Yoog Search and Contextual Ads by Addestination [Closed], Pops Up and Computer Running Very Slow |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 May 27 2009, 05:56 PM
Post
#1
|
|
 Member  Posts: 55 OS: XP  |
My computer is running extremely slow. There is a toolbar for Yoog Search that we did not install. I have tried to uninstall but was unsuccessful. Pop Ups from Contextual Ads are popping up continuously...
Here is my HiJack This Log. Thanks! Goldilocks  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:56:00 PM, on 5/27/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\WINXP\Nhksrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINXP\System32\svchost.exe C:\WINXP\Explorer.EXE C:\WINXP\BCMSMMSG.exe C:\WINXP\MMKeybd.exe C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\WINXP\System32\dlbxcoms.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\Netropa\OSD.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\System32\WISPTIS.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM\..\Run: [DellTouch] C:\WINXP\MMKeybd.exe O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://www.myspace.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://152.1.131.130/activex/AMC.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/...tiveXPlugin.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://m-cam.uchicago.edu/activex/AMC.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - Winlogon Notify: avgrsstarter - C:\WINXP\SYSTEM32\avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbx_device - Dell - C:\WINXP\System32\dlbxcoms.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINXP\Nhksrv.exe O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINXP\System32\NMSSvc.exe -- End of file - 11194 bytes |
 |
 
|
|
May 27 2009, 09:26 PM
Post
#2
|
|
 Trusted Helper  Posts: 8,065 OS: XP Pro |
Hello goldilocks1990,
You may have used Malwarebytes before. If you have, and still have it on your machine, please update and run. Post the scan report back here. If you do not have Malwarebytes please download from Here or Here Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Next
So when you return please post
Note: Unless otherwise instructed always post the logs in the forum. If reports don't fit on one post. It might be necessary to break the logs up to get them on the forum. Just use as many posts as you need, that's fine. 
This post has been edited by emeraldnzl: May 28 2009, 01:31 PM |
|
|
|
|
May 28 2009, 08:01 PM
Post
#3
|
|
|
Member Posts: 55 OS: XP |
Thanks for helping me out.
Here are my two logs that you requested... Malware: Malwarebytes' Anti-Malware 1.37 Database version: 2182 Windows 5.1.2600 Service Pack 3 5/28/2009 8:31:15 PM mbam-log-2009-05-28 (20-31-15).txt Scan type: Quick Scan Objects scanned: 187147 Time elapsed: 12 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 3 Folders Infected: 1 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINXP\system32\twain32 (Backdoor.Bot) -> Quarantined and deleted successfully. Files Infected: c:\WINXP\system32\twain32\local.ds (Backdoor.Bot) -> Quarantined and deleted successfully. c:\WINXP\system32\twain32\user.ds (Backdoor.Bot) -> Quarantined and deleted successfully. |
|
|
|
|
May 28 2009, 08:01 PM
Post
#4
|
|
|
Member Posts: 55 OS: XP |
Here is the OTL log:
Error: Unable to interpret <:OTLI> in the current context! Error: Unable to interpret <PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context! Error: Unable to interpret <PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)> in the current context! Error: Unable to interpret <PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaultenginename: "Yoog Search"> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www14.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.selectedEngine: "Yoog Search"> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www14.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaultenginename: "Yoog Search"> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www14.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.selectedEngine: "Yoog Search"> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www14.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www8.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www8.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www8.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www8.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www15.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www15.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www5.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www7.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www7.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www7.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www7.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www13.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www13.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www13.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www13.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www3.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www3.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www3.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www3.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www10.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www10.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www10.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www10.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www11.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www11.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www11.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www11.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www2.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www2.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www2.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www2.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www26.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www26.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www26.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www26.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www5.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www5.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www5.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www5.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www1.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www1.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www1.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www1.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www9.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www9.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www9.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www9.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www6.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www6.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www6.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www6.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "http://www27.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - prefs.js..keyword.URL: "http://www27.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..browser.search.defaulturl: "http://www27.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.URL: "http://www27.yoog.com/search.php?q="> in the current context! Error: Unable to interpret <FF - user.js..keyword.enabled: true> in the current context! ========== FILES ========== File/Folder C:\Program Files\IEToolbar not found. File/Folder C:\Program Files\Mozilla Firefox\components\nsadzgalore.dll not found. File/Folder C:\Program Files\Mozilla Firefox\components\nsadsoftinc.dll not found. File/Folder C:\Program Files\Mozilla Firefox\components\nsBrowserOpt.dll not found. File/Folder C:\Program Files\Mozilla Firefox\searchplugins\Yoog.xml not found. File/Folder C:\Program Files\Mozilla Firefox\components\nsBrowserDc.dll not found. File/Folder C:\Program Files\Mozilla Firefox\components\nsdcads.dll not found. File/Folder C:\Documents and Settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\Yoog Search.xml not found. File/Folder C:\WINXP\system32\nsj*.dll not found. File/Folder C:\WINXP\system32\nsv*.dll not found. File/Folder C:\WINXP\system32\nsf*.dll not found. File/Folder C:\WINXP\mutfp*.exe not found. File/Folder C:\WINXP\obwu*.exe not found. File/Folder C:\WINXP\ntaj*.exe not found. File/Folder C:\WINXP\nwuhr*.exe not found. File/Folder C:\WINXP\System32\nss*.dll not found. File/Folder C:\WINXP\system32\*-uninst.exe not found. File/Folder C:\WINXP\system32\*-remove.exe not found. File/Folder C:\WINXP\system32\nsr*.dll not found. File/Folder C:\WINXP\reax*.exe not found. File/Folder C:\WINXP\giptf*.exe not found. File/Folder C:\WINXP\tkoo*.exe not found. File/Folder C:\WINXP\axjth*.exe not found. File/Folder C:\WINXP\ertbg*.exe not found. File/Folder C:\WINXP\jnnmp*.exe not found. File/Folder C:\WINXP\bprxe*.exe not found. File/Folder C:\WINXP\xwisg*.exe not found. File/Folder C:\WINXP\jpng*.exe not found. File/Folder C:\WINXP\fhsv*.exe not found. File/Folder C:\WINXP\dfmqc*.exe not found. File/Folder C:\WINXP\wgfp*.exe not found. File/Folder C:\WINXP\gweq*.exe not found. File/Folder C:\WINXP\system32\yprhhrqubcbujp.exe not found. File/Folder C:\WINXP\system32\ucicolizrhssr.dll not found. File/Folder C:\WINXP\system32\hiwdrlnk.exe not found. File/Folder C:\Documents and Settings\Brad.HOME-95K9VV3PU6\Start Menu\Programs\Startup\runit_32.lnk not found. File/Folder C:\Program Files\runit not found. File/Folder C:\WINXP\System32\dsygtypzdloyoxivg.exe not found. File/Folder C:\WINXP\System32\qdfggdhhofhhylbfx.exe not found. File/Folder C:\Program Files\mozilla firefox\components\????????-????-????-????-????????????.dll not found. C:\WINXP\System32\463dab3a-4c0b-f691-ad91-ad1d4501e345.exe moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0d2e786-354b-fea1-8de7-883e7524e6d2}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0d2e786-354b-fea1-8de7-883e7524e6d2}\ not found. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINXP\temp\Perflib_Perfdata_71c.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 05282009_204225 Files moved on Reboot... File C:\WINXP\temp\Perflib_Perfdata_71c.dat not found! Registry entries deleted on Reboot... |
|
|
|
|
May 28 2009, 08:06 PM
Post
#5
|
|
|
Trusted Helper Posts: 8,065 OS: XP Pro |
Hi goldilocks1990,
Please download ComboFix from one of these locations: NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable. Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a new HijackThis log. |
|
|
|
|
May 29 2009, 09:35 PM
Post
#6
|
|
|
Member Posts: 55 OS: XP |
Here is the Combo log:
ComboFix 09-05-29.01 - Brad 05/29/2009 22:16.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.260 [GMT -5:00] Running from: c:\documents and settings\Brad.HOME-95K9VV3PU6\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 ))))))))))))))))))))))))))))))) . 2009-05-29 01:42 . 2009-05-29 01:42 -------- d-----w C:\_OTL 2009-05-29 01:12 . 2009-05-29 01:12 3371383 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 2051864 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgcorex.dll 2009-05-26 17:34 . 2009-05-05 15:45 2302232 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avguiadv.dll 2009-05-26 17:34 . 2009-05-05 15:45 3399960 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgui.exe 2009-05-26 17:34 . 2009-05-05 15:45 3288344 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 354584 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgxch32.dll 2009-05-26 17:34 . 2009-05-05 15:45 424472 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgwdwsc.dll 2009-05-26 17:34 . 2009-05-05 15:45 312088 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avglngx.dll 2009-05-26 17:34 . 2009-05-05 15:45 177432 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgmail.dll 2009-05-26 17:34 . 2009-05-05 15:45 486168 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgrsx.exe 2009-05-26 17:33 . 2009-05-05 15:40 1437464 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgupd.dll 2009-05-26 17:33 . 2009-05-05 15:40 755992 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avginet.dll 2009-05-06 19:01 . 2009-05-06 19:01 -------- d--h--w c:\documents and settings\Default User.WINDOWS1 2009-05-06 19:01 . 2009-05-06 19:01 -------- d-----w c:\documents and settings\All Users.WINDOWS1 2009-05-06 11:34 . 2009-03-11 03:18 453512 ----a-w c:\winxp\system32\KB905474\wgasetup.exe 2009-05-06 11:34 . 2009-03-11 03:26 1403264 ----a-w c:\winxp\system32\KB905474\wganotifypackageinner.exe 2009-05-06 11:34 . 2009-05-06 11:34 -------- d-----w c:\winxp\system32\KB905474 2009-05-05 01:26 . 2009-05-05 01:26 -------- d-----w C:\_OTListIt 2009-05-03 16:31 . 2009-05-03 16:31 -------- d-----w c:\program files\7-Zip . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-30 02:59 . 2006-03-04 00:41 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\AdobeUM 2009-05-29 01:13 . 2009-01-19 14:22 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-26 18:20 . 2009-01-19 14:22 40160 ----a-w c:\winxp\system32\drivers\mbamswissarmy.sys 2009-05-26 18:19 . 2009-01-19 14:22 19096 ----a-w c:\winxp\system32\drivers\mbam.sys 2009-05-05 15:45 . 2009-01-21 01:37 11952 ----a-w c:\winxp\system32\avgrsstx.dll 2009-05-05 15:45 . 2009-01-21 01:37 325896 ----a-w c:\winxp\system32\drivers\avgldx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 27784 ----a-w c:\winxp\system32\drivers\avgmfx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 108552 ----a-w c:\winxp\system32\drivers\avgtdix.sys 2009-05-03 16:34 . 2009-01-24 16:01 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\WinZip 2009-05-01 00:01 . 2009-01-18 17:05 -------- d-----w c:\program files\Trend Micro 2009-04-16 00:35 . 2009-04-16 00:35 1915520 ----a-w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-04-12 21:31 . 2009-04-12 21:29 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Cucusoft,inc 2009-04-12 21:30 . 2009-04-12 21:30 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\cucusoft 2009-04-12 21:29 . 2009-04-12 21:29 -------- d-----w c:\program files\Cucusoft 2009-04-12 21:29 . 2009-04-12 21:25 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\GetRightToGo 2009-04-07 02:49 . 2009-04-07 02:48 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-07 02:49 . 2006-01-08 02:23 -------- d-----w c:\program files\iTunes 2009-04-07 02:48 . 2004-01-09 23:39 -------- d-----w c:\program files\iPod 2009-04-07 02:48 . 2008-02-17 23:17 -------- d-----w c:\program files\Common Files\Apple 2009-04-07 02:36 . 2009-04-07 02:36 75048 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-05 14:18 . 2006-02-18 04:44 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\DVD Shrink 2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 21:32 . 2008-01-29 17:01 23400 ----a-w c:\winxp\system32\drivers\GEARAspiWDM.sys 2009-03-15 00:22 . 2006-02-18 23:07 10 ----a-w c:\winxp\popcinfo.dat 2009-03-06 14:22 . 2006-02-19 19:07 284160 ----a-w c:\winxp\system32\pdh.dll 2009-03-06 04:59 . 2009-03-13 23:52 1900544 ----a-w c:\winxp\system32\usbaaplrc.dll 2009-03-06 04:59 . 2008-02-17 23:18 36864 ----a-w c:\winxp\system32\drivers\usbaapl.sys 2009-03-03 00:18 . 2005-10-21 18:51 826368 ----a-w c:\winxp\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 1957888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\winxp\system32\NeroCheck.exe" [2001-07-09 155648] "DellTouch"="c:\winxp\MMKeybd.exe" [2001-09-05 163840] "dlbxmon.exe"="c:\program files\Dell Photo AIO Printer 962\dlbxmon.exe" [2004-08-27 417792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600] "LVCOMSX"="c:\winxp\system32\LVCOMSX.EXE" [2004-10-08 221184] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-22 185872] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-05 1947928] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "BCMSMMSG"="BCMSMMSG.exe" - c:\winxp\BCMSMMSG.exe [2003-08-29 122880] c:\documents and settings\Brad.HOME-95K9VV3PU6\Start Menu\Programs\Startup\ DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848] c:\documents and settings\All Users.WINXP\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-8-5 724992] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-05 15:45 11952 ----a-w c:\winxp\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-10-17 02:35 87352 ----a-w c:\winxp\system32\LMIinit.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave"= serwvdrv.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\Ring Factory\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winxp\system32\drivers\avgldx86.sys [1/20/2009 8:37 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\winxp\system32\drivers\avgtdix.sys [1/20/2009 8:37 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/1/2009 10:18 AM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/1/2009 10:18 AM 298776] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\winxp\system32\drivers\LMIRfsDriver.sys [12/10/2008 7:04 PM 47640] R2 Nhksrv;Netropa NHK Server;c:\winxp\Nhksrv.exe [2/17/2006 11:40 PM 28672] R3 Msikbd2k;DellTouch;c:\winxp\system32\drivers\Msikbd2k.sys [2/17/2006 11:40 PM 6942] S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?] S3 ati2mpaa;ati2mpaa;c:\winxp\system32\drivers\ati2mpaa.sys [2/17/2006 1:45 PM 281856] S4 LMIRfsClientNP;LMIRfsClientNP; [x] . Contents of the 'Scheduled Tasks' folder 2009-05-26 c:\winxp\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] 2009-05-30 c:\winxp\Tasks\User_Feed_Synchronization-{4F637E82-0A9F-48E5-9DE6-DAE71EA0AF8A}.job - c:\winxp\system32\msfeedssync.exe [2006-10-17 18:58] 2009-05-29 c:\winxp\Tasks\WGASetup.job - c:\winxp\system32\KB905474\wgasetup.exe [2009-05-06 03:18] . - - - - ORPHANS REMOVED - - - - HKLM-Run-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe SafeBoot-procexp90.Sys . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm Trusted Zone: myspace.com\www Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://m-cam.uchicago.edu/activex/AMC.cab FF - ProfilePath - c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-29 22:20 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run MsnMsgr = "c:\program files\MSN Messenger\MsnMsgr.Exe" /background?g scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1292428093-602162358-725345543-1004\Software\SecuROM\License information*] "datasecu"=hex:27,87,ad,95,6b,46,2f,6a,1f,e2,a6,b2,d9,4f,40,9a,f9,dc,e8,76,06, 44,96,16,7c,c2,62,67,ee,0d,34,15,e1,78,a2,55,c9,15,90,f6,98,7e,90,85,9a,6a,\ "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(668) c:\winxp\system32\LMIinit.dll c:\winxp\system32\LMIRfsClientNP.dll - - - - - - - > 'explorer.exe'(2596) c:\progra~1\WINDOW~2\wmpband.dll c:\winxp\system32\WPDShServiceObj.dll c:\winxp\system32\PortableDeviceTypes.dll c:\winxp\system32\PortableDeviceApi.dll c:\winxp\system32\LMIRfsClientNP.dll . Completion time: 2009-05-30 22:30 ComboFix-quarantined-files.txt 2009-05-30 03:29 Pre-Run: 3,351,568,384 bytes free Post-Run: 3,610,234,880 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=signature(9dc96e9e)disk(0)rdisk(0)partition(2)\WINDOWS1 [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons signature(9dc96e9e)disk(0)rdisk(0)partition(2)\WINDOWS1="Microsoft Windows XP Professional" /fastdetect multi(0)disk(0)rdisk(0)partition(2)\WINXP="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 205 --- E O F --- 2009-05-26 09:07 |
|
|
|
|
May 29 2009, 09:37 PM
Post
#7
|
|
|
Member Posts: 55 OS: XP |
Here is the Hijack Log:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:37:04 PM, on 5/29/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\WINXP\Nhksrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINXP\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINXP\BCMSMMSG.exe C:\WINXP\MMKeybd.exe C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\WINXP\system32\wscntfy.exe C:\WINXP\System32\dlbxcoms.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Netropa\OSD.exe C:\WINXP\system32\ctfmon.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINXP\System32\WISPTIS.EXE C:\Program Files\AVG\AVG8\avgtray.exe C:\WINXP\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM\..\Run: [DellTouch] C:\WINXP\MMKeybd.exe O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://www.myspace.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://152.1.131.130/activex/AMC.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/...tiveXPlugin.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://m-cam.uchicago.edu/activex/AMC.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - Winlogon Notify: avgrsstarter - C:\WINXP\SYSTEM32\avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbx_device - Dell - C:\WINXP\System32\dlbxcoms.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINXP\Nhksrv.exe O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINXP\System32\NMSSvc.exe -- End of file - 11141 bytes |
|
|
|
|
May 29 2009, 11:47 PM
Post
#8
|
|
|
Trusted Helper Posts: 8,065 OS: XP Pro |
Hello goldilocks1990,
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html Now 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE Registry:: [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] "BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00 Reboot:: Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it will produce a log for you at C:\ComboFix.txt Please post that here for further review. Also tell me how your machine is performing now |
|
|
|
|
May 31 2009, 08:07 PM
Post
#9
|
|
|
Member Posts: 55 OS: XP |
Hello Emeraldnzl...
My computer is still running sluggish (it might be a little faster, but not much). I still have the Yoog Search window on my toolbar, too...and I still can't find a way to uninstall it. However, the Addestination pop-ups seem to have stop (I think). Here is my ComboFix Log: (I am also going to attach a new HiJack This log just in case you need it, too) ComboFix 09-05-29.01 - Brad 05/31/2009 20:17.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.176 [GMT -5:00] Running from: c:\documents and settings\Brad.HOME-95K9VV3PU6\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Brad.HOME-95K9VV3PU6\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2009-05-01 to 2009-06-01 ))))))))))))))))))))))))))))))) . 2009-06-01 00:58 . 2009-06-01 01:15 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\NOS 2009-06-01 00:58 . 2009-06-01 01:15 -------- d-----w c:\program files\NOS 2009-05-31 20:24 . 2009-05-31 20:24 -------- d--h--w c:\documents and settings\Default User.WINDOWS1 2009-05-31 20:24 . 2009-05-31 20:24 -------- d-----w c:\documents and settings\All Users.WINDOWS1 2009-05-29 01:42 . 2009-05-29 01:42 -------- d-----w C:\_OTL 2009-05-29 01:12 . 2009-05-29 01:12 3371383 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 2051864 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgcorex.dll 2009-05-26 17:34 . 2009-05-05 15:45 2302232 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avguiadv.dll 2009-05-26 17:34 . 2009-05-05 15:45 3399960 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgui.exe 2009-05-26 17:34 . 2009-05-05 15:45 3288344 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 354584 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgxch32.dll 2009-05-26 17:34 . 2009-05-05 15:45 424472 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgwdwsc.dll 2009-05-26 17:34 . 2009-05-05 15:45 312088 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avglngx.dll 2009-05-26 17:34 . 2009-05-05 15:45 177432 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgmail.dll 2009-05-26 17:34 . 2009-05-05 15:45 486168 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgrsx.exe 2009-05-26 17:33 . 2009-05-05 15:40 1437464 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgupd.dll 2009-05-26 17:33 . 2009-05-05 15:40 755992 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avginet.dll 2009-05-06 11:34 . 2009-03-11 03:18 453512 ----a-w c:\winxp\system32\KB905474\wgasetup.exe 2009-05-06 11:34 . 2009-03-11 03:26 1403264 ----a-w c:\winxp\system32\KB905474\wganotifypackageinner.exe 2009-05-06 11:34 . 2009-05-06 11:34 -------- d-----w c:\winxp\system32\KB905474 2009-05-05 01:26 . 2009-05-05 01:26 -------- d-----w C:\_OTListIt 2009-05-03 16:31 . 2009-05-03 16:31 -------- d-----w c:\program files\7-Zip . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-30 02:59 . 2006-03-04 00:41 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\AdobeUM 2009-05-29 01:13 . 2009-01-19 14:22 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-26 18:20 . 2009-01-19 14:22 40160 ----a-w c:\winxp\system32\drivers\mbamswissarmy.sys 2009-05-26 18:19 . 2009-01-19 14:22 19096 ----a-w c:\winxp\system32\drivers\mbam.sys 2009-05-05 15:45 . 2009-01-21 01:37 11952 ----a-w c:\winxp\system32\avgrsstx.dll 2009-05-05 15:45 . 2009-01-21 01:37 325896 ----a-w c:\winxp\system32\drivers\avgldx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 27784 ----a-w c:\winxp\system32\drivers\avgmfx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 108552 ----a-w c:\winxp\system32\drivers\avgtdix.sys 2009-05-03 16:34 . 2009-01-24 16:01 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\WinZip 2009-05-01 00:01 . 2009-01-18 17:05 -------- d-----w c:\program files\Trend Micro 2009-04-16 00:35 . 2009-04-16 00:35 1915520 ----a-w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-04-12 21:31 . 2009-04-12 21:29 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Cucusoft,inc 2009-04-12 21:30 . 2009-04-12 21:30 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\cucusoft 2009-04-12 21:29 . 2009-04-12 21:29 -------- d-----w c:\program files\Cucusoft 2009-04-12 21:29 . 2009-04-12 21:25 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\GetRightToGo 2009-04-07 02:49 . 2009-04-07 02:48 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-07 02:49 . 2006-01-08 02:23 -------- d-----w c:\program files\iTunes 2009-04-07 02:48 . 2004-01-09 23:39 -------- d-----w c:\program files\iPod 2009-04-07 02:48 . 2008-02-17 23:17 -------- d-----w c:\program files\Common Files\Apple 2009-04-07 02:36 . 2009-04-07 02:36 75048 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-05 14:18 . 2006-02-18 04:44 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\DVD Shrink 2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 21:32 . 2008-01-29 17:01 23400 ----a-w c:\winxp\system32\drivers\GEARAspiWDM.sys 2009-03-15 00:22 . 2006-02-18 23:07 10 ----a-w c:\winxp\popcinfo.dat 2009-03-06 14:22 . 2006-02-19 19:07 284160 ----a-w c:\winxp\system32\pdh.dll 2009-03-06 04:59 . 2009-03-13 23:52 1900544 ----a-w c:\winxp\system32\usbaaplrc.dll 2009-03-06 04:59 . 2008-02-17 23:18 36864 ----a-w c:\winxp\system32\drivers\usbaapl.sys . ((((((((((((((((((((((((((((( SnapShot@2009-05-30_03.21.01 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-01 01:29 . 2009-06-01 01:29 16384 c:\winxp\temp\Perflib_Perfdata_7bc.dat - 2009-05-29 01:46 . 2009-05-29 01:46 16384 c:\winxp\temp\Perflib_Perfdata_7bc.dat + 2006-02-21 22:38 . 2009-06-01 00:58 49152 c:\winxp\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2006-02-21 22:38 . 2009-02-07 00:56 49152 c:\winxp\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2006-02-18 00:59 . 2009-06-01 00:58 32768 c:\winxp\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2006-02-18 00:59 . 2009-02-07 00:56 32768 c:\winxp\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2006-02-18 00:59 . 2009-06-01 00:58 16384 c:\winxp\system32\config\systemprofile\Cookies\index.dat - 2006-02-18 00:59 . 2009-02-07 00:56 16384 c:\winxp\system32\config\systemprofile\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 1957888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\winxp\system32\NeroCheck.exe" [2001-07-09 155648] "DellTouch"="c:\winxp\MMKeybd.exe" [2001-09-05 163840] "dlbxmon.exe"="c:\program files\Dell Photo AIO Printer 962\dlbxmon.exe" [2004-08-27 417792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600] "LVCOMSX"="c:\winxp\system32\LVCOMSX.EXE" [2004-10-08 221184] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-22 185872] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-05 1947928] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "BCMSMMSG"="BCMSMMSG.exe" - c:\winxp\BCMSMMSG.exe [2003-08-29 122880] c:\documents and settings\Brad.HOME-95K9VV3PU6\Start Menu\Programs\Startup\ DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848] c:\documents and settings\All Users.WINXP\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-8-5 724992] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-05 15:45 11952 ----a-w c:\winxp\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-10-17 02:35 87352 ----a-w c:\winxp\system32\LMIinit.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave"= serwvdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\Ring Factory\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winxp\system32\drivers\avgldx86.sys [1/20/2009 8:37 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\winxp\system32\drivers\avgtdix.sys [1/20/2009 8:37 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/1/2009 10:18 AM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/1/2009 10:18 AM 298776] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\winxp\system32\drivers\LMIRfsDriver.sys [12/10/2008 7:04 PM 47640] R2 Nhksrv;Netropa NHK Server;c:\winxp\Nhksrv.exe [2/17/2006 11:40 PM 28672] R3 Msikbd2k;DellTouch;c:\winxp\system32\drivers\Msikbd2k.sys [2/17/2006 11:40 PM 6942] S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?] S3 ati2mpaa;ati2mpaa;c:\winxp\system32\drivers\ati2mpaa.sys [2/17/2006 1:45 PM 281856] S4 LMIRfsClientNP;LMIRfsClientNP; [x] . Contents of the 'Scheduled Tasks' folder 2009-05-26 c:\winxp\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] 2009-06-01 c:\winxp\Tasks\User_Feed_Synchronization-{4F637E82-0A9F-48E5-9DE6-DAE71EA0AF8A}.job - c:\winxp\system32\msfeedssync.exe [2006-10-17 18:58] 2009-06-01 c:\winxp\Tasks\WGASetup.job - c:\winxp\system32\KB905474\wgasetup.exe [2009-05-06 03:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm Trusted Zone: myspace.com\www Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://m-cam.uchicago.edu/activex/AMC.cab FF - ProfilePath - c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-31 20:29 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1292428093-602162358-725345543-1004\Software\SecuROM\License information*] "datasecu"=hex:27,87,ad,95,6b,46,2f,6a,1f,e2,a6,b2,d9,4f,40,9a,f9,dc,e8,76,06, 44,96,16,7c,c2,62,67,ee,0d,34,15,e1,78,a2,55,c9,15,90,f6,98,7e,90,85,9a,6a,\ "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(668) c:\winxp\system32\LMIinit.dll c:\winxp\system32\LMIRfsClientNP.dll - - - - - - - > 'explorer.exe'(3444) c:\progra~1\WINDOW~2\wmpband.dll c:\winxp\system32\mshtml.dll c:\winxp\system32\WPDShServiceObj.dll c:\winxp\system32\PortableDeviceTypes.dll c:\winxp\system32\PortableDeviceApi.dll c:\winxp\system32\LMIRfsClientNP.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\winxp\system32\wscntfy.exe c:\winxp\system32\dlbxcoms.exe c:\program files\Netropa\OSD.exe c:\program files\iPod\bin\iPodService.exe c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe . ************************************************************************** . Completion time: 2009-06-01 20:44 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-01 01:44 ComboFix2.txt 2009-05-30 03:30 Pre-Run: 3,466,756,096 bytes free Post-Run: 3,450,134,528 bytes free 222 --- E O F --- 2009-05-26 09:07 |
|
|
|
|
May 31 2009, 08:12 PM
Post
#10
|
|
|
Member Posts: 55 OS: XP |
Here is a new Hijack This Log...
Thanks so much for helping me out!  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:09:19 PM, on 5/31/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\svchost.exe C:\WINXP\system32\spoolsv.exe C:\WINXP\Nhksrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINXP\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINXP\system32\wscntfy.exe C:\WINXP\BCMSMMSG.exe C:\WINXP\MMKeybd.exe C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINXP\System32\dlbxcoms.exe C:\Program Files\Netropa\OSD.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Southwest Airlines\Ding\Ding.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINXP\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINXP\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM\..\Run: [DellTouch] C:\WINXP\MMKeybd.exe O4 - HKLM\..\Run: [dlbxmon.exe] "C:\Program Files\Dell Photo AIO Printer 962\dlbxmon.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://www.myspace.com O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://152.1.131.130/activex/AMC.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} - http://www.sibelius.com/download/software/...tiveXPlugin.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab53083.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://m-cam.uchicago.edu/activex/AMC.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - Winlogon Notify: avgrsstarter - C:\WINXP\SYSTEM32\avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlbx_device - Dell - C:\WINXP\System32\dlbxcoms.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINXP\Nhksrv.exe O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINXP\System32\NMSSvc.exe -- End of file - 11264 bytes |
|
|
|
|
Jun 1 2009, 12:33 AM
Post
#11
|
|
|
Trusted Helper Posts: 8,065 OS: XP Pro |
Hello again goldilocks1990,
Now 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE KillAll:: File:: c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\ Firefox:: FF - ProfilePath - c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\ FF - prefs.js: browser.search.defaulturl - FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll Reboot:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it will produce a log for you at C:\ComboFix.txt Please post that here for further review. Next Download FoxScan to your desktop.
So when you return please post
|
|
|
|
|
Jun 3 2009, 07:25 PM
Post
#12
|
|
|
Member Posts: 55 OS: XP |
Howdy...
Here is the FoxScan Log: FoxScan Version 1.1.1 By Loup blanc - Zebulon.fr Scan started Wed 06/03/2009 at 19:47 Microsoft Windows XP Professional Service Pack 3 [Version 5.1.2600] Mozilla Firefox version : 3.0.10 (en-US) Installation folder : C:\Program Files\Mozilla Firefox ================================================================================= ---------- User account : Administrator.HOME-95K9VV3PU6 ================================================================================= //////////// Setting \\\\\\\\\\\\\ //////////// Add-on \\\\\\\\\\\\\ //////////// Search plugins \\\\\\\\\\\\\ ================================================================================= ---------- User account : Brad.HOME-95K9VV3PU6 [Current session] ================================================================================= Profile name : HOME-95K9VV3PU6\Application Data\mozilla\firefox\Profiles\62uz97bf Profile folder : C:\Documents and Settings\Brad.HOME-95K9VV3PU6\Application Data\mozilla\firefox\Profiles\62uz97bf\ //////////// Setting \\\\\\\\\\\\\ ======= Profile name : HOME-95K9VV3PU6\Application Data\mozilla\firefox\Profiles\62uz97bf ======= Firefox update : Activated Add-on update : Activated Search engines update : Activated Java : Activated Javascript : Activated Proxy : No Proxy //////////// Add-on \\\\\\\\\\\\\ ======= Profile name : HOME-95K9VV3PU6\Application Data\mozilla\firefox\Profiles\62uz97bf ======= Installation notification for Add-on is enabled //////////// Search plugins \\\\\\\\\\\\\ ======= Profile name : HOME-95K9VV3PU6\Application Data\mozilla\firefox\Profiles\62uz97bf ======= Search in "prefs.js" : browser.search.defaultenginename : browser.search.defaulturl : browser.search.selectedEngine : keyword.URL : keyword.enable : --------- Search engines found ------------ + Search form configured for the engine ================================================================================= ---------- User account : Ruth ================================================================================= Profile name : default Profile folder : C:\Documents and Settings\Ruth\Application Data\mozilla\firefox\Profiles\br7vqldw.default\ //////////// Setting \\\\\\\\\\\\\ ======= Profile name : default ======= Firefox update : Activated Add-on update : Activated Search engines update : Activated Java : Activated Javascript : Activated Proxy : No Proxy //////////// Add-on \\\\\\\\\\\\\ ======= Profile name : default ======= Installation notification for Add-on is enabled Nom : Default Dossier : C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\ Etat : actif //////////// Search plugins \\\\\\\\\\\\\ ======= Profile name : default ======= Search in "prefs.js" : browser.search.defaultenginename : browser.search.defaulturl : browser.search.selectedEngine : keyword.URL : keyword.enable : --------- Search engines found ------------ + Search form configured for the engine ================================================================================= ---------- Common section ================================================================================= //////////// DLL found in C:\Program Files\Mozilla Firefox\components \\\\\\\\\\\\\ browserdirprovider.dll brwsrcmp.dll ------------------------------------------------------ //////////// Search plugins \\\\\\\\\\\\\ --------- Search engines found ------------ + Search form configured for the engine C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml Template : http://www.amazon.com/exec/obidos/external-search/ C:\Program Files\Mozilla Firefox\searchplugins\answers.xml Template : http://www.answers.com/main/ntquery C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml Template : http://search.creativecommons.org/ C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml Template : http://rover.ebay.com/rover/1/711-47294-18009-3/4 C:\Program Files\Mozilla Firefox\searchplugins\google.xml Template : http://www.google.com/search C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml Template : http://en.wikipedia.org/wiki/Special:Search C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml Template : http://search.yahoo.com/search ------------------------------------------------------ //////////// Plugins set in registry \\\\\\\\\\\\\ [HKEY_LOCAL_MACHINE\software\mozillaplugins\@Apple.com/iTunes,version=] "Description"="iTunes Detector Plug-in" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@Apple.com/iTunes,version=1.0] "Vendor"="Apple Inc." "Path"="C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@divx.com/DivX Browser Plugin,version=1.0.0] "Description"="DivX Web Player" "Vendor"="DivX,Inc." "Path"="C:\Program Files\DivX\DivX Web Player\npdivx32.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@macromedia.com/FlashPlayer9] "Description"="Adobe Flash Player 9.0" "Vendor"="Adobe Systems Inc." "Path"="C:\WINXP\system32\Macromed\Flash\NPSWF32.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1] "Description"="Yahoo Messenger State Plugin" "Vendor"="Yahoo" "Path"="C:\Program Files\Yahoo!\Shared\npYState.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nppl3260;version=6.0.12.69] "Description"="RealPlayer™ LiveConnect-Enabled Plug-In" "Vendor"="RealNetworks" "Path"="C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nprjplug;version=1.0.3.69] "Description"="RealJukebox Netscape Plugin" "Vendor"="RealNetworks" "Path"="C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nprpjplug;version=6.0.12.69] "Description"="6.0.12.69" "Vendor"="RealNetworks" "Path"="C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll" [HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/nsJSRealPlayerPlugin;version=] [HKEY_LOCAL_MACHINE\software\mozillaplugins\@real.com/RhapsodyPlayerEngine,version=1.0] "Description"="Rhapsody Control" "Vendor"="RealNetworks" "Path"="C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll" [HKEY_CURRENT_USER\software\mozillaplugins\@macromedia.com/FlashPlayer9] "Description"="Adobe Flash Player 9.0" "Vendor"="Adobe Systems Inc." "Path"="C:\WINXP\system32\Macromed\Flash\NPSWF32.dll" [HKEY_CURRENT_USER\software\mozillaplugins\@real.com/RhapsodyPlayerEngine] "Description"="Browser plugin for Rhapsody on the Web" "Vendor"="RealNetworks" "Path"="C:\Documents and Settings\Brad.HOME-95K9VV3PU6\Application Data\nprhapengine.dll" ------------------------------------------------------ //////////// Additional search... \\\\\\\\\\\\\ ==== Additional extension ==== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Program Files\Real\RealPlayer\browserrecord" "{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG8\Firefox" "jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] =========================== End of report =========================== Here is the ComboFix Log you requested: ComboFix 09-05-29.01 - Brad 06/01/2009 22:28.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.270 [GMT -5:00] Running from: c:\documents and settings\Brad.HOME-95K9VV3PU6\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Brad.HOME-95K9VV3PU6\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FILE :: "c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\AVG\AVG8\Firefox\components\avgssff.dll c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll . ((((((((((((((((((((((((( Files Created from 2009-05-02 to 2009-06-02 ))))))))))))))))))))))))))))))) . 2009-06-01 22:35 . 2009-06-01 22:35 -------- d--h--w c:\documents and settings\Default User.WINDOWS1 2009-06-01 22:35 . 2009-06-01 22:35 -------- d-----w c:\documents and settings\All Users.WINDOWS1 2009-06-01 00:58 . 2009-06-01 01:15 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\NOS 2009-06-01 00:58 . 2009-06-01 01:15 -------- d-----w c:\program files\NOS 2009-05-29 01:42 . 2009-05-29 01:42 -------- d-----w C:\_OTL 2009-05-29 01:12 . 2009-05-29 01:12 3371383 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 2051864 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgcorex.dll 2009-05-26 17:34 . 2009-05-05 15:45 2302232 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avguiadv.dll 2009-05-26 17:34 . 2009-05-05 15:45 3399960 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgui.exe 2009-05-26 17:34 . 2009-05-05 15:45 3288344 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\setup.exe 2009-05-26 17:34 . 2009-05-05 15:45 354584 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgxch32.dll 2009-05-26 17:34 . 2009-05-05 15:45 424472 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgwdwsc.dll 2009-05-26 17:34 . 2009-05-05 15:45 312088 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avglngx.dll 2009-05-26 17:34 . 2009-05-05 15:45 177432 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgmail.dll 2009-05-26 17:34 . 2009-05-05 15:45 486168 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgrsx.exe 2009-05-26 17:33 . 2009-05-05 15:40 1437464 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avgupd.dll 2009-05-26 17:33 . 2009-05-05 15:40 755992 ----a-w c:\documents and settings\All Users.WINXP\Application Data\avg8\update\backup\avginet.dll 2009-05-06 11:34 . 2009-03-11 03:18 453512 ----a-w c:\winxp\system32\KB905474\wgasetup.exe 2009-05-06 11:34 . 2009-03-11 03:26 1403264 ----a-w c:\winxp\system32\KB905474\wganotifypackageinner.exe 2009-05-06 11:34 . 2009-05-06 11:34 -------- d-----w c:\winxp\system32\KB905474 2009-05-05 01:26 . 2009-05-05 01:26 -------- d-----w C:\_OTListIt 2009-05-03 16:31 . 2009-05-03 16:31 -------- d-----w c:\program files\7-Zip . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-30 02:59 . 2006-03-04 00:41 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\AdobeUM 2009-05-29 01:13 . 2009-01-19 14:22 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-26 18:20 . 2009-01-19 14:22 40160 ----a-w c:\winxp\system32\drivers\mbamswissarmy.sys 2009-05-26 18:19 . 2009-01-19 14:22 19096 ----a-w c:\winxp\system32\drivers\mbam.sys 2009-05-05 15:45 . 2009-01-21 01:37 11952 ----a-w c:\winxp\system32\avgrsstx.dll 2009-05-05 15:45 . 2009-01-21 01:37 325896 ----a-w c:\winxp\system32\drivers\avgldx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 27784 ----a-w c:\winxp\system32\drivers\avgmfx86.sys 2009-05-05 15:45 . 2009-01-21 01:37 108552 ----a-w c:\winxp\system32\drivers\avgtdix.sys 2009-05-03 16:34 . 2009-01-24 16:01 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\WinZip 2009-05-01 00:01 . 2009-01-18 17:05 -------- d-----w c:\program files\Trend Micro 2009-04-16 00:35 . 2009-04-16 00:35 1915520 ----a-w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-04-12 21:31 . 2009-04-12 21:29 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Cucusoft,inc 2009-04-12 21:30 . 2009-04-12 21:30 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\cucusoft 2009-04-12 21:29 . 2009-04-12 21:29 -------- d-----w c:\program files\Cucusoft 2009-04-12 21:29 . 2009-04-12 21:25 -------- d-----w c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\GetRightToGo 2009-04-07 02:49 . 2009-04-07 02:48 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-07 02:49 . 2006-01-08 02:23 -------- d-----w c:\program files\iTunes 2009-04-07 02:48 . 2004-01-09 23:39 -------- d-----w c:\program files\iPod 2009-04-07 02:48 . 2008-02-17 23:17 -------- d-----w c:\program files\Common Files\Apple 2009-04-07 02:36 . 2009-04-07 02:36 75048 ----a-w c:\documents and settings\All Users.WINXP\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-05 14:18 . 2006-02-18 04:44 -------- d-----w c:\documents and settings\All Users.WINXP\Application Data\DVD Shrink 2009-03-19 21:32 . 2009-03-19 21:32 23400 ----a-w c:\documents and settings\All Users.WINXP\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-19 21:32 . 2008-01-29 17:01 23400 ----a-w c:\winxp\system32\drivers\GEARAspiWDM.sys 2009-03-15 00:22 . 2006-02-18 23:07 10 ----a-w c:\winxp\popcinfo.dat 2009-03-06 14:22 . 2006-02-19 19:07 284160 ----a-w c:\winxp\system32\pdh.dll 2009-03-06 04:59 . 2009-03-13 23:52 1900544 ----a-w c:\winxp\system32\usbaaplrc.dll 2009-03-06 04:59 . 2008-02-17 23:18 36864 ----a-w c:\winxp\system32\drivers\usbaapl.sys . ((((((((((((((((((((((((((((( SnapShot@2009-05-30_03.21.01 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-02 11:43 . 2009-06-02 11:43 16384 c:\winxp\temp\Perflib_Perfdata_7f8.dat + 2006-02-21 22:38 . 2009-06-01 00:58 49152 c:\winxp\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2006-02-21 22:38 . 2009-02-07 00:56 49152 c:\winxp\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2006-02-18 00:59 . 2009-06-01 00:58 32768 c:\winxp\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2006-02-18 00:59 . 2009-02-07 00:56 32768 c:\winxp\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2006-02-18 00:59 . 2009-06-01 00:58 16384 c:\winxp\system32\config\systemprofile\Cookies\index.dat - 2006-02-18 00:59 . 2009-02-07 00:56 16384 c:\winxp\system32\config\systemprofile\Cookies\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-03 68856] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 1957888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\winxp\system32\NeroCheck.exe" [2001-07-09 155648] "DellTouch"="c:\winxp\MMKeybd.exe" [2001-09-05 163840] "dlbxmon.exe"="c:\program files\Dell Photo AIO Printer 962\dlbxmon.exe" [2004-08-27 417792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-24 136600] "LVCOMSX"="c:\winxp\system32\LVCOMSX.EXE" [2004-10-08 221184] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-22 185872] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-05 1947928] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "BCMSMMSG"="BCMSMMSG.exe" - c:\winxp\BCMSMMSG.exe [2003-08-29 122880] c:\documents and settings\Brad.HOME-95K9VV3PU6\Start Menu\Programs\Startup\ DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848] c:\documents and settings\All Users.WINXP\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-8-5 724992] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-05 15:45 11952 ----a-w c:\winxp\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-10-17 02:35 87352 ----a-w c:\winxp\system32\LMIinit.dll HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave"= serwvdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\Ring Factory\\Ring Factory\\RingFactory.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"= "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winxp\system32\drivers\avgldx86.sys [1/20/2009 8:37 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\winxp\system32\drivers\avgtdix.sys [1/20/2009 8:37 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/1/2009 10:18 AM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/1/2009 10:18 AM 298776] R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\winxp\system32\drivers\LMIRfsDriver.sys [12/10/2008 7:04 PM 47640] R2 Nhksrv;Netropa NHK Server;c:\winxp\Nhksrv.exe [2/17/2006 11:40 PM 28672] R3 Msikbd2k;DellTouch;c:\winxp\system32\drivers\Msikbd2k.sys [2/17/2006 11:40 PM 6942] S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?] S3 ati2mpaa;ati2mpaa;c:\winxp\system32\drivers\ati2mpaa.sys [2/17/2006 1:45 PM 281856] S4 LMIRfsClientNP;LMIRfsClientNP; [x] . Contents of the 'Scheduled Tasks' folder 2009-05-26 c:\winxp\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34] 2009-06-02 c:\winxp\Tasks\User_Feed_Synchronization-{4F637E82-0A9F-48E5-9DE6-DAE71EA0AF8A}.job - c:\winxp\system32\msfeedssync.exe [2006-10-17 18:58] 2009-06-02 c:\winxp\Tasks\WGASetup.job - c:\winxp\system32\KB905474\wgasetup.exe [2009-05-06 03:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm Trusted Zone: myspace.com\www Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://m-cam.uchicago.edu/activex/AMC.cab FF - ProfilePath - c:\documents and settings\Brad.HOME-95K9VV3PU6\Application Data\Mozilla\Firefox\Profiles\62uz97bf.default\ . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-02 06:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1292428093-602162358-725345543-1004\Software\SecuROM\License information*] "datasecu"=hex:27,87,ad,95,6b,46,2f,6a,1f,e2,a6,b2,d9,4f,40,9a,f9,dc,e8,76,06, 44,96,16,7c,c2,62,67,ee,0d,34,15,e1,78,a2,55,c9,15,90,f6,98,7e,90,85,9a,6a,\ "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(672) c:\winxp\system32\LMIinit.dll c:\winxp\system32\LMIRfsClientNP.dll - - - - - - - > 'explorer.exe'(2916) c:\progra~1\WINDOW~2\wmpband.dll c:\winxp\system32\mshtml.dll c:\winxp\system32\WPDShServiceObj.dll c:\winxp\system32\PortableDeviceTypes.dll c:\winxp\system32\PortableDeviceApi.dll c:\winxp\system32\LMIRfsClientNP.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\winxp\system32\wscntfy.exe c:\winxp\system32\dlbxcoms.exe c:\program files\Netropa\OSD.exe c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-06-02 7:01 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-02 12:01 ComboFix2.txt 2009-06-01 01:44 ComboFix3.txt 2009-05-30 03:30 Pre-Run: 3,472,891,904 bytes free Post-Run: 3,460,722,688 bytes free 223 --- E O F --- 2009-05-26 09:07 |
|
|
|
|
Jun 7 2009, 04:08 PM
Post
#13
|
|
|
Trusted Helper Posts: 8,065 OS: XP Pro |
Hello goldilocks1990,
I have been away a few days. Just to bring me up to speed - are you still experencing the yoog redirection problems? |
|
|
|
|
Jun 8 2009, 02:03 PM
Post
#14
|
|
|
Member Posts: 55 OS: XP |
Welcome back
Yes, I still have the Yoog Search bar on the toolbar at the top of the browser. I also have Google, and if I type my searches in google...they work fine. However, if I accidentally type them in that Yoog Search window, then I start getting those popups... I would just like to have the Yoog Search uninstalled...but I guess it is not that easy. Thanks and let me know what I need to do now. |
|
|
|
|
Jun 8 2009, 05:10 PM
Post
#15
|
|
|
Trusted Helper Posts: 8,065 OS: XP Pro |
QUOTE I would just like to have the Yoog Search uninstalled...but I guess it is not that easy. No Yoog won't just uninstall. Usually it is not too difficult to remove but I am not seeing it in your logs where I expected it. Just out of interest...is the Yoog Search showing in your Firefox or your Internet Explorer? |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
19 / 3,115 | 21st March 2009 - 11:48 AM b.bcalhoon started - last by Rorschach112 |
|||||
|
14 / 612 | 10th May 2009 - 10:57 AM goldilocks1990 started - last by Rorschach112 |
|||||
 |
13 / 8,226 | 1st November 2009 - 08:19 PM Rorschach112 started - last by petra.blabla |
|||||
|
2 / 247 | 10th June 2009 - 12:21 PM monkeymagic started - last by Rorschach112 |
|||||
|
Time is now: 21st November 2009 - 12:29 PM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising