hjt check up..

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box into the main textfield:
  
  Code:

  ---

  :filefind
wscntfy.exe

  ---

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

here's the result what shall i do next...?


SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 21:35 on 10/02/2010 by Owner (Administrator - Elevation successful)

========== filefind ==========

Searching for "wscntfy.exe"
No files found.

-=End Of File=-

Attached is zipped wscntfy.exe file.
Unzip it and paste wscntfy.exe file into c:\windows\System32 folder.

Re-run Combofix and post its fresh log.

i just did the instructions you said broni...but there's a message box telling (open win.doc)

and i inserted the xp sp3 installer but there appears again a message box telling (open win2.doc)


what should i do..?i think there's no way to execute that file...

The first message is simply generic warning.
Cancel the message and forget about it.

Please, re run Combofix.

ComboFix 10-02-09.03 - Owner 02/12/2010 9:56.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1916.1394 [GMT 8:00]
Running from: e:\sheryl\set up\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-01-12 to 2010-02-12 )))))))))))))))))))))))))))))))
.

2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\xircom
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\wbem\snmp
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\oobe
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\program files\microsoft frontpage
2010-02-09 16:14 . 2010-02-09 16:27 2967799 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-09 15:59 . 2001-12-25 02:23 12074 ----a-r- c:\windows\system32\hsfinst.dll
2010-02-09 15:59 . 2010-02-09 15:59 -------- d-----w- c:\program files\CONEXANT
2010-02-09 15:59 . 2001-10-22 06:37 57344 ----a-r- c:\windows\system32\mdmxsdk.dll
2010-02-09 15:59 . 2002-03-08 16:01 6454 ----a-r- c:\windows\system32\drivers\firmware.bin
2010-02-09 15:59 . 2001-10-22 06:46 9855 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys
2010-02-09 15:59 . 2002-03-14 07:08 1171616 ----a-r- c:\windows\system32\drivers\HSF_DP.sys
2010-02-09 15:59 . 2002-03-14 10:47 162164 ----a-r- c:\windows\system32\drivers\HSFHWCD2.sys
2010-02-09 15:59 . 2002-03-14 07:02 594960 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2010-02-09 15:36 . 2010-02-09 15:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-02-09 15:35 . 2009-04-06 07:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 15:35 . 2009-04-06 07:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 15:35 . 2010-02-09 16:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 15:35 . 2010-02-09 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 14:20 . 2010-02-05 13:18 25 ----a-w- c:\windows\popcinfot.dat
2010-01-25 13:56 . 2010-01-25 13:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Media Player Classic
2010-01-25 13:55 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-01-25 13:55 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-01-25 13:55 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-01-25 13:55 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-01-25 13:55 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-25 13:55 . 2010-01-25 13:56 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-19 05:51 . 2010-01-19 05:51 -------- d-----w- c:\windows\system32\NtmsData
2010-01-18 10:29 . 2010-01-18 10:29 -------- d-----w- c:\program files\Defraggler
2010-01-17 15:43 . 2010-01-17 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2010-01-17 08:18 . 2010-02-12 01:52 1660 ----a-w- c:\windows\bthservsdp.dat
2010-01-17 05:49 . 2010-02-08 12:29 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- C:\logs
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- c:\documents and settings\Owner\ChikkaDefault
2010-01-16 17:50 . 2010-01-16 17:50 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Ahead
2010-01-16 17:48 . 2010-01-16 06:50 -------- d-----w- c:\program files\Ahead
2010-01-16 17:42 . 2004-03-22 21:17 25840 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-01-16 17:42 . 2004-03-22 21:17 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\windows\SHELLNEW
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft.NET
2010-01-16 07:27 . 2010-01-16 07:27 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2010-01-16 07:04 . 2009-02-18 02:34 112640 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2010-01-16 07:04 . 2008-12-30 17:55 102656 ----a-w- c:\windows\system32\drivers\ewusbfake.sys
2010-01-16 07:04 . 2008-12-13 17:26 102400 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-01-16 07:04 . 2008-04-14 15:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2010-01-16 07:04 . 2007-08-09 10:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-01-16 07:04 . 2010-01-16 06:55 -------- d-----w- c:\program files\Smart Bro
2010-01-16 07:01 . 2010-01-16 06:59 64456 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-16 07:01 . 2010-01-16 07:01 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Toshiba
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-01-16 06:54 . 2010-01-16 06:57 -------- d-----w- c:\program files\Total Video Converter
2010-01-16 06:53 . 2009-04-29 15:09 24064 ----a-w- c:\windows\system32\drivers\PGEffect.sys
2010-01-16 06:52 . 2010-01-16 06:52 -------- d-----w- c:\program files\VideoLAN
2010-01-16 06:52 . 2008-06-10 07:00 69632 ----a-w- c:\windows\system32\TosOlkN.dll
2010-01-16 06:52 . 2008-06-10 07:00 40960 ----a-w- c:\windows\system32\ToscmddN.dll
2010-01-16 06:52 . 2008-06-10 07:00 24576 ----a-w- c:\windows\system32\TosusrpN.dll
2010-01-16 06:52 . 2008-06-10 07:00 102400 ----a-w- c:\windows\system32\Tossps.scr
2010-01-16 06:50 . 2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe
2010-01-16 06:50 . 2009-05-19 14:54 45056 ----a-w- c:\windows\system32\TPSMainCtl.dll
2010-01-16 06:50 . 2008-07-01 21:03 38200 ----a-w- c:\windows\system32\TPSBattM.exe
2010-01-16 06:50 . 2007-10-08 19:02 69632 ----a-w- c:\windows\system32\TPwrReg.dll
2010-01-16 06:50 . 2007-10-08 19:02 53248 ----a-w- c:\windows\system32\TPwrCfg.dll
2010-01-16 06:50 . 2007-10-08 19:02 45056 ----a-w- c:\windows\system32\TPSAddin.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSTrace.dll
2010-01-16 06:50 . 2007-10-08 19:02 77824 ----a-w- c:\windows\system32\CpuPerf.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSDel.dll
2010-01-16 06:50 . 2010-01-16 07:01 -------- d-----w- c:\documents and settings\Owner\Application Data\toshiba
2010-01-16 06:48 . 2009-05-27 18:18 279376 ----a-w- c:\windows\system32\drivers\tos_sps32.sys
2010-01-16 06:48 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\TOSHIBA
2010-01-16 06:48 . 2010-01-16 06:48 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2010-01-16 06:48 . 2007-11-21 23:23 129632 ----a-w- c:\windows\system32\TODDSrv.exe
2010-01-16 06:47 . 2003-01-29 21:35 12032 ----a-w- c:\windows\system32\drivers\Netdevio.sys
2010-01-16 06:46 . 2009-06-09 19:14 118784 ----a-w- c:\windows\system32\TCtrlIO.dll
2010-01-16 06:46 . 2009-02-13 16:51 53248 ----a-w- c:\windows\system32\DLLVGA.dll
2010-01-16 06:46 . 2009-01-10 00:04 28672 ----a-w- c:\windows\system32\TPeculiarity.dll
2010-01-16 06:46 . 2009-01-08 22:16 9728 ----a-w- c:\windows\system32\TCMSVR.dll
2010-01-16 06:46 . 2008-11-26 23:52 4608 ----a-w- c:\windows\system32\TSBWLS.dll
2010-01-16 06:46 . 2007-12-11 14:54 24576 ----a-w- c:\windows\system32\LEDONOFF.exe
2010-01-16 06:46 . 2007-04-04 14:56 5888 ----a-w- c:\windows\system32\drivers\FwLnk.sys
2010-01-16 06:46 . 2008-03-21 19:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-01-16 06:46 . 2010-01-16 06:46 -------- d-----w- c:\program files\Synaptics
2010-01-16 06:45 . 2009-03-18 17:20 208304 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-01-16 06:45 . 2009-03-18 17:19 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-01-16 06:45 . 2009-03-18 17:19 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-01-16 06:45 . 2009-03-18 17:19 206120 ----a-w- c:\windows\system32\SynCtrl.dll
2010-01-16 06:45 . 2009-03-18 17:19 169256 ----a-w- c:\windows\system32\SynCOM.dll
2010-01-16 06:45 . 2010-01-16 06:45 -------- d-----w- c:\program files\Realtek WLAN Driver
2010-01-16 06:44 . 2010-01-16 06:51 -------- d-----w- c:\windows\system32\sda
2010-01-16 06:43 . 2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE
2010-01-16 06:43 . 2009-03-10 21:32 2168320 ----a-w- c:\windows\MicCal.exe
2010-01-16 06:43 . 2008-08-06 03:10 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-01-16 06:43 . 2008-06-19 23:42 2808832 ----a-w- c:\windows\ALCWZRD.EXE
2010-01-16 06:43 . 2006-01-04 22:41 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2010-01-16 06:43 . 2008-08-25 23:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Default User\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\program files\Common Files\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-01-16 06:38 . 2010-01-16 06:41 -------- d-----w- c:\program files\Intel
2010-01-16 06:38 . 2008-07-16 23:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- C:\Intel
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\program files\V.92 Modem On Hold
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Avanquest software
2010-01-16 06:36 . 2008-04-14 04:47 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-01-16 06:36 . 2008-04-14 04:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-16 06:36 . 2008-04-14 04:15 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-01-16 06:36 . 2008-04-14 04:15 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys
2010-01-16 06:36 . 2008-04-14 04:15 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-16 06:36 . 2008-04-14 02:09 142592 ------w- c:\windows\system32\drivers\aec.sys
2010-01-16 06:36 . 2008-04-14 04:45 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2010-01-16 06:36 . 2008-04-14 04:15 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2010-01-16 06:36 . 2008-03-21 17:35 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2010-01-16 06:36 . 2008-04-14 04:15 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
2010-01-16 06:36 . 2010-01-16 06:36 -------- d-----w- c:\documents and settings\Default User\Application Data\TOSHIBA
2010-01-16 06:35 . 2008-04-14 04:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys
2010-01-16 06:35 . 2008-04-14 09:42 151552 ----a-w- c:\windows\system32\irftp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-12 02:00 . 2010-01-16 05:50 3103776 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-12 01:52 . 2010-01-16 05:50 44060 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-09 16:49 . 2010-02-09 16:53 1657344 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-01-25 13:48 . 2010-01-25 13:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp Detect
2010-01-20 15:27 . 2010-01-16 05:09 -------- d-----w- c:\program files\QuickTime Alternative
2010-01-18 06:17 . 2010-01-16 06:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-16 16:22 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-16 06:44 . 2010-01-16 06:43 -------- d-----w- c:\program files\Realtek
2010-01-16 06:34 . 2010-01-16 05:48 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\program files\Atheros
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Atheros
2010-01-16 06:29 . 2010-01-16 06:33 51712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-01-16 06:28 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2010-01-16 06:09 . 2010-01-16 05:18 -------- d-----w- c:\program files\driver
2010-01-16 05:52 . 2010-01-16 05:52 -------- d-----w- c:\documents and settings\Owner\Application Data\MailFrontier
2010-01-16 05:47 . 2010-01-16 05:47 -------- d-----w- c:\program files\Zone Labs
2010-01-16 05:46 . 2010-01-16 05:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Unlocker
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\MediaLooks
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\7-Zip
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Foxit
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Foxit Software
2010-01-16 05:09 . 2010-01-16 05:09 318 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2010-01-16 05:09 . 2010-01-16 05:09 25214 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\UPHClean
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-16 05:08 . 2010-01-16 05:08 410984 ----a-w- c:\windows\system32\deploytk.dll
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Java
2010-01-16 05:06 . 2010-01-16 05:06 94248 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-16 05:06 . 2010-01-16 05:06 -------- d-----w- c:\program files\Reference Assemblies
2010-01-16 05:01 . 2010-01-16 05:01 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-16 05:00 . 2010-01-16 05:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\MSXML 4.0
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 04:51 . 2010-01-16 04:51 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-16 04:51 . 2010-01-16 04:51 -------- d-----w- c:\program files\TrendMicro
2010-01-16 04:45 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:38 -------- d-----w- c:\program files\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-16 04:18 . 2010-01-16 04:18 -------- d-----w- c:\program files\CCleaner
.

------- Sigcheck -------

[-] 2009-07-19 . BA8C046D98345129723E6BCAA1E8AB99 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys


c:\windows\System32\wscntfy.exe ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2010-02-10_04.03.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-12 01:54 . 2010-02-12 01:54 16384 c:\windows\Temp\Perflib_Perfdata_2b0.dat
+ 2010-02-12 01:53 . 2010-02-12 01:53 16384 c:\windows\Temp\Perflib_Perfdata_104.dat
+ 2008-04-14 12:00 . 2010-02-12 01:58 71462 c:\windows\system32\perfc009.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 71462 c:\windows\system32\perfc009.dat
+ 2010-01-16 05:50 . 2010-02-12 01:55 315424 c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 441692 c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2010-02-12 01:58 441692 c:\windows\system32\perfh009.dat
+ 2010-01-17 05:50 . 2010-02-11 15:15 5164544 c:\windows\system32\ZoneLabs\zlqrtdb.dat
+ 2010-01-16 05:48 . 2010-02-10 13:41 15336238 c:\windows\system32\ZoneLabs\spyware.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

***1/2 page***

***2/2 page***
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-16 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-07-19 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-16 3450608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk
backup=c:\windows\pss\Bluetooth Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-03-06 09:26 479320 ----a-w- c:\program files\Atheros\ACU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 12:00 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch]
2002-03-19 23:30 45632 ----a-w- c:\windows\system32\TaskSwitch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
2007-04-14 00:16 311296 ----a-w- c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-21 19:18 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-05-21 19:18 143360 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 ----a-w- c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2009-02-27 12:40 1202448 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2009-02-27 13:22 1368064 ----a-w- c:\program files\Intel\WiFi\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 07:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-05-21 19:17 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-04-10 00:07 159744 ----a-w- c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-06-10 03:24 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-16 05:08 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-18 17:19 1451304 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDispVol]
2009-04-24 23:27 208896 ----a-w- c:\windows\system32\TDispVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2009-06-10 17:05 368640 ----a-w- c:\program files\TOSHIBA\TOSHIBA Applet\THotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2004-12-30 06:32 65536 ----a-w- c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2009-05-26 12:11 2549624 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-01-16 06:19 289584 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-01-13 22:44 37888 ----a-w- c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 iastor86;iastor86;c:\windows\system32\drivers\iastor86.sys [7/20/2009 12:48 AM 327192]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/16/2010 2:14 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/16/2010 2:14 PM 20560]
R2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\RSelect\RSelSvc.exe [2/20/2009 5:52 AM 57344]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/27/2007 2:22 AM 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/20/2007 2:15 AM 134016]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [1/16/2010 2:46 PM 5888]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [1/16/2010 2:53 PM 24064]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [1/16/2010 6:53 AM 340096]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/16/2010 2:43 PM 1684736]
S3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [2/9/2010 11:59 PM 162164]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [1/16/2010 3:04 PM 102656]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys --> c:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder

2010-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-12 c:\windows\Tasks\User_Feed_Synchronization-{F1FADE19-5CFC-45FA-A4E9-31EF44FE5198}.job
- c:\windows\system32\msfeedssync.exe [2009-07-19 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 09:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3728)
c:\windows\system32\WININET.dll
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-02-12 10:01:09
ComboFix-quarantined-files.txt 2010-02-12 02:01
ComboFix2.txt 2010-02-10 07:28
ComboFix3.txt 2010-02-10 04:04

Pre-Run: 91,991,277,568 bytes free
Post-Run: 91,953,696,768 bytes free

- - End Of File - - 71311D722F5E09D98C5A1C7D4D943D16

Something wrong here.
Did you actually...

Quote:

---

Unzip it and paste wscntfy.exe file into c:\windows\System32 folder.

---

See, if the file is there.

yes..but i deleted it...because if don't do that, the message box wont stop to reappear again..and i think there's no way to execute that file...but my laptop quite doing good...i did what you said lately..i did the system restore stuff and i defrag my laptop lately...is that wscntfy.exe important..?


and by the way whenever i reboot my laptop there's to option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp start to load...how can i get rid of that option..?

yes..but i deleted it...because if don't do that, the message box wont stop to reappear again..and i think there's no way to execute that file...but my laptop quite doing good...i did what you said lately..i did the system restore stuff and i defrag my laptop lately...is that wscntfy.exe important..?


and by the way whenever i reboot my laptop there's two option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp starts to load...how can i get rid of that option..?

*sorry for the repost..i didn't mean it...

Quote:

---

but my laptop quite doing good

---

We'll leave it alone then.

Quote:

---

and by the way whenever i reboot my laptop there's to option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp starts to load...how can i get rid of that option..?

---

You could, but recovery console was installed for a reason.
It's a very useful tool, if the computer gets into serious trouble, like being not bootable.
It's for your own good.

I want you to run one more scan, but first...

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

Then...

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
• Archives
• Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Post fresh HijackThis log as well.