Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Privacy Protector?


  • This topic is locked This topic is locked
1 reply to this topic

#1 stackdollaz89

stackdollaz89

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:24 AM

Posted 02 June 2008 - 09:46 PM

ok, so I get on the internet looking for a codec to play mp4's on my computer and seemingly I've found one. problem is its not really a codec its some rogue program that takes over your computer and creates error messages and pop up screens in order for you to buy their so called virus protection program. so, I googled the name "privacy protector" and found this website. I saw someone else was having the same problem I was having. I read that forum and it was extremely helpful. with instructions from http://www.bleepingcomputer.com/combofix/how-to-use-combofix I ran combofix and the problem was solved in a couple of hours. in fact I think my computer is running more smoothly than before. the only issue I have now is that my computer's clock is stuck on military time due to combofix and I cant seem to fix it. I'm not complaining because it's so irrelevant compared to the "privacy protector" problem but the combofix program said I show post my log in case there are any problems down the road so here it is:


ComboFix 08-06-01.6 - 2008-06-02 13:24:12.1 - NTFSx86
Running from: C:\Documents and Settings\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Application Data\Adssite Advanced Toolbar
C:\Documents and Settings\Application Data\Adssite Advanced Toolbar\advertbuttons.xml
C:\Documents and SettingsApplication Data\Adssite Advanced Toolbar\selected.xml
C:\Documents and Settings\Application Data\searchtoolbarcorp
C:\Documents and Settings\Application Data\searchtoolbarcorp\Toolbar Vision\PageHistory.txt
C:\Documents and Settings\Application Data\searchtoolbarcorp\Toolbar Vision\WebHistory.txt
C:\Documents and Settings\Desktop\Error Cleaner.url
C:\Documents and Settings\Desktop\Privacy Protector.url
C:\Documents and Settings\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Favorites\Error Cleaner.url
C:\Documents and Settings\Favorites\Privacy Protector.url
C:\Documents and Settings\Favorites\Spyware&Malware Protection.url
C:\Program Files\vsadd-in
C:\WINDOWS\boqnrwdmnow.dll
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\iQWwxyay.ini
C:\WINDOWS\system32\iQWwxyay.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\thfmxpov.dll
C:\WINDOWS\system32\tuvtUOHW.dll
C:\WINDOWS\system32\vopxmfht.ini
C:\WINDOWS\system32\yayxwWQi.dll
C:\WINDOWS\vltdfabw.dll
C:\WINDOWS\vregfwlx.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSUPDATE
-------\Service_msupdate


((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 )))))))))))))))))))))))))))))))
.

2008-06-02 12:42 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-02 12:42 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-02 12:42 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-02 12:42 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-02 12:42 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-02 12:42 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-02 12:42 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-02 12:42 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-02 12:07 . 2008-06-02 12:08 <DIR> d-------- C:\Program Files\Windows Defender
2008-06-02 00:57 . 2008-06-01 23:22 163,840 --a------ C:\WINDOWS\edrw.exe
2008-05-17 11:57 . 2008-05-17 11:59 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-02 15:23 --------- d-----w C:\Documents and Settings\Application Data\AVG7
2008-06-02 05:02 --------- d-----w C:\Program Files\DownloadToolz
2008-05-29 05:13 --------- d-----w C:\Documents and Settings\Application Data\BitTorrent
2008-05-23 09:59 --------- d-----w C:\Program Files\Songbird
2008-05-21 16:47 --------- d-----w C:\Program Files\FriendBlasterPro
2008-05-20 20:20 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-06 03:04 --------- d-----w C:\Documents and Settings\Application Data\PACE Anti-Piracy
2008-05-06 03:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
2008-04-26 22:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\ALM
2008-04-26 17:41 --------- d-----w C:\Program Files\Badder Adder
2008-04-22 12:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-04-21 22:01 --------- d-----w C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-21 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-21 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-04-21 21:40 --------- d-----w C:\Program Files\AVG
2008-04-20 17:11 --------- d-----w C:\Documents and Settings\Application Data\dvdcss
2008-04-20 15:45 --------- d-----w C:\Program Files\Maketorrent 2
2008-04-18 17:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\SongbirdVLC
2008-04-18 17:11 --------- d-----w C:\Documents and Settings\Application Data\Songbird1
2008-04-14 16:44 --------- d-----w C:\Documents and Settings\Application Data\LimeWire
2008-04-04 02:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2006-11-11 21:27 1,461,743 --sha-w C:\WINDOWS\repair\cmfavja.bak1
2006-11-20 06:54 1,419,826 --sha-w C:\WINDOWS\repair\cmfavja.bak2
2006-11-23 03:32 1,428,546 --sha-w C:\WINDOWS\repair\cmfavja.ini2
2006-02-07 20:58 104 --sh--r C:\WINDOWS\system32\9E93F31B28.sys
2006-05-03 10:06 163,328 --sha-r C:\WINDOWS\system32\flvDX.dll
2006-02-07 20:58 4,184 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-02-21 11:47 31,232 --sha-r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sha-w C:\WINDOWS\system32\Smab0.dll
2008-02-04 19:26 151,040 --sha-w C:\WINDOWS\system32\VistaUltm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6EC0B5C2-25E9-4248-81DB-C613E5DCFF56}]
C:\WINDOWS\repair\ajvafmc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spyware Assassin v.4.0"="C:\Program Files\Spyware Assassin 4.0\Spyware Assassin.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe" [ ]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 10:59 224248]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:39 1289000]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-01-17 12:51 486856]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 23:06 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 10:59 224248]
"Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 09:32 94208]
"Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 10:10 69632]
"HostManager"="C:\Program Files\Common Files\AOL\1149114779\ee\AOLHostManager.exe" [2005-08-02 15:33 159832]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 20:05 200704]
"DigidesignMMERefresh"="E:\Digidesign\Drivers\MMERefresh.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-21 18:09 579584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-21 18:09 219136]

C:\Documents and Settings\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2006-11-08 19:18:44 189952]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ajvafmc]
C:\WINDOWS\repair\ajvafmc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"vidc.yv12"= yv12vfw.dll
"wave4"= Digi32.dll
"MIDI1"= diomidi.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\yfK30.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^dlbcserv.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\dlbcserv.lnk
backup=C:\WINDOWS\pss\dlbcserv.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=C:\WINDOWS\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Ulead Photo Express 4.0 SE Calendar Checker .lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ulead Photo Express 4.0 SE Calendar Checker .lnk
backup=C:\WINDOWS\pss\Ulead Photo Express 4.0 SE Calendar Checker .lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
C:\Program Files\ewido anti-spyware 4.0\ewido.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2005-05-15 04:04 332800 C:\Program Files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM]
--a------ 2005-08-15 21:38 20553 C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-09-01 16:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe"=
"C:\\Documents and Settings\\Desktop\\MySpaceMp3Gopher.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 DigiFilter;DigiFilter;C:\WINDOWS\system32\drivers\DigiFilt.sys [2006-12-08 22:50]
R2 DigiNet;Digidesign Ethernet Support;C:\WINDOWS\system32\DRIVERS\diginet.sys [2007-10-31 02:16]
S0 yfK30;yfK30;C:\WINDOWS\system32\Drivers\yfK30.sys []
S2 Ca533av;Mega DV(Video);C:\WINDOWS\system32\Drivers\Ca533av.sys [2002-10-21 12:37]
S2 DP1112;DP1112;C:\WINDOWS\system32\Drivers\DP.sys []
S3 USBCamera;DSC Still Image Capture (CA533A);C:\WINDOWS\system32\Drivers\Bulk533.sys [2002-12-04 15:38]
S3 wdm_opl3sax;YAMAHA OPL3-SAx Audio Driver (WDM);C:\WINDOWS\system32\drivers\opl3sax.sys [2001-08-17 12:20]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b83cdd56-f8fa-11dc-879f-9d188898aebb}]
\Shell\AutoRun\command - H:\wd_windows_tools\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-05-27 21:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-02 17:52:18 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-02 13:50:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\pccguide.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Common Files\AOL\1149114779\ee\AOLServiceHost.exe
.
**************************************************************************
.
Completion time: 2008-06-02 14:05:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-02 18:04:55

Pre-Run: 22,348,517,376 bytes free
Post-Run: 23,157,272,576 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

229 --- E O F --- 2008-05-28 16:08:56




P.S. Any help with the clock situation would be appreciated as well, thanks :thumbsup:

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,854 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:08:24 AM

Posted 02 June 2008 - 11:33 PM

Hello stackdollaz89 and welcome to BC :thumbsup:

ComboFix logs should not to be posted outside the HijackThis forums. It is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert", NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Please create a new topic explaining the nature of your problem in the Am I infected? What do I do? forum. Describe pop-ups and system tray or desktop icons that have appeared. Explain what is "going wrong" with your computer. Note any tools you have used and their respective results.

If needed, we will direct you to our HJT Preparation Guide.

Thank you for using BleepingComputer as your malware removal source.

This topic is now closed.
The BC Staff
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users