Many many problems - Can't run ComboFix.exe, SDFix.exe, Cmd.exe or Regedit

Thanks for reply...

You were exactly right. And the link (http://vil.nai.com/vil/content/v_142400.htm) gives complete information for NoooH virus. I scanned the pc with Kaspersky Antivirus and posting the log taken in gape of 30 minutes.

(Note:  I have deleted the Sys.exe and ncscv32.exe files when Kaspersky gave me option to delete them. And now after performing the Full Scan, My Computer is not showing any threat. Kaspersky shows that pc is free of threats.)

Here is the log:

Ist Log:

Untreated:      0
Start time:      9/14/2007 8:40:37 AM
Duration:      00:05:13


Detected
--------
Status      Object
------      ------
disinfected: virus Virus.Boot.Malmo      Physical disk sector: \Device\Harddisk0\DR0
detected: riskware Worm.generic      Running process: C:\WINDOWS\system32\drivers\ncscv32.exe
not found: virus Virus.Win32.AutoRun.ad      Running module: Sys.exe\Sys.exe
deleted: virus Virus.Win32.AutoRun.ad      File: C:\Windows\Web\Sys.exe
deleted: virus Worm.Win32.Fujack.aa      File: C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE
deleted: virus Worm.Win32.Fujack.aa      File: c:\program files\microsoft office\office11\mstore.exe
deleted: virus Worm.Win32.Fujack.aa      File: c:\program files\spybot - search & destroy\blindman.exe
deleted: virus Worm.Win32.Fujack.aa      File: C:\PROGRA~1\MICROS~2\OFFICE11\OIS.EXE
deleted: virus Virus.Win32.AutoRun.ad      File: C:\System Volume Information\_restore{8D290BB5-E59C-462B-A0EE-E8949A1E4344}\RP82\A0047389.exe
deleted: virus Virus.Win32.AutoRun.ad      File: C:\Sys.exe
deleted: virus Virus.Win32.AutoRun.ad      Running module: Sys.exe\Sys.exe
deleted: virus Worm.Win32.Fujack.aa      File: C:\Games.exe
deleted: virus Worm.Win32.Fujack.bd      File: C:\claudien\Curriculum Implementation.htm
deleted: virus Worm.Win32.Fujack.aa      File: C:\Cleaning-Fixing Tools\ComboFix from BeepingComputers\ComboFix.exe
deleted: virus Worm.Win32.Fujack.aa      File: C:\Cleaning-Fixing Tools\ComboFix from TechSupportForum\ComboFix.exe
disinfected: virus Worm.Win32.Fujack.aa      File: C:\Cleaning-Fixing Tools\SDFix\SDFix.exe
disinfected: virus Worm.Win32.Fujack.aa      File: C:\ComboFix\ntp.exe
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Arabic\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Brazil\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Danish\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Dutch\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\English\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Finnish\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\French\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\German\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Hebrew\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Italian\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Japanese\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Korean\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Norwegan\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Russian\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\SimpChin\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Spanish\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Swedish\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\Thai\SMaxFAQ.htm
disinfected: virus Worm.Win32.Fujack.bd      File: C:\Compaq\Audio\ADI\SM_Panel\Sys\TradChin\SMaxFAQ.htm


Events
------
Time      Event
----      -----
9/13/2007 4:16:54 PM      A full computer scan has never been performed. You are advised to perform a full scan as soon as possible.
9/13/2007 4:17:02 PM      Process  (PID 564) tried to access Kaspersky Anti-Virus process (PID 1644), but the action has been blocked by the Self-Defense component. No action on your part is necessary.
9/13/2007 4:17:17 PM      Real-time protection started.
9/13/2007 4:17:32 PM      Update error: proxy connection error, invalid or inaccessible address.
9/13/2007 4:17:32 PM      The threat signatures are obsolete. Your computer is at risk. You are advised to update the signatures immediately.
9/13/2007 4:19:58 PM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/13/2007 4:19:58 PM      Security threats have been detected. You are advised to neutralize them immediately.
9/13/2007 4:19:58 PM      Physical disk sector \Device\Harddisk0\DR0: is still infected, postponed.
9/13/2007 4:19:58 PM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/13/2007 4:20:42 PM      Physical disk sector \Device\Harddisk0\DR0: is still infected, skipped by user.
9/13/2007 4:27:54 PM      Running process C:\WINDOWS\system32\drivers\ncscv32.exe: detected modification of riskware 'Worm.generic'.
9/13/2007 4:42:53 PM      Process C:\WINDOWS\system32\drivers\ncscv32.exe (PID 1220) successfully terminated.
9/13/2007 4:46:44 PM      The threat signatures are obsolete. Your computer is at risk. You are advised to update the signatures immediately.
9/13/2007 5:07:57 PM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/13/2007 5:08:03 PM      Update error: internal error.
9/13/2007 5:11:57 PM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: is still infected, skipped by user.
9/13/2007 5:12:09 PM      Real-time protection is not running. You are advised to resume protection.
9/14/2007 7:37:37 AM      A full computer scan has never been performed. You are advised to perform a full scan as soon as possible.
9/14/2007 7:37:42 AM      Real-time protection started.
9/14/2007 7:38:02 AM      Security threats have been detected. You are advised to neutralize them immediately.
9/14/2007 7:38:18 AM      Process  (PID 740) tried to access Kaspersky Anti-Virus process (PID 1632), but the action has been blocked by the Self-Defense component. No action on your part is necessary.
9/14/2007 7:38:46 AM      Process  (PID 1824) tried to access Kaspersky Anti-Virus process (PID 1632), but the action has been blocked by the Self-Defense component. No action on your part is necessary.
9/14/2007 7:40:03 AM      Running module Sys.exe\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 7:40:03 AM      Running module Sys.exe\Sys.exe: is still infected, postponed.
9/14/2007 7:40:03 AM      File C:\Windows\Web\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 7:40:03 AM      File C:\Windows\Web\Sys.exe: is still infected, postponed.
9/14/2007 7:40:11 AM      File c:\program files\microsoft office\office11\frontpg.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 7:40:11 AM      File c:\program files\microsoft office\office11\frontpg.exe: is still infected, postponed.
9/14/2007 7:40:12 AM      File c:\program files\microsoft office\office11\mstore.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 7:40:12 AM      File c:\program files\microsoft office\office11\mstore.exe: is still infected, postponed.
9/14/2007 7:40:12 AM      File c:\program files\spybot - search & destroy\blindman.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 7:40:12 AM      File c:\program files\spybot - search & destroy\blindman.exe: is still infected, postponed.
9/14/2007 7:40:14 AM      File c:\windows\web\sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 7:40:14 AM      File c:\windows\web\sys.exe: is still infected, postponed.
9/14/2007 7:40:27 AM      File c:\program files\microsoft office\office11\ois.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 7:40:27 AM      File c:\program files\microsoft office\office11\ois.exe: is still infected, postponed.
9/14/2007 7:41:13 AM      File C:\WINDOWS\Web\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 7:41:13 AM      File C:\WINDOWS\Web\Sys.exe: is still infected, postponed.
9/14/2007 7:41:55 AM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/14/2007 7:41:55 AM      Physical disk sector \Device\Harddisk0\DR0: is still infected, postponed.
9/14/2007 7:41:55 AM      Running module Sys.exe\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 7:47:11 AM      The application  cannot establish connection with server 192.168.5.223. Please check your internet connection settings. If you have a firewall installed, check that the application avp.exe is allowed internet access.
9/14/2007 7:51:34 AM      File C:\System Volume Information\_restore{8D290BB5-E59C-462B-A0EE-E8949A1E4344}\RP82\A0047389.exe: detected virus 'Virus.Win32.AutoRun.ad'. User: EDUCATION\CLAUDINE$, computer: localhost.
9/14/2007 7:56:18 AM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 7:56:19 AM      Please restart your computer to complete the installation of new or updated protection components.
9/14/2007 7:56:19 AM      Please restart your computer to complete the installation of new or updated protection components.
9/14/2007 7:56:27 AM      Update completed successfully.
9/14/2007 8:01:41 AM      File C:\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'. User: CLAUDINE\Administrator, computer: localhost.
9/14/2007 8:34:12 AM      Running module Sys.exe\Sys.exe: is still infected, skipped by user.
9/14/2007 8:34:12 AM      File c:\windows\web\sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:34:12 AM      File C:\System Volume Information\_restore{8D290BB5-E59C-462B-A0EE-E8949A1E4344}\RP82\A0047389.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File c:\windows\web\sys.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File C:\Sys.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File C:\WINDOWS\Web\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'. User: CLAUDINE\Administrator, computer: localhost.
9/14/2007 8:34:18 AM      File C:\WINDOWS\Web\Sys.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE: detected virus 'Worm.Win32.Fujack.aa'. User: CLAUDINE\Administrator, computer: localhost.
9/14/2007 8:34:18 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File c:\program files\microsoft office\office11\frontpg.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:34:18 AM      File c:\program files\microsoft office\office11\frontpg.exe: is still infected, skipped by user.
9/14/2007 8:34:18 AM      File c:\program files\microsoft office\office11\mstore.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:34:18 AM      File c:\program files\microsoft office\office11\mstore.exe: is still infected, skipped by user.
9/14/2007 8:34:19 AM      File c:\program files\spybot - search & destroy\blindman.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:34:19 AM      File c:\program files\spybot - search & destroy\blindman.exe: is still infected, skipped by user.
9/14/2007 8:34:19 AM      File c:\program files\microsoft office\office11\ois.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:34:19 AM      File c:\program files\microsoft office\office11\ois.exe: is still infected, skipped by user.
9/14/2007 8:34:19 AM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/14/2007 8:34:19 AM      Physical disk sector \Device\Harddisk0\DR0: is still infected, skipped by user.
9/14/2007 8:34:28 AM      Real-time protection is not running. You are advised to resume protection.
9/14/2007 8:35:20 AM      A full computer scan has never been performed. You are advised to perform a full scan as soon as possible.
9/14/2007 8:35:34 AM      Process  (PID 540) tried to access Kaspersky Anti-Virus process (PID 1488), but the action has been blocked by the Self-Defense component. No action on your part is necessary.
9/14/2007 8:35:40 AM      Security threats have been detected. You are advised to neutralize them immediately.
9/14/2007 8:35:40 AM      Real-time protection started.
9/14/2007 8:36:23 AM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:36:31 AM      Quarantine: File C:\WINDOWS\system32\drivers\ncscv32.exe: deleted.
9/14/2007 8:37:14 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE: detected virus 'Worm.Win32.Fujack.aa'. User: CLAUDINE\Administrator, computer: localhost.
9/14/2007 8:37:19 AM      Update completed successfully.
9/14/2007 8:37:22 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE: deleted.
9/14/2007 8:37:53 AM      Running module Sys.exe\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:37:53 AM      Running module Sys.exe\Sys.exe: is still infected, postponed.
9/14/2007 8:37:53 AM      File C:\Windows\Web\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:37:53 AM      File C:\Windows\Web\Sys.exe: is still infected, postponed.
9/14/2007 8:37:56 AM      File c:\program files\microsoft office\office11\mstore.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:37:56 AM      File c:\program files\microsoft office\office11\mstore.exe: is still infected, postponed.
9/14/2007 8:37:57 AM      File c:\program files\spybot - search & destroy\blindman.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:37:57 AM      File c:\program files\spybot - search & destroy\blindman.exe: is still infected, postponed.
9/14/2007 8:37:57 AM      File c:\windows\web\sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:37:57 AM      File c:\windows\web\sys.exe: is still infected, postponed.
9/14/2007 8:37:58 AM      File c:\program files\microsoft office\office11\ois.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:37:58 AM      File c:\program files\microsoft office\office11\ois.exe: is still infected, postponed.
9/14/2007 8:37:58 AM      File C:\WINDOWS\Web\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:37:58 AM      File C:\WINDOWS\Web\Sys.exe: is still infected, postponed.
9/14/2007 8:38:11 AM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/14/2007 8:38:11 AM      Physical disk sector \Device\Harddisk0\DR0: is still infected, postponed.
9/14/2007 8:38:11 AM      Running module Sys.exe\Sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:38:28 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\OIS.EXE: detected virus 'Worm.Win32.Fujack.aa'. User: CLAUDINE\Administrator, computer: localhost.
9/14/2007 8:38:28 AM      File C:\PROGRA~1\MICROS~2\OFFICE11\OIS.EXE: deleted.
9/14/2007 8:38:42 AM      Running module Sys.exe\Sys.exe: deleted.
9/14/2007 8:38:42 AM      File c:\windows\web\sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:38:49 AM      File c:\windows\web\sys.exe: detected virus 'Virus.Win32.AutoRun.ad'.
9/14/2007 8:38:50 AM      File c:\windows\web\sys.exe: deleted.
9/14/2007 8:38:52 AM      File c:\program files\microsoft office\office11\mstore.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:38:59 AM      File c:\program files\microsoft office\office11\mstore.exe: deleted.
9/14/2007 8:38:59 AM      File c:\program files\spybot - search & destroy\blindman.exe: detected virus 'Worm.Win32.Fujack.aa'.
9/14/2007 8:39:00 AM      File c:\program files\spybot - search & destroy\blindman.exe: deleted.
9/14/2007 8:39:11 AM      Real-time protection is not running. You are advised to resume protection.
9/14/2007 8:40:13 AM      A full computer scan has never been performed. You are advised to perform a full scan as soon as possible.
9/14/2007 8:40:26 AM      Process  (PID 768) tried to access Kaspersky Anti-Virus process (PID 1636), but the action has been blocked by the Self-Defense component. No action on your part is necessary.
9/14/2007 8:40:37 AM      Real-time protection started.
9/14/2007 8:41:17 AM      Security threats have been detected. You are advised to neutralize them immediately.
9/14/2007 8:43:11 AM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/14/2007 8:43:11 AM      Physical disk sector \Device\Harddisk0\DR0: is still infected, postponed.
9/14/2007 8:43:11 AM      Physical disk sector \Device\Harddisk0\DR0: detected virus 'Virus.Boot.Malmo'.
9/14/2007 8:43:18 AM      Physical disk sector \Device\Harddisk0\DR0: disinfected.
9/14/2007 8:43:18 AM      Physical disk sector \Device\Harddisk0\DR0: disinfected.


Reports
-------
Component      Status      Start      Finish      Size
---------      ------      -----      ------      ----
Proactive Defense      running      9/14/2007 8:40:37 AM            0 bytes
File Anti-Virus      running      9/14/2007 8:40:37 AM            246.3 KB
Mail Anti-Virus      running      9/14/2007 8:40:37 AM            0 bytes
Web Anti-Virus      running      9/14/2007 8:40:38 AM            10 KB
Scan      running      9/14/2007 8:42:12 AM            265.0 KB
Scan startup objects      completed      9/14/2007 8:42:42 AM      9/14/2007 8:43:18 AM      498.5 KB


Quarantine
----------
Status      Object      Size      Added
------      ------      ----      -----


Backup
------
Status      Object      Size
------      ------      ----
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\danish\smaxfaq.htm      16.9 KB
Infected: virus Worm.Win32.Fujack.aa      c:\cleaning-fixing tools\combofix from techsupportforum\combofix.exe      1.5 MB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\simpchin\smaxfaq.htm      12.5 KB
Infected: virus Worm.Win32.Fujack.aa      c:\program files\microsoft office\office11\mstore.exe      189.4 KB
Infected: virus Worm.Win32.Fujack.aa      C:\PROGRA~1\MICROS~2\OFFICE11\OIS.EXE      344.4 KB
Infected: virus Virus.Win32.AutoRun.ad      Sys.exe\Sys.exe      40 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\thai\smaxfaq.htm      15.0 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\russian\smaxfaq.htm      16.6 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\brazil\smaxfaq.htm      18.9 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\dutch\smaxfaq.htm      16 KB
Infected: virus Worm.Win32.Fujack.aa      c:\cleaning-fixing tools\sdfix\sdfix.exe      1.2 MB
Infected: virus Worm.Win32.Fujack.bd      c:\claudien\curriculum implementation.htm      10.2 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\korean\smaxfaq.htm      15.3 KB
Infected: virus Worm.Win32.Fujack.aa      c:\combofix\ntp.exe      109.2 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\hebrew\smaxfaq.htm      59.6 KB
Infected: virus Worm.Win32.Fujack.aa      c:\cleaning-fixing tools\combofix from beepingcomputers\combofix.exe      1.5 MB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\french\smaxfaq.htm      19.4 KB
Infected: virus Virus.Win32.AutoRun.ad      c:\windows\web\sys.exe      40 KB
Infected: virus Worm.Win32.Fujack.aa      c:\program files\spybot - search & destroy\blindman.exe      113.5 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\swedish\smaxfaq.htm      17.8 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\english\smaxfaq.htm      15.8 KB
Infected: virus Virus.Win32.AutoRun.ad      c:\sys.exe      40 KB
Infected: virus Worm.Win32.Fujack.aa      C:\WINDOWS\system32\drivers\ncscv32.exe      67.3 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\japanese\smaxfaq.htm      15.7 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\tradchin\smaxfaq.htm      12.7 KB
Infected: virus Virus.Win32.AutoRun.ad      c:\system volume information\_restore{8d290bb5-e59c-462b-a0ee-e8949a1e4344}\rp82\a0047389.exe      40 KB
Infected: virus Worm.Win32.Fujack.aa      C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE      4.3 MB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\italian\smaxfaq.htm      17.7 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\norwegan\smaxfaq.htm      16.3 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\finnish\smaxfaq.htm      18.2 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\arabic\smaxfaq.htm      62.2 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\german\smaxfaq.htm      18 KB
Infected: virus Worm.Win32.Fujack.bd      c:\compaq\audio\adi\sm_panel\sys\spanish\smaxfaq.htm      18.8 KB
Infected: virus Worm.Win32.Fujack.aa      c:\games.exe      67.3 KB

Now I can do everything previously I failed to do. BUT....

There  another problem raised. When I try to open C: volume by double clicking it, I find the following message...

Windows cannot find 'Sys.exe'. Make sure you typed the name correctly, and then try again. To search for a file, Click the Start button, and then click Search.

In the link (http://vil.nai.com/vil/content/v_142400.htm), I read out that virus W32/Hooon.Worm Alias Virus.Win32.AutoRun.ad (Kaspersky Antivirus) copies two files to removable media...Sys.exe (Worm) and autorun.inf.

While scanning Kaspersky Antivirus gave me option to either disinfect or delete this file. I deleted this file as it is a worm. Now When I double click on C: volume, I receive the above message I told you about.

Please check it what is the cause of this message. How can I be able to open the C: volume again normally. SHOULD I TRY SDFIX AND COMBOFIX AGAIN ?

Thanks...

Hemant

Thanks for your suggestions.

I removed the following entries from registry :

O4 - HKLM\..\Run: [NoooH] C:\Windows\Web\Sys.exe
O4 - HKCU\..\Run: [nvscv32] C:\WINDOWS\system32\drivers\ncscv32.exe

and then I run SDFix and ComboFix. They both worked together. And now I can open the volume normally. Everything is OK and this is because of you.

By the way I didn't run the FindAWF.exe but thanks for giving me this tool. I request you if in future you can explain me about this tool and other tool VundoFix.exe also.

For your perusal I am sending ComboFix and SDFix log files :

ComboFix Log File:

ComboFix 07-09-10.6 - "Administrator" 2007-09-14 14:50:09.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.240 [GMT 3:00]
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop_.ini
C:\Cleaning-Fixing Tools\Coolpixs Remover\Desktop_.ini
C:\Documents and Settings\Administrator\Desktop\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop_.ini
C:\Documents and Settings\Administrator\Desktop\Cleaning-Fixing Tools\Coolpixs Remover\Desktop_.ini
c:\RECYCLER\Desktop__.ini


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\nm


(((((((((((((((((((((((((   Files Created from 2007-08-14 to 2007-09-14  )))))))))))))))))))))))))))))))
.

2007-09-14 14:49      51,200      --a------      C:\WINDOWS\NirCmd.exe
2007-09-14 14:42      <DIR>      d--------      C:\WINDOWS\ERUNT
2007-09-13 16:07      20,512      --ahs----      C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-13 16:07      1,356,576      --ahs----      C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-13 16:07      <DIR>      d--------      C:\Program Files\Kaspersky Lab
2007-09-13 16:07      <DIR>      d--------      C:\kav
2007-09-13 16:07      <DIR>      d--------      C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-09-13 15:15      <DIR>      d--------      C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-13 14:45      <DIR>      d--------      C:\Program Files\CCleaner
2007-09-13 14:39      <DIR>      d--------      C:\Cleaning-Fixing Tools
2007-09-07 07:17      <DIR>      d--------      C:\AGNES DOCUMENT
2007-09-03 16:09      118,784      --a------      C:\DOCUME~1\ADMINI~1\WZQKPICK.EXE.exe
2007-08-30 15:35      <DIR>      d-a------      C:\Maths (2nd year marks) Epi
2007-08-29 12:28      1,495,552      --a------      C:\WINDOWS\system32\epoPGPsdk.dll
2007-08-29 12:28      <DIR>      d--------      C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-08-29 12:18      2,781,184      --a------      C:\DOCUME~1\ADMINI~1\WINZIP32.EXE.exe
2007-08-27 16:33      10,073,144      --a------      C:\DOCUME~1\ADMINI~1\EXCEL.EXE.exe
2007-08-16 14:54      525,824      --a------      C:\DOCUME~1\ADMINI~1\SetRefresh.exe.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-14 14:56      ---------      d--------      C:\DOCUME~1\ADMINI~1\APPLIC~1\Skype
2007-09-14 14:53      22208      --ahs----      C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-14 14:53      20696      --ahs----      C:\WINDOWS\system32\drivers\fidbox2.idx
2007-09-14 09:14      ---------      d--------      C:\Program Files\Altiris
2007-09-13 16:17      ---------      d--------      C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
2007-09-13 15:52      ---------      d--------      C:\Program Files\McAfee
2007-09-13 11:19      ---------      d--------      C:\DOCUME~1\ADMINI~1\APPLIC~1\U3
2007-09-13 07:27      9      -r-hs----      C:\Program Files\Desktop__.ini
2007-08-29 12:59      ---------      d--------      C:\Program Files\PDF Complete
2007-08-29 12:59      ---------      d--------      C:\Program Files\HPMAK
2007-08-16 14:17      ---------      d--------      C:\Program Files\Skype
2007-08-16 14:17      ---------      d--------      C:\Program Files\Real
2007-08-16 14:17      ---------      d--------      C:\Program Files\Program Shortcuts
2007-08-16 14:17      ---------      d--------      C:\Program Files\Microsoft.NET
2007-08-16 14:17      ---------      d--------      C:\Program Files\Microsoft Works
2007-08-16 14:16      ---------      d--------      C:\Program Files\Microsoft ActiveSync
2007-08-16 14:16      ---------      d--------      C:\Program Files\HPQ
2007-08-16 14:16      ---------      d--------      C:\Program Files\Hewlett-Packard
2007-08-16 14:15      ---------      d--------      C:\Program Files\Google
2007-08-16 14:15      ---------      d--------      C:\Program Files\Compaq
2007-08-16 14:15      ---------      d--------      C:\Program Files\Broadcom
2007-08-16 14:15      ---------      d--------      C:\Program Files\Analog Devices
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-09-30 19:41]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-09-30 19:37]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-07-30 19:08]
"MAKTray"="MAKTray.exe" [2004-08-28 03:07 C:\WINDOWS\MAKTray.exe]
"PDF Complete"="C:\Program Files\PDF Complete\pdfsty.exe" [2006-01-03 22:30]
"SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" []
"LayoutM"="KLayMgr.exe" [2004-08-17 06:46 C:\WINDOWS\KLayMgr.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-09 16:50]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-11-08 18:28]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-22 23:31]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 07:53]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 13:06]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSetTaskbar"=0 (0x0)



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Sys.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2139a016-ffc6-11db-96e4-000ffe4b2b45}]
AutoRun\command- ntde1ect.com
explore\Command- ntde1ect.com
open\Command- ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2141f85a-0dab-11dc-9708-000ffe4b2b45}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26d583c6-52d4-11dc-97b9-000ffe4b2b45}]
Auto\command- E:\setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36796976-5ba0-11dc-97f1-000ffe4b2b45}]
Auto\command- E:\setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41314abc-2b8c-11dc-9755-000ffe4b2b45}]
Auto\command- E:\bittorrent.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4dc8eda6-293c-11dc-9751-000ffe4b2b45}]
Auto\command- E:\boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f73faba-2b8d-11dc-9756-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5bb02cbc-0859-11dc-96f3-000ffe4b2b45}]
Auto\command- bittorrent.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65c548f9-fe30-11db-96df-000ffe4b2b45}]
AutoRun\command- E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7249909c-3077-11dc-9764-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{844de992-3134-11dc-9765-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{844de995-3134-11dc-9765-000ffe4b2b45}]
Auto\command- E:\boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8bb54078-0507-11dc-96eb-000ffe4b2b45}]
Auto\command- OSO.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91fece9c-5c4c-11dc-97f5-000ffe4b2b45}]
AutoRun\command- E:\ntde1ect.com
explore\Command- E:\ntde1ect.com
open\Command- E:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9265b936-44b1-11dc-9793-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9bdb455f-2466-11dc-9743-000ffe4b2b45}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcee610c-508b-11dc-97b0-000ffe4b2b45}]
AutoRun\command- E:\ntde1ect.com
explore\Command- E:\ntde1ect.com
open\Command- E:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca99c9a6-45b2-11dc-9798-000ffe4b2b45}]
Auto\command- E:\bittorrent.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cad82f17-17d8-11dc-9723-000ffe4b2b45}]
Auto\command- E:\bittorrent.exe e
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca45514-fc64-11db-96d9-000ffe4b2b45}]
Auto\command- E:\OSO.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d91e448a-1ee9-11dc-9735-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e355ca10-260f-11dc-974a-000ffe4b2b45}]
Auto\command- boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5966a0a-02a7-11dc-96e6-000ffe4b2b45}]
Auto\command- E:\boot.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e762441c-4c7b-11dc-97a8-000ffe4b2b45}]
Auto\command- E:\setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ef773770-5c57-11dc-97f6-000ffe4b2b45}]
Auto\command- E:\setup.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-14 14:55:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-14 14:56:58 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-14 14:56
.
      --- E O F ---

SDFix Log File:

SDFix: Version 1.104

Run by Administrator on Fri 09/14/2007 at 02:43 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\AcroRd32Info.exe.exe - Deleted
C:\WINDOWS\system32\FrameworkService.exe.exe - Deleted
C:\WINDOWS\system32\FrmInst.exe.exe - Deleted
C:\WINDOWS\system32\OUTLOOK.EXE.exe - Deleted
C:\WINDOWS\system32\UdaterUI.exe.exe - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
 


                                 Final Check:

Remaining Services:
------------------




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"="C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe:*:Enabled:McAfee Framework Service"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop_.ini
C:\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop__.ini
C:\Documents and Settings\Administrator\Application Data\U3\temp\Launchpad Removal.exe
C:\Documents and Settings\Administrator\Desktop\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop_.ini
C:\Documents and Settings\Administrator\Desktop\Cleaning-Fixing Tools\Coolpixs Remover\BFU.exe\Desktop__.ini
C:\AGNES DOCUMENT\~WRL0274.tmp
C:\Documents and Settings\Administrator\My Documents\~WRL0005.tmp
C:\Documents and Settings\Administrator\My Documents\~WRL3561.tmp

Finished!


Thanks...

Regards,

Hemant

>>By the way I didn't run the FindAWF.exe but thanks for giving me this tool. I request you if in future you can explain me about this tool and other tool VundoFix.exe also.<<

Vundofix.exe is a tool for removal of vundo infections which you do not have. Your logs did not show any signs of vundo so there's no need to use vundofix at the moment.

You need my guidance when using FindAWF.exe because it's not like any normal scanners, the whole process is done in steps.
The first step is just scanning the system for bak files. I then analyze the log before you can proceed to the next step.
What prompted me to suggest FindAWF.exe is because Kaspersky's log was showing legit programs as being infected.

Are these programs working?
Microsoft Office, Frontpage in particular
Spybot S&D

Combofix deleted files from flashdrive infections, the log also shows some bad registry entries.
You might like to run this tool too. Though the tool hasn't been updated since July. Still just try and run it.
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

Thanks!

User Desktop Profile Compromised.  Workaround as follows:
Just rename ComboFix.exe to Combo-Fix.exe
SDFix.exe to SD-Fix.exe
Both should run properly and remove the bad stuff.
Continue with the above suggestions.

cpsitech - your comment was right on....thanks for the comment!