Google Redirect on Search...Help Please! [Solved], In FF and IE and Slimbrowser the google search function is infected.. |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 Oct 7 2009, 02:49 AM
Post
#1
|
|
|
Member  Posts: 15 OS: xp  |
Windows xp
Have run many maleware softwares and nothing finds or clears anything. This happened to me back in April and you guys were able to help. Looks like different bug.. Please help me clean this computer. Thanks, Tom Here's one of my logs: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:50:56 AM, on 10/7/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaAgent.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Program Files\Subliminal Power\Subliminal.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\Tom\Application Data\Dropbox\bin\Dropbox.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Program Files\Subliminal Power\Library.dll C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\vssvc.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local R3 - URLSearchHook: _URLHandler - {100BC27E-338E-4EFA-94E1-467CB80A724A} - C:\PROGRA~1\SMEStorage Desktop Tools\SMEStorage.nse.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TextAloud\TAForIE.dll O4 - HKLM\..\Run: [SanaSafeConnect] "C:\Program Files\Sana Security\Primary Response SafeConnect\agent\bin\SanaSafeConnect.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [Subliminal Power] C:\Program Files\Subliminal Power\Subliminal.exe /s O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: Dropbox.lnk = Application Data\Dropbox\bin\Dropbox.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} (CWebLaunchCtl Object) - http://esupport.cf1live.com/esupport/stati.../weblaunch2.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Update Service (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SanaSafeConnectAgent - Unknown owner - C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaAgent.exe O23 - Service: SanaSafeConnectWatcher - Unknown owner - C:\Program Files\Sana Security\Primary Response SafeConnect\agent\Bin\SanaSafeConnectWatcher.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 10459 bytes This post has been edited by TommyK: Oct 7 2009, 02:52 AM |
 |
 
|
|
Oct 7 2009, 06:03 AM
Post
#2
|
|
 GeekU Teacher  Posts: 35,115 From: Dublin OS: XP |
hi
Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall** |
|
|
|
|
Oct 7 2009, 08:15 AM
Post
#3
|
|
|
Member Posts: 15 OS: xp |
Hi Good to meet you again. I started to run Combo, but it said that Kapersky is still running. I don;t own Kapersky, can not find it programs, and do not see it in task manager. What's going on?
|
|
|
|
|
Oct 7 2009, 08:46 AM
Post
#4
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
ignore that and run it anyway
|
|
|
|
|
Oct 7 2009, 09:45 AM
Post
#5
|
|
|
Member Posts: 15 OS: xp |
ok, here you go..
ComboFix 09-10-06.04 - Tom 10/07/2009 11:31.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1919.1517 [GMT -4:00] Running from: c:\documents and settings\Tom\Desktop\Combo-Fix.exe AV: avast! antivirus 4.8.1351 [VPS 091007-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\recycler\S-1-5-21-1435650248-2458950338-2801487568-500 c:\recycler\S-1-5-21-3224528238-692825667-3860356365-500 c:\windows\Installer\105f0fbe.msp c:\windows\Installer\26e35ba.msp c:\windows\Installer\41d353.msp c:\windows\Installer\44cb15.msp c:\windows\Installer\5c9a41c.msp c:\windows\Installer\63626.msp c:\windows\Installer\baa7a1.msp c:\windows\kb913800.exe D:\Autorun.inf F:\Autorun.inf Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected Kitty ate it  . ((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 ))))))))))))))))))))))))))))))) . 2009-10-07 15:38 . 2009-10-07 15:38 -------- d-----w- c:\documents and settings\Tom\Application Data\113808 2009-10-07 08:39 . 2009-10-07 08:39 -------- d-----w- c:\documents and settings\Tom\Application Data\043935 2009-10-07 04:29 . 2009-10-07 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-10-07 04:29 . 2009-10-07 14:42 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-10-07 04:29 . 2009-10-07 14:42 -------- d-----w- c:\documents and settings\Tom\Application Data\SUPERAntiSpyware.com 2009-10-07 04:00 . 2009-10-07 04:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-10-07 03:58 . 2009-10-07 03:58 -------- d-----w- c:\documents and settings\Tom\Application Data\235824 2009-10-04 21:50 . 2009-10-06 00:50 -------- d-----w- c:\program files\2nd Story Software 2009-09-30 17:21 . 2009-09-30 17:21 -------- d-----w- c:\documents and settings\Tom\Application Data\132152 2009-09-29 10:06 . 2009-09-29 10:06 -------- d-----w- c:\documents and settings\Tom\Application Data\060657 2009-09-25 15:22 . 2009-09-25 15:22 -------- d-----w- c:\documents and settings\Tom\Application Data\112226 2009-09-23 13:12 . 2009-09-23 13:12 -------- d-----w- c:\documents and settings\Tom\Application Data\091252 2009-09-22 10:54 . 2009-09-22 10:54 -------- d-----w- c:\documents and settings\Tom\Application Data\065404 2009-09-21 14:47 . 2009-09-21 14:47 -------- d-----w- c:\documents and settings\Tom\Application Data\104731 2009-09-20 22:19 . 2009-09-20 22:20 -------- d-----w- c:\documents and settings\Tom\Application Data\181959 2009-09-19 17:28 . 2009-09-19 17:28 -------- d-----w- c:\documents and settings\Tom\Application Data\132855 2009-09-18 13:18 . 2009-09-18 13:18 -------- d-----w- c:\documents and settings\Tom\Application Data\091843 2009-09-17 02:05 . 2009-09-17 02:05 -------- d-----w- c:\documents and settings\Tom\Application Data\220545 2009-09-13 01:54 . 2009-09-13 01:54 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE 2009-09-13 01:46 . 2009-09-13 01:46 -------- d-sh--w- c:\documents and settings\Owner\IETldCache 2009-09-10 01:41 . 2009-09-10 01:41 -------- d-----w- c:\documents and settings\Tom\Application Data\214127 2009-09-10 01:25 . 2009-09-10 01:25 -------- d-----w- c:\documents and settings\Tom\Application Data\212537 2009-09-09 13:38 . 2009-09-09 13:38 -------- d-----w- c:\documents and settings\Tom\Application Data\093851 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-07 15:38 . 2009-07-16 13:21 -------- d-----w- c:\program files\Subliminal Power 2009-10-07 15:37 . 2008-12-09 18:14 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs 2009-10-07 15:37 . 2008-12-09 18:12 0 ----a-w- c:\windows\system32\drivers\logiflt.iad 2009-10-07 14:45 . 2007-11-02 18:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-10-07 14:42 . 2008-12-17 20:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-10-07 14:35 . 2009-06-01 16:17 -------- d-----w- c:\documents and settings\Tom\Application Data\Dropbox 2009-10-07 14:18 . 2006-02-01 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-10-07 08:29 . 2006-07-22 22:45 -------- d-----w- c:\documents and settings\Tom\Application Data\Free Download Manager 2009-10-07 01:54 . 2009-04-12 03:34 -------- d-----w- c:\program files\Trend Micro 2009-10-07 01:28 . 2007-11-02 18:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-10-06 18:37 . 2009-04-12 03:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-06 18:35 . 2007-01-23 17:58 -------- d-----w- c:\documents and settings\Tom\Application Data\SlimBrowser 2009-10-06 18:30 . 2007-04-08 13:39 -------- d-----w- c:\documents and settings\Tom\Application Data\OpenOffice.org2 2009-10-02 13:50 . 2006-05-29 21:24 -------- d-----w- c:\program files\DYMO Label 2009-09-13 01:48 . 2009-06-07 04:54 -------- d-----w- c:\program files\LastPass 2009-09-13 01:48 . 2007-12-28 21:34 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM 2009-09-10 18:54 . 2009-04-12 03:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 18:53 . 2009-04-12 03:39 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-09 15:43 . 2009-09-02 15:15 -------- d-----w- c:\documents and settings\Tom\Application Data\HpUpdate 2009-09-09 04:20 . 2007-02-25 02:34 -------- d-----w- c:\documents and settings\Tom\Application Data\Skype 2009-09-09 04:07 . 2008-04-22 00:02 -------- d-----w- c:\documents and settings\Tom\Application Data\skypePM 2009-09-09 03:31 . 2006-02-01 03:43 -------- d-----w- c:\program files\Google 2009-09-07 13:32 . 2009-09-07 13:32 -------- d-----w- c:\documents and settings\Tom\Application Data\093249 2009-09-06 17:38 . 2009-09-06 17:38 -------- d-----w- c:\program files\Business Plan Pro 2009-09-05 19:45 . 2009-05-14 22:40 -------- d-----w- c:\program files\TextAloud 2009-09-05 19:36 . 2009-09-05 19:36 -------- d-----w- c:\documents and settings\Tom\Application Data\153654 2009-09-04 13:21 . 2009-09-04 13:21 -------- d-----w- c:\documents and settings\Tom\Application Data\092145 2009-09-02 12:07 . 2009-09-02 12:07 -------- d-----w- c:\documents and settings\Tom\Application Data\080752 2009-08-31 12:34 . 2009-08-31 12:34 -------- d-----w- c:\documents and settings\Tom\Application Data\083428 2009-08-30 12:09 . 2009-08-30 12:09 -------- d-----w- c:\documents and settings\Tom\Application Data\080901 2009-08-29 16:08 . 2009-08-29 16:08 -------- d-----w- c:\documents and settings\Tom\Application Data\120840 2009-08-25 08:21 . 2009-08-25 08:21 -------- d-----w- c:\documents and settings\Tom\Application Data\042102 2009-08-24 13:16 . 2009-08-24 13:16 -------- d-----w- c:\documents and settings\Tom\Application Data\091604 2009-08-23 18:45 . 2009-08-23 18:45 -------- d-----w- c:\documents and settings\Tom\Application Data\144548 2009-08-22 17:00 . 2009-08-22 17:00 -------- d-----w- c:\documents and settings\Tom\Application Data\130032 2009-08-19 12:50 . 2009-08-19 12:50 -------- d-----w- c:\documents and settings\Tom\Application Data\085007 2009-08-18 11:53 . 2009-08-18 11:53 -------- d-----w- c:\documents and settings\Tom\Application Data\075357 2009-08-17 20:18 . 2009-03-21 15:53 -------- d-----w- c:\program files\PsychicSalesLetter 2009-08-17 16:10 . 2007-11-02 18:58 1279456 ----a-w- c:\windows\system32\aswBoot.exe 2009-08-17 16:06 . 2007-11-02 18:58 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-08-17 16:06 . 2007-11-02 18:58 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-08-17 16:05 . 2008-04-05 13:38 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-08-17 16:05 . 2008-04-05 13:38 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-08-17 16:04 . 2007-11-02 18:58 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-08-17 16:04 . 2007-11-02 18:58 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-08-17 16:03 . 2007-11-02 18:58 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-08-17 16:02 . 2007-11-02 18:58 97480 ----a-w- c:\windows\system32\AvastSS.scr 2009-08-17 12:19 . 2009-08-17 12:19 -------- d-----w- c:\documents and settings\Tom\Application Data\081936 2009-08-17 04:46 . 2009-08-17 04:46 -------- d-----w- c:\documents and settings\Tom\Application Data\004627 2009-08-16 14:28 . 2009-08-16 14:28 -------- d-----w- c:\documents and settings\Tom\Application Data\102807 2009-08-15 14:01 . 2009-08-15 14:01 -------- d-----w- c:\documents and settings\Tom\Application Data\100104 2009-08-14 01:04 . 2009-08-14 01:04 -------- d-----w- c:\documents and settings\Tom\Application Data\210439 2009-08-13 21:28 . 2006-07-21 22:35 -------- d-----w- c:\program files\DivX 2009-08-13 13:09 . 2009-08-13 13:09 -------- d-----w- c:\documents and settings\Tom\Application Data\090904 2009-08-12 13:33 . 2009-08-12 13:33 -------- d-----w- c:\documents and settings\Tom\Application Data\093336 2009-08-12 13:08 . 2009-04-16 02:13 -------- d-----w- c:\program files\HP 2009-08-12 13:08 . 2009-08-12 13:06 120069 ----a-w- c:\windows\hpqins00.dat 2009-08-12 12:59 . 2009-08-12 12:59 -------- d-----w- c:\documents and settings\Tom\Application Data\085952 2009-08-06 23:24 . 2005-01-10 01:09 327896 ----a-w- c:\windows\system32\wucltui.dll 2009-08-06 23:24 . 2005-01-10 01:09 209632 ----a-w- c:\windows\system32\wuweb.dll 2009-08-06 23:24 . 2005-05-26 11:16 44768 ----a-w- c:\windows\system32\wups2.dll 2009-08-06 23:24 . 2005-01-10 01:09 35552 ----a-w- c:\windows\system32\wups.dll 2009-08-06 23:24 . 2005-01-10 01:09 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-08-06 23:24 . 2005-01-09 23:47 96480 ----a-w- c:\windows\system32\cdm.dll 2009-08-06 23:23 . 2005-01-10 01:09 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-08-06 23:23 . 2008-09-07 16:04 215920 ----a-w- c:\windows\system32\muweb.dll 2009-08-06 23:23 . 2008-09-07 16:04 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-08-06 23:23 . 2005-01-10 01:09 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-08-05 09:01 . 2005-01-09 23:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-07-31 16:14 . 2008-03-28 21:58 516096 -c--a-w- c:\windows\iwexec.exe 2009-07-17 19:01 . 2005-01-09 23:47 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-14 23:18 . 2009-07-14 23:18 720896 ----a-w- c:\windows\iun6002.exe 2009-07-14 03:43 . 2005-01-09 23:49 286208 ----a-w- c:\windows\system32\wmpdxm.dll 2009-06-07 04:54 . 2009-06-07 04:54 4364032 ----a-w- c:\program files\Common Files\lpuninstall.exe 2007-07-20 22:57 . 2007-01-24 20:06 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-06-03 17:56 . 2008-06-03 17:56 44360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll 2008-06-03 17:56 . 2008-06-03 17:56 107928 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-18 23:27 . 2006-05-18 23:27 16496 -csha-w- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Windows NT\DiskQuota\NTDiskQuotaSidCache.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Red] @="{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}" [HKEY_CLASSES_ROOT\CLSID\{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 1207080] "Google Update"="c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104] "Subliminal Power"="c:\program files\Subliminal Power\Subliminal.exe" [2008-08-22 913617] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000] "Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2008-01-18 587712] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-18 7204864] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968] c:\documents and settings\Administrator\Start Menu\Programs\Startup\ Install LastPass FF RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2009-6-7 4364032] c:\documents and settings\Tom\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Tom\Application Data\Dropbox\bin\Dropbox.exe [2009-8-28 26784939] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AntiVirService"=2 (0x2) "AntiVirScheduler"=2 (0x2) "PatchLink Update"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"= "c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/5/2008 9:38 AM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/5/2008 9:38 AM 20560] R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [6/18/2008 8:55 AM 31896] S2 gupdate;Google Update Service;c:\program files\Google\Update\GoogleUpdate.exe [7/12/2008 10:58 AM 133104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-10-03 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-07-12 14:18] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-07-12 14:18] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2919136098-2494697476-672956410-1007Core.job - c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 13:06] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2919136098-2494697476-672956410-1007UA.job - c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 13:06] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = www.google.com uInternet Settings,ProxyOverride = 127.0.0.1;*.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s DPF: Microsoft XML Parser for Java DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} - hxxp://esupport.cf1live.com/esupport/static/weblaunch/weblaunch2.cab FF - ProfilePath - c:\documents and settings\Tom\Application Data\Mozilla\Firefox\Profiles\uzceb9ot.default\ FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?hl=en&utm_source=en-et-more&utm_medium=et&utm_campaign=en&shva=1#inbox FF - component: c:\documents and settings\Tom\Application Data\Mozilla\Firefox\Profiles\uzceb9ot.default\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - plugin: c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npfdm.dll FF - plugin: c:\program files\OpenOffice.org 2.2\program\npsoplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . . ------- File Associations ------- . vbefile\shell\open2\command=%SystemRoot%\System32\WScript.exe "%1" %* vbsfile\shell\open2\command=%SystemRoot%\System32\WScript.exe "%1" %* jsefile\shell\open2\command=%SystemRoot%\System32\WScript.exe "%1" %* . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-07 11:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(1744) c:\windows\system32\WININET.dll c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Carbonite\Carbonite Backup\CarboniteService.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\progra~1\MICROS~3\rapimgr.exe c:\program files\Subliminal Power\Library.dll c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\dllhost.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\program files\HP\Digital Imaging\bin\hpqbam08.exe c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe . ************************************************************************** . Completion time: 2009-10-07 11:43 - machine was rebooted ComboFix-quarantined-files.txt 2009-10-07 15:43 Pre-Run: 132,228,497,408 bytes free Post-Run: 132,096,114,688 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 319 --- E O F --- 2009-09-10 00:05 |
|
|
|
|
Oct 7 2009, 11:33 AM
Post
#6
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
hi
1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE Folder:: c:\documents and settings\Tom\Application Data\113808 c:\documents and settings\Tom\Application Data\043935 c:\documents and settings\Tom\Application Data\235824 c:\documents and settings\Tom\Application Data\132152 c:\documents and settings\Tom\Application Data\060657 c:\documents and settings\Tom\Application Data\112226 c:\documents and settings\Tom\Application Data\091252 c:\documents and settings\Tom\Application Data\065404 c:\documents and settings\Tom\Application Data\104731 c:\documents and settings\Tom\Application Data\181959 c:\documents and settings\Tom\Application Data\132855 c:\documents and settings\Tom\Application Data\091843 c:\documents and settings\Tom\Application Data\220545 c:\documents and settings\Tom\Application Data\214127 c:\documents and settings\Tom\Application Data\212537 c:\documents and settings\Tom\Application Data\093851 c:\documents and settings\Tom\Application Data\153654 c:\documents and settings\Tom\Application Data\092145 c:\documents and settings\Tom\Application Data\080752 c:\documents and settings\Tom\Application Data\083428 c:\documents and settings\Tom\Application Data\080901 c:\documents and settings\Tom\Application Data\120840 c:\documents and settings\Tom\Application Data\042102 c:\documents and settings\Tom\Application Data\091604 c:\documents and settings\Tom\Application Data\144548 c:\documents and settings\Tom\Application Data\130032 c:\documents and settings\Tom\Application Data\085007 c:\documents and settings\Tom\Application Data\075357 c:\documents and settings\Tom\Application Data\081936 c:\documents and settings\Tom\Application Data\004627 c:\documents and settings\Tom\Application Data\102807 c:\documents and settings\Tom\Application Data\100104 c:\documents and settings\Tom\Application Data\210439 c:\documents and settings\Tom\Application Data\090904 c:\documents and settings\Tom\Application Data\093336 c:\documents and settings\Tom\Application Data\085952 SecCenter:: AV: Kaspersky Anti-Virus *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0} Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. |
|
|
|
|
Oct 7 2009, 11:55 AM
Post
#7
|
|
|
Member Posts: 15 OS: xp |
next up...
ComboFix 09-10-06.04 - Tom 10/07/2009 13:49.2.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1919.1415 [GMT -4:00] Running from: c:\documents and settings\Tom\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Tom\Desktop\CFScript.txt AV: avast! antivirus 4.8.1351 [VPS 091007-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Tom\Application Data\004627 c:\documents and settings\Tom\Application Data\042102 c:\documents and settings\Tom\Application Data\043935 c:\documents and settings\Tom\Application Data\060657 c:\documents and settings\Tom\Application Data\065404 c:\documents and settings\Tom\Application Data\075357 c:\documents and settings\Tom\Application Data\080752 c:\documents and settings\Tom\Application Data\080901 c:\documents and settings\Tom\Application Data\081936 c:\documents and settings\Tom\Application Data\083428 c:\documents and settings\Tom\Application Data\085007 c:\documents and settings\Tom\Application Data\085952 c:\documents and settings\Tom\Application Data\090904 c:\documents and settings\Tom\Application Data\091252 c:\documents and settings\Tom\Application Data\091604 c:\documents and settings\Tom\Application Data\091843 c:\documents and settings\Tom\Application Data\092145 c:\documents and settings\Tom\Application Data\093336 c:\documents and settings\Tom\Application Data\093851 c:\documents and settings\Tom\Application Data\100104 c:\documents and settings\Tom\Application Data\102807 c:\documents and settings\Tom\Application Data\104731 c:\documents and settings\Tom\Application Data\112226 c:\documents and settings\Tom\Application Data\113808 c:\documents and settings\Tom\Application Data\120840 c:\documents and settings\Tom\Application Data\130032 c:\documents and settings\Tom\Application Data\132152 c:\documents and settings\Tom\Application Data\132855 c:\documents and settings\Tom\Application Data\144548 c:\documents and settings\Tom\Application Data\153654 c:\documents and settings\Tom\Application Data\181959 c:\documents and settings\Tom\Application Data\210439 c:\documents and settings\Tom\Application Data\212537 c:\documents and settings\Tom\Application Data\214127 c:\documents and settings\Tom\Application Data\220545 c:\documents and settings\Tom\Application Data\235824 . ((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 ))))))))))))))))))))))))))))))) . 2009-10-07 04:29 . 2009-10-07 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-10-07 04:29 . 2009-10-07 14:42 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-10-07 04:29 . 2009-10-07 14:42 -------- d-----w- c:\documents and settings\Tom\Application Data\SUPERAntiSpyware.com 2009-10-07 04:00 . 2009-10-07 04:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-10-04 21:50 . 2009-10-06 00:50 -------- d-----w- c:\program files\2nd Story Software 2009-09-13 01:54 . 2009-09-13 01:54 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE 2009-09-13 01:46 . 2009-09-13 01:46 -------- d-sh--w- c:\documents and settings\Owner\IETldCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-07 15:39 . 2009-06-01 16:17 -------- d-----w- c:\documents and settings\Tom\Application Data\Dropbox 2009-10-07 15:38 . 2009-07-16 13:21 -------- d-----w- c:\program files\Subliminal Power 2009-10-07 15:37 . 2008-12-09 18:14 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs 2009-10-07 15:37 . 2008-12-09 18:12 0 ----a-w- c:\windows\system32\drivers\logiflt.iad 2009-10-07 14:45 . 2007-11-02 18:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-10-07 14:42 . 2008-12-17 20:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-10-07 14:18 . 2006-02-01 03:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint 2009-10-07 08:29 . 2006-07-22 22:45 -------- d-----w- c:\documents and settings\Tom\Application Data\Free Download Manager 2009-10-07 01:54 . 2009-04-12 03:34 -------- d-----w- c:\program files\Trend Micro 2009-10-07 01:28 . 2007-11-02 18:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-10-06 18:37 . 2009-04-12 03:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-06 18:35 . 2007-01-23 17:58 -------- d-----w- c:\documents and settings\Tom\Application Data\SlimBrowser 2009-10-06 18:30 . 2007-04-08 13:39 -------- d-----w- c:\documents and settings\Tom\Application Data\OpenOffice.org2 2009-10-02 13:50 . 2006-05-29 21:24 -------- d-----w- c:\program files\DYMO Label 2009-09-13 01:48 . 2009-06-07 04:54 -------- d-----w- c:\program files\LastPass 2009-09-13 01:48 . 2007-12-28 21:34 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM 2009-09-10 18:54 . 2009-04-12 03:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-10 18:53 . 2009-04-12 03:39 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-09-09 15:43 . 2009-09-02 15:15 -------- d-----w- c:\documents and settings\Tom\Application Data\HpUpdate 2009-09-09 04:20 . 2007-02-25 02:34 -------- d-----w- c:\documents and settings\Tom\Application Data\Skype 2009-09-09 04:07 . 2008-04-22 00:02 -------- d-----w- c:\documents and settings\Tom\Application Data\skypePM 2009-09-09 03:31 . 2006-02-01 03:43 -------- d-----w- c:\program files\Google 2009-09-07 13:32 . 2009-09-07 13:32 -------- d-----w- c:\documents and settings\Tom\Application Data\093249 2009-09-06 17:38 . 2009-09-06 17:38 -------- d-----w- c:\program files\Business Plan Pro 2009-09-05 19:45 . 2009-05-14 22:40 -------- d-----w- c:\program files\TextAloud 2009-08-17 20:18 . 2009-03-21 15:53 -------- d-----w- c:\program files\PsychicSalesLetter 2009-08-17 16:10 . 2007-11-02 18:58 1279456 ----a-w- c:\windows\system32\aswBoot.exe 2009-08-17 16:06 . 2007-11-02 18:58 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-08-17 16:06 . 2007-11-02 18:58 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-08-17 16:05 . 2008-04-05 13:38 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-08-17 16:05 . 2008-04-05 13:38 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-08-17 16:04 . 2007-11-02 18:58 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-08-17 16:04 . 2007-11-02 18:58 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-08-17 16:03 . 2007-11-02 18:58 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-08-17 16:02 . 2007-11-02 18:58 97480 ----a-w- c:\windows\system32\AvastSS.scr 2009-08-13 21:28 . 2006-07-21 22:35 -------- d-----w- c:\program files\DivX 2009-08-12 13:08 . 2009-04-16 02:13 -------- d-----w- c:\program files\HP 2009-08-12 13:08 . 2009-08-12 13:06 120069 ----a-w- c:\windows\hpqins00.dat 2009-08-06 23:24 . 2005-01-10 01:09 327896 ----a-w- c:\windows\system32\wucltui.dll 2009-08-06 23:24 . 2005-01-10 01:09 209632 ----a-w- c:\windows\system32\wuweb.dll 2009-08-06 23:24 . 2005-05-26 11:16 44768 ----a-w- c:\windows\system32\wups2.dll 2009-08-06 23:24 . 2005-01-10 01:09 35552 ----a-w- c:\windows\system32\wups.dll 2009-08-06 23:24 . 2005-01-10 01:09 53472 ------w- c:\windows\system32\wuauclt.exe 2009-08-06 23:24 . 2005-01-09 23:47 96480 ----a-w- c:\windows\system32\cdm.dll 2009-08-06 23:23 . 2005-01-10 01:09 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-08-06 23:23 . 2008-09-07 16:04 215920 ----a-w- c:\windows\system32\muweb.dll 2009-08-06 23:23 . 2008-09-07 16:04 274288 ----a-w- c:\windows\system32\mucltui.dll 2009-08-06 23:23 . 2005-01-10 01:09 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-08-05 09:01 . 2005-01-09 23:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-07-31 16:14 . 2008-03-28 21:58 516096 -c--a-w- c:\windows\iwexec.exe 2009-07-17 19:01 . 2005-01-09 23:47 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-14 23:18 . 2009-07-14 23:18 720896 ----a-w- c:\windows\iun6002.exe 2009-07-14 03:43 . 2005-01-09 23:49 286208 ----a-w- c:\windows\system32\wmpdxm.dll 2009-06-07 04:54 . 2009-06-07 04:54 4364032 ----a-w- c:\program files\Common Files\lpuninstall.exe 2007-07-20 22:57 . 2007-01-24 20:06 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll 2008-06-03 17:56 . 2008-06-03 17:56 44360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll 2008-06-03 17:56 . 2008-06-03 17:56 107928 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll 2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2006-05-18 23:27 . 2006-05-18 23:27 16496 -csha-w- c:\windows\system32\config\systemprofile\Application Data\Microsoft\Windows NT\DiskQuota\NTDiskQuotaSidCache.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue] @="{E300CD91-100F-4E67-9AF3-1384A6124015}" [HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green] @="{95A27763-F62A-4114-9072-E81D87DE3B68}" [HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Red] @="{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}" [HKEY_CLASSES_ROOT\CLSID\{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow] @="{5E529433-B50E-4bef-A63B-16A6B71B071A}" [HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}] 2008-01-18 20:57 483264 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-06-27 03:02 77824 ----a-w- c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 1207080] "Google Update"="c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-04-21 133104] "Subliminal Power"="c:\program files\Subliminal Power\Subliminal.exe" [2008-08-22 913617] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000] "Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2008-01-18 587712] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-18 7204864] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [X] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968] c:\documents and settings\Administrator\Start Menu\Programs\Startup\ Install LastPass FF RunOnce.lnk - c:\program files\Common Files\lpuninstall.exe [2009-6-7 4364032] c:\documents and settings\Tom\Start Menu\Programs\Startup\ Dropbox.lnk - c:\documents and settings\Tom\Application Data\Dropbox\bin\Dropbox.exe [2009-8-28 26784939] c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AntiVirService"=2 (0x2) "AntiVirScheduler"=2 (0x2) "PatchLink Update"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"= "c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\Participatory Culture Foundation\\Miro\\Miro_Downloader.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/5/2008 9:38 AM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/5/2008 9:38 AM 20560] R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [6/18/2008 8:55 AM 31896] S2 gupdate;Google Update Service;c:\program files\Google\Update\GoogleUpdate.exe [7/12/2008 10:58 AM 133104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-10-03 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-07-12 14:18] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2008-07-12 14:18] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2919136098-2494697476-672956410-1007Core.job - c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 13:06] 2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2919136098-2494697476-672956410-1007UA.job - c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-04-21 13:06] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = www.google.com uInternet Settings,ProxyOverride = 127.0.0.1;*.local uSearchURL,(Default) = hxxp://www.google.com/keyword/%s DPF: Microsoft XML Parser for Java DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} - hxxp://esupport.cf1live.com/esupport/static/weblaunch/weblaunch2.cab FF - ProfilePath - c:\documents and settings\Tom\Application Data\Mozilla\Firefox\Profiles\uzceb9ot.default\ FF - prefs.js: browser.startup.homepage - hxxps://mail.google.com/mail/?hl=en&utm_source=en-et-more&utm_medium=et&utm_campaign=en&shva=1#inbox FF - component: c:\documents and settings\Tom\Application Data\Mozilla\Firefox\Profiles\uzceb9ot.default\extensions\support@lastpass.com\platform\WINNT_x86-msvc\components\lpxpcom.dll FF - component: c:\program files\Google\Google Gears\Firefox\lib\ff35\gears.dll FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - plugin: c:\documents and settings\Tom\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npfdm.dll FF - plugin: c:\program files\OpenOffice.org 2.2\program\npsoplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-07 13:52 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2708) c:\windows\system32\WININET.dll c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll c:\documents and settings\Tom\Application Data\Dropbox\bin\DropboxExt.3.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-10-07 13:54 ComboFix-quarantined-files.txt 2009-10-07 17:53 ComboFix2.txt 2009-10-07 15:43 Pre-Run: 132,097,695,744 bytes free Post-Run: 132,073,848,832 bytes free 268 --- E O F --- 2009-09-10 00:05 |
|
|
|
|
Oct 7 2009, 12:01 PM
Post
#8
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
hi
Please download OTM
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. * I notice that you have no firewall on your PC, this is extremely dangerous and leaves your PC open to vulnerabilities, so please download and install one of the following programs : ZoneAlarm, Comodo, or Outpost Make sure you only use one firewall though. A tutorial on understanding and using firewalls may be found here. Download TFC to your desktop
Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan.
|
|
|
|
|
Oct 8 2009, 12:43 PM
Post
#9
|
|
|
Member Posts: 15 OS: xp |
power failure for past 24 hours. interupted kaspersky. will start up kaspersky again. Kaspersky is very slow. is that normal?
|
|
|
|
|
Oct 8 2009, 12:46 PM
Post
#10
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
yes it can take around 8 hours in some cases
|
|
|
|
|
Oct 9 2009, 03:26 AM
Post
#11
|
|
|
Member Posts: 15 OS: xp |
finally got it done..
you said I was not using a firewall, but I have been using windows' firewall. Is that not sufficient? How can I prevent these attacks in future (this is twice in 6 months)? I have read the security recom post on your site. Any other advice? thanks,t ok here you go... All processes killed ========== PROCESSES ========== ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== c:\documents and settings\Tom\Application Data\093249 moved successfully. c:\windows\iwexec.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. ->Temp folder emptied: 65536 bytes ->Temporary Internet Files folder emptied: 67 bytes ->FireFox cache emptied: 3964916 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Owner ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 521539 bytes ->FireFox cache emptied: 5356009 bytes User: Tom ->Temp folder emptied: 408 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 50687549 bytes ->Google Chrome cache emptied: 341965637 bytes %systemdrive% .tmp files removed: 0 bytes C:\WINDOWS\LMI4.tmp\script folder deleted successfully. C:\WINDOWS\LMI4.tmp folder deleted successfully. %systemroot% .tmp files removed: 2293245 bytes %systemroot%\System32 .tmp files removed: 11356177 bytes File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_58c.dat scheduled to be deleted on reboot. Windows Temp folder emptied: 16845 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 396.98 mb OTM by OldTimer - Version 3.0.0.6 log created on 10072009_150811 Files moved on Reboot... File C:\WINDOWS\temp\Perflib_Perfdata_58c.dat not found! Registry entries deleted on Reboot... Malwarebytes' Anti-Malware 1.41 Database version: 2916 Windows 5.1.2600 Service Pack 3 10/9/2009 5:18:35 AM mbam-log-2009-10-09 (05-18-35).txt Scan type: Quick Scan Objects scanned: 115740 Time elapsed: 3 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Friday, October 9, 2009 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, October 09, 2009 03:47:01 Records in database: 2939060 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Objects scanned: 150506 Threats found: 1 Infected objects found: 0 Suspicious objects found: 4 Scan duration: 04:24:27 File name / Threat / Threats count F:\Documents and Settings\Tom\Local Settings\Application Data\Microsoft\Outlook\archive.pst Suspicious: Exploit.HTML.Iframe.FileDownload 4 Selected area has been scanned. |
|
|
|
|
Oct 9 2009, 06:32 AM
Post
#12
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
I'd recommend disabling Windows firewall and use one of the ones I listed
Post a new HJT log |
|
|
|
|
Oct 9 2009, 07:21 AM
Post
#13
|
|
|
Member Posts: 15 OS: xp |
got it..
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:21:28 AM, on 10/9/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\Tom\Application Data\Dropbox\bin\Dropbox.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TextAloud\TAForIE.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Tom\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O4 - Startup: Dropbox.lnk = Application Data\Dropbox\bin\Dropbox.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.32.0\gears.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {97BB6657-DC7F-4489-9067-51FAB9D8857E} (CWebLaunchCtl Object) - http://esupport.cf1live.com/esupport/stati.../weblaunch2.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Update Service (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 8455 bytes |
|
|
|
|
Oct 9 2009, 07:26 AM
Post
#14
|
|
|
GeekU Teacher Posts: 35,115 From: Dublin OS: XP |
Your logs are clean
Follow these steps to uninstall Combofix and tools used in the removal of malware
Below I have included a number of recommendations for how to protect your computer against malware infections.
Thank you for your patience, and performing all of the procedures requested. |
|
|
|
|
Oct 9 2009, 08:20 AM
Post
#15
|
|
|
Member Posts: 15 OS: xp |
You are amazing, responsive and your service and commitment is deeply appreciated! Thank you.
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
10 / 468 | 5th February 2009 - 06:16 PM jfisch06 started - last by Rorschach112 |
|||||
|
 |
11 / 547 | 21st February 2009 - 12:00 PM kws_divine started - last by heir |
||||
|
3 / 303 | 4th June 2009 - 02:54 PM corleonexx2 started - last by handhfan |
|||||
|
13 / 197 | 23rd June 2009 - 12:35 PM libbipick started - last by Rorschach112 |
|||||
|
Time is now: 21st November 2009 - 08:58 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising