My log file
My comp is infected with generic.dx trojan but I am not able to
clean it
any one can help
Logfile of HijackThis v1.99.1
Scan saved at 14:22, on 2007-05-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft
Shared\Ink\KeyboardSurrogate.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Encentuate\AccessUpdate.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\ccsrvc.exe
C:\Program Files\Altiris\Carbon Copy\shellker.exe
C:\Program Files\Sygate\LogClient.exe
C:\Program Files\Network Associates\Common
Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft
Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\Program Files\Sygate\SPA\smc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Encentuate\SOCIService.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\WuxService.exe
C:\Program Files\Common Files\Microsoft
Shared\Ink\TCServer.exe
C:\PROGRA~1\Altiris\CARBON~1\client.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Soft Button\tabletpc.exe
C:\Program Files\Protector Suite QL\menusw.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Sygate\SPA\smcgui.exe
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe
C:\Program Files\Common
Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE
Basic\Monitor.exe
C:\Program Files\Encentuate\AATray.exe
C:\WINDOWS\wnl.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Network Associates\Common
Framework\UpdaterUI.exe
C:\Program Files\Encentuate\Sync.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\RPlatinum\pltsvc.exe
C:\Program Files\RPlatinum\toumok.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Documents and Settings\ta\Desktop\Hijackit\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://global.acer.com/
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) -
{22BF413B-C6D2-4d91-82A9-A0F997BA588C} -
C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Encentuate AccessAgent component -
{54E49085-CD17-464A-A7A3-5B108D6A5E41} - C:\Program
Files\Encentuate\WebObserver2.dll
O2 - BHO: NetCtrl Class - {68FACDB7-76C2-481F-BED0-5176BFC06F40} -
C:\WINDOWS\system32\jng.dll
O2 - BHO: Platinum Class - {6F100783-3B02-4A0F-8995-CF4450A1AE99} -
C:\Program Files\RPlatinum\platinum.dll
O2 - BHO: asetapp Class - {73289162-036F-467D-921C-8DDC081693A5} -
C:\WINDOWS\system32\appset.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
- C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: SRead.Set - {766617CE-5CA7-42ED-ACE2-DE56B387547B} -
C:\WINDOWS\system32\SysRead.dll
O2 - BHO: upg Class - {AD4A14F9-1BA1-49EC-B721-E1D79AD768F6} -
C:\WINDOWS\system32\upl.dll
O2 - BHO: (no name) - {C449AB75-308B-4428-A710-C68B8E87E0D5} -
C:\WINDOWS\system32\pket.dll
O2 - BHO: (no name) - {D2A0394A-64E0-461B-A038-A52B41C03F75} -
C:\WINDOWS\system32\beans.dll
O2 - BHO: (no name) - {FECCE700-8269-47FC-A0FA-98D658FEA055} -
C:\WINDOWS\system32\gmgr.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common
Files\microsoft shared\ink\tabtip.exe" /resume
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut]
HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program
Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program
Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE"
/Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002]
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Snippet] "C:\Program Files\Microsoft Experience
Pack\Snipping Tool\SnippingTool.exe" /i
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe
bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering
Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [AcerSoftButton] C:\Acer\Soft
Button\tabletpc.exe
O4 - HKLM\..\Run: [Biomenu] "C:\Program Files\Protector Suite
QL\menusw.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering
Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch
Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network
Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service]
"C:\Program Files\Common Files\Network
Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common
Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead
Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe
O4 - HKLM\..\Run: [AeXAgentLogon] "C:\Program Files\Altiris\Altiris
Agent\AeXAgentActivate.exe" /logon
O4 - HKLM\..\Run: [NClean] C:\Program
Files\NClean\NCleanMain.exe
O4 - HKLM\..\Run: [AAAgent] "C:\Program
Files\Encentuate\AATray.exe"
O4 - HKLM\..\Run: [WNL Pro] C:\WINDOWS\wnl.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication]
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [OpenApizs] C:\WINDOWS\zrscbm.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Platinum] C:\Program
Files\RPlatinum\pltup.exe
O4 - HKLM\..\Run: [wpu] C:\WINDOWS\system32\upstu.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vacpro] C:\Program
Files\vacpro\vaccineprogram.exe 1
O4 - HKLM\..\Run: [vaccinefree Plus] C:\Program
Files\vaccinefreeplus\vaccinefreeplus_starter.exe
O4 - HKLM\..\Run: [ns70] C:\WINDOWS\system32\ns70.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network
Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [o9]
C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\n9\o9.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [lsasvc] C:\WINDOWS\system32\lsasvc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program
Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program
Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PASPortal.lnk = ?
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} -
C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: 敲贰萍逞 - {971FB3AF-DE69-489d-BDF2-2F7476AC78A6} -
C:\Program Files\RPlatinum\platinum.dll
O9 - Extra 'Tools' menuitem: 敲贰萍逞 -
{971FB3AF-DE69-489d-BDF2-2F7476AC78A6} - C:\Program
Files\RPlatinum\platinum.dll
O9 - Extra button: @btrez.dll,-4015 -
{CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program
Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 -
{CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program
Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet
Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {243C3672-9526-40AA-BE22-988F92CFA591} -
http://nclean.co.kr/install/nclean.cab
O16 - DPF: {517A520F-84B1-4EC5-A0CF-6A034BA17038} (DWUpdate
Control) -
http://dn.dreamwiz.com/hompy/DWUpdate/DWUpdate_2005_05_06.cab
O16 - DPF: {68253470-5D4F-4CDF-8D9C-353C14A2F013} (SVPorsche
Control) -
http://img.yahoo.co.kr/multi/2005/tool/player/20051026/SVPorsche.cab
O16 - DPF: {84F7A3A9-B92A-41F4-890F-83F2DC0ADB7E} (ToolBarInstall
Control) - http://toolbar.imbc.com/toolbar/MBCToolBar.cab
O16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} (Cdmcco Class) -
http://cafeimg.hanmail.net/activex/dmcc2.cab?Version=1,0,0,10
O16 - DPF: {AF60D574-F249-4243-8040-5521AAA5BB5E} (PandoraTVSet
Class) -
http://imgcdn.pandora.tv/pan_img/p3player/package/pdrtvset.cab
O16 - DPF: {B104A4D5-3D64-4D7A-A4F9-3E6B4A2D4E00} (SBSToolBar
Control) - http://toolbar.sbs.co.kr/toolbar/SBSToolBar.cab
O16 - DPF: {B9B38E70-EEF6-4E3A-AE84-DDE59A053B7C} (Daum ActiveX
manager Class) -
http://cafeimg.hanmail.net/cto/xman.cab?ver=1,2,3,1
O16 - DPF: {BCA935CA-7E41-4F73-BA9C-FAB4393DBAC0} (MADanalCtrl
Control) - http://www.csafer.net/ActiveX/MAStreamCtrl.cab
O16 - DPF: {CEE326E8-7571-4086-B347-3C0ACA9A9DE8} (PcubeSet Class)
- http://casx.musiccity.co.kr/empas/dll/p3empasset.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}
- C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui -
C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: loginkey - C:\Program Files\Common
Files\Microsoft Shared\Ink\loginkey.dll
O20 - Winlogon Notify: psfus -
C:\WINDOWS\SYSTEM32\fusstub.dll
O20 - Winlogon Notify: TabBtnWL -
C:\WINDOWS\SYSTEM32\TabBtnWL.dll
O20 - Winlogon Notify: tpgwlnotify -
C:\WINDOWS\SYSTEM32\tpgwlnot.dll
O23 - Service: AccessUpdate - Encentuate Pte Ltd - C:\Program
Files\Encentuate\AccessUpdate.exe
O23 - Service: Altiris Agent - Altiris, Inc. - C:\Program
Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: Extended Upgrade Check Starter (AuService) - Unknown
owner - C:\WINDOWS\system32\AuService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation.
- c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Altiris Carbon Copy (CarbonCopy32) - Altiris -
C:\WINDOWS\system32\ccsrvc.exe
O23 - Service: Debug Log (dbglg) - Unknown owner -
C:\WINDOWS\system32\dbglg.exe
O23 - Service: Error Event Log (ereventlog) - Unknown owner -
C:\WINDOWS\system32\drivers\erelog.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel
Networks NA, Inc. - C:\Program Files\Nortel
Networks\Extranet_serv.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG -
C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: lmab_device - Lexmark International, Inc. -
C:\WINDOWS\system32\LMabcoms.exe
O23 - Service: Sygate Anti-Spyware Log Report Client (LogClient) -
Unknown owner - C:\Program Files\Sygate\LogClient.exe
O23 - Service: Macromedia Licensing Service - Macromedia -
C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia
Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown
owner - C:\Program Files\Network Associates\Common
Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network
Associates, Inc. - C:\Program Files\Network
Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) -
Network Associates, Inc. - C:\Program Files\Network
Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA
Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Protection Agent 5.0 (SmcService) - Sygate
Technologies, Inc. - C:\Program Files\Sygate\SPA\smc.exe
O23 - Service: SOCIService - Encentuate Pte Ltd - C:\Program
Files\Encentuate\SOCIService.exe
O23 - Service: Typer Interface Service (typemgr2) - Unknown owner -
C:\WINDOWS\system32\hddmgri.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead
Systems, Inc. - C:\Program Files\Common Files\Ulead
Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows File Update Auto Check Program (WuxService)
- Unknown owner - C:\WINDOWS\system32\WuxService.exe
