PWS.LDPinchIE

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

PWS.LDPinchIE, Removed via SDfix-Want to be sure computer is safe

Options

astronomr5 View Member Profile	Jun 30 2009, 02:26 PM Post #1
New Member Group: Members Posts: 4 Joined: 30-June 09 Member No.: 346,943	OS=Windows XP Pro, SP3 Long story short, I was missing my "Folder Options" option on the tools menu of my windows explorer and also from the control panel. I searched Microsoft's Tech communities and found that this is sometimes caused by malware/viruses that also prevent you from changing the registry. Which I also found to be the case on my system. I scanned with adaware, and spysweeper but neither found any threats. I scanned with Spybot S&D and it found the trojan listed in the title. After letting spybot remove the threat, it would keep coming back after restarting the computer. I searched google and found some older posts about how to remove this threat using SDfix and combofix. Unfortunately, I jumped the gun a bit and ran them before reading how to make a post here. Anyhow, attached is the log from the SDfix and the combofix scans. Can you please let me know if my computer is safe to use? Thanks in advance for our help! Attached File(s) Report.txt ( 12.46k ) Number of downloads: 4 ComboFix.txt ( 10.92k ) Number of downloads: 6

Replies (1 - 7)

schrauber View Member Profile	Jul 4 2009, 02:50 AM Post #2
Mr.Mechanic Group: HJT Team Posts: 3,127 Joined: 3-May 08 From: Saarland,Germany Member No.: 206,858	Hello astronomr5 and welcome to Bleeping Computer We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far. Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware. If you have already posted a DDS log, please do so again, as your situation may have changed. Use the 'Add Reply' and add the new log to this thread. Thanks and again sorry for the delay. We need to see some information about what is happening in your machine. Please perform the following scan: Download DDS by sUBs from one of the following links. Save it to your desktop. DDS.scr DDS.pif Double click on the DDS icon, allow it to run. A small box will open, with an explaination about the tool. No input is needed, the scan is running. Notepad will open with the results. Follow the instructions that pop up for posting the results. Close the program window, and delete the program from your desktop. Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE -------------------- regards, schrauber If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you! If I have helped you then please consider donating to continue the fight against malware

astronomr5 View Member Profile	Jul 7 2009, 06:18 AM Post #3
New Member Group: Members Posts: 4 Joined: 30-June 09 Member No.: 346,943	DDS logfile: DDS (Ver_09-06-26.01) - NTFSx86 Run by smay at 7:07:15.45 on Tue 07/07/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.479.200 [GMT -4:00] AV: Trend Micro OfficeScan Antivirus On-access scanning enabled (Updated) {C543F6E5-C8DF-4641-8211-E4797B709EF0} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\slClient.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroTray.exe C:\Program Files\Microsoft Hardware\Mouse\POINT32.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\smay\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://msnbc.com/ mStart Page = about:blank TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: {9516EB1C-AC77-492D-8FD6-A05AFAC9EA6E} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [AdobeUpdater] "c:\program files\common files\adobe\updater5\AdobeUpdater.exe" mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime StartupFolder: c:\docume~1\smay\startm~1\programs\startup\micros~1.lnk - c:\windows\installer\{90110409-6000-11d3-8cfe-0150048383c9}\outicon.exe IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxps://trendsvr.winston.luwausa.local:4343/officescan/console/ClientInstall/WinNTChk.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=67633 DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxps://trendsvr.winston.luwausa.local:4343/officescan/console/ClientInstall/setup.cab DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} - hxxps://trendsvr.winston.luwausa.local:4343/officescan/console/html/AtxEnc.cab DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl.sun.com/webapps/download/AutoDL?BundleId=26688 DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R1 dwvkbd;DameWare Virtual Keyboard 32 bit Driver;c:\windows\system32\drivers\dwvkbd.sys [2007-2-15 26624] R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [2007-2-9 14976] R2 SLClient;ScriptLogic Service;c:\windows\system32\SLClient.exe [2005-6-8 534528] R2 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\TmXPFlt.sys [2006-9-6 225296] R2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\tmpreflt.sys [2006-9-6 36368] R3 DwMirror;DwMirror;c:\windows\system32\drivers\DamewareMini.sys [2007-2-7 3712] S3 DAmirr;DAmirr;c:\windows\system32\drivers\damirr.sys --> c:\windows\system32\drivers\DAmirr.sys [?] S3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [2004-12-22 16384] S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\PELUSBLF.SYS [2004-12-22 9216] S3 TmProxy;OfficeScan NT Proxy Service;c:\program files\trend micro\officescan client\TmProxy.exe [2008-9-9 652552] S4 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2005-1-17 102463] S4 SSI Client Installer;SSI Survey Client Installer Service;c:\windows\system32\SCInstallerNT.exe [2008-10-1 466944] S4 SSI Survey Client;SSI Survey Client;c:\program files\scalable software\survey\ssi survey client\surveyclientnt.exe [2008-10-1 90112] =============== Created Last 30 ================ 2009-06-30 11:45 <DIR> --d----- c:\windows\system32\dllcache\cache 2009-06-30 08:28 39,424 a------- c:\windows\system32\grpconv.exe 2009-06-30 08:28 39,424 a------- c:\windows\system32\dllcache\grpconv.exe 2009-06-30 08:20 <DIR> a-dshr-- C:\cmdcons 2009-06-30 08:11 161,792 a------- c:\windows\SWREG.exe 2009-06-30 08:11 155,136 a------- c:\windows\PEV.exe 2009-06-30 08:11 98,816 a------- c:\windows\sed.exe 2009-06-30 07:22 <DIR> --d----- C:\SDFix 2009-06-30 06:56 578,560 a------- c:\windows\system32\dllcache\user32.dll 2009-06-30 06:53 <DIR> --d----- c:\windows\ERUNT 2009-06-18 08:05 <DIR> --d----- c:\documents and settings\smay\etpro 2009-06-18 08:04 <DIR> --d----- C:\data 2009-06-12 11:06 664 a------- c:\windows\system32\d3d9caps.dat ==================== Find3M ==================== 2009-06-30 07:12 4,728 a------- c:\windows\system32\PerfStringBackup.TMP 2009-06-12 06:55 10,752 a------- c:\windows\DCEBoot.exe 2009-05-22 07:39 153,104 a------- c:\windows\system32\drivers\tmcomm.sys 2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll 2009-05-07 11:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll 2009-04-29 00:56 827,392 a------- c:\windows\system32\wininet.dll 2009-04-29 00:56 827,392 a------- c:\windows\system32\dllcache\cache\wininet.dll 2009-04-29 00:56 827,392 -------- c:\windows\system32\dllcache\wininet.dll 2009-04-29 00:56 233,472 -------- c:\windows\system32\dllcache\webcheck.dll 2009-04-29 00:56 1,159,680 -------- c:\windows\system32\dllcache\urlmon.dll 2009-04-29 00:56 671,232 -------- c:\windows\system32\dllcache\mstime.dll 2009-04-29 00:56 105,984 -------- c:\windows\system32\dllcache\url.dll 2009-04-29 00:56 102,912 -------- c:\windows\system32\dllcache\occache.dll 2009-04-29 00:56 44,544 -------- c:\windows\system32\dllcache\pngfilt.dll 2009-04-29 00:56 3,596,288 -------- c:\windows\system32\dllcache\mshtml.dll 2009-04-29 00:56 477,696 -------- c:\windows\system32\dllcache\mshtmled.dll 2009-04-29 00:56 193,024 -------- c:\windows\system32\dllcache\msrating.dll 2009-04-28 05:05 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe 2009-04-28 05:05 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe 2009-04-25 01:27 636,088 -------- c:\windows\system32\dllcache\iexplore.exe 2009-04-25 01:26 161,792 -------- c:\windows\system32\dllcache\ieakui.dll 2009-04-17 08:26 1,847,168 a------- c:\windows\system32\win32k.sys 2009-04-17 08:26 1,847,168 -------- c:\windows\system32\dllcache\win32k.sys 2009-04-15 10:51 585,216 a------- c:\windows\system32\rpcrt4.dll 2009-04-15 10:51 585,216 -------- c:\windows\system32\dllcache\rpcrt4.dll 2009-02-17 10:53 1,848 a------- c:\docume~1\alluse~1\applic~1\SSIHistory.dat 2006-05-03 05:06 163,328 ---shr-- c:\windows\system32\flvDX.dll 2007-02-21 06:47 31,232 ---shr-- c:\windows\system32\msfDX.dll ============= FINISH: 7:08:29.72 =============== Thanks for your help!

PropagandaPanda View Member Profile	Jul 9 2009, 07:39 PM Post #4
Group: HJT Team Posts: 6,895 Joined: 10-March 08 Member No.: 195,473	Hello. What symptoms are present at the moment? If this file is present, please post the contents of it: C:\Qoobox\ComboFix2.txt Run Scan with Kaspersky Please do a scan with Kaspersky Online Scanner. If you are using Windows Vista, open your browser by right-clicking on its icon and select Run as administrator to perform this scan. Please disable your realtime protection software before proceeding. Refer to this page if you are unsure how. Open the Kaspersky Scanner page. Click on Accept and install any components it needs. The program will install and then begin downloading the latest definition files. After the files have been downloaded on the left side of the page in the Scan section select Critical Areas. This will start the program and scan your system. The scan will take a while, so be patient and let it run. Once the scan is complete, click on View scan report Now, click on the Save Report as button. Save the file to your desktop. Copy and paste that information in your next post. You can refer to this animation by sundavis. This scanner will only scan. It does not remove any malware it finds. Please take a fresh DDS log after. Include the Attach.txt. With Regards, The Panda -------------------- If I have been helping you and do not reply within 24 hours, please send me a message.

PropagandaPanda View Member Profile	Jul 13 2009, 08:26 AM Post #6
Group: HJT Team Posts: 6,895 Joined: 10-March 08 Member No.: 195,473	Hello. The latest logs are clean. Unless there are any issues at the moment, we can update your Java and wrap up. Update Java to Version 6 Update 14 Your current version of Java is outdated. Malware creators can exploit the lesser security of older versions. Please uninstall your current version through Add/Remove Programs. Remove all instances of Java, J2SE Runtime, Java Runtime, and Java Runtime Environment. Restart your computer after uninstalling. Please download the installer here. Choose "Windows". Delete the installer after use. Uninstall ComboFix Remove Combofix now that we're done with it. Click on your Start Menu, then Run.... Now type the following into the runbox and click OK. Notice the space between the "x" and "/". CODE ComboFix /u Uninstalling ComboFix will do the following: Delete ComboFix and its components from your computer. Delete other tools commonly used during the malware removal process. Resets clock settings to standard format. Hides file extensions and hidden/system files. Clears System Restore cache and creates new restore point. Preventing Malware Infection in the Future Please take some time to look at the following links, giving some advice and suggestions for preventing future infections: So How did I get infected? Microsoft - 'Security at home' For general slowness problems that you may have, take a look at Slow Computer/browser? It May Not Be Malware. Read How to use the Startup Database to identify and disable uneeded processes and increase the amount of available resources. Do you have any questions or concerns? With Regards, The Panda -------------------- If I have been helping you and do not reply within 24 hours, please send me a message.

astronomr5 View Member Profile	Jul 13 2009, 01:34 PM Post #7
New Member Group: Members Posts: 4 Joined: 30-June 09 Member No.: 346,943	Panda, I updated my java and uninstalled the combofix. Thank you and all the volunteers on this site for the work you all do!!

PropagandaPanda View Member Profile	Jul 13 2009, 02:00 PM Post #8
Group: HJT Team Posts: 6,895 Joined: 10-March 08 Member No.: 195,473	Glad we could ehlp. Since this issue appears to be resolved, this topic is now closed. If you are the topic starter and need this topic reopened, send me a message. Everyone else, please begin a new topic. With Regards, The Panda -------------------- If I have been helping you and do not reply within 24 hours, please send me a message.

« Next Oldest · HijackThis Logs and Virus/Trojan/Spyware/Malware Removal · Next Newest »

2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)

0 Members:

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides