Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Annoying Adware! Help PLEASE! [RESOLVED]

Started by BushPilot223 , May 20 2008 09:44 PM

  • This topic is locked This topic is locked

#1
BushPilot223
Posted 20 May 2008 - 09:44 PM

BushPilot223

    New Member

  • Member
  • Pip
  • 5 posts
Ok just today right when I turned on my computer I got adware problems, showing up from various sites, and strangely they have been circulating around security sites. And also some computer performace sites. Anyway some have been from www.winannonymous.com and also one from www.premiercardoffers.com just popped up right now, and another from areaconnect.com just right now again! And there have been system optimizers that also popped up, I don't quite remember the names. A new ad pops up every 5-10 minutes regardless of my actions, when I am playing a game one will pop up and take me out of the game and get me killed or make me crash my airplane in FSX, and it makes me mad. I got a HiJackThis report, I'll put it below. This just started today, last night it was completely fine. The only website I visited before this happened today was http://www.cs.ubc.ca...a/javademo.html and that's it.
===========================================================================

HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:00 PM, on 5/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gotbush.org/forums/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe -1 --delay 15
O4 - HKLM\..\Run: [LXDDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [68a6d62d] rundll32.exe "C:\WINDOWS\system32\gwxxjceu.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1210388054250
O17 - HKLM\System\CCS\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB389411-2E54-4BE6-A8C9-422551C18D92}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS1\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS2\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe

--
End of file - 5223 bytes


Would appreciate any help.

Thanks,
Bush
  • 0

Advertisements

#2
Rorschach112
Posted 21 May 2008 - 05:21 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.




Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
  • 0

#3
BushPilot223
Posted 21 May 2008 - 06:47 PM

BushPilot223

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Okay thanks a lot. I already think it's working because I haven't had one pop up since I ran that cleaner. Here are the logs.
=================================
Combo Fix Log
=================================
ComboFix 08-05-21.2 - Tommy W 2008-05-21 18:39:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1439 [GMT -6:00]
Running from: C:\Documents and Settings\Tommy W\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\_000003_.tmp.dll
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\_000009_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll
C:\WINDOWS\system32\_000013_.tmp.dll
C:\WINDOWS\system32\gwxxjceu.dll
C:\WINDOWS\system32\idctnkdw.dll
C:\WINDOWS\system32\lofuuone.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\TAIjRqru.ini
C:\WINDOWS\system32\TAIjRqru.ini2
C:\WINDOWS\system32\uecjxxwg.ini
C:\WINDOWS\system32\urqRjIAT.dll
C:\WINDOWS\system32\vtUnkHxX.dll
C:\WINDOWS\system32\wdkntcdi.ini

.
((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 )))))))))))))))))))))))))))))))
.

2008-05-20 18:35 . 2008-05-20 18:35 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-19 18:06 . 2008-05-20 18:50 <DIR> d-------- C:\WINDOWS\system32\COD4MW Screensaver dir
2008-05-18 22:07 . 2008-05-18 22:07 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-05-18 22:06 . 2008-05-18 22:06 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2008-05-18 13:00 . 2000-05-22 22:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx
2008-05-18 12:56 . 2008-05-18 13:00 <DIR> d-------- C:\Program Files\Total Video Converter
2008-05-18 11:15 . 2001-08-17 13:57 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-05-18 11:15 . 2001-08-17 13:57 16,128 --a--c--- C:\WINDOWS\system32\dllcache\modemcsa.sys
2008-05-18 11:14 . 2008-05-18 11:14 <DIR> d-------- C:\WINDOWS\Motorola
2008-05-17 14:24 . 2008-05-17 14:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-05-16 18:10 . 2008-05-16 18:10 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2008-05-16 18:10 . 2008-05-16 18:10 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\teamspeak2
2008-05-16 18:10 . 2008-05-16 18:10 34,064 --a------ C:\WINDOWS\system32\lhacm.acm
2008-05-16 16:51 . 2008-05-16 16:51 <DIR> d-------- C:\info
2008-05-15 16:01 . 2008-05-15 16:01 <DIR> d-------- C:\Program Files\Microsoft Speech SDK 5.1
2008-05-14 19:29 . 2008-05-14 19:29 <DIR> d-------- C:\ijji
2008-05-14 19:16 . 2008-05-14 19:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-05-14 19:16 . 2008-05-14 19:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MumboJumbo
2008-05-14 16:44 . 2007-10-04 01:14 167,936 --a------ C:\WINDOWS\system\binkw32.dll
2008-05-13 19:29 . 2008-05-13 19:29 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-05-11 22:05 . 2008-05-11 22:05 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-05-11 21:00 . 2007-10-04 01:14 434,688 --a------ C:\WINDOWS\system\mss32.dll
2008-05-11 18:33 . 2008-05-11 19:08 <DIR> d-------- C:\Program Files\NovaLogic
2008-05-11 18:28 . 2008-05-11 18:28 <DIR> d-------- C:\Documents and Settings\Tommy W\WINDOWS
2008-05-11 18:28 . 1998-01-23 12:22 304,128 --a------ C:\WINDOWS\IsUninst.exe
2008-05-11 18:25 . 2008-05-11 18:25 <DIR> d-------- C:\Program Files\Ares
2008-05-11 08:11 . 2008-05-11 08:11 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Xfire
2008-05-11 07:06 . 2008-05-17 14:42 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-05-10 20:28 . 2008-05-10 20:28 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-05-10 18:29 . 2008-05-11 12:43 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\Sony
2008-05-10 18:29 . 2008-05-10 18:29 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\Publish Providers
2008-05-10 18:24 . 2008-05-10 18:24 <DIR> d-------- C:\Program Files\Vstplugins
2008-05-10 18:24 . 2008-05-10 18:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-05-10 18:23 . 2008-05-10 18:23 <DIR> d-------- C:\Program Files\Sony
2008-05-10 18:20 . 2008-05-10 18:20 <DIR> d-------- C:\Program Files\MSBuild
2008-05-10 18:18 . 2008-05-18 22:07 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-05-10 18:18 . 2008-05-10 18:18 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-05-10 18:17 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
2008-05-10 18:14 . 2008-05-10 18:14 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\Sony Setup
2008-05-10 11:12 . 2008-05-10 16:28 <DIR> d-------- C:\Program Files\HiFiUninstaller
2008-05-10 11:12 . 2008-05-10 16:28 <DIR> d-------- C:\Program Files\HiFi
2008-05-10 11:12 . 2008-05-10 16:28 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\HiFi
2008-05-10 10:54 . 2008-05-10 11:12 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-05-10 10:54 . 2008-05-13 20:13 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-10 10:50 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-05-10 10:50 . 2008-05-10 10:50 376 --a------ C:\WINDOWS\ODBC.INI
2008-05-10 10:49 . 2008-05-10 10:49 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-05-10 10:49 . 2008-05-10 10:49 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-05-10 10:49 . 2008-05-10 10:49 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-05-10 09:35 . 2008-05-18 15:40 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\Azureus
2008-05-10 09:35 . 2008-05-10 09:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-05-10 09:34 . 2008-05-14 19:10 <DIR> d-------- C:\Program Files\Azureus
2008-05-10 09:17 . 2008-05-10 09:17 <DIR> d-------- C:\Program Files\CCleaner
2008-05-10 09:10 . 2008-05-19 21:34 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-10 09:10 . 2008-05-10 09:10 22,328 --a------ C:\Documents and Settings\Tommy W\Application Data\PnkBstrK.sys
2008-05-10 09:09 . 2008-05-19 21:33 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-05-10 09:09 . 2008-05-10 20:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-05-10 09:09 . 2008-05-10 09:09 319 --a------ C:\WINDOWS\game.ini
2008-05-10 08:51 . 2008-05-10 08:51 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-05-10 08:36 . 2008-05-10 08:36 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-05-10 08:35 . 2008-05-10 09:09 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-05-10 08:35 . 2008-05-14 22:15 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-05-10 08:35 . 2008-05-10 08:36 <DIR> d-------- C:\c432f639500f4c743607b5629a
2008-05-10 08:26 . 2008-05-10 08:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-05-10 08:20 . 2008-05-10 08:20 <DIR> d-------- C:\WINDOWS\Sun
2008-05-10 08:20 . 2008-05-10 08:20 <DIR> d-------- C:\WINDOWS\.jagex_cache_32
2008-05-10 07:34 . 2008-05-18 21:07 <DIR> d-------- C:\Program Files\Lx_cats
2008-05-10 07:31 . 2008-05-10 07:33 <DIR> d-------- C:\Program Files\Java
2008-05-10 07:31 . 2008-05-10 07:31 <DIR> d-------- C:\Program Files\Common Files\Java
2008-05-10 07:31 . 2008-05-10 07:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FaxCtr
2008-05-10 07:30 . 2008-05-10 08:04 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-05-10 07:30 . 2008-03-19 18:26 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-05-10 07:30 . 2008-03-19 18:29 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-05-10 07:28 . 2008-05-10 07:28 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-05-10 07:28 . 2008-05-10 07:28 <DIR> d-------- C:\Program Files\Lexmark Toolbar
2008-05-10 07:28 . 2008-05-10 07:46 <DIR> d-------- C:\Program Files\Lexmark Fax Solutions
2008-05-10 07:28 . 2008-05-10 07:28 <DIR> d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint
2008-05-10 07:28 . 2006-12-06 11:19 44 --a------ C:\WINDOWS\system32\lxddrwrd.ini
2008-05-10 07:27 . 2008-05-10 07:33 <DIR> d-------- C:\Program Files\Lexmark 2500 Series
2008-05-10 07:26 . 2008-05-10 07:27 <DIR> d-------- C:\WINDOWS\system32\drivers\AU_Backup
2008-05-10 07:26 . 2007-09-17 14:39 263,160 --a------ C:\WINDOWS\system32\drivers\Tmfilter.sys
2008-05-10 07:26 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-05-10 07:26 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-05-10 07:26 . 2007-10-06 16:38 12,358 --a------ C:\WINDOWS\system32\drivers\tmfilter.cat
2008-05-10 07:26 . 2008-01-10 11:44 10,533 --a------ C:\WINDOWS\system32\drivers\tmcomm.cat
2008-05-10 07:26 . 2007-09-17 14:41 3,418 --a------ C:\WINDOWS\system32\drivers\tmpreflt.inf
2008-05-10 07:26 . 2007-09-17 14:41 2,557 --a------ C:\WINDOWS\system32\drivers\tmxpflt.inf
2008-05-10 07:26 . 2007-09-17 14:31 2,518 --a------ C:\WINDOWS\system32\drivers\vsapint.inf
2008-05-10 07:26 . 2007-12-24 17:36 2,487 --a------ C:\WINDOWS\system32\drivers\tmcomm.inf
2008-05-10 07:23 . 2008-05-20 21:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-10 07:23 . 2008-05-10 07:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-05-10 07:23 . 2007-12-24 17:37 138,384 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-05-10 07:23 . 2007-09-17 14:40 35,856 --a------ C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-05-10 07:22 . 2007-04-18 10:12 2,854,400 --a------ C:\WINDOWS\system32\SET315.tmp
2008-05-10 07:20 . 2007-10-25 21:34 8,460,288 --a------ C:\WINDOWS\system32\SET442.tmp
2008-05-10 07:20 . 2007-10-25 21:34 8,460,288 --a--c--- C:\WINDOWS\system32\dllcache\SET444.tmp
2008-05-10 07:20 . 2005-10-20 16:20 1,082,368 --a------ C:\WINDOWS\system32\SET2F5.tmp
2008-05-10 07:20 . 2007-07-09 07:16 582,656 --a------ C:\WINDOWS\system32\SET3FB.tmp
2008-05-10 07:20 . 2007-07-09 07:16 582,656 --a--c--- C:\WINDOWS\system32\dllcache\SET3FD.tmp
2008-05-10 07:20 . 2007-04-01 23:58 546,304 --a------ C:\WINDOWS\system32\SET40E.tmp
2008-05-10 07:20 . 2007-10-29 04:04 350,720 --a------ C:\WINDOWS\system32\SET443.tmp
2008-05-09 22:37 . 2008-05-09 22:37 <DIR> d-------- C:\Program Files\Marvell
2008-05-09 22:37 . 2008-05-09 22:37 <DIR> d-------- C:\Documents and Settings\Tommy W\Application Data\TMP
2008-05-09 22:12 . 2008-05-09 22:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-05-09 22:00 . 2008-05-09 22:00 <DIR> d-------- C:\WINDOWS\OEM_ICPLUS
2008-05-09 22:00 . 2008-05-09 22:00 0 --a------ C:\WINDOWS\reboot.icp
2008-05-09 21:36 . 2008-03-01 07:06 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-05-09 21:36 . 2007-04-17 03:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-05-09 21:36 . 2007-03-07 23:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-05-09 21:36 . 2008-03-01 07:06 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-05-09 21:36 . 2008-03-01 07:06 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-05-09 21:36 . 2008-03-01 07:06 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-05-09 21:36 . 2008-03-01 07:06 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-05-09 21:36 . 2008-03-01 07:06 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-05-09 21:36 . 2008-02-22 04:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-05-09 21:31 . 2008-05-09 21:31 <DIR> d-------- C:\Program Files\Yahoo!
2008-05-09 21:31 . 2008-05-09 21:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-05-09 20:56 . 2008-05-18 22:03 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-05-09 20:54 . 2008-05-09 20:54 <DIR> d--hs---- C:\Documents and Settings\Tommy W\UserData
2008-05-09 20:54 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-05-09 20:54 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-05-09 20:54 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-05-09 20:54 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-05-09 20:54 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-05-09 20:06 . 2008-05-09 20:06 <DIR> d-------- C:\WINDOWS\system32\Lang

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-22 00:38 --------- d-----w C:\Documents and Settings\Tommy W\Application Data\Xfire
2008-05-20 23:24 --------- d-----w C:\Program Files\Xfire
2008-05-15 01:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 03:59 --------- d-----w C:\Program Files\Common Files\InstallShield1
2008-05-10 02:12 --------- d-----w C:\Program Files\Qwest
2008-05-10 02:12 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-05-10 02:03 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-05-10 00:56 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-05-10 00:38 --------- d-----w C:\Program Files\2Wire
2008-05-10 00:37 --------- d-----w C:\Program Files\Actiontec
2008-05-10 00:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-05-10 00:17 --------- d-----w C:\Documents and Settings\Tommy W\Application Data\InstallShield
2008-05-10 00:12 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-17 22:33 4,707,328 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-04-10 22:52 16,861,184 ----a-w C:\WINDOWS\RTHDCPL.exe
2008-04-02 15:27 1,196,032 ----a-w C:\WINDOWS\RtlUpd.exe
2008-03-06 00:07 520,192 ----a-w C:\WINDOWS\RtlExUpd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-12 07:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"Trend Micro AntiVirus 2007"="C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe" [2007-07-05 20:09 4609288]
"LXDDCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll" [2007-01-22 16:05 102400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\lxddcoms.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=
"C:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"H:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"H:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"H:\\Program Files\\Steam\\SteamApps\\bushpilot223\\garrysmod\\hl2.exe"=
"C:\\Program Files\\Lavasoft\\Ad-aware 6\\Ad-aware.exe"=
"C:\\Program Files\\Lavasoft\\Ad-aware 6\\Ad-watch.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8080:TCP"= 8080:TCP:ad-aware 6.0
"8080:UDP"= 8080:UDP:ad-aware 6.0U

R2 lxdd_device;lxdd_device;C:\WINDOWS\system32\lxddcoms.exe [2007-02-12 17:59]
R2 sprtlisten;SupportSoft Listener Service;C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe [2008-01-08 12:02]
R3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys [2004-04-19 15:01]
R3 SaiH0461;SaiH0461;C:\WINDOWS\system32\DRIVERS\SaiH0461.sys [2006-08-08 18:25]
S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe [2008-01-08 12:02]
S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-21 18:41:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
C:\Program Files\Trend Micro\AntiVirus 2007\components\TmProxy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-05-21 18:44:27 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-22 00:44:24

Pre-Run: 126,969,929,728 bytes free
Post-Run: 127,222,943,744 bytes free

247 --- E O F --- 2008-05-18 17:10:36






=========================
HiJackThis Log
=========================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:47:49 PM, on 5/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\lxddcoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://gotbush.org/forums/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe -1 --delay 15
O4 - HKLM\..\Run: [LXDDCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDDtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1210388054250
O17 - HKLM\System\CCS\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB389411-2E54-4BE6-A8C9-422551C18D92}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS1\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CS2\Services\Tcpip\..\{15B826F9-5809-41FA-83B0-CBC6908E8713}: NameServer = 205.171.3.65,205.171.2.65
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe

--
End of file - 5361 bytes
  • 0

#4
Rorschach112
Posted 22 May 2008 - 07:02 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Also tell me how your PC is running
  • 0

#5
BushPilot223
Posted 22 May 2008 - 09:29 PM

BushPilot223

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Ok it found 3! Deleted them. And BTW my computer is running fine, nothing wrong, and its running pretty fastly.

Malwarebytes' Anti-Malware 1.12
Database version: 779

Scan type: Quick Scan
Objects scanned: 36177
Time elapsed: 3 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\KCMDNIns.exe (Trojan.Inject) -> Quarantined and deleted successfully.
  • 0

#6
BushPilot223
Posted 22 May 2008 - 09:29 PM

BushPilot223

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
I want to thank you, you have been a lot of help! I'm not just saying that! YOU ROCK!!!!
  • 0

#7
Rorschach112
Posted 23 May 2008 - 05:24 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Your logs are clean

Follow these steps to uninstall Combofix and tools used in the removal of malware
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    Posted Image



You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here




Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.
  • 0

#8
BushPilot223
Posted 23 May 2008 - 04:38 PM

BushPilot223

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks you so much!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
  • 0

#9
Rorschach112
Posted 23 May 2008 - 04:57 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP