|
|
|
I think I have a problem here.
|
|
|
rw1985
Newbie
|
7. November 2008 @ 21:07 |
Link to this message
|
Okay, here's the deal. Every time I click on a Google search result, Firefox opens a new tab with what appears to be a random site. A few examples: BankingMyWay.com, Divorcepipe.info, etc. It never actually takes me to my desired site. Some sort of browser hijacker, I presume? Any advice on getting rid of this thing is greatly appreciated.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:55:35 PM, on 11/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3...sario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3...sario&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
O20 - AppInit_DLLs: karna.dat
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
--
End of file - 4642 bytes
|
|
Advertisement
|
|
|
|
Senior Member
|
8. November 2008 @ 03:48 |
Link to this message
|
Hi rw1985
Please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
rw1985
Newbie
|
8. November 2008 @ 16:24 |
Link to this message
|
Thanks for the reply. Here's my SuperAntiSpyware log.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/08/2008 at 04:13 PM
Application Version : 4.21.1004
Core Rules Database Version : 3555
Trace Rules Database Version: 1543
Scan type : Complete Scan
Total Scan Time : 06:21:59
Memory items scanned : 171
Memory threats detected : 0
Registry items scanned : 4659
Registry threats detected : 0
File items scanned : 51326
File threats detected : 15
Adware.Tracking Cookie
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@revsci[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@2o7[1].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@edge.ru4[1].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@cgi-bin[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@as-us.falkag[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@advertising[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@advert.runescape[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@tacoda[1].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@tribalfusion[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@adknowledge[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@atwola[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@ads.pointroll[1].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@ads.adgoto[1].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@ad[2].txt
C:\Documents and Settings\Ryan Warner\Cookies\ryan warner@atdmt[2].txt
|
Senior Member
|
9. November 2008 @ 02:15 |
Link to this message
|
Hey rw1985
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
rw1985
Newbie
|
9. November 2008 @ 10:47 |
Link to this message
|
Here's the ComboFix Log:
ComboFix 08-11-07.01 - Ryan Warner 2008-11-09 10:18:53.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.81 [GMT -5:00]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\TDSSpaxt.sys
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS
((((((((((((((((((((((((( Files Created from 2008-10-09 to 2008-11-09 )))))))))))))))))))))))))))))))
.
2008-11-08 09:30 . 2008-11-08 09:30 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-08 09:30 . 2008-11-08 09:30 <DIR> d-------- c:\documents and settings\Ryan Warner\Application Data\SUPERAntiSpyware.com
2008-11-08 09:30 . 2008-11-08 09:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-07 18:19 . 2008-11-07 18:22 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-07 18:19 . 2008-11-07 20:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-07 16:23 . 2008-11-07 16:23 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-07 16:23 . 2008-11-07 16:23 <DIR> d-------- c:\documents and settings\Ryan Warner\Application Data\Malwarebytes
2008-11-07 16:23 . 2008-11-07 16:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-07 16:23 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-07 16:23 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 16:19 . 2008-11-07 16:19 <DIR> d-------- c:\program files\Lavasoft
2008-11-07 16:19 . 2008-11-07 16:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-07 15:52 . 2005-04-30 00:49 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2008-11-07 15:52 . 2005-04-30 00:39 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Apple Computer
2008-11-07 15:52 . 2008-11-07 15:52 <DIR> d-------- c:\documents and settings\Administrator
2008-11-07 15:36 . 2008-11-07 15:36 <DIR> d-------- c:\program files\Trend Micro
2008-10-29 21:06 . 2007-07-19 17:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
2008-10-29 21:06 . 2007-05-16 15:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll
2008-10-29 21:06 . 2007-07-19 17:14 1,358,192 --a------ c:\windows\system32\D3DCompiler_35.dll
2008-10-29 21:06 . 2007-05-16 15:45 1,124,720 --a------ c:\windows\system32\D3DCompiler_34.dll
2008-10-29 21:06 . 2007-07-19 17:14 444,776 --a------ c:\windows\system32\d3dx10_35.dll
2008-10-29 21:06 . 2007-05-16 15:45 443,752 --a------ c:\windows\system32\d3dx10_34.dll
2008-10-29 21:06 . 2007-07-19 23:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll
2008-10-29 21:06 . 2007-06-20 19:46 266,088 --a------ c:\windows\system32\xactengine2_8.dll
2008-10-29 21:06 . 2007-04-04 17:55 261,480 --a------ c:\windows\system32\xactengine2_7.dll
2008-10-29 21:06 . 2007-04-04 17:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-10-29 21:06 . 2007-07-19 23:54 18,280 --a------ c:\windows\system32\x3daudio1_2.dll
2008-10-29 21:04 . 2005-05-26 14:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-10-29 21:03 . 2008-10-29 21:04 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-10-29 21:03 . 2008-10-29 21:03 <DIR> d-------- c:\documents and settings\Ryan Warner\Application Data\SystemRequirementsLab
2008-10-29 21:02 . 2008-10-29 21:02 <DIR> d-------- c:\program files\OpenAL
2008-10-29 21:02 . 2008-10-29 21:02 413,696 --a------ c:\windows\system32\wrap_oal.dll
2008-10-29 21:02 . 2008-10-29 21:02 110,592 --a------ c:\windows\system32\OpenAL32.dll
2008-10-29 21:00 . 2008-10-29 21:01 <DIR> d-------- c:\windows\system32\AGEIA
2008-10-29 21:00 . 2008-11-08 09:29 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-10-29 21:00 . 2008-10-29 21:01 <DIR> d-------- c:\program files\AGEIA Technologies
2008-10-26 15:12 . 2008-10-26 15:12 346 --a------ C:\TIM.SAV
2008-10-26 15:12 . 2008-10-26 15:12 169 --a------ C:\timwin.ini
2008-10-26 15:11 . 2008-10-26 15:11 280 --a------ c:\windows\SIERRA.INI
2008-10-24 21:02 . 2008-10-15 11:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-20 17:51 . 2008-10-20 17:53 <DIR> d-------- c:\program files\iTunes
2008-10-20 17:51 . 2008-10-20 17:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-20 17:46 . 2008-10-20 17:46 <DIR> d-------- c:\program files\Bonjour
2008-10-20 17:43 . 2008-10-20 17:45 <DIR> d-------- c:\program files\QuickTime
2008-10-17 19:29 . 2008-09-08 05:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-17 19:23 . 2008-09-15 07:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-17 19:22 . 2008-08-14 05:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-17 19:22 . 2008-08-14 05:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-17 19:22 . 2008-08-14 04:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-17 19:22 . 2008-08-14 04:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-07 19:43 --------- d-----w c:\program files\Winamp
2008-11-07 19:22 --------- d-----w c:\program files\Soulseek
2008-10-25 01:36 --------- d-----w c:\program files\Apple Software Update
2008-10-20 22:51 --------- d-----w c:\program files\iPod
2008-10-20 22:44 --------- d-----w c:\program files\Common Files\Apple
2008-10-08 19:15 --------- d-----w c:\documents and settings\Ryan Warner\Application Data\Move Networks
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-08-29 14:18 87,336 ----a-w c:\windows\system32\dns-sd.exe
2008-08-29 13:53 61,440 ----a-w c:\windows\system32\dnssd.dll
2008-08-25 21:41 1,304 ----a-w c:\documents and settings\Ryan Warner\Application Data\wklnhst.dat
2008-08-20 05:30 666,112 ----a-w c:\windows\system32\wininet.dll
2008-08-20 05:30 666,112 ------w c:\windows\system32\dllcache\wininet.dll
2008-08-20 05:30 619,520 ------w c:\windows\system32\dllcache\urlmon.dll
2008-08-20 05:30 3,067,904 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-20 05:30 1,499,136 ------w c:\windows\system32\dllcache\shdocvw.dll
2008-08-14 10:11 2,189,184 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 10:04 138,496 ------w c:\windows\system32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 ----a-w c:\windows\system32\ntkrnlpa.exe
2006-05-03 10:06 163,328 --sh--r c:\windows\system32\flvDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-10-01 11:57 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-04-11 12:00 339968 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
--a------ 2005-02-17 16:01 233534 c:\program files\HPQ\Default Settings\Cpqset.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-05-08 15:24 54840 c:\program files\Hp\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
--a------ 2005-04-01 17:11 794624 c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 17:57 289576 c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher]
--a------ 2004-10-14 15:54 253952 c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmcService]
--a------ 2004-10-15 18:40 2577632 c:\progra~1\Sygate\SPF\Smc.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-09-16 12:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 03:00 132496 c:\program files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a------ 2005-02-02 07:11 692316 c:\program files\Synaptics\SynTP\SynTPEnh.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]
--a------ 2005-02-02 07:12 102492 c:\program files\Synaptics\SynTP\SynTPLpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-08-02 21:03 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
--a------ 2008-02-29 02:12 76304 c:\windows\KHALMNPR.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\ABC\\abc.exe"=
"c:\\Program Files\\Soulseek\\slsk.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R3 HSFHWATI;HSFHWATI;c:\windows\system32\DRIVERS\HSFHWATI.sys [2004-12-15 200192]
S0 qoebz;qoebz;c:\windows\system32\drivers\iorv.sys [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a65627e-1f3c-11db-a235-00163636fd8b}]
\Shell\AutoRun\command - E:\Help!.exe
\Shell\open\command - E:\Help!.exe
.
Contents of the 'Scheduled Tasks' folder
2008-10-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe
MSConfigStartUp-URLLSTCK - c:\program files\Norton Internet Security\UrlLstCk.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Ryan Warner\Application Data\Mozilla\Firefox\Profiles\jyrqnoqp.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.
.
------- File Associations -------
.
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-09 10:27:53
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"=""
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Sygate\SPF\Smc.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-11-09 10:41:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-09 15:40:57
Pre-Run: 5,239,422,976 bytes free
Post-Run: 5,865,779,200 bytes free
228 --- E O F --- 2008-10-25 04:16:35
|
Senior Member
|
9. November 2008 @ 22:07 |
Link to this message
|
Hey rw1985
Please upload all the contents of C:\Qoobox here:
http://www.uploadmalware.com/
After that, tell me what problems you have left.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
rw1985
Newbie
|
10. November 2008 @ 10:20 |
Link to this message
|
|
I uploaded the files. Everything seems to be back in working order! Thanks so much for all of your help!
|
|
Advertisement
|
|
|
Senior Member
|
11. November 2008 @ 00:24 |
Link to this message
|
|
You're welcome, rw1985. Enjoy!
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
