Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

PLease help IE


  • Please log in to reply

#1
BlueStreek

BlueStreek

    Member

  • Member
  • PipPip
  • 10 posts
using firefox but getting IE popups please help. More specifically I have 2 problems I have to Iexplore.exe processe constantly open and the wont stop and second every time I play a game I get popups for Ie please help here is my hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 3:10:54 PM, on 11/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Steam\Steam.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrator\Desktop\Apps\HS\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

please help thanks.
  • 0

Advertisements


#2
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hi

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • 0

#3
BlueStreek

BlueStreek

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
here is the log u requested thanks
Administrator - 06-11-11 17:45:45.84 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-11 to 2006-11-11 ))))))))))))))))))))))))))))))))))


2006-11-08 09:55 314,368 --a------ C:\WINDOWS\uninst.exe
2006-10-31 12:15 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2006-10-31 12:15 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2006-10-31 08:23 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-10-30 19:29 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-10-22 14:10 172,032 --a------ C:\WINDOWS\system32\cncs32.dll
2006-10-20 10:33 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2006-10-20 10:33 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2006-10-12 11:37 745,984 --a------ C:\WINDOWS\system32\ir50_32.dll
2006-10-12 11:37 56,320 --------- C:\WINDOWS\system32\iyvu9_32.dll
2006-10-12 11:37 202,240 --a------ C:\WINDOWS\system32\ir32_32.dll
2006-10-12 11:37 136,704 --a------ C:\WINDOWS\system32\iacenc.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-11 17:43 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-11 15:24 -------- d-------- C:\Program Files\Morpheus
2006-11-11 13:58 -------- d-------- C:\Program Files\Steam
2006-11-11 12:21 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-11 12:21 -------- d-------- C:\Program Files\dominions3
2006-11-10 23:21 -------- d-------- C:\Program Files\ZC2.10
2006-11-10 10:55 -------- d-------- C:\Program Files\Neon Wars
2006-11-09 12:56 -------- d-------- C:\Program Files\AGEIA Technologies
2006-11-09 12:55 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-11-09 12:55 -------- d-------- C:\Program Files\Common Files
2006-11-08 12:05 -------- d-------- C:\Program Files\Jet Jumper
2006-11-08 12:05 -------- d-------- C:\Program Files\Astral Masters
2006-11-08 10:38 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Help
2006-11-08 10:13 -------- d-------- C:\Program Files\LucasArts
2006-11-06 13:34 -------- d-------- C:\Program Files\War Chess
2006-11-06 13:34 -------- d-------- C:\Program Files\Sewer Run
2006-11-06 13:34 -------- d-------- C:\Program Files\Risk II
2006-11-06 13:34 -------- d-------- C:\Program Files\Project Xenoclone
2006-11-06 13:34 -------- d-------- C:\Program Files\Gish
2006-11-06 13:34 -------- d-------- C:\Program Files\CoolCube TV
2006-11-06 13:34 -------- d-------- C:\Program Files\Avast
2006-11-06 13:32 -------- d-------- C:\Program Files\CleanUp!
2006-11-06 11:22 -------- d-------- C:\Program Files\Lavasoft
2006-11-05 08:19 -------- d-------- C:\Program Files\Electronic Arts
2006-11-04 17:51 -------- d-------- C:\Program Files\Travelogue 360 Paris
2006-11-03 21:15 -------- d-------- C:\Program Files\Ubisoft
2006-11-03 21:14 -------- d-------- C:\Program Files\asc
2006-11-03 21:07 -------- d-------- C:\Documents and Settings\Administrator\Application Data\SpieleEntwicklungsKombinat
2006-11-02 17:18 -------- d-------- C:\Program Files\Mystery Solitaire - Secret Island
2006-11-01 13:03 -------- d-------- C:\Program Files\Word Cross
2006-10-31 12:18 -------- d-------- C:\Program Files\Gumboy Crazy Adventures
2006-10-31 12:15 -------- d-------- C:\Program Files\OpenAL
2006-10-31 11:05 -------- d-------- C:\Program Files\Pat Sajak`s Trivia Gems
2006-10-31 03:13 -------- d-------- C:\Program Files\Internet Explorer
2006-10-31 03:00 -------- d-------- C:\Program Files\MSXML 4.0
2006-10-30 19:42 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-10-28 12:38 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Activision
2006-10-28 12:16 -------- d-------- C:\Program Files\Activision
2006-10-26 22:31 -------- d-------- C:\Program Files\Virus 3
2006-10-26 02:02 -------- d-------- C:\Program Files\Championship Chess
2006-10-25 16:58 -------- d-------- C:\Program Files\PacSteam
2006-10-25 15:13 -------- d-------- C:\Program Files\Aspyr Media, Inc
2006-10-24 23:11 -------- d-------- C:\Program Files\PacSteam 04.09.06
2006-10-24 23:10 -------- d-------- C:\Program Files\Monte Cristo
2006-10-24 23:03 -------- d-------- C:\Program Files\GameHouse
2006-10-24 22:33 -------- d-------- C:\Program Files\PartyGaming
2006-10-24 20:40 -------- d-------- C:\Program Files\Newspaper Puzzle Challenge
2006-10-22 22:33 -------- d-------- C:\Program Files\JetacerGames
2006-10-20 13:17 -------- d-------- C:\Program Files\FlashFXP
2006-10-20 11:49 -------- d-------- C:\Program Files\Gothic III
2006-10-20 10:33 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-19 15:59 -------- d-------- C:\Program Files\iWin.com
2006-10-18 21:47 -------- d-------- C:\Program Files\NetPumper
2006-10-18 20:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\NetPumper
2006-10-18 20:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Idle burn bash
2006-10-18 20:57 -------- d-------- C:\Program Files\Idle burn bash
2006-10-18 20:57 -------- d-------- C:\Program Files\Anti-Leech
2006-10-18 18:15 -------- d-------- C:\Program Files\Putt Nutz DX
2006-10-18 17:58 -------- d-------- C:\Program Files\MultiplayUNO
2006-10-17 07:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\DivX
2006-10-16 19:41 -------- d-------- C:\Program Files\Heretic Kingdoms - The Inquisition
2006-10-16 17:24 -------- d-------- C:\Program Files\EA SPORTS
2006-10-16 17:03 -------- d-------- C:\Program Files\Project 3 Interactive
2006-10-13 17:27 -------- d-------- C:\Program Files\Trymedia
2006-10-13 11:18 -------- d-------- C:\Program Files\Mirror Mixup
2006-10-13 11:18 -------- d-------- C:\Program Files\Explore the World
2006-10-12 11:37 -------- d-------- C:\Program Files\Ligos
2006-10-12 10:06 -------- d-------- C:\Program Files\DivX
2006-10-09 22:30 1248 --a------ C:\Documents and Settings\Administrator\Application Data\enigmarc.lua2
2006-10-09 10:35 -------- d-------- C:\Program Files\Gorilla 2
2006-10-08 22:05 -------- d-------- C:\Program Files\Cenega
2006-10-07 23:24 -------- d-------- C:\Program Files\Radical Games
2006-10-07 18:25 -------- d-------- C:\Program Files\Billy Blade and the Temple of Time
2006-10-07 17:36 -------- d-------- C:\Program Files\Numericon
2006-10-04 15:14 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2006-10-04 15:10 -------- d-------- C:\Program Files\Adobe
2006-10-04 15:09 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-04 15:07 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-10-04 11:46 -------- d-------- C:\Program Files\JustFreeGames.com
2006-10-03 19:09 -------- d-------- C:\Program Files\Macromedia
2006-10-03 19:09 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-10-03 18:59 -------- d-------- C:\Program Files\Virtual Villagers
2006-10-03 18:59 -------- d-------- C:\Program Files\Jig Art Quest
2006-10-03 18:58 -------- d-------- C:\Program Files\Devastation Zone Troopers
2006-10-03 18:58 -------- d-------- C:\Program Files\Alawar
2006-10-03 18:55 -------- d-------- C:\Program Files\Activision Value
2006-10-02 22:08 -------- d-------- C:\Program Files\Cipher8
2006-10-02 22:05 -------- d-------- C:\Program Files\Anacrostics
2006-10-02 22:04 286720 --------- C:\WINDOWS\Setup1.exe
2006-10-02 19:45 -------- d-------- C:\Program Files\Diamondo
2006-10-02 14:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 14:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 14:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 14:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-01 22:23 -------- d-------- C:\Program Files\NAMCO BANDAI Games
2006-10-01 12:39 73216 --------- C:\WINDOWS\ST6UNST.EXE
2006-09-30 12:59 -------- d-------- C:\Program Files\CAPCOM
2006-09-28 14:55 53248 --a------ C:\WINDOWS\system32\PhysXLoader.dll
2006-09-27 19:37 -------- d-------- C:\Program Files\Boxed In
2006-09-27 11:12 -------- d-------- C:\Program Files\Sunflowers
2006-09-26 20:01 -------- d-------- C:\Program Files\Logitech
2006-09-26 20:01 -------- d-------- C:\Program Files\Common Files\Logitech
2006-09-26 18:19 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Registry Booster
2006-09-26 14:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelJapanese.dll
2006-09-26 11:25 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-25 10:45 666240 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-09-25 10:40 87424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2006-09-25 10:40 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-09-25 10:39 36176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-09-25 10:39 16352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-09-25 10:37 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-09-25 10:37 24560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-09-25 04:00 -------- d-------- C:\Program Files\The Guild 2
2006-09-24 02:11 -------- d-------- C:\Program Files\TopWare
2006-09-23 14:51 -------- d-------- C:\Program Files\Uniblue
2006-09-21 22:36 -------- d-------- C:\Program Files\CureROM
2006-09-21 21:15 -------- d-------- C:\Program Files\Eidos
2006-09-20 10:40 -------- dr-h----- C:\Documents and Settings\Administrator\Application Data\SecuROM
2006-09-18 19:19 -------- d-------- C:\Program Files\AutoPatcher
2006-09-15 17:42 -------- d-------- C:\Program Files\WarRock
2006-09-14 11:54 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Electronic Arts
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-12 19:17 34308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-09-12 18:46 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Backyard Baseball 2007
2006-09-12 17:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-09-11 13:09 -------- d-------- C:\Documents and Settings\Administrator\Application Data\FlashFXP
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelTraditionalChinese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSwedish.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSpanish.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSimplifiedChinese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelPortugese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelKorean.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelGerman.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelFrench.dll
2006-09-05 17:38 14 --a------ C:\WINDOWS\system32\systeminfo.dll
2006-09-01 17:55 737280 --a------ C:\WINDOWS\iun6002.exe
2006-09-01 17:35 158669 --a------ C:\WINDOWS\Windows Uninstaller.exe
2006-09-01 12:08 1334032 --a------ C:\WINDOWS\system32\msxml6.dll
2006-08-31 17:09 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-08-25 21:36 260608 --a------ C:\WINDOWS\steampatcherv2.exe
2006-08-25 21:36 1264832 --a------ C:\WINDOWS\RunDLL32.exe
2006-08-25 21:36 1264832 --a------ C:\WINDOWS\30004.exe
2006-08-25 21:33 81920 --a------ C:\WINDOWS\loader.exe
2006-08-25 21:33 69632 --a------ C:\WINDOWS\Vac 2 Disabler.dll
2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-19 09:33 0 -rahs---- C:\MSDOS.SYS
2006-08-19 09:33 0 -rahs---- C:\IO.SYS
2006-08-19 09:33 0 --a------ C:\CONFIG.SYS
2006-08-19 09:33 0 --a------ C:\AUTOEXEC.BAT
2006-08-19 04:43 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2006-08-16 16:55 208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2006-08-16 16:55 208896 --a------ C:\WINDOWS\system32\nvudisp.exe
2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-11 20:45 888832 --a------ C:\WINDOWS\system32\nvmobls.dll
2006-08-11 20:45 5611520 --a------ C:\WINDOWS\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINDOWS\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINDOWS\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINDOWS\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINDOWS\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2006-08-11 20:45 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINDOWS\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2006-08-11 20:43 794624 --a------ C:\WINDOWS\system32\nvcplui.exe
2006-08-11 20:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll
2006-08-11 20:43 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINDOWS\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINDOWS\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"RunDLL32"="C:\\WINDOWS\\RunDLL32.exe"
"Bat Drive"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\IDLEBU~1\\Win Close Math.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"RunDLL32"="C:\\WINDOWS\\RunDLL32.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bat Drive]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Win Close Math"
"hkey"="HKCU"
"command"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\IDLEBU~1\\Win Close Math.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLL32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RunDLL32"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\RunDLL32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RegistryBooster"
"hkey"="HKCU"
"command"="C:\\Program Files\\Uniblue\\Registry Booster\\RegistryBooster.exe /S"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A919545A91FECCBE.job

Completion time: 06-11-11 17:46:49.76
C:\ComboFix.txt ... 06-11-11 17:46
  • 0

#4
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hi :whistling:

Please run a scan with HijackThis and check the following lines for removal:


O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe

Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Exit HijackThis.


Please open Notepad, and copy/paste the code in the white box below into a new text file. Save it as "delete.bat" WITH THE QUOTES and save it on your Desktop.

@echo off
attrib -s -r -h "C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\*.*"
rd /q /s "C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1"
attrib -s -r -h "C:\Documents and Settings\Administrator\Application Data\Idle burn bash\*.*"
rd /q /s "C:\Documents and Settings\Administrator\Application Data\Idle burn bash"
attrib -s -r -h "C:\Program Files\Idle burn bash\*.*"
rd /q /s "C:\Program Files\Idle burn bash"
attrib -s -r -h "C:\WINDOWS\tasks\A919545A91FECCBE.job"
del /q "C:\WINDOWS\tasks\A919545A91FECCBE.job"
attrib -s -r -h "C:\WINDOWS\iun6002.exe"
del /q "C:\WINDOWS\iun6002.exe"
attrib -s -r -h "C:\WINDOWS\loader.exe"
del /q "C:\WINDOWS\loader.exe"
attrib -s -r -h "C:\WINDOWS\30004.exe"
del /q "C:\WINDOWS\30004.exe"
attrib -s -r -h "C:\WINDOWS\RunDLL32.exe"
del /q "C:\WINDOWS\RunDLL32.exe"
quit

after saving as instructed above, please close notepad. You will now have a file on your desktop called delete.bat. Dont do anything with it yet

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Please double click the delete.bat file we created and let it run, it will only take a second or two

Clean out your Temporary Internet files. Proceed as follows:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.

Reboot and post a new hijack log and let me know how the system is behaving

Thanks
  • 0

#5
BlueStreek

BlueStreek

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Heres the log as you requested and so far no pop ups thanks :whistling: :blink:

Logfile of HijackThis v1.99.1
Scan saved at 1:26:16 AM, on 11/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\Apps\HS\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
  • 0

#6
loophole

loophole

    Malware Expert

  • Retired Staff
  • 9,798 posts
Hi< good to hear :whistling:

I think you missed this one with the fixes for Hijack :blink:

O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe

Please go HERE to run Panda's ActiveScan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report along with a new hijackthis log.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP