# Smartest and Hardest BAT.Trojan



## Tomboby8

Hello all,
Yesterday, 16/07/2010 i was struck down by a BAT.Trojan,
I spent many frustrated hours trying to remove it but with no gold.
I have given up on all my weak, failed attacks including scanning with software, internet search (no luck), file editing and a failed system restore.

The Virus slows my computer down alot; cpu reads 17%(normal), ram 70%(normal) but it takes 1-2min to open internet explorer and other programs (usually 3 sec), god knows what it is doing to my OS system files and i don't have a back up disk (came preinstalled by some internet market company). And i'm worried that it may cause identity theft.


My computer is a ASUS A41I series (beta model)
with:
1G ram
2.4ghz CPU
Nvidia Geforce 310M Cuda 512MB
Windows 7 Ultimate 32bit
and most importantly:
Norton 360 Premier Edition
IObit Security 360

The Virus that has infected my computer (i think) creates several files named "launchhh.**" in my windows32 directory, they were created on the day and time of infection. They are vbscripts and batch files, with a text logg.txt. Norton says that the file is launchh.vbs and blocks it, making not attempt to remove it and other files. A full sytem scan with iobit and norton turns up with nothing.

System restore says that norton is disallowing it to complete restore, but it i disable norton the virus may take full hold of the system.
The virus pop up also appears in safe boot (using msconfig) so it may be an error prompt.

Norton detects the virus and blocks it but the virus keeps on reappearing at each start up and during computer use as a error pop up (photo 1) the launch files are also replaced.

I have deleted the files but they are recreated by some hidden code. I have found that windows script.exe is used to execute the virus.

A hijackthis log has been run but I can't detect the virus, i hope u can.

There is an attached file of the "launch" files and some photo shoots with the hijack this log.
-launch files have been removed for safety


I hope u can analyze the virus.

Thank you so much for your help

P.S. How do you configure msconfig to boot using safe mode with minimal services and  *system restore*  ?
My computer does not allow safe mode as a option during boot only in msconfig.
_This is my last try at removing the virus before i give up_ 



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:54:47 p.m., on 17/07/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\IObit\IObit Security 360\is360tray.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Users\Administrator\Downloads\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe,
O1 - Hosts: ------ ÆÁ±ÎÑ¸À×¿´¿´¹ã¸æ ------
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Users\Administrator\Downloads\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: SRS Premium Sound.lnk = ?%SystemRoot%\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut4_E9C83B3EDF9141A39DA5EC05C79BBB91.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: Ê¹ÓÃÑ¸À×ÏÂÔØ - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: Ê¹ÓÃÑ¸À×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???¡¥??¨¤¡Á5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???¡¥??¨¤¡Á5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Contrl Center of Storm Media (ccosm) - ±±¾©±©·çÍø¼Ê¿Æ¼¼ÓÐÏÞ¹«Ë¾ - C:\Program Files\StormII\stormliv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 7110 bytes


----------



## Tomboby8

Hey, I've just ran a scan with malware bytes (credits go to cwee1) and this poped up:

A error has occurred. Please report this error code to our support team.

MBAM_ERROR_ADD_TO_RESULTS (0,6)

Any clues? The program kept on scanning:

17 Threats (Trojan.Dropper, Trojan.BHO, Malware.Trace, Disabled.Security)

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4321

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

17/07/2010 9:58:40 p.m.
mbam-log-2010-07-17 (21-58-40).txt

Scan type: Quick scan
Objects scanned: 128888
Time elapsed: 8 minute(s), 5 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe (Trojan.Dropper) -> No action taken.

Memory Modules Infected:
C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll (Trojan.BHO) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{988934a4-064b-11d3-bb80-00104b35e7f9} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a1dd29ed-2598-48e9-9793-64a9cd08ac94} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{87ca3845-37fe-414c-81cf-e08a7d0f6779} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{802f530b-a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{802f530b-a8f6-4631-ae49-6bacaac6373e} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{889d2feb-5411-4565-8998-1dd2c5261283} (Trojan.BHO) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Dropper) -> Data: c:\users\administrator\appdata\roaming\recyclerr\recyclerr.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll (Trojan.BHO) -> No action taken.
C:\autorun.inf (Trojan.Dropper) -> No action taken.
C:\ntldr.exe (Trojan.Dropper) -> No action taken.
C:\Windows\System32\drivers\tmpp.exe (Trojan.Dropper) -> No action taken.
C:\Windows\System32\launch.vbs (Malware.Trace) -> No action taken.
C:\Windows\System32\logg.txt (Malware.Trace) -> No action taken.

*Which ones should I remove? malwarebytes seems like a too strong program that'll do damage*


----------



## johnb35

Malwarebytes will not do any damage to your system, please let it remove whatever it finds.  Since you infected pretty bad, perform the following procedure after rerunning malwarebytes and removing whatever it found.

*Download and Run ComboFix*
*If you already have Combofix, please delete this copy and download it again as it's being updated regularly.*

*Download this file* here :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Then double click *combofix.exe* & follow the prompts.
When finished, it shall produce *a log* for you. *Post that log* in your next reply
*Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall*

Combofix should never take more that 20 minutes including the reboot if malware is detected.


In your next reply please post:

The ComboFix log
A fresh HiJackThis log
An update on how your computer is running


----------



## Tomboby8

The launch files in system32 still reappear so i will run a full sytem scan with malware bytes instead of a quick one that i did last time,

also norton has reported that unknown ping signals have been successfully sent from my computer?? Maybe the trojan.

I will reply when i have completed combo fix, scan, hijack log

thankyou for your continued help


----------



## Tomboby8

*Scan Results*

Hey just finished the scan although i had to research the combofix program to find out where the log was stored (C:/Combofix/Combofix.txt/)

The malware bytes full scan turned up with 5 more viruses (trojans) which have all been removed.

The pop up has stopped showing and i can detect no trace of the launch files in system32.

Can you please look through the attached Just to be sure that the virus is removed
-Combofix.txt
-hijackthis.txt

Is it alright to delete the combofix folder which contains the program's files?

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:27:48 p.m., on 18/07/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5756 bytes

Thank you for your continued help


----------



## johnb35

Your combofix log is not a complete log.  I need you to post the whole log.  If its too long to put into one post, break it up into smaller posts.  

Do not attach your logs to a post, they are easier to read if you just copy and paste them in a reply.

May I ask what country you live in as the log contains weird characters.  Just want to make sure they are pertaining to your countries language.


----------



## Tomboby8

*Log*

This is the log, my computer is a beta model which i brought from china so the "weird characters is chinese" i live conterminous: Australia. I have changed the OS language to English using control panel, but driver install, Combofix seem to be in chinese. The annoying fact is that the bios is also chinese. The message "windows is shutting down" when u shut down is also in chinese. Oh well, it has never bothered me untill this point.


I shortened syteminfo parts of the log because of the attachment size limit and unfortunately didn't make a back up (not the scan results only time date system info ect.). I can redo the scan if you would like a full log. Sorry.
(Top part and bottom shortened not the middle with all the paths)

ComboFix 10-07-16.01 - Administrator 7/2010 Sun  15:01:02.2.2 - x86
Microsoft Windows 7 旗舰版   6.1.7600.0.936.86.2052.18.1023.386 [GMT 12:00]


C:\Users\Administrator\AppData\Roaming\recyclerr
C:\Windows\system32\Drivers\ywomt.sys
.
---- 早前运行的结果 -------
.
C:\Program Files\StormII\codec\264be.dll
C:\Program Files\StormII\codec\264dmmx.dll
C:\Program Files\StormII\codec\264dsse.dll
C:\Program Files\StormII\codec\264dsse2.dll
C:\Program Files\StormII\codec\264dsse3.dll
C:\Program Files\StormII\codec\aasc32.dll
C:\Program Files\StormII\codec\ac3filter.ax
C:\Program Files\StormII\codec\acelpdec.ax
C:\Program Files\StormII\codec\asusasv1.dll
C:\Program Files\StormII\codec\asusasv2.dll
C:\Program Files\StormII\codec\ativcr2.dll
C:\Program Files\StormII\codec\avcodec.dll
C:\Program Files\StormII\codec\avformat.dll
C:\Program Files\StormII\codec\avidavicodec.dll
C:\Program Files\StormII\codec\AviSplitter.ax
C:\Program Files\StormII\codec\avutil.dll
C:\Program Files\StormII\codec\bass.dll
C:\Program Files\StormII\codec\bass_aac.dll
C:\Program Files\StormII\codec\bass_alac.dll
C:\Program Files\StormII\codec\bass_ape.dll
C:\Program Files\StormII\codec\bass_flac.dll
C:\Program Files\StormII\codec\bass_mpc.dll
C:\Program Files\StormII\codec\bass_tta.dll
C:\Program Files\StormII\codec\bass_wv.dll
C:\Program Files\StormII\codec\binkw32.dll
C:\Program Files\StormII\codec\bw10.dll
C:\Program Files\StormII\codec\cddareader.ax
C:\Program Files\StormII\codec\cdxareader.ax
C:\Program Files\StormII\codec\ChpSrcFilter.ax
C:\Program Files\StormII\codec\CinemasterAudio.DLL
C:\Program Files\StormII\codec\cl264dec.ax
C:\Program Files\StormII\codec\CLNavX.ax
C:\Program Files\StormII\codec\CLRVIDDC.DLL
C:\Program Files\StormII\codec\clrviddd.dll
C:\Program Files\StormII\codec\CLVc1Dec.ax
C:\Program Files\StormII\codec\CLVSD.ax
C:\Program Files\StormII\codec\clvsdx.ax
C:\Program Files\StormII\codec\coreavc.ax
C:\Program Files\StormII\codec\CUVCcodc.dll
C:\Program Files\StormII\codec\DCBassSource.ax
C:\Program Files\StormII\codec\DECVW_32.DLL
C:\Program Files\StormII\codec\divxdec.ax
C:\Program Files\StormII\codec\DmoDec.dll
C:\Program Files\StormII\codec\DSMSplitter.ax
C:\Program Files\StormII\codec\empgdmx.ax
C:\Program Files\StormII\codec\ff_kernelDeint.dll
C:\Program Files\StormII\codec\ff_liba52.dll
C:\Program Files\StormII\codec\ff_libavcodec.dll
C:\Program Files\StormII\codec\ff_libdts.dll
C:\Program Files\StormII\codec\ff_libfaad2.dll
C:\Program Files\StormII\codec\ff_libmad.dll
C:\Program Files\StormII\codec\ff_libmpeg2.dll
C:\Program Files\StormII\codec\ff_libmplayer.dll
C:\Program Files\StormII\codec\ff_realaac.dll
C:\Program Files\StormII\codec\ff_samplerate.dll
C:\Program Files\StormII\codec\ff_theora.dll
C:\Program Files\StormII\codec\ff_TomsMoComp.dll
C:\Program Files\StormII\codec\ff_tremor.dll
C:\Program Files\StormII\codec\ff_unrar.dll
C:\Program Files\StormII\codec\ff_wmv9.dll
C:\Program Files\StormII\codec\ff_xvidcore.dll
C:\Program Files\StormII\codec\ffdshow.ax
C:\Program Files\StormII\codec\ffdshow.ax.manifest
C:\Program Files\StormII\codec\ffmpeg.dll
C:\Program Files\StormII\codec\ffsource.ax
C:\Program Files\StormII\codec\FLT_ffdshow.dll
C:\Program Files\StormII\codec\FLVSplitter.ax
C:\Program Files\StormII\codec\frapsvid.dll
C:\Program Files\StormII\codec\G722ADEC.dll
C:\Program Files\StormII\codec\GeoCodec.dll
C:\Program Files\StormII\codec\H264VDEC.dll
C:\Program Files\StormII\codec\HikAudioDec.ax
C:\Program Files\StormII\codec\HikFileSource.ax
C:\Program Files\StormII\codec\HikFileSplitter.ax
C:\Program Files\StormII\codec\HIKM4DEC.dll
C:\Program Files\StormII\codec\HikVideoDec.ax
C:\Program Files\StormII\codec\i263_32.drv
C:\Program Files\StormII\codec\icmw_32.dll
C:\Program Files\StormII\codec\iconv.dll
C:\Program Files\StormII\codec\kdh4.dll
C:\Program Files\StormII\codec\kdm4.dll
C:\Program Files\StormII\codec\keys.dat
C:\Program Files\StormII\codec\l3codecx.ax
C:\Program Files\StormII\codec\LCodcCMP.dll
C:\Program Files\StormII\codec\libavcodec.dll
C:\Program Files\StormII\codec\libmpeg2_ff.dll
C:\Program Files\StormII\codec\libmplayer.dll
C:\Program Files\StormII\codec\LMVRGBxf.dll
C:\Program Files\StormII\codec\LMVYUVxf.dll
C:\Program Files\StormII\codec\lsvxdec.dll
C:\Program Files\StormII\codec\mkunicode.dll
C:\Program Files\StormII\codec\mkx.dll
C:\Program Files\StormII\codec\mkzlib.dll
C:\Program Files\StormII\codec\mmamrdmx.ax
C:\Program Files\StormII\codec\MP3DMOD.DLL
C:\Program Files\StormII\codec\mp4.dll
C:\Program Files\StormII\codec\mp43dmod.dll
C:\Program Files\StormII\codec\mp4sdmod.dll
C:\Program Files\StormII\codec\MP4Splitter.ax
C:\Program Files\StormII\codec\MpaDecFilter.ax
C:\Program Files\StormII\codec\MpaSplitter.ax
C:\Program Files\StormII\codec\mpcvideodec.ax
C:\Program Files\StormII\codec\Mpeg2DecFilter.ax
C:\Program Files\StormII\codec\mpeg2dmx.ax
C:\Program Files\StormII\codec\MpegSplitter.ax
C:\Program Files\StormII\codec\mpg2splt.ax
C:\Program Files\StormII\codec\mpg4dmod.dll
C:\Program Files\StormII\codec\msdmo.dll
C:\Program Files\StormII\codec\msms001.vwp
C:\Program Files\StormII\codec\msvcr71.dll
C:\Program Files\StormII\codec\MZP4_DEC.DLL
C:\Program Files\StormII\codec\NDParser.ax
C:\Program Files\StormII\codec\NeMP4Splitter.ax
C:\Program Files\StormII\codec\nvviddec.ax
C:\Program Files\StormII\codec\OggSplitter.ax
C:\Program Files\StormII\codec\Plugins\nppl3260.dll
C:\Program Files\StormII\codec\Plugins\nppl3260.xpt
C:\Program Files\StormII\codec\Plugins\npqtplugin.dll
C:\Program Files\StormII\codec\Plugins\nprpjplug.dll
C:\Program Files\StormII\codec\Plugins\nsIQTScriptablePlugin.xpt
C:\Program Files\StormII\codec\Plugins\nsJSRealPlayerPlugin.xpt
C:\Program Files\StormII\codec\Plugins\QuickTimePlugin.class
C:\Program Files\StormII\codec\PmpSplt.ax
C:\Program Files\StormII\codec\pncrt.dll
C:\Program Files\StormII\codec\pndx5016.dll
C:\Program Files\StormII\codec\pndx5032.dll
C:\Program Files\StormII\codec\pthreadVC2.dll
C:\Program Files\StormII\codec\pvmjpg21.dll
C:\Program Files\StormII\codec\PVWV220.DLL
C:\Program Files\StormII\codec\qasf.dll
C:\Program Files\StormII\codec\QTSystem\CFCharacterSetBitmaps.bitmap
C:\Program Files\StormII\codec\QTSystem\CoreVideo.qtx
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\CoreVideo.qtr
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\en.lproj\CoreVideoLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\CoreVideo.Resources\zh_CN.lproj\CoreVideoLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.qtp
C:\Program Files\StormII\codec\QTSystem\QuickTime.qts
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\en.lproj\QuickTimeLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\QuickTime.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\QuickTime.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTime.Resources\zh_CN.lproj\QuickTimeLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\en.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\QuickTime3GPP.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTime3GPP.Resources\zh_CN.lproj\QuickTime3GPPLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\en.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\QuickTimeAudioSupport.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeAudioSupport.Resources\zh_CN.lproj\QuickTimeAudioSupportLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\en.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\QuickTimeEssentials.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeEssentials.Resources\zh_CN.lproj\QuickTimeEssentialsLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\en.lproj\QuickTimeH264Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\QuickTimeH264.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeH264.Resources\zh_CN.lproj\QuickTimeH264Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\en.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\QuickTimeInternetExtras.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeInternetExtras.Resources\zh_CN.lproj\QuickTimeInternetExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\en.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\QuickTimeMPEG4.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeMPEG4.Resources\zh_CN.lproj\QuickTimeMPEG4Localized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\en.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\QuickTimeStreaming.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreaming.Resources\zh_CN.lproj\QuickTimeStreamingLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\en.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\QuickTimeStreamingExtras.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeStreamingExtras.Resources\zh_CN.lproj\QuickTimeStreamingExtrasLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\en.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\QuickTimeVR.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeVR.Resources\zh_CN.lproj\QuickTimeVRLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.qtx
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\en.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\QuickTimeWebHelper.qtr
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.dll
C:\Program Files\StormII\codec\QTSystem\QuickTimeWebHelper.Resources\zh_CN.lproj\QuickTimeWebHelperLocalized.qtr
C:\Program Files\StormII\codec\QuickTime.qts
C:\Program Files\StormII\codec\QuickTimeVR.qtx
C:\Program Files\StormII\codec\RadGtSplitter.ax
C:\Program Files\StormII\codec\Real\Codecs\14_43260.dll
C:\Program Files\StormII\codec\Real\Codecs\28_83260.dll
C:\Program Files\StormII\codec\Real\Codecs\atrc.dll
C:\Program Files\StormII\codec\Real\Codecs\cook.dll
C:\Program Files\StormII\codec\Real\Codecs\ddnt3260.dll
C:\Program Files\StormII\codec\Real\Codecs\dnet3260.dll
C:\Program Files\StormII\codec\Real\Codecs\drv1.dll
C:\Program Files\StormII\codec\Real\Codecs\drv2.dll
C:\Program Files\StormII\codec\Real\Codecs\drvc.dll
C:\Program Files\StormII\codec\Real\Codecs\hxltcolor.dll
C:\Program Files\StormII\codec\Real\Codecs\raac.dll
C:\Program Files\StormII\codec\Real\Codecs\ralf.dll
C:\Program Files\StormII\codec\Real\Codecs\rv10.dll
C:\Program Files\StormII\codec\Real\Codecs\rv20.dll
C:\Program Files\StormII\codec\Real\Codecs\rv30.dll
C:\Program Files\StormII\codec\Real\Codecs\rv40.dll
C:\Program Files\StormII\codec\Real\Codecs\sipr.dll
C:\Program Files\StormII\codec\Real\Common\objb3201.dll
C:\Program Files\StormII\codec\Real\Common\pnen3260.dll
C:\Program Files\StormII\codec\Real\Common\pngu3267.dll
C:\Program Files\StormII\codec\Real\Common\pnrs3260.dll
C:\Program Files\StormII\codec\Real\Common\rppr3260.dll
C:\Program Files\StormII\codec\Real\Plugins\audplin.dll
C:\Program Files\StormII\codec\Real\Plugins\authmgr.dll
C:\Program Files\StormII\codec\Real\Plugins\clbascauth.dll
C:\Program Files\StormII\codec\Real\Plugins\clntxres.dll
C:\Program Files\StormII\codec\Real\Plugins\ExtResources\coreres.xrs
C:\Program Files\StormII\codec\Real\Plugins\fpsechnd.dll
C:\Program Files\StormII\codec\Real\Plugins\httpfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\hxsdp.dll
C:\Program Files\StormII\codec\Real\Plugins\hxxml.dll
C:\Program Files\StormII\codec\Real\Plugins\imgrender.dll
C:\Program Files\StormII\codec\Real\Plugins\memfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\mp3fformat.dll
C:\Program Files\StormII\codec\Real\Plugins\mp3render.dll
C:\Program Files\StormII\codec\Real\Plugins\mp4arender.dll
C:\Program Files\StormII\codec\Real\Plugins\ntlmauth.dll
C:\Program Files\StormII\codec\Real\Plugins\oggfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\pacplin.dll
C:\Program Files\StormII\codec\Real\Plugins\plusplin.dll
C:\Program Files\StormII\codec\Real\Plugins\pxcb3210.dll
C:\Program Files\StormII\codec\Real\Plugins\ramfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\ramrender.dll
C:\Program Files\StormII\codec\Real\Plugins\rarender.dll
C:\Program Files\StormII\codec\Real\Plugins\rmfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\rmxfpln.dll
C:\Program Files\StormII\codec\Real\Plugins\rmxrend.dll
C:\Program Files\StormII\codec\Real\Plugins\rn5auth.dll
C:\Program Files\StormII\codec\Real\Plugins\rtfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\rtrender.dll
C:\Program Files\StormII\codec\Real\Plugins\rvrender.dll
C:\Program Files\StormII\codec\Real\Plugins\sdpplin.dll
C:\Program Files\StormII\codec\Real\Plugins\security.dll
C:\Program Files\StormII\codec\Real\Plugins\smlfformat.dll
C:\Program Files\StormII\codec\Real\Plugins\smlrender.dll
C:\Program Files\StormII\codec\Real\Plugins\smmrender.dll
C:\Program Files\StormII\codec\Real\Plugins\smplfsys.dll
C:\Program Files\StormII\codec\Real\Plugins\stubdrm.dll
C:\Program Files\StormII\codec\Real\Plugins\tfilesys.dll
C:\Program Files\StormII\codec\Real\Plugins\vidplin.dll
C:\Program Files\StormII\codec\Real\Plugins\vidsite.dll
C:\Program Files\StormII\codec\Real\Plugins\vorbisrend.dll
C:\Program Files\StormII\codec\Real\Plugins\vsrlocal.dll
C:\Program Files\StormII\codec\Real\rpplugins\cn\embed_cn.dll
C:\Program Files\StormII\codec\Real\rpplugins\cn\rpclsvc_cn.dll
C:\Program Files\StormII\codec\Real\rpplugins\embd3260.dll
C:\Program Files\StormII\codec\Real\rpplugins\rpcl3260.dll
C:\Program Files\StormII\codec\Real\rpplugins\rput3260.dll
C:\Program Files\StormII\codec\RLMPCDec.ax
C:\Program Files\StormII\codec\rmoc3260.dll
C:\Program Files\StormII\codec\RMSplt.ax
C:\Program Files\StormII\codec\Sc726dec.ax
C:\Program Files\StormII\codec\SCMPack.dll
C:\Program Files\StormII\codec\scsource.ax
C:\Program Files\StormII\codec\silverlight.exe
C:\Program Files\StormII\codec\smackw32.dll
C:\Program Files\StormII\codec\SonicLicenseManager9.dll
C:\Program Files\StormII\codec\splitter.ax
C:\Program Files\StormII\codec\TomsMoComp_ff.dll
C:\Program Files\StormII\codec\ts.dll
C:\Program Files\StormII\codec\tsccvid.dll
C:\Program Files\StormII\codec\TTL2Dec.dll
C:\Program Files\StormII\codec\v2k2_dec.dll
C:\Program Files\StormII\codec\v2kdspde.dll
C:\Program Files\StormII\codec\vc1dc.dll
C:\Program Files\StormII\codec\vc1dmmx.dll
C:\Program Files\StormII\codec\vc1dsse.dll
C:\Program Files\StormII\codec\vc1dsse2.dll
C:\Program Files\StormII\codec\vc1wp.ax
C:\Program Files\StormII\codec\VDODEC32.dll
C:\Program Files\StormII\codec\vdowave.drv
C:\Program Files\StormII\codec\VgmAudio.ax
C:\Program Files\StormII\codec\vgmbgr.ax
C:\Program Files\StormII\codec\VgmSplt.ax
C:\Program Files\StormII\codec\vgmv2k2.ax
C:\Program Files\StormII\codec\Vid1Dec.dll
C:\Program Files\StormII\codec\vmnc.dll
C:\Program Files\StormII\codec\voxmsdec.ax
C:\Program Files\StormII\codec\vp6vfw.dll
C:\Program Files\StormII\codec\vp7vfw.dll
C:\Program Files\StormII\codec\WMADMOD.dll
C:\Program Files\StormII\codec\wmpasf.dll
C:\Program Files\StormII\codec\wmsdmod.dll
C:\Program Files\StormII\codec\WMVDECOD.dll
C:\Program Files\StormII\codec\wmvdmod.dll
C:\Program Files\StormII\codec\xvid.ax
C:\Program Files\StormII\codec\xvidcore.dll
C:\Program Files\StormII\current.ecs
C:\Program Files\StormII\jscript.dll
C:\Program Files\StormII\keys.dat
C:\Program Files\StormII\media\def\def.flv
C:\Program Files\StormII\media\def\def.ini
C:\Program Files\StormII\media\empty.swf
C:\Program Files\StormII\media\media4in1.swf
C:\Program Files\StormII\media\mediabp.swf
C:\Program Files\StormII\media\others.xml
C:\Program Files\StormII\media\others.xml.ini
C:\Program Files\StormII\media\stcon.ini
C:\Program Files\StormII\media\toff.ini
C:\Program Files\StormII\media\video_material_list.xml
C:\Program Files\StormII\media\video_material_list.xml.ini
C:\Program Files\StormII\media\video_style_list.xml
C:\Program Files\StormII\media\video_style_list.xml.ini
C:\Program Files\StormII\Media2.dll
C:\Program Files\StormII\mee.db
C:\Program Files\StormII\MovieInfo.dll
C:\Program Files\StormII\mps.dll
C:\Program Files\StormII\msscript.ocx
C:\Program Files\StormII\msvcp60.dll
C:\Program Files\StormII\rndrmgr.dll
C:\Program Files\StormII\score.dll
C:\Program Files\StormII\sexpert.dll
C:\Program Files\StormII\Skin\AERO SKIS.zip
C:\Program Files\StormII\Skin\KMP_Black.zip
C:\Program Files\StormII\Skin\VistaAdvance.zip
C:\Program Files\StormII\Skin\WMP11_Black.zip
C:\Program Files\StormII\Skin\暴风1经典.zip
C:\Program Files\StormII\Skin\暴风2经典.zip
C:\Program Files\StormII\Skin\见龙卸甲.zip
C:\Program Files\StormII\spfa.dll
C:\Program Files\StormII\splayers.dll
C:\Program Files\StormII\sprobe.dll
C:\Program Files\StormII\Storm.exe
C:\Program Files\StormII\StormExcept.log
C:\Program Files\StormII\stormliv.exe
C:\Program Files\StormII\stormply.exe
C:\Program Files\StormII\StormRes.dll
C:\Program Files\StormII\subdecoder.dll
C:\Program Files\StormII\uninst.exe
C:\Users\Administrator\AppData\Roaming\recyclerr\recyclerr.exe
C:\Windows\system32\drivers\tmpp.exe
C:\Windows\system32\launch.bat
C:\Windows\system32\launch.vbs
C:\Windows\system32\logg.txt
C:\Windows\system32\net.vbs
C:\Windows\tmp.log
C:\Windows\tmpp.log
D:\Autorun.inf
E:\Autorun.inf
F:\autorun.inf

-------\Service_ccosm
-------\Service_ccosm

Storm Live came preinstalled and is a video player which i can't use (in chinese) i can uninstall.


----------



## johnb35

I need to see the full log please.  There is lots of information in that log that I need to see.  Like I said, if the log is too long to put into 1 post then break it down into more than 1 post or upload the file to file hosting site and give me the link to it.


----------



## Tomboby8

Sorry, I reran combo fix and this was the COMPLETE LOG AS I FIRST SAW IT WITHOUT ANY EDITS, as i said COMPLETE.
(very small?? why?)

ComboFix 10-07-16.01 - Administrator 7/2010 Mon  21:05:15.3.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.936.86.2052.18.1023.400 [GMT 12:00]
执行位置: C:\Users\Administrator\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   被删除的档案   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- 早前运行的结果 -------
.
C:\Windows\system32\Drivers\ywomt.sys

.
(((((((((((((((((((((((((((((((((((((((   驱动/服务   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ccosm
-------\Service_ccosm


Thank you for your continued help


----------



## johnb35

Thats not the full log and I don't know whats going on.

Please download, update and run Superantispyware.

http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html

When its done scanning I need to see the log.  To get to the log, click on preferences on the main page, then click on the statistics/logs tab and open the log, then copy and paste it back here.


----------



## Tomboby8

Here it is:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/20/2010 at 08:43 PM

Application Version : 4.40.1002

Core Rules Database Version : 5233
Trace Rules Database Version: 3045

Scan type       : Quick Scan
Total Scan Time : 00:14:25

Memory items scanned      : 765
Memory threats detected   : 0
Registry items scanned    : 2626
Registry threats detected : 14
File items scanned        : 7560
File threats detected     : 65

Trojan.Agent/Gen-Sino[TAO]
	HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01443AEC-0FD1-40fd-9C87-E93D1494C233}
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}#AppID
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\InprocServer32
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\InprocServer32#ThreadingModel
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\ProgID
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\Programmable
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\TypeLib
	HKCR\CLSID\{01443AEC-0FD1-40FD-9C87-E93D1494C233}\VersionIndependentProgID
	HKCR\XLF24.ThunderAtOnce.1
	HKCR\XLF24.ThunderAtOnce
	HKCR\TypeLib\{A3187009-B303-458C-9F01-0DAF932ECA17}
	C:\PROGRAM FILES\THUNDER NETWORK\THUNDER\COMDLLS\TDATONCE_NOW.DLL
	HKU\S-1-5-21-1273124903-1408800724-415184003-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01443AEC-0FD1-40FD-9C87-E93D1494C233}

Adware.Tracking Cookie
	ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.doubleclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.fastclick.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.apmebf.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.realmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.realmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	ad.yieldmanager.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.revsci.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.googleadservices.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.tacoda.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.xiti.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.advertising.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.at.atwola.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.at.atwola.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.mediaplex.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.network.alluremedia.com.au [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.imrworldwide.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.imrworldwide.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.smartadserver.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.atdmt.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.atdmt.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	ext-us.bestofmedia.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.collective-media.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adtech.de [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.tribalfusion.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.www.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.adbrite.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.burstnet.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.chitika.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
www.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.technologyquestions.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.kontera.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]
	.microsoftsto.112.2o7.net [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\zoj7nuio.default\cookies.sqlite ]


----------



## johnb35

Next I need to see an uninstall list using hijackthis.  Open hijackthis and click on open misc tools section, click on open uninstall manager, click on save list and save the file.  Then copy and paste it back here.

Please delete the copy of combofix you have and download the latest version from here and run it.  When the program is done it will bring up the log on your screen, just copy and paste the whole log into a reply back here.

After running combofix please rerun hijackthis and post its log as well.


----------



## Tomboby8

Before.....

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:48:34 p.m., on 21/07/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Administrator\Downloads\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5653 bytes


----------



## Tomboby8

ComboFix 10-07-16.01 - Administrator 7/2010 Wed  20:51:28.4.2 - x86
Microsoft Windows 7 旗舰版   6.1.7600.0.936.86.2052.18.1023.389 [GMT 12:00]
执行位置: C:\Users\Administrator\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   被删除的档案   )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((   驱动/服务   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ccosm
-------\Service_ccosm


Oh and u have a mistake:

Please delete the copy of combofix you have and download the latest version from _here_ and run it. When the program is done it will bring up the log on your screen, just copy and paste the whole log into a reply back here.

Yellow text: no link

Oh and i think this program may be unusable on my computer what do u think of this john??? CLICK ON THIS LINK COMBO FIX WIN 7 Discuss:
http://remove-malware.com/antimalware/anti-malware-news/using-combofix-on-windows-vista-and-windows-7-i-wouldnt/

But then again this guy has a full log??:

ComboFix 10-01-15.01 - Gary 01/15/2010 22:40:45.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2038.867 [GMT -5:00]
Running from: c:\users\Gary\Desktop\456out.com
http://forum.bullguard.com/forum/10/ComboFix-on-Windows-7-32-bit_81481.html


----------



## Tomboby8

Latest combo fix from: http://www.bleepingcomputer.com/download/anti-virus/combofix

Hijack this.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:08:54 p.m., on 21/07/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5566 bytes


----------



## Tomboby8

*Combo fix Uninstalling*

I this how u uninstall combo fix to run a new version?


----------



## johnb35

Yes, just delete the file you have and redownload the new one as it updates almost daily.

I still need to see the uninstall list using hijackthis, you never posted it.  

You said your machine was a beta?  Not sure if that is what is causing the combofix issue.

Download and run Ccleaner from here.

http://www.filehippo.com/download_ccleaner/

Click up top right where it says download latest version and install the program.  Then set it to the options that are checked in the attached image and then click on run cleaner.


----------



## Tomboby8

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:35:07 p.m., on 22/07/2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Windows\AsScrPro.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Administrator\Downloads\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe
O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe
O4 - HKLM\..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm
O8 - Extra context menu item: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O9 - Extra button: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O9 - Extra 'Tools' menuitem: ???ˉ??à×5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\program\Thunder.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\coIEPlg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360 Premier Edition\Engine\3.8.0.41\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

--
End of file - 5598 bytes


----------



## Tomboby8

Hey U sure this has to continue?
i have used CCleaner for years now and i also have professional registry/systemfiles/startupmanger/and system security hole fixer. Do u want to continue?


----------



## Tomboby8

Thanks for all your help I will try to return in the future to help out with this fourm however my studies are catching up so will not be able to help out as much. Love to be part of this popular growing fourm. 

Thanks again for all your help have a nice year and some.


----------



## johnb35

Are you still having issues?


----------



## Tomboby8

No.
Computer is back to full strength, 5 sec for internet.
And .5 for windows features.
thank you for caring.


----------

