AdzGalore...maybe more? [Solved]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

AdzGalore...maybe more? [Solved]

Options

xBrittneyx View Member Profile	Feb 26 2009, 10:39 AM Post #1
New Member Posts: 5 OS: XP	Afternoon! I have been infected with AdzGalore. It is causing contextual ads to pop up in IE. Also, I use firefox and have Google set as my homepage. Whenever I conduct a search an extra "Sponsored Links" section pops into the left side of my search results. I followed the instructions in the "You must read this before...." post, I haven't had any popups yet, but the extra "Sponsored Links" on my google page is still there. I have an MBAM log if needed. Here is my HijackThis log (Any help would be appreciated, thank you!): C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\vsnpstd2.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Belkin\F5D7050v5\Belkinwcui.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll (file missing) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Belkin Wireless G USB Adapter Client Utility.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 4907 bytes

Replies (1 - 10)

BHowett View Member Profile	Mar 1 2009, 12:39 AM Post #2
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	Hello and welcome to Geeks To Go! My name is BHowett and I will be helping you to get sorted. If for any reason you do not understand any of the instructions, or are just unsure then please do not guess , simply post back with your question, and we will go through it again. ComboFix Please download ComboFix from Here or Here * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Do not mouse-click Combofix's window while it is running. That may cause it to stall.**

xBrittneyx View Member Profile	Mar 1 2009, 09:54 AM Post #3
New Member Posts: 5 OS: XP	Hey, thank you for your help! I had a little trouble turning my anti-virus off, but I hope this is ok: ComboFix 09-02-28.01 - User 2009-03-01 10:36:37.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.608 [GMT -5:00] Running from: c:\documents and settings\User\Desktop\ComboFix.exe AV: AVG Anti-Virus Free On-access scanning enabled (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\User\Application Data\02000000f195bfea530C.manifest c:\documents and settings\User\Application Data\02000000f195bfea530O.manifest c:\documents and settings\User\Application Data\02000000f195bfea530P.manifest c:\documents and settings\User\Application Data\02000000f195bfea530S.manifest c:\program files\Mozilla Firefox\components\uhikjwjdsm.dll c:\windows\GnuHashes.ini c:\windows\system32\GroupPolicy000.dat c:\windows\system32\uhikjwjdsm.dll . ((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 ))))))))))))))))))))))))))))))) . 2009-02-26 14:07 . 2003-11-19 17:48 61,555 --a------ c:\windows\system32\jpicpl32.cpl 2009-02-26 11:12 . 2009-01-09 14:19 1,089,593 --------- c:\windows\system32\dllcache\ntprint.cat 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\program files\MSBuild 2009-02-26 01:34 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-26 01:34 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-26 01:34 . 2008-07-06 05:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-26 01:34 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-26 01:34 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-26 01:34 . 2008-07-06 07:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-26 01:34 . 2008-07-06 07:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-26 01:20 . 2009-02-26 01:20 <DIR> d-------- c:\program files\ERUNT 2009-02-25 23:17 . 2009-02-28 12:17 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-02-25 23:09 . 2009-02-25 22:07 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-02-25 22:22 . 2009-03-01 10:32 <DIR> d-------- c:\windows\system32\drivers\Avg 2009-02-25 22:22 . 2009-02-25 22:22 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys 2009-02-25 22:22 . 2009-02-25 22:22 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys 2009-02-25 22:22 . 2009-02-25 22:22 10,520 --a------ c:\windows\system32\avgrsstx.dll 2009-02-25 22:21 . 2009-02-25 22:21 <DIR> d-------- c:\program files\AVG 2009-02-25 22:21 . 2009-02-25 22:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2009-02-25 22:07 . 2009-02-25 22:07 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-02-25 22:06 . 2009-02-25 22:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-02-25 22:06 . 2009-02-25 22:06 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-25 21:16 . 2009-02-25 21:16 <DIR> d-------- c:\program files\Trend Micro 2009-02-25 20:49 . 2009-02-25 20:49 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes 2009-02-25 20:48 . 2009-02-25 20:49 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-25 20:48 . 2009-02-25 20:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-25 20:48 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-25 20:48 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-21 23:49 . 2009-02-21 23:49 133,120 --a------ c:\windows\iciderir.dll 2009-02-21 22:43 . 2009-02-21 22:43 132,096 --a------ c:\windows\ixihulatoletuzu.dll 2009-02-21 13:52 . 2009-02-21 13:52 131,584 --a------ c:\windows\oserocohuvil.dll 2009-02-20 22:17 . 2009-02-20 22:17 131,584 --a------ c:\windows\iwonobapuyuqiy.dll 2009-02-20 14:52 . 2009-02-20 14:52 133,632 --a------ c:\windows\upecewekife.dll 2009-02-20 13:09 . 2009-02-20 13:09 135,680 --a------ c:\windows\eyiliyojoqo.dll 2009-02-20 00:10 . 2009-02-20 00:10 132,608 --a------ c:\windows\icohehucuca.dll 2009-02-19 13:45 . 2009-02-19 13:45 131,584 --a------ c:\windows\asubikehejonuq.dll 2009-02-19 11:02 . 2009-02-19 11:02 135,168 --a------ c:\windows\azulidupayazada.dll 2009-02-08 11:35 . 2009-02-08 11:35 <DIR> d-------- c:\documents and settings\User\Application Data\Amazon 2009-02-08 11:34 . 2009-02-08 11:34 <DIR> d-------- c:\program files\Amazon . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-01 03:00 --------- d-----w c:\documents and settings\User\Application Data\Move Networks 2009-02-26 19:07 --------- d-----w c:\program files\Java 2009-02-26 18:56 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-02-26 03:20 --------- d-----w c:\program files\Symantec 2009-02-26 03:20 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-02-26 03:19 --------- d-----w c:\program files\Symantec AntiVirus 2009-02-26 03:19 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-02-26 03:16 --------- d-----w c:\program files\Common Files\Roxio Shared 2009-02-26 03:06 --------- d-----w c:\program files\Lavasoft 2009-02-25 22:17 --------- d-----w c:\documents and settings\User\Application Data\LimeWire 2009-02-25 22:10 --------- d-----w c:\program files\LimeWire 2009-01-24 04:58 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-01-23 20:57 --------- d-----w c:\program files\AIM6 2009-01-23 20:56 --------- d-----w c:\documents and settings\All Users\Application Data\acccore 2009-01-23 20:54 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads 2009-01-22 02:05 --------- d-----w c:\program files\Yahoo! 2009-01-22 02:04 --------- d-----w c:\program files\EA GAMES 2008-09-12 07:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091220080913\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-01-05 40960] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-25 509784] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-25 1601304] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G USB Adapter Client Utility.lnk - c:\program files\Belkin\F5D7050v5\Belkinwcui.exe [2008-08-27 1564672] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-05-16 24576] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-02-25 22:22 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk \0\0lsdelete [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "f:\\Warcraft III\\Warcraft III.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft III "6112:UDP"= 6112:UDP:Warcraft III R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-25 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-25 325128] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-25 107272] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-25 298264] R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-08-27 38144] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] S3 Alpham1;Ideazon ZBoard USB Human Interface Device;c:\windows\system32\drivers\Alpham1.sys [2007-07-23 42624] S3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;c:\windows\system32\drivers\Alpham2.sys [2007-03-20 18432] S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [2008-08-27 238848] . Contents of the 'Scheduled Tasks' folder 2009-02-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-25 22:07] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Aim6 - (no file) Notify-NavLogon - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.dell.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\i7vecg04.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www3.yoog.com/search.php?q= FF - prefs.js: browser.search.selectedEngine - Yoog Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=en FF - prefs.js: keyword.URL - hxxp://www3.yoog.com/search.php?q= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\i7vecg04.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll ---- FIREFOX POLICIES ---- FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: browser.search.defaultenginename - Yoog Search FF - user.js: browser.search.defaulturl - hxxp://www3.yoog.com/search.php?q= FF - user.js: browser.search.selectedEngine - Yoog Search FF - user.js: keyword.URL - hxxp://www3.yoog.com/search.php?q= FF - user.js: keyword.enabled - true . *********************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-01 10:45:48 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\AVG\AVG8\avgrsx.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe . ************************************************************************ . Completion time: 2009-03-01 10:49:22 - machine was rebooted ComboFix-quarantined-files.txt 2009-03-01 15:49:19 Pre-Run: 12,216,250,368 bytes free Post-Run: 12,199,170,048 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 199 --- E O F --- 2009-02-26 20:52:46

BHowett View Member Profile	Mar 1 2009, 11:15 AM Post #4
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	Hi xBrittneyx, P2P Warning! Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur. Once upon a time, P2P file sharing was fairly safe. That is no longer true. You may continue to use P2P sharing at your own risk; however, please keep in mind that this practice may be the source of your current problem/infection. I would strongly suggest you remove LimeWire. Removing can be done through Add/Remove Programs. Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): LimeWire =============================================== Combofix Script.txt 1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box. 2. Now copy/paste the entire content of the codebox below into the Notepad window: CODE File:: c:\windows\iciderir.dll c:\windows\ixihulatoletuzu.dll c:\windows\oserocohuvil.dll c:\windows\iwonobapuyuqiy.dll c:\windows\upecewekife.dll c:\windows\eyiliyojoqo.dll c:\windows\icohehucuca.dll c:\windows\asubikehejonuq.dll c:\windows\azulidupayazada.dll 3. Save the above as CFScript.txt 4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again. 5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply: Combofix.txt A new HijackThis log. =============================================== Also let me know how things are running, and if you are still having problems

xBrittneyx View Member Profile	Mar 1 2009, 01:05 PM Post #5
New Member Posts: 5 OS: XP	Yay ! Google is back to normal again! I'm not being redirected when clicking on search links, and I have not had any popups so far. Here are my new logs: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:00:53 PM, on 3/1/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Belkin\F5D7050v5\Belkinwcui.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll (file missing) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Belkin Wireless G USB Adapter Client Utility.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- End of file - 5023 bytes ComboFix 09-02-28.01 - User 2009-03-01 13:51:08.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.494 [GMT -5:00] Running from: c:\documents and settings\User\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt AV: AVG Anti-Virus Free On-access scanning enabled (Updated) * Created a new restore point FILE :: c:\windows\asubikehejonuq.dll c:\windows\azulidupayazada.dll c:\windows\eyiliyojoqo.dll c:\windows\iciderir.dll c:\windows\icohehucuca.dll c:\windows\iwonobapuyuqiy.dll c:\windows\ixihulatoletuzu.dll c:\windows\oserocohuvil.dll c:\windows\upecewekife.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\asubikehejonuq.dll c:\windows\azulidupayazada.dll c:\windows\eyiliyojoqo.dll c:\windows\iciderir.dll c:\windows\icohehucuca.dll c:\windows\iwonobapuyuqiy.dll c:\windows\ixihulatoletuzu.dll c:\windows\oserocohuvil.dll c:\windows\upecewekife.dll . ((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 ))))))))))))))))))))))))))))))) . 2009-02-26 14:07 . 2003-11-19 17:48 61,555 --a------ c:\windows\system32\jpicpl32.cpl 2009-02-26 11:12 . 2009-01-09 14:19 1,089,593 --------- c:\windows\system32\dllcache\ntprint.cat 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-26 01:34 . 2009-02-26 01:34 <DIR> d-------- c:\program files\MSBuild 2009-02-26 01:34 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-26 01:34 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-26 01:34 . 2008-07-06 05:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-26 01:34 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-26 01:34 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-26 01:34 . 2008-07-06 07:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-26 01:34 . 2008-07-06 07:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-26 01:20 . 2009-02-26 01:20 <DIR> d-------- c:\program files\ERUNT 2009-02-25 23:17 . 2009-03-01 12:13 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-02-25 23:09 . 2009-02-25 22:07 15,688 --a------ c:\windows\system32\lsdelete.exe 2009-02-25 22:22 . 2009-03-01 10:32 <DIR> d-------- c:\windows\system32\drivers\Avg 2009-02-25 22:22 . 2009-02-25 22:22 325,128 --a------ c:\windows\system32\drivers\avgldx86.sys 2009-02-25 22:22 . 2009-02-25 22:22 107,272 --a------ c:\windows\system32\drivers\avgtdix.sys 2009-02-25 22:22 . 2009-02-25 22:22 10,520 --a------ c:\windows\system32\avgrsstx.dll 2009-02-25 22:21 . 2009-02-25 22:21 <DIR> d-------- c:\program files\AVG 2009-02-25 22:21 . 2009-02-25 22:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8 2009-02-25 22:07 . 2009-02-25 22:07 64,160 --a------ c:\windows\system32\drivers\Lbd.sys 2009-02-25 22:06 . 2009-02-25 22:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2009-02-25 22:06 . 2009-02-25 22:06 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-02-25 21:16 . 2009-02-25 21:16 <DIR> d-------- c:\program files\Trend Micro 2009-02-25 20:49 . 2009-02-25 20:49 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes 2009-02-25 20:48 . 2009-02-25 20:49 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-25 20:48 . 2009-02-25 20:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-25 20:48 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-25 20:48 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-08 11:35 . 2009-02-08 11:35 <DIR> d-------- c:\documents and settings\User\Application Data\Amazon 2009-02-08 11:34 . 2009-02-08 11:34 <DIR> d-------- c:\program files\Amazon . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-01 03:00 --------- d-----w c:\documents and settings\User\Application Data\Move Networks 2009-02-26 19:07 --------- d-----w c:\program files\Java 2009-02-26 18:56 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint 2009-02-26 03:20 --------- d-----w c:\program files\Symantec 2009-02-26 03:20 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-02-26 03:19 --------- d-----w c:\program files\Symantec AntiVirus 2009-02-26 03:19 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-02-26 03:16 --------- d-----w c:\program files\Common Files\Roxio Shared 2009-02-26 03:06 --------- d-----w c:\program files\Lavasoft 2009-02-25 22:17 --------- d-----w c:\documents and settings\User\Application Data\LimeWire 2009-01-24 04:58 --------- d-----w c:\program files\Common Files\Blizzard Entertainment 2009-01-23 20:57 --------- d-----w c:\program files\AIM6 2009-01-23 20:56 --------- d-----w c:\documents and settings\All Users\Application Data\acccore 2009-01-23 20:54 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads 2009-01-22 02:05 --------- d-----w c:\program files\Yahoo! 2009-01-22 02:04 --------- d-----w c:\program files\EA GAMES 2008-09-12 07:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091220080913\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "SNPSTD2"="c:\windows\vsnpstd2.exe" [2004-01-05 40960] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-25 509784] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-25 1601304] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Belkin Wireless G USB Adapter Client Utility.lnk - c:\program files\Belkin\F5D7050v5\Belkinwcui.exe [2008-08-27 1564672] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-05-16 24576] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-02-25 22:22 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk \0\0lsdelete [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "f:\\Warcraft III\\Warcraft III.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:Warcraft III "6112:UDP"= 6112:UDP:Warcraft III R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-02-25 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-02-25 325128] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-02-25 107272] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-25 298264] R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-08-27 38144] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096] S3 Alpham1;Ideazon ZBoard USB Human Interface Device;c:\windows\system32\drivers\Alpham1.sys [2007-07-23 42624] S3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;c:\windows\system32\drivers\Alpham2.sys [2007-03-20 18432] S3 BELKIN;Belkin Wireless G USB Network Adapter;c:\windows\system32\drivers\BLKWGU.sys [2008-08-27 238848] . Contents of the 'Scheduled Tasks' folder 2009-02-26 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-25 22:07] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.dell.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\i7vecg04.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www3.yoog.com/search.php?q= FF - prefs.js: browser.search.selectedEngine - Yoog Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp?hl=en FF - prefs.js: keyword.URL - hxxp://www3.yoog.com/search.php?q= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\i7vecg04.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll ---- FIREFOX POLICIES ---- FF - user.js: google.toolbar.linkdoctor.enabled - false FF - user.js: browser.search.defaultenginename - Yoog Search FF - user.js: browser.search.defaulturl - hxxp://www3.yoog.com/search.php?q= FF - user.js: browser.search.selectedEngine - Yoog Search FF - user.js: keyword.URL - hxxp://www3.yoog.com/search.php?q= FF - user.js: keyword.enabled - true . *********************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-01 13:55:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wscntfy.exe . ************************************************************************ . Completion time: 2009-03-01 14:00:03 - machine was rebooted ComboFix-quarantined-files.txt 2009-03-01 19:00:00 ComboFix2.txt 2009-03-01 15:49:23 Pre-Run: 12,286,054,400 bytes free Post-Run: 12,269,637,632 bytes free 191 --- E O F --- 2009-02-26 20:52:46

BHowett View Member Profile	Mar 1 2009, 02:03 PM Post #6
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	Hi xBrittneyx, please do the following... Fix with HijackThis Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. =============================================== Update Java Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Upgrading Java: Download the latest version of Java Runtime Environment (JRE) 6 Update 12. Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u7-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version. =============================================== ATF Cleaner Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. =============================================== Kaspersky WebScanner please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply. =============================================== Please post the Kaspersky WebScanner results in your next reply

xBrittneyx View Member Profile	Mar 1 2009, 10:40 PM Post #7
New Member Posts: 5 OS: XP	It came up clean: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, March 1, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, March 01, 2009 20:40:03 Records in database: 1860269 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 74378 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:29:52 No malware has been detected. The scan area is clean. The selected area was scanned.

BHowett View Member Profile	Mar 1 2009, 11:10 PM Post #8
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	Hi xBrittneyx, Well done, your log appears clean Now lets uninstall Combofix: Click START then RUN Now type Combofix /u in the runbox and click OK. Note the space between the X and the /u, it needs to be there. =============================================== Click Here to download OTCleanIt Double-click OTCleanIt.exe to run it. Click the Clean up button Click Yes to the reboot. Now delete any logs that you have left over on your desktop. =============================================== For some useful tips on staying clean, along with links to some freeware to help, have a look at this page. To find out more information about how you got infected in the first place, you can read this article. =============================================== Follow this list and your potential for being infected again will reduce dramatically. Thanks for letting us help you!

xBrittneyx View Member Profile	Mar 2 2009, 10:19 AM Post #9
New Member Posts: 5 OS: XP	You guys are lifesavers! Thank you!

BHowett View Member Profile	Mar 2 2009, 10:47 PM Post #10
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	your very welcome

BHowett View Member Profile	Mar 2 2009, 10:47 PM Post #11
Moderator / Malware Staff Posts: 4,137 From: USA OS: Windows XP professional	Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal vundo and infogamepass? maybe more [Solved] 12	26 / 542	17th February 2009 - 11:11 PM zoloft started - last by fenzodahl512
Virus, Spyware and Trojan Removal Just another dork with a Hijacker ... maybe more [Solved]	13 / 408	28th April 2009 - 12:28 PM cigarboxguitar started - last by Rorschach112
Virus, Spyware and Trojan Removal Win32/Rootkit.Agent.ODG and maybe more [Solved] 12	17 / 678	8th May 2009 - 04:21 PM anarxaki started - last by Rorschach112
Virus, Spyware and Trojan Removal Braviax and maybe more [Solved] 12	16 / 281	28th September 2009 - 04:49 AM Pocket started - last by Raktor