Micro

2008-07-08 11:12:01 0 d-------- C:\Users\All Users\Yahoo! Companion

2008-07-07 20:50:51 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller

2008-07-07 20:50:43 0 d-------- C:\Program Files\Windows Live

2008-07-07 20:50:18 0 d-------- C:\Users\All Users\WLInstaller

2008-07-03 15:39:43 0 d-------- C:\Program Files\EA SPORTS

2008-07-01 17:28:35 0 d-------- C:\Program Files\Common Files\PX Storage Engine

2008-07-01 17:28:31 0 d-------- C:\Program Files\DivX

2008-07-01 17:06:37 0 d-------- C:\SISSigner

2008-07-01 16:58:21 0 d-------- C:\Users\All Users\PC Suite

2008-07-01 16:57:41 0 d-------- C:\Program Files\Common Files\PCSuite

2008-07-01 16:57:40 0 d-------- C:\Program Files\Common Files\Nokia

2008-07-01 16:57:33 0 d-------- C:\Program Files\DIFX

2008-07-01 16:57:06 0 d------c- C:\Windows\system32\DRVSTORE

2008-07-01 16:56:54 0 d-------- C:\Program Files\PC Connectivity Solution

2008-07-01 16:55:54 0 d-------- C:\Program Files\Nokia

2008-07-01 16:55:21 0 d-------- C:\Users\All Users\Installations

2008-07-01 11:44:59 0 d-------- C:\Program Files\MSECache

2008-07-01 11:44:01 0 d-------- C:\Program Files\Java

2008-07-01 11:44:00 0 d-------- C:\Program Files\Common Files\Java

2008-07-01 11:40:53 0 d-------- C:\Users\All Users\Spybot - Search & Destroy

2008-07-01 11:39:41 0 d-------- C:\Program Files\Softland

2008-07-01 11:27:56 0 d-a------ C:\Users\All Users\TEMP

2008-07-01 11:27:39 0 d-------- C:\Program Files\Common Files\PC Tools

2008-07-01 11:27:35 0 d-------- C:\Users\All Users\PC Tools

2008-07-01 11:27:35 0 d-------- C:\Program Files\PC Tools AntiVirus

2008-07-01 11:27:07 0 d-------- C:\Program Files\CCleaner

2008-07-01 11:21:47 0 d-------- C:\Program Files\Common Files\L&H

2008-07-01 11:21:09 0 d-------- C:\Program Files\Microsoft ActiveSync

2008-07-01 11:19:53 0 d-------- C:\Windows\PCHEALTH

2008-07-01 11:19:53 0 d-------- C:\Program Files\Microsoft.NET

2008-07-01 00:19:57 0 d-------- C:\Program Files\Winamp

2008-06-30 23:38:15 0 d-------- C:\Program Files\Opera

2008-06-30 23:26:44 0 d-------- C:\Users\All Users\Motive

2008-06-25 13:41:46 0 d-------- C:\Windows\BUVC_AP

2008-06-25 13:28:07 0 d-------- C:\Windows\BisonC07

2008-06-25 13:27:30 0 d-------- C:\Windows\Options

2008-06-25 13:27:30 53248 --a------ C:\Windows\BR040286.exe <Not Verified; Bison Inc.; Bison Inc. Pcam>

2008-06-25 13:27:30 57856 --a------ C:\Windows\BR040264.exe <Not Verified; Bison Inc.; Bison Inc. Pcam>

-- Find3M Report ---------------------------------------------------------------

2008-07-17 12:11:02 12 --a------ C:\Windows\bthservsdp.dat

2008-07-16 20:30:58 0 d-------- C:\Program Files\Launch Manager

2008-07-10 15:55:12 0 d-------- C:\Program Files\Windows Mail

2008-07-07 20:50:51 0 d-------- C:\Program Files\Common Files

2008-07-03 20:29:13 0 d-------- C:\Users\acer\AppData\Roaming\temp

2008-07-03 15:49:52 0 dr-h----- C:\Users\acer\AppData\Roaming\SecuROM

2008-07-02 12:16:58 0 d--hs---- C:\Users\acer\AppData\Roaming\.#

2008-07-01 17:00:45 0 d-------- C:\Users\acer\AppData\Roaming\PC Suite

2008-07-01 17:00:30 0 d-------- C:\Users\acer\AppData\Roaming\Nokia

2008-07-01 16:44:44 0 d-------- C:\Users\acer\AppData\Roaming\Adobe

2008-07-01 11:38:43 0 d-------- C:\Program Files\Microsoft Works

2008-07-01 11:27:56 0 d-------- C:\Users\acer\AppData\Roaming\PC Tools

2008-07-01 11:27:12 0 d-------- C:\Program Files\Yahoo!

2008-07-01 00:21:36 0 d-------- C:\Users\acer\AppData\Roaming\Winamp

2008-06-30 23:38:24 0 d-------- C:\Users\acer\AppData\Roaming\Opera

2008-06-25 13:41:46 0 d--h----- C:\Program Files\InstallShield Installation Information

2008-06-25 13:24:12 0 d-------- C:\Users\acer\AppData\Roaming\InstallShield

2008-06-06 16:14:59 0 d-------- C:\Users\acer\AppData\Roaming\CyberLink

2008-06-06 15:14:07 0 -rahs---- C:\MSDOS.SYS

2008-06-06 15:14:07 0 -rahs---- C:\IO.SYS

2008-06-06 15:06:57 0 d-------- C:\Program Files\MSXML 4.0

2008-06-06 15:04:20 0 d-------- C:\Program Files\Acer Inc

2008-06-06 14:50:52 0 d-------- C:\Program Files\Common Files\InstallShield

2008-06-06 14:50:10 0 d-------- C:\Users\acer\AppData\Roaming\Acer

2008-06-06 14:49:58 0 d-------- C:\Program Files\Acer

2008-06-06 14:41:14 0 d-------- C:\Program Files\O2Micro Oz128 Driver

2008-06-06 14:40:30 0 d-------- C:\Program Files\Synaptics

2008-06-06 14:38:08 0 d-------- C:\Program Files\Realtek

2008-06-06 14:38:07 315392 --a------ C:\Windows\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>

2008-06-06 14:30:28 0 d-------- C:\Program Files\Acer Arcade Deluxe

2008-06-06 14:25:58 0 d-------- C:\Program Files\WIDCOMM

2008-06-06 14:25:00 0 d-------- C:\Users\acer\AppData\Roaming\Macromedia

2008-06-06 14:24:04 0 d-------- C:\Users\acer\AppData\Roaming\Identities

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [21/01/2008 10:23 AM]

"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [04/10/2007 06:44 AM]

"Adobe Reader Speed Launcher"="c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [08/03/2007 07:38 PM]

"IgfxTray"="C:\Windows\system32\igfxtray.exe" [29/08/2007 04:43 AM]

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [29/08/2007 04:43 AM]

"Persistence"="C:\Windows\system32\igfxpers.exe" [29/08/2007 04:43 AM]

"PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [22/01/2008 11:14 AM]

"RtHDVCpl"="RtHDVCpl.exe" [08/01/2008 08:25 AM C:\Windows\RtHDVCpl.exe]

"Skytel"="Skytel.exe" [21/11/2007 10:15 AM C:\Windows\SkyTel.exe]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [19/01/2008 03:31 AM]

"eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [10/10/2007 06:41 AM]

"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [08/01/2008 08:32 AM]

"eRecoveryService"="" []

"BisonInst0402"="C:\Windows\BR040286.exe" [08/05/2007 08:48 PM]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [02/04/2008 02:49 AM]

"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [05/03/2008 09:37 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [21/01/2008 10:23 AM]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 11:43 AM]

"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [26/03/2008 06:41 PM]

"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [16/04/2008 12:53 PM]

"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 11:34 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"=2 (0x2)

"EnableUIADesktopToggle"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc

LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum

bthsvcs BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]

%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI

-- End of Deckard's System Scanner: finished at 2008-07-17 12:17:19 ------------

July 16, 2008

I did a reverse to the system restore and my anti virus start working again. the same virus appear on the scan, exploit.HTML.Agent.H. Nevertheless, this is the new hijackthis log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:10:12 AM, on 17/7/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe

C:\Windows\RtHDVCpl.exe

C:\Users\acer\AppData\Local\Temp\RtkBtMnt.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Acer\Empowering Technology\eAudio\eAudio.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Launch Manager\LManager.exe

C:\Windows\BR040286.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Acer\Acer VCM\AcerVCM.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE

C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

C:\Program Files\PC Tools AntiVirus\PCTAV.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Acer\Acer VCM\acp2HID.exe

C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe

C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe