Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Google Redirect Virus? Please please please (!) help! [Solved

Started by matty_z , Dec 07 2009 10:03 PM

  • This topic is locked This topic is locked

#16
matty_z
Posted 09 December 2009 - 07:24 AM

matty_z

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
K, whew! The scan took about 8.5 hours.

While it seems some of the terms they now use have changed, this is what I think you were referring to:

Autoscan: completed 1 minute ago (events: 34, objects: 342795, time: 08:29:13)
12/8/2009 10:39:27 PM Task started
12/8/2009 11:50:58 PM Detected: http://www.viruslist...dvisories/36983 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
12/8/2009 11:53:25 PM Detected: http://www.viruslist...dvisories/35948 C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll
12/9/2009 12:06:37 AM Detected: http://www.viruslist...dvisories/37231 C:\Program Files\Java\jre1.5.0_02\bin\java.exe
12/9/2009 12:24:22 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 12:24:23 AM Untreated: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Postponed
12/9/2009 12:24:23 AM Detected: http://www.viruslist...dvisories/23655 C:\Qoobox\Quarantine\C\WINDOWS\system32\System\msxml4.dll.vir
12/9/2009 12:32:48 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 12:32:48 AM Untreated: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack Postponed
12/9/2009 1:22:50 AM Detected: http://www.viruslist...dvisories/22288 D:\i386\Apps\App01317\nav\external\norton\app\navapsvc.exe
12/9/2009 1:31:47 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 1:31:47 AM Untreated: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN Postponed
12/9/2009 1:37:35 AM Detected: http://www.viruslist...dvisories/35314 C:\Program Files\iTunes\iTunes.exe
12/9/2009 1:39:40 AM Detected: http://www.viruslist...dvisories/36983 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
12/9/2009 1:40:19 AM Detected: http://www.viruslist...dvisories/36627 C:\Program Files\QuickTime\QuickTimePlayer.exe
12/9/2009 2:42:51 AM Detected: http://www.viruslist...dvisories/35948 C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll
12/9/2009 2:54:17 AM Detected: http://www.viruslist...dvisories/37231 C:\Program Files\Java\jre1.5.0_02\bin\java.exe
12/9/2009 3:09:06 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 3:09:06 AM Untreated: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Postponed
12/9/2009 3:09:06 AM Detected: http://www.viruslist...dvisories/23655 C:\Qoobox\Quarantine\C\WINDOWS\system32\System\msxml4.dll.vir
12/9/2009 3:13:29 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 3:13:29 AM Untreated: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack Postponed
12/9/2009 3:58:42 AM Detected: http://www.viruslist...dvisories/22288 D:\i386\Apps\App01317\nav\external\norton\app\navapsvc.exe
12/9/2009 4:03:50 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 4:03:51 AM Untreated: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN Postponed
12/9/2009 4:07:25 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Disinfected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Disinfected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:30 AM Disinfected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:30 AM Disinfected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:31 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 7:08:41 AM Deleted: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe
12/9/2009 7:08:42 AM Task completed

Yes?
  • 0

Advertisements

#17
matty_z
Posted 09 December 2009 - 07:41 AM

matty_z

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
*****Sorry... didn't mean to post log twice!!*****


Here is the Kas log:


Autoscan: completed 1 minute ago (events: 34, objects: 342795, time: 08:29:13)
12/8/2009 10:39:27 PM Task started
12/8/2009 11:50:58 PM Detected: http://www.viruslist...dvisories/36983 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
12/8/2009 11:53:25 PM Detected: http://www.viruslist...dvisories/35948 C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll
12/9/2009 12:06:37 AM Detected: http://www.viruslist...dvisories/37231 C:\Program Files\Java\jre1.5.0_02\bin\java.exe
12/9/2009 12:24:22 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 12:24:23 AM Untreated: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Postponed
12/9/2009 12:24:23 AM Detected: http://www.viruslist...dvisories/23655 C:\Qoobox\Quarantine\C\WINDOWS\system32\System\msxml4.dll.vir
12/9/2009 12:32:48 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 12:32:48 AM Untreated: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack Postponed
12/9/2009 1:22:50 AM Detected: http://www.viruslist...dvisories/22288 D:\i386\Apps\App01317\nav\external\norton\app\navapsvc.exe
12/9/2009 1:31:47 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 1:31:47 AM Untreated: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN Postponed
12/9/2009 1:37:35 AM Detected: http://www.viruslist...dvisories/35314 C:\Program Files\iTunes\iTunes.exe
12/9/2009 1:39:40 AM Detected: http://www.viruslist...dvisories/36983 C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
12/9/2009 1:40:19 AM Detected: http://www.viruslist...dvisories/36627 C:\Program Files\QuickTime\QuickTimePlayer.exe
12/9/2009 2:42:51 AM Detected: http://www.viruslist...dvisories/35948 C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll
12/9/2009 2:54:17 AM Detected: http://www.viruslist...dvisories/37231 C:\Program Files\Java\jre1.5.0_02\bin\java.exe
12/9/2009 3:09:06 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 3:09:06 AM Untreated: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Postponed
12/9/2009 3:09:06 AM Detected: http://www.viruslist...dvisories/23655 C:\Qoobox\Quarantine\C\WINDOWS\system32\System\msxml4.dll.vir
12/9/2009 3:13:29 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 3:13:29 AM Untreated: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack Postponed
12/9/2009 3:58:42 AM Detected: http://www.viruslist...dvisories/22288 D:\i386\Apps\App01317\nav\external\norton\app\navapsvc.exe
12/9/2009 4:03:50 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 4:03:51 AM Untreated: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN Postponed
12/9/2009 4:07:25 AM Detected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Disinfected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Disinfected: Rootkit.Win32.TDSS.y C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir
12/9/2009 7:07:23 AM Detected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:30 AM Disinfected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:30 AM Disinfected: Rootkit.Win32.TDSS.y C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP432\A0096526.sys/DoomPack
12/9/2009 7:07:31 AM Detected: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe/WiseSFXDropper/WISE0015.BIN
12/9/2009 7:08:41 AM Deleted: not-a-virus:AdWare.Win32.SearchIt.t D:\i386\Apps\App00577\comps\toolbar\toolbr.exe
12/9/2009 7:08:42 AM Task completed


All clear??

Edited by matty_z, 09 December 2009 - 07:44 AM.

  • 0

#18
Rorschach112
Posted 09 December 2009 - 08:12 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
one final scan

post a new HJT log
  • 0

#19
matty_z
Posted 09 December 2009 - 06:13 PM

matty_z

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Here is the new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:55:18 PM, on 12/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\McAfee\Common Framework\McScript_InUse.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\79dcd525ce358a24d1cdafa5eb0136fa\update\update.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Norton PasswordManager] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID {D1AFB197-5F24-49f4-9571-2F28A9798936}
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.liv...m/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} (F5 Networks VPN Manager) - https://corp.qintera...0,2009,514,2217
O16 - DPF: {41EF3CD2-D8CC-4438-84B1-280BB4E77C8E} (F5 Networks Dynamic Application Tunnel Control) - https://corp.qintera...0,2009,514,2213
O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - https://corp.qintera...,2009,0514,2204
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} (F5 Networks SuperHost Class) - https://corp.qintera...0,2009,514,2210
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} (F5 Networks Host Control) - https://corp.qintera...0,2009,514,2205
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 11825 bytes
  • 0

#20
Rorschach112
Posted 10 December 2009 - 06:17 AM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Your logs are clean


Follow these steps to uninstall Combofix and tools used in the removal of malware

Uninstall ComboFix

Remove Combofix now that we're done with it.
  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
    Posted Image
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.



  • Download OTC to your desktop and run it
  • Click Yes to beginning the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.




Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html



Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.



Below I have included a number of recommendations for how to protect your computer against malware infections.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • TFC - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here


    If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
    • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.

  • Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

  • Please read my guide on how to prevent malware and about safe computing here
Thank you for your patience, and performing all of the procedures requested.
  • 0

#21
Rorschach112
Posted 16 December 2009 - 03:30 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP