[WTB] Finding Nemo 3D

Ray78 — Sat, 04 Jan 2014 12:22:29 +0800

As per title.New or used.Kindly PM me.Thanks.

[HELP] PC infected with virus

Ray78 — Mon, 28 Jun 2010 20:13:02 +0800

Hi.

Before I post HJT and SRE log files here is what happens:

"RECYCLER" , "SYSTEM VOLUME INFORMATION" folders created on both my C: and D: drives.I cannot delete these folders as they keep regenerating.I believe my PC got infected through USB flashdrive which I used.I am unable to delete autorun.inf files even using cmd.And there is Isass window on my C: drive.I tried deleting it but access is denied.

Here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:02:03, on 6/28/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\TEMP\ggktpfg.exe
C:\DOCUMENTS AND SETTINGS\WINDOWS XP\START MENU\PROGRAMS\STARTUP\Adobe update.com
C:\DOCUMENTS AND SETTINGS\WINDOWS XP\START MENU\PROGRAMS\STARTUP\Adobe Online.com
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
c:\lsass.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [32740] C:\WINDOWS\TEMP\ggktpfg.exe
O4 - Startup: Adobe Online.com
O4 - Startup: Adobe update.com
O4 - Global Startup: Tenda W541U.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 1871 bytes
________________________________________________________________________________________________

Here is another log from SREng:

007-06-28,11:27:18

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
All Boot Items (Including Registry, Startup Folders, Services and so on)
Browser Add-ons
Runing Processes (Including process model information)
File Associations
Winsock Provider
Autorun.Inf
HOSTS File
Process Privileges Scan

Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<27378><C:\WINDOWS\TEMP\ggktpfg.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]

==================================
Startup Folders
[Tenda W541U]
<C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Tenda W541U.lnk --> C:\PROGRA~1\Tenda\W541U\UI.exe []><N>
[Adobe Online]
<C:\Documents and Settings\Windows XP\Start Menu\Programs\Startup\Adobe Online.com --> [N/A]><N>
[Adobe update]
<C:\Documents and Settings\Windows XP\Start Menu\Programs\Startup\Adobe update.com --> [N/A]><N>

==================================
Services
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>

==================================
Drivers
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AEGIS Protocol (IEEE 802.1x) v3.5.3.0 / AegisP][Running/Auto Start]
<System32\DRIVERS\AegisP.sys><Meetinghouse Data Communications>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RT73 USB Wireless LAN Card Driver / RT73][Running/Manual Start]
<System32\DRIVERS\rt73.sys><Ralink Technology, Corp.>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>

==================================
Browser Add-ons
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[&Radio]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, >
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash10h.ocx, Adobe Systems, Inc.>

==================================
Running Processes
[PID: 404 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 628 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 652 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 696 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[PID: 712 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 896 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 920 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[PID: 992 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1016 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1064 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[PID: 1364 / SYSTEM][C:\WINDOWS\System32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.4403]
[PID: 1396 / SYSTEM][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] [Analog Devices, Inc., 3, 2, 5, 0]
[PID: 360 / Windows XP][C:\Program Files\Tenda\W541U\UI.exe] [, 1.0.0.1]
[C:\Program Files\Tenda\W541U\acAuth.dll] [, 4.1.0.65 2006-07-12 18:36:34]
[C:\Program Files\Tenda\W541U\dllPublicFunc.dll] [, 1.0.0]
[C:\Program Files\Tenda\W541U\dllCommonCtrl.dll] [, 1.0.0]
[C:\Program Files\Tenda\W541U\dllMultiLanguage.dll] [, 1.0.0.1]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[PID: 444 / Windows XP][C:\Documents and Settings\Windows XP\Start Menu\Programs\Startup\Adobe Online.com] [N/A, ]
[C:\WINDOWS\thumbs .db] [N/A, ]
[PID: 496 / SYSTEM][C:\WINDOWS\System32\wbem\wmiprvse.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1840 / Windows XP][C:\WINDOWS\TEMP\ggktpfg.exe] [N/A, ]
[PID: 140 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 612 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1640 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 5356 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[PID: 5124 / Windows XP][C:\DOCUMENTS AND SETTINGS\WINDOWS XP\START MENU\PROGRAMS\STARTUP\Adobe update.com] [N/A, ]
[C:\WINDOWS\thumbs .db] [N/A, ]
[PID: 4792 / Windows XP][C:\Program Files\Mozilla Firefox\firefox.exe] [Mozilla Corporation, 1.9.2.6]
[C:\Program Files\Mozilla Firefox\xul.dll] [Mozilla Foundation, 1.9.2.6]
[C:\Program Files\Mozilla Firefox\sqlite3.dll] [sqlite.org, 3.6.22]
[C:\Program Files\Mozilla Firefox\MOZCRT19.dll] [Mozilla Foundation, 8.00.0000]
[C:\Program Files\Mozilla Firefox\js3250.dll] [N/A, ]
[C:\Program Files\Mozilla Firefox\nspr4.dll] [Mozilla Foundation, 4.8.3]
[C:\Program Files\Mozilla Firefox\smime3.dll] [Mozilla Foundation, 3.12.6.2 Basic ECC]
[C:\Program Files\Mozilla Firefox\nss3.dll] [Mozilla Foundation, 3.12.6.2 Basic ECC]
[C:\Program Files\Mozilla Firefox\nssutil3.dll] [Mozilla Foundation, 3.12.6.2]
[C:\Program Files\Mozilla Firefox\plc4.dll] [Mozilla Foundation, 4.8.3]
[C:\Program Files\Mozilla Firefox\plds4.dll] [Mozilla Foundation, 4.8.3]
[C:\Program Files\Mozilla Firefox\ssl3.dll] [Mozilla Foundation, 3.12.6.2 Basic ECC]
[C:\Program Files\Mozilla Firefox\MOZCPP19.dll] [Mozilla Foundation, 8.00.0000]
[C:\Program Files\Mozilla Firefox\xpcom.dll] [Mozilla Foundation, 1.9.2.6]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll] [Mozilla Foundation, 1.9.2.6]
[C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll] [Mozilla Foundation, 1.9.2.6]
[C:\Program Files\Mozilla Firefox\softokn3.dll] [Mozilla Foundation, 3.12.4.6 Basic ECC]
[C:\Program Files\Mozilla Firefox\nssdbm3.dll] [Mozilla Foundation, 3.12.4.6 Basic ECC]
[C:\Program Files\Mozilla Firefox\freebl3.dll] [Mozilla Foundation, 3.12.4.6 Basic ECC]
[C:\Program Files\Mozilla Firefox\nssckbi.dll] [Mozilla Foundation, 1.78]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 5172 / Windows XP][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 4760 / Windows XP][C:\Program Files\Trillian\trillian.exe] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\SSLEAY32.dll] [The OpenSSL Project, http://www.openssl.org/, 0.9.8j]
[C:\Program Files\Trillian\LIBEAY32.dll] [The OpenSSL Project, http://www.openssl.org/, 0.9.8j]
[C:\Program Files\Trillian\MSVCR90.dll] [Microsoft Corporation, 9.00.21022.8]
[C:\Program Files\Trillian\zlib1.dll] [, 1.2.3]
[C:\Program Files\Trillian\MSVCP90.dll] [Microsoft Corporation, 9.00.21022.8]
[C:\Program Files\Trillian\images.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\core.dll] [Cerulean Studios, LLC, 4, 1, 0, 21]
[C:\Program Files\Trillian\jpeg62.dll] [Independent JPEG Group <www.ijg.org>, 6b.1961.25445]
[C:\Program Files\Trillian\libpng12.dll] [GnuWin32 <http://gnuwin32.sourceforge.net>, 1.2.34.3276]
[C:\Program Files\Trillian\libungif.dll] [, 4, 1, 4, 0]
[C:\Program Files\Trillian\expatxml.dll] [Cerulean Studios, 4, 1, 0, 24]
[c:\program files\trillian\languages\en\trillian.dll] [N/A, ]
[C:\Program Files\Trillian\toolkit.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\kdu_v43R.dll] [The University of New South Wales, 4, 3, 1, 1]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[C:\Program Files\Trillian\events.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\crypto.dll] [Cerulean Studios, LLC, 4, 1, 0, 21]
[C:\Program Files\Trillian\list.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\buddy.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\talk.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\plugins\astra.dll] [Cerulean Studios, LLC, 4, 1, 0, 21]
[C:\Program Files\Trillian\libspeex.dll] [N/A, ]
[C:\Program Files\Trillian\plugins\MSVCP90.dll] [Microsoft Corporation, 9.00.21022.8]
[C:\Program Files\Trillian\plugins\MSVCR90.dll] [Microsoft Corporation, 9.00.21022.8]
[c:\program files\trillian\languages\en\toolkit.dll] [N/A, ]
[c:\program files\trillian\languages\en\events.dll] [N/A, ]
[c:\program files\trillian\languages\en\buddy.dll] [N/A, ]
[c:\program files\trillian\languages\en\talk.dll] [N/A, ]
[C:\Program Files\Trillian\plugins\mail.dll] [Cerulean Studios, 4, 1, 0, 24]
[C:\Program Files\Trillian\plugins\msn.dll] [Cerulean Studios, LLC, 4, 1, 0, 21]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 5052 / Windows XP][C:\Documents and Settings\Windows XP\My Documents\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[C:\WINDOWS\System32\SYNCOR11.DLL] [SoundMAX, 1.2.2]
[C:\Documents and Settings\Windows XP\My Documents\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]

==================================
File Associations
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR Error. [%1]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
[C:\]
[Autorun]
Open=Thumbs.com -a
ShellExecute=Thumbs.com
Shell\Auto\Command=Thumbs.com
Shell=Auto
[Definitions]
Launchpad=Thumbs.com
Vtype=1
[D:\]
[Autorun]
Open=Thumbs.com -a
ShellExecute=Thumbs.com
Shell\Auto\Command=Thumbs.com
Shell=Auto
[Definitions]
Launchpad=Thumbs.com
Vtype=1

==================================
HOSTS File
127.0.0.1 www.Brenz.pl
127.0.0.1 localhost

==================================
Process Privileges Scan
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1064, C:\WINDOWS\SYSTEM32\SPOOLSV.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 360, C:\PROGRAM FILES\TENDA\W541U\UI.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 444, C:\DOCUMENTS AND SETTINGS\WINDOWS XP\START MENU\PROGRAMS\STARTUP\ADOBE ONLINE.COM]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 1840, C:\WINDOWS\TEMP\GGKTPFG.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 5124, C:\DOCUMENTS AND SETTINGS\WINDOWS XP\START MENU\PROGRAMS\STARTUP\ADOBE UPDATE.COM]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 5172, C:\WINDOWS\EXPLORER.EXE]

==================================
API HOOK
Entrypoint Error: NtCreateFile (Dangerous Level: High, Hooked by Module: 0x7FFA64D2)
Entrypoint Error: NtCreateProcess (Dangerous Level: High, Hooked by Module: 0x7FFA6561)
Entrypoint Error: NtCreateProcessEx (Dangerous Level: High, Hooked by Module: 0x7FFA656E)
Entrypoint Error: NtQueryInformationProcess (Dangerous Level: High, Hooked by Module: 0x7FFA65AF)
Entrypoint Error: ZwCreateFile (Dangerous Level: High, Hooked by Module: 0x7FFA64D2)
Entrypoint Error: ZwCreateProcess (Dangerous Level: High, Hooked by Module: 0x7FFA6561)
Entrypoint Error: ZwCreateProcessEx (Dangerous Level: High, Hooked by Module: 0x7FFA656E)
Entrypoint Error: ZwOpenFile (Dangerous Level: High, Hooked by Module: 0x7FFA6557)
Entrypoint Error: ZwQueryInformationProcess (Dangerous Level: High, Hooked by Module: 0x7FFA65AF)

==================================
Hidden Process
[1932] c:\lsass.exe

==================================

________________________________________________________________________________________________

BTW,I have also tried Combofix removal tool from bleepingcomputer.com but unfortunately it could not start and says there could be file-patching virus in my PC.

Tried DR.Web CureIt too(in safe mode) but it just halts saying "Invalid path to virus database".

Please help.Thanks!

CHROMEHOUNDS : FINAL FAREWELL

Ray78 — Fri, 18 Dec 2009 11:31:13 +0800

Ask your Questions - Chromehounds Japanese Producer

So, I've brokered what I hope to be a Q&A with the Japanese producer, Nabeshima-san, on Chromehounds as a final send off for you, the fans, to interact with the development side of things. I'm honestly not sure what the extent of the Q&A portion of the message will be, but I do know that there is an opportunity, and I have a quick turnaround to get some questions . Let's roll the dice and see what we can get.

Ok, so, if you have questions (and I expect you do), please write them below and I will compile and send along. No guarauntee that they will be answered, please remember to be respectful (hate posts will be ignored), and try to be clear in your question (so I don't have to guess as to the point). Cut off for the questions is Monday, December 21.

LINK:
http://forums.sega.com/showthread.php?t=306988

Lowyat.NET: Latest topics by Ray78

[WTB] Finding Nemo 3D

[HELP] PC infected with virus

CHROMEHOUNDS : FINAL FAREWELL