Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HELP Search Engine redirect virus or something


  • Please log in to reply

#1
nickr660

nickr660

    New Member

  • Member
  • Pip
  • 1 posts
Please help everytime I search for something through any search engine it takes me to a different site full of ads or other weird search engines and then eventually a bunch of anti virus stuff pops up. I have no anti virus software on my computer its xp and windows updates are current. I breifly read other posts but it seems like they are fixed differently. I am very computer savey but can't solve this one, please help!

I did the combo fix here is the report now what?




ComboFix 09-11-29.02 - Nick Rovenko 11/29/2009 17:30.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.561 [GMT -6:00]
Running from: c:\documents and settings\Nick Rovenko\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\010112010146116101.xxe
c:\windows\0101120101465250.xxe
c:\windows\0101120101465355.xxe
c:\windows\bk23567.dat
c:\windows\freddy75.exe
c:\windows\ld15.exe
c:\windows\rdr_1259533669.exe
c:\windows\system32\drivers\fio32.sys
c:\windows\system32\fio32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FIOO32
-------\Service_fioo32
-------\Service_SfX
-------\Legacy_fio32
-------\Service_fio32


((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))
.

2009-11-29 22:26 . 2009-11-29 22:26 -------- d-----w- c:\windows\system32\wbem\Repository
2009-11-29 22:00 . 2009-11-29 22:33 4152 ----a-w- c:\windows\fs1235.dat
2009-11-29 21:54 . 2009-11-29 21:54 -------- d-----w- c:\documents and settings\Nick Rovenko\IECompatCache
2009-11-28 09:16 . 2009-11-28 09:16 1 ---h--w- c:\windows\mmsmark3.dat
2009-11-25 15:57 . 2009-11-25 15:57 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\TeamViewer
2009-11-25 15:56 . 2009-11-25 15:56 -------- d-----w- c:\program files\TeamViewer
2009-11-20 02:33 . 2009-11-20 02:33 31 ----a-w- c:\windows\bk20856.dat
2009-11-12 19:58 . 2009-11-12 19:58 -------- d-----w- c:\windows\Sun

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-29 23:36 . 2009-10-12 21:20 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire
2009-11-29 22:25 . 2009-10-18 23:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-29 22:16 . 2009-10-12 19:08 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-19 20:58 . 2009-10-19 20:58 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\Office Genuine Advantage
2009-10-17 08:12 . 2009-10-09 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-10-17 08:01 . 2009-10-17 08:01 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-10-15 20:07 . 2009-10-15 19:52 79379 ----a-w- c:\windows\hpfins05.dat
2009-10-15 20:06 . 2009-10-15 20:06 -------- d-----w- c:\program files\Hewlett-Packard
2009-10-15 20:06 . 2009-10-15 19:52 -------- d-----w- c:\program files\HP
2009-10-15 20:06 . 2009-10-15 20:06 -------- d-----w- c:\documents and settings\All Users\Application Data\HP
2009-10-15 19:58 . 2009-10-09 20:50 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\AdobeUM
2009-10-15 19:48 . 2009-10-15 19:48 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\HP
2009-10-14 03:51 . 2009-10-14 03:51 18088 ---ha-w- c:\windows\system32\mlfcache.dat
2009-10-12 23:42 . 2009-10-12 23:42 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-10-12 23:41 . 2009-10-12 23:41 -------- d-----w- c:\program files\PC Drivers HeadQuarters
2009-10-12 21:49 . 2009-10-09 20:43 18240 ----a-w- c:\documents and settings\Nick Rovenko\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-12 21:46 . 2009-10-12 21:46 -------- d-----w- c:\program files\Addition
2009-10-12 21:40 . 2009-10-12 21:40 -------- d-----w- c:\program files\MSBuild
2009-10-12 21:40 . 2009-10-12 21:40 -------- d-----w- c:\program files\Reference Assemblies
2009-10-12 21:20 . 2009-10-12 21:20 8192 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
2009-10-12 21:20 . 2009-10-12 21:20 20480 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
2009-10-12 21:20 . 2009-10-12 21:20 20480 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
2009-10-12 21:20 . 2009-10-12 21:20 18944 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
2009-10-12 21:20 . 2009-10-12 21:20 17408 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\LimeWire\browser\xulrunner\components\auth.dll
2009-10-12 21:19 . 2009-10-12 19:16 -------- d-----w- c:\documents and settings\Nick Rovenko\Application Data\Apple Computer
2009-10-12 21:17 . 2009-10-12 21:16 -------- d-----w- c:\program files\LimeWire
2009-10-12 21:17 . 2009-10-12 21:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-12 21:17 . 2009-10-12 21:17 -------- d-----w- c:\program files\Java
2009-10-12 21:17 . 2009-10-12 21:17 152576 ----a-w- c:\documents and settings\Nick Rovenko\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-12 21:15 . 2009-10-12 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-12 19:15 . 2009-10-12 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-12 19:15 . 2009-10-12 19:15 -------- d-----w- c:\program files\iPod
2009-10-12 19:15 . 2009-10-12 19:14 -------- d-----w- c:\program files\Common Files\Apple
2009-10-12 19:15 . 2009-10-12 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-12 19:15 . 2009-10-12 19:15 -------- d-----w- c:\program files\Bonjour
2009-10-12 19:15 . 2009-10-12 19:14 -------- d-----w- c:\program files\QuickTime
2009-10-12 19:14 . 2009-10-12 19:14 -------- d-----w- c:\program files\Apple Software Update
2009-10-12 18:31 . 2009-10-12 18:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-10-09 21:27 . 2009-10-09 21:27 -------- d-----w- c:\program files\Analog Devices
2009-10-09 21:27 . 2009-10-09 20:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-09 21:27 . 2009-10-09 20:45 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-09 21:27 . 2009-10-09 21:27 -------- d-----w- c:\program files\Broadcom
2009-10-09 20:53 . 2009-10-09 20:53 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-10-09 20:53 . 2009-10-09 20:53 -------- d-----w- c:\program files\CyberLink
2009-10-09 20:52 . 2009-10-09 20:51 -------- d-----w- c:\program files\Ahead
2009-10-09 20:50 . 2009-10-09 20:50 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-09 20:46 . 2009-10-09 20:45 -------- d-----w- c:\program files\Linksys Wireless-G PCI Adapter with SRX400
2009-10-09 20:46 . 2009-10-09 20:46 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-10-09 20:39 . 2009-10-09 20:39 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-10-09 20:23 . 2009-10-09 20:23 -------- d-----w- c:\program files\microsoft frontpage
2009-10-09 20:19 . 2009-10-09 20:19 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-10-09 20:05 . 2009-10-09 20:21 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-09 19:37 . 2009-10-09 19:37 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-10-09 19:36 . 2009-10-09 19:36 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2009-09-21 22:09 . 2009-09-21 22:09 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroCheck"="c:\windows\system32\\NeroCheck.exe" [2001-07-09 155648]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-04-06 94208]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-04-06 77824]
"Persistence"="c:\windows\system32\igfxpers.exe" [2005-04-06 114688]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="f:\music\iTunesHelper.exe" [2009-09-21 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-12 149280]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]

c:\documents and settings\Nick Rovenko\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-9-30 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Music\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

R3 Linksys3P;Wireless-G PCI Adapter with SRX400 Driver;c:\windows\system32\drivers\TMIMO31P.sys [10/9/2009 2:46 PM 780800]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
fioo32 REG_MULTI_SZ fioo32
.
Contents of the 'Scheduled Tasks' folder

2009-11-29 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-29 17:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2812)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2009-11-29 17:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-29 23:38

Pre-Run: 23,853,928,448 bytes free
Post-Run: 24,124,039,168 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 11E1E0B29E723EF1AE383E0297DA885C

Edited by nickr660, 29 November 2009 - 05:49 PM.

  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP