Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet Explorer Ads when using Firefox - Help appreciated


  • This topic is locked This topic is locked
8 replies to this topic

#1 mattface

mattface

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:29 AM

Posted 22 February 2009 - 10:27 AM

yeah i always get internet explorer ads while im using firefox D:
i'd really appreciate it if someone could help me out. This is Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:26:47, on 22/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\rundll32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 0.0.0.0:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\csml.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0D39A900-0F3A-4C29-A254-3E65244FDC34} - (no file)
O2 - BHO: (no name) - {12f85003-1f21-488f-ae45-d6239fc1f029} - (no file)
O2 - BHO: (no name) - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - (no file)
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [meet great active lies] C:\Documents and Settings\All Users\Application Data\soft chic meet great\meow win.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Curb blue] C:\DOCUME~1\Matty\APPLIC~1\UPEACH~1\Support spam manager.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZCxdm491YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\SCRABBLE\Images\stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Monopoly Here and Now\Images\armhelper.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: crypt - crypts.dll (file missing)
O21 - SSODL: MSHTMLS - {A888F568-58E4-11d0-A68A-0000837E3100} - (no file)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Windows Client/Server Management Layer (CSML) - Unknown owner - C:\WINDOWS\system32\csml.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Windows Update Manager Security Service (wumss) - Unknown owner - C:\WINDOWS\system32\wumss.exe (file missing)

--
End of file - 9058 bytes

Attached Files


Edited by mattface, 22 February 2009 - 10:34 AM.


BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:29 PM

Posted 23 February 2009 - 05:35 AM

Hello,

Go to start > controlpanel > software > add/remove programs and look if you have one or more of next programs installed and uninstall them:

3wPlayer
Anti-Leech
Bitgrabber
BitRoll
Bitdownload
Browser Enhancer
CiD Help
CiD Manager
DivoCodec version X.X.X.X (X are numbers)
DivoPlayer version X.X.X.X (X are numbers)
DomPlayer
Download Plugin for Internet Explorer
Get-Torrent version X.X.X.X (X are numbers)
KitPlayer
Lop.com
LOP SEARCH
Messenger Plus! Live & Sponsor (CiD)
Messenger Plus or Messenger Plus and Client
Netpumper
Search Plugin
Torrent101
TorrentQ
TorrentSpeeder version X.X.X.X (X are numbers)
Ultimate Browser Enhancer
Window Search
Window Searching
WinZix
W3player
Zone Media


This because they are bundled with the malware you are dealing with (swizzor aka lop).

This will uninstall the malware application.
In case, during uninstall, when asked for the uninstall Verification, please enter the numbers that will appear in the window.
In case it says that the file was not found, doublecheck again if you entered the exact command. If still the same, proceed with next steps.


In case you can't find them,

* Go to start > run and copy and paste next command below in the field:
(Please make sure you copy and paste it exactly as you'll find below)

"C:\DOCUME~1\Matty\APPLIC~1\UPEACH~1\Support spam manager.exe" -uninstall

Hit enter.

Then reboot. Important!

After reboot,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 mattface

mattface
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:29 AM

Posted 23 February 2009 - 11:51 AM

Thanks :thumbup2:

here's the combofix log

ComboFix 09-02-21.01 - Matty 2009-02-23 16:38:52.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.716 [GMT 0:00]
Running from: c:\documents and settings\Matty\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Starware386
c:\documents and settings\All Users\Application Data\Starware386\buttons\1154_button_1b_def.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\1154_button_1b_over.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\Button_50.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\Button_60.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\Button_70.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\FindIt.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\FindItHot.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\findithotxp.png
c:\documents and settings\All Users\Application Data\Starware386\buttons\finditxp.png
c:\documents and settings\All Users\Application Data\Starware386\buttons\logo.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\logoxp.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\Reference.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\ReferenceHot.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\referencehotxp.png
c:\documents and settings\All Users\Application Data\Starware386\buttons\referencexp.png
c:\documents and settings\All Users\Application Data\Starware386\buttons\Weather.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\WeatherHot.bmp
c:\documents and settings\All Users\Application Data\Starware386\buttons\weatherhotxp.png
c:\documents and settings\All Users\Application Data\Starware386\buttons\weatherxp.png
c:\documents and settings\All Users\Application Data\Starware386\contexts\error.xml
c:\documents and settings\All Users\Application Data\Starware386\contexts\Related.xml
c:\documents and settings\All Users\Application Data\Starware386\contexts\Travel.xml
c:\documents and settings\All Users\Application Data\Starware386\images\walertXP.bmp
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\ProductMessagingConfig.xml
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\ProductMessagingConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\SimpleUpdateConfig.xml
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\SimpleUpdateConfig.xml.backup
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\TimerManagerConfig.xml
c:\documents and settings\All Users\Application Data\Starware386\SimpleUpdate\TimerManagerConfig.xml.backup
c:\documents and settings\Matty\Application Data\inst.exe
c:\documents and settings\Matty\Application Data\Starware386
c:\documents and settings\Matty\Application Data\Starware386\BrowserSearch\BrowserSearch.xml
c:\documents and settings\Matty\Application Data\Starware386\BrowserSearch\BrowserSearch.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Button_5\Button_5Options.xml
c:\documents and settings\Matty\Application Data\Starware386\Button_5\Button_5Options.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Button_6\Button_6Options.xml
c:\documents and settings\Matty\Application Data\Starware386\Button_6\Button_6Options.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Button_7\Button_7Options.xml
c:\documents and settings\Matty\Application Data\Starware386\Button_7\Button_7Options.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Configurator\Configurator.xml
c:\documents and settings\Matty\Application Data\Starware386\Configurator\Configurator.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\ErrorSearch\ErrorSearchOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\ErrorSearch\ErrorSearchOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Layouts\ToolbarLayout.xml
c:\documents and settings\Matty\Application Data\Starware386\Layouts\ToolbarLayout.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Manager\ManagerOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\Manager\ManagerOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Reference\ReferenceOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\Reference\ReferenceOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\RelatedSearch\RelatedSearchOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\RelatedSearch\RelatedSearchOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Screensavers\ScreensaversOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\Screensavers\ScreensaversOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Toolbar\TBProductsOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\Toolbar\TBProductsOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\ToolbarLogo\ToolbarLogoOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\ToolbarLogo\ToolbarLogoOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\ToolbarSearch\ToolbarSearchOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\ToolbarSearch\ToolbarSearchOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\TravelSearch\TravelSearchOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\TravelSearch\TravelSearchOptions.xml.backup
c:\documents and settings\Matty\Application Data\Starware386\Weather\AlertArchive.xml
c:\documents and settings\Matty\Application Data\Starware386\Weather\WeatherOptions.xml
c:\documents and settings\Matty\Application Data\Starware386\Weather\WeatherOptions.xml.backup
c:\program files\ContextTool
c:\program files\ContextTool\ContextHelper.dat
c:\program files\ContextTool\pcre3.dll
c:\program files\ContextTool\uninstall.exe
c:\program files\outlook
c:\program files\outlook\p.zip
c:\windows\system32\adssite-remove.exe
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\Config.xml
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
c:\windows\system32\fxe.sp
c:\windows\system32\nahatona.dll
c:\windows\system32\ninjaext-uninstall.exe
c:\windows\system32\rightonadz-uninst.exe
c:\windows\system32\sowemame.dll
c:\windows\system32\wejibeni.dll
c:\windows\ynh.dx

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_WUMSS
-------\Service_wumss


((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.

2009-02-22 17:37 . 2009-02-22 17:38 <DIR> d-------- c:\program files\Decadence by Design
2009-02-22 17:37 . 2009-02-22 17:37 <DIR> d-------- c:\program files\Chocolatier Decadence by Design
2009-02-22 16:12 . 2009-02-22 16:14 <DIR> d-------- c:\program files\Startup Manager
2009-02-22 16:12 . 2009-02-22 16:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Startup Manager
2009-02-22 15:55 . 2009-02-22 15:55 <DIR> d-------- c:\program files\Uniblue
2009-02-22 15:55 . 2009-02-22 15:55 <DIR> d-------- c:\documents and settings\Matty\Application Data\Uniblue
2009-02-22 15:54 . 2009-02-22 15:55 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-02-22 15:20 . 2009-02-22 15:20 <DIR> d-------- c:\program files\Trend Micro
2009-02-22 13:43 . 2009-02-22 15:11 <DIR> d-------- c:\documents and settings\Matty\.housecall6.6
2009-02-21 08:58 . 2009-02-06 18:08 55,152 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys
2009-02-21 08:57 . 2009-02-21 08:57 <DIR> d-------- c:\program files\Microsoft Sync Framework
2009-02-19 08:25 . 2009-02-19 08:25 <DIR> d-------- c:\program files\ffdshow
2009-02-19 08:25 . 2006-10-02 13:44 5,120 --a------ c:\windows\system32\ff_vfw.dll
2009-02-19 08:25 . 2006-08-05 12:06 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-18 15:59 . 2009-02-18 15:59 <DIR> d-------- c:\program files\FlashFXP
2009-02-18 15:57 . 2009-02-18 15:57 <DIR> d-------- c:\program files\GrabIt
2009-02-18 15:57 . 2009-02-22 18:07 <DIR> d-------- c:\documents and settings\Matty\Application Data\GrabIt
2009-02-17 16:06 . 2009-02-17 16:06 <DIR> d-------- C:\Games
2009-02-17 16:06 . 2009-02-17 16:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Reflexive
2009-02-16 18:45 . 2009-02-16 18:50 <DIR> d-------- c:\documents and settings\Matty\Application Data\SlipStream
2009-02-16 18:29 . 2009-02-16 18:29 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-02-16 18:20 . 2009-02-16 18:20 <DIR> dr-h----- C:\AHCache
2009-02-13 10:22 . 2002-10-16 17:00 778,240 --a------ c:\windows\system32\Petz 5.scr
2009-02-06 19:03 . 2009-02-06 19:03 307,576 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-23 16:42 --------- d-----w c:\program files\DNA
2009-02-23 16:42 --------- d-----w c:\documents and settings\Matty\Application Data\DNA
2009-02-23 16:25 --------- d-----w c:\documents and settings\All Users\Application Data\soft chic meet great
2009-02-22 17:38 --------- d-----w c:\documents and settings\Matty\Application Data\PlayFirst
2009-02-22 17:38 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-02-22 17:37 --------- d-----w c:\documents and settings\Matty\Application Data\uTorrent
2009-02-21 08:58 --------- d-----w c:\program files\Windows Live
2009-02-19 19:40 --------- d-----w c:\documents and settings\Matty\Application Data\Vso
2009-02-18 16:43 --------- d-----w c:\program files\PopCap Games
2009-02-18 16:42 --------- d-----w c:\program files\Bonjour
2009-02-18 16:11 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\Hamachi
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\CyberLink
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\AVGTOOLBAR
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\Audacity
2009-02-16 18:50 --------- d-----w c:\documents and settings\Matty\Application Data\Apple Computer
2009-02-08 10:41 --------- d-----w c:\program files\Messenger Plus! Live
2009-01-18 10:57 --------- d-----w c:\program files\Yahoo! Games
2009-01-18 10:44 --------- d-----w c:\program files\RealArcade
2009-01-13 15:47 --------- d-----w c:\program files\Microsoft Silverlight
2009-01-12 18:11 --------- d-----w c:\program files\Microsoft
2009-01-12 18:10 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-01-12 18:06 --------- d-----w c:\program files\Windows Live SkyDrive
2009-01-12 17:54 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-04 18:57 --------- d-----w c:\program files\Finale NotePad 2008
2009-01-04 17:40 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-04 17:40 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-01-04 17:25 22,368 ----a-w c:\windows\system32\drivers\ggsemc.sys
2009-01-04 17:25 10,976 ----a-w c:\windows\system32\drivers\ggflt.sys
2009-01-01 19:15 --------- d-----w c:\program files\uTorrent
2008-12-31 12:04 --------- d-----w c:\program files\iLyrics
2008-11-30 15:31 47,360 ----a-w c:\documents and settings\Matty\Application Data\pcouffin.sys
2008-11-26 16:32 103 ----a-w C:\11.bat
2008-07-12 18:14 0 ----a-w c:\program files\temp01
2007-12-14 19:15 374 ----a-w c:\documents and settings\Matty\Application Data\internaldb6334.dat
2007-11-13 19:23 18,432 ----a-w c:\documents and settings\Matty\Application Data\internaldb41.dat
2007-11-13 19:09 555 ----a-w c:\documents and settings\Matty\Application Data\internaldb8467.dat
2008-04-25 13:32 5,817,064 ----a-w c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
.
file copied: c:\windows\system32\user32.dll -> c:\qoobox\Quarantine\C\WINDOWS\system32\user32.dll.vir ( 578048 bytes )
Infected c:\windows\system32\user32.dll hex repaired


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-19 342848]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2006-09-26 1694208]
"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE" [2003-09-11 99840]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^camtool.lnk]
backup=c:\windows\pss\camtool.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^TransBar.lnk]
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^UberIcon.lnk]
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^Y'z Shadow.lnk]
backup=c:\windows\pss\Y'z Shadow.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 19:12 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--------- 2004-08-03 22:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2006-09-26 21:09 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=c:\\WINDOWS\\system32\\spoolsv.exe
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe
"c:\\Program Files\\Analog Devices\\SoundMAX\\spkrmon.exe"=c:\\Program Files\\Analog Devices\\SoundMAX\\spkrmon.exe
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=c:\\program files\\ipod\\bin\\ipodservice.exe
"c:\\WINDOWS\\system32\\userinit.exe"=userinit.exe
"c:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe"=c:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe
"c:\\WINDOWS\\system32\\sysocmgr.exe"=sysocmgr.exe
"c:\\Program Files\\Messenger\\msmsgs.exe"=c:\\Program Files\\Messenger\\msmsgs.exe
"c:\\WINDOWS\\system32\\Macromed\\Flash\\NPSWF32_FlashUtil.exe"=c:\\WINDOWS\\system32\\Macromed\\Flash\\NPSWF32_FlashUtil.exe
"c:\\WINDOWS\\system32\\imapi.exe"=c:\\WINDOWS\\system32\\imapi.exe
"c:\\WINDOWS\\system32\\control.exe"=c:\\WINDOWS\\system32\\control.exe
"c:\\WINDOWS\\system32\\wuauclt.exe"=c:\\WINDOWS\\system32\\wuauclt.exe
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=c:\\Program Files\\Mozilla Firefox\\firefox.exe
"c:\\WINDOWS\\system32\\hkcmd.exe"=c:\\WINDOWS\\system32\\hkcmd.exe
"c:\\Program Files\\Analog Devices\\SoundMAX\\SpkrMonX.exe"=SpkrMonX.exe
"c:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"=c:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe
"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe"=c:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe
"c:\\WINDOWS\\system32\\WgaTray.exe"=c:\\WINDOWS\\system32\\WgaTray.exe
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"= c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exec:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe
"c:\\WINDOWS\\system32\\wscntfy.exe"=c:\\WINDOWS\\system32\\wscntfy.exe
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=c:\\Program Files\\iTunes\\iTunesHelper.exe
"c:\\Program Files\\camtool\\VideoMonitor\\CamTool.exe"=c:\\Program Files\\camtool\\VideoMonitor\\CamTool.exe
"c:\\WINDOWS\\system32\\igfxtray.exe"=c:\\WINDOWS\\system32\\igfxtray.exe
"c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0H2.EXE"=c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0H2.EXE
"c:\\WINDOWS\\system32\\svchost.exe"=c:\\WINDOWS\\system32\\svchost
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-10 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-03 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-10 76040]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-02-21 55152]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S2 CSML;Windows Client/Server Management Layer;c:\windows\system32\csml.exe --> c:\windows\system32\csml.exe [?]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-01-04 10976]
.
Contents of the 'Scheduled Tasks' folder

2008-11-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-22 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.
- - - - ORPHANS REMOVED - - - -

SSODL-MSHTMLS-{A888F568-58E4-11d0-A68A-0000837E3100} - (no file)
MSConfigStartUp-Curb blue - c:\docume~1\Matty\APPLIC~1\UPEACH~1\Support spam manager.exe
MSConfigStartUp-Google Update - c:\documents and settings\Matty\Local Settings\Application Data\Google\Update\GoogleUpdate.exe


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyServer = 0.0.0.0:80
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZCxdm491YYGB
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\Matty\Application Data\Mozilla\Firefox\Profiles\6my9vqcc.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-23 16:43:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Analog Devices\SoundMAX\spkrmon.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\WgaTray.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-02-23 16:48:42 - machine was rebooted [Matty]
ComboFix-quarantined-files.txt 2009-02-23 16:47:23

Pre-Run: 2,525,933,568 bytes free
Post-Run: 2,525,704,192 bytes free

319 --- E O F --- 2008-04-09 16:39:01

Attached Files



#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:29 PM

Posted 23 February 2009 - 12:43 PM

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.
Copy/paste the text in the quotebox below into notepad:

File::
C:\11.bat
c:\program files\temp01
c:\documents and settings\Matty\Application Data\internaldb6334.dat
c:\documents and settings\Matty\Application Data\internaldb41.dat
c:\documents and settings\Matty\Application Data\internaldb8467.dat
Folder::
c:\documents and settings\All Users\Application Data\soft chic meet great
DDS::
IE: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZCxdm491YYGB



Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 mattface

mattface
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:29 AM

Posted 23 February 2009 - 12:59 PM

Thanks again

ComboFix 09-02-21.01 - Matty 2009-02-23 17:52:03.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.541 [GMT 0:00]
Running from: c:\documents and settings\Matty\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Matty\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
* Created a new restore point

FILE ::
C:\11.bat
c:\documents and settings\Matty\Application Data\internaldb41.dat
c:\documents and settings\Matty\Application Data\internaldb6334.dat
c:\documents and settings\Matty\Application Data\internaldb8467.dat
c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\11.bat
c:\documents and settings\All Users\Application Data\soft chic meet great
c:\documents and settings\Matty\Application Data\internaldb41.dat
c:\documents and settings\Matty\Application Data\internaldb6334.dat
c:\documents and settings\Matty\Application Data\internaldb8467.dat
c:\program files\temp01

.
((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.

2009-02-22 17:37 . 2009-02-22 17:38 <DIR> d-------- c:\program files\Decadence by Design
2009-02-22 17:37 . 2009-02-22 17:37 <DIR> d-------- c:\program files\Chocolatier Decadence by Design
2009-02-22 16:12 . 2009-02-22 16:14 <DIR> d-------- c:\program files\Startup Manager
2009-02-22 16:12 . 2009-02-22 16:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\Startup Manager
2009-02-22 15:55 . 2009-02-22 15:55 <DIR> d-------- c:\program files\Uniblue
2009-02-22 15:55 . 2009-02-22 15:55 <DIR> d-------- c:\documents and settings\Matty\Application Data\Uniblue
2009-02-22 15:54 . 2009-02-22 15:55 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2009-02-22 15:20 . 2009-02-22 15:20 <DIR> d-------- c:\program files\Trend Micro
2009-02-22 13:43 . 2009-02-22 15:11 <DIR> d-------- c:\documents and settings\Matty\.housecall6.6
2009-02-21 08:58 . 2009-02-06 18:08 55,152 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys
2009-02-21 08:57 . 2009-02-21 08:57 <DIR> d-------- c:\program files\Microsoft Sync Framework
2009-02-19 08:25 . 2009-02-19 08:25 <DIR> d-------- c:\program files\ffdshow
2009-02-19 08:25 . 2006-10-02 13:44 5,120 --a------ c:\windows\system32\ff_vfw.dll
2009-02-19 08:25 . 2006-08-05 12:06 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
2009-02-18 15:59 . 2009-02-18 15:59 <DIR> d-------- c:\program files\FlashFXP
2009-02-18 15:57 . 2009-02-18 15:57 <DIR> d-------- c:\program files\GrabIt
2009-02-18 15:57 . 2009-02-22 18:07 <DIR> d-------- c:\documents and settings\Matty\Application Data\GrabIt
2009-02-17 16:06 . 2009-02-17 16:06 <DIR> d-------- C:\Games
2009-02-17 16:06 . 2009-02-17 16:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Reflexive
2009-02-16 18:45 . 2009-02-16 18:50 <DIR> d-------- c:\documents and settings\Matty\Application Data\SlipStream
2009-02-16 18:29 . 2009-02-16 18:29 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2009-02-16 18:20 . 2009-02-16 18:20 <DIR> dr-h----- C:\AHCache
2009-02-13 10:22 . 2002-10-16 17:00 778,240 --a------ c:\windows\system32\Petz 5.scr
2009-02-06 19:03 . 2009-02-06 19:03 307,576 --a------ c:\windows\WLXPGSS.SCR
2009-02-06 18:52 . 2009-02-06 18:52 49,504 --a------ c:\windows\system32\sirenacm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-23 16:42 --------- d-----w c:\program files\DNA
2009-02-23 16:42 --------- d-----w c:\documents and settings\Matty\Application Data\DNA
2009-02-22 17:38 --------- d-----w c:\documents and settings\Matty\Application Data\PlayFirst
2009-02-22 17:38 --------- d-----w c:\documents and settings\All Users\Application Data\PlayFirst
2009-02-22 17:37 --------- d-----w c:\documents and settings\Matty\Application Data\uTorrent
2009-02-21 08:58 --------- d-----w c:\program files\Windows Live
2009-02-19 19:40 --------- d-----w c:\documents and settings\Matty\Application Data\Vso
2009-02-18 16:43 --------- d-----w c:\program files\PopCap Games
2009-02-18 16:42 --------- d-----w c:\program files\Bonjour
2009-02-18 16:11 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\Hamachi
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\CyberLink
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\AVGTOOLBAR
2009-02-16 18:51 --------- d-----w c:\documents and settings\Matty\Application Data\Audacity
2009-02-16 18:50 --------- d-----w c:\documents and settings\Matty\Application Data\Apple Computer
2009-02-08 10:41 --------- d-----w c:\program files\Messenger Plus! Live
2009-01-18 10:57 --------- d-----w c:\program files\Yahoo! Games
2009-01-18 10:44 --------- d-----w c:\program files\RealArcade
2009-01-13 15:47 --------- d-----w c:\program files\Microsoft Silverlight
2009-01-12 18:11 --------- d-----w c:\program files\Microsoft
2009-01-12 18:10 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition
2009-01-12 18:06 --------- d-----w c:\program files\Windows Live SkyDrive
2009-01-12 17:54 --------- d-----w c:\program files\Common Files\Windows Live
2009-01-04 18:57 --------- d-----w c:\program files\Finale NotePad 2008
2009-01-04 17:40 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-01-04 17:40 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_ggsemc_01007.Wdf
2009-01-04 17:25 22,368 ----a-w c:\windows\system32\drivers\ggsemc.sys
2009-01-04 17:25 10,976 ----a-w c:\windows\system32\drivers\ggflt.sys
2009-01-04 17:25 1,107,296 ----a-w c:\windows\system32\WdfCoInstaller01007.dll
2009-01-01 19:15 --------- d-----w c:\program files\uTorrent
2008-12-31 12:04 --------- d-----w c:\program files\iLyrics
2008-11-30 15:31 47,360 ----a-w c:\documents and settings\Matty\Application Data\pcouffin.sys
2008-11-26 16:32 578,048 ------w c:\windows\system32\user32.DLL
2008-04-25 13:32 5,817,064 ----a-w c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-19 342848]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2006-09-26 1694208]
"Uniblue RegistryBooster 2009"="c:\program files\Uniblue\RegistryBooster\RegistryBooster.exe" [2008-08-26 2019624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus Photo R200 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE" [2003-09-11 99840]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.MSNAUDIO"= msnaudio.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^camtool.lnk]
backup=c:\windows\pss\camtool.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^TransBar.lnk]
backup=c:\windows\pss\TransBar.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^UberIcon.lnk]
backup=c:\windows\pss\UberIcon.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Matty^Start Menu^Programs^Startup^Y'z Shadow.lnk]
backup=c:\windows\pss\Y'z Shadow.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
--a------ 2008-09-03 19:12 111936 c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--------- 2004-08-03 22:56 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2006-09-26 21:09 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=c:\\WINDOWS\\system32\\spoolsv.exe
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe
"c:\\Program Files\\Analog Devices\\SoundMAX\\spkrmon.exe"=c:\\Program Files\\Analog Devices\\SoundMAX\\spkrmon.exe
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=c:\\program files\\ipod\\bin\\ipodservice.exe
"c:\\WINDOWS\\system32\\userinit.exe"=userinit.exe
"c:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe"=c:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\ngen.exe
"c:\\WINDOWS\\system32\\sysocmgr.exe"=sysocmgr.exe
"c:\\Program Files\\Messenger\\msmsgs.exe"=c:\\Program Files\\Messenger\\msmsgs.exe
"c:\\WINDOWS\\system32\\Macromed\\Flash\\NPSWF32_FlashUtil.exe"=c:\\WINDOWS\\system32\\Macromed\\Flash\\NPSWF32_FlashUtil.exe
"c:\\WINDOWS\\system32\\imapi.exe"=c:\\WINDOWS\\system32\\imapi.exe
"c:\\WINDOWS\\system32\\control.exe"=c:\\WINDOWS\\system32\\control.exe
"c:\\WINDOWS\\system32\\wuauclt.exe"=c:\\WINDOWS\\system32\\wuauclt.exe
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=c:\\Program Files\\Mozilla Firefox\\firefox.exe
"c:\\WINDOWS\\system32\\hkcmd.exe"=c:\\WINDOWS\\system32\\hkcmd.exe
"c:\\Program Files\\Analog Devices\\SoundMAX\\SpkrMonX.exe"=SpkrMonX.exe
"c:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"=c:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe
"c:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe"=c:\\Program Files\\Java\\jre1.6.0_03\\bin\\jusched.exe
"c:\\WINDOWS\\system32\\WgaTray.exe"=c:\\WINDOWS\\system32\\WgaTray.exe
"c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe"= c:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exec:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe
"c:\\WINDOWS\\system32\\wscntfy.exe"=c:\\WINDOWS\\system32\\wscntfy.exe
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=c:\\Program Files\\iTunes\\iTunesHelper.exe
"c:\\Program Files\\camtool\\VideoMonitor\\CamTool.exe"=c:\\Program Files\\camtool\\VideoMonitor\\CamTool.exe
"c:\\WINDOWS\\system32\\igfxtray.exe"=c:\\WINDOWS\\system32\\igfxtray.exe
"c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0H2.EXE"=c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0H2.EXE
"c:\\WINDOWS\\system32\\svchost.exe"=c:\\WINDOWS\\system32\\svchost
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe"=c:\\Program Files\\Common Files\\Microsoft Shared\\Windows Live\\WLLoginProxy.exe
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-10 97928]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-03 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-10 76040]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-02-21 55152]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
S2 CSML;Windows Client/Server Management Layer;c:\windows\system32\csml.exe --> c:\windows\system32\csml.exe [?]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-01-04 10976]
.
Contents of the 'Scheduled Tasks' folder

2008-11-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-22 c:\windows\Tasks\Norton Security Scan.job
- c:\program files\Norton Security Scan\Nss.exe []
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
mStart Page = hxxp://www.yahoo.com
uInternet Settings,ProxyServer = 0.0.0.0:80
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\Matty\Application Data\Mozilla\Firefox\Profiles\6my9vqcc.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-23 17:54:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2009-02-23 17:57:45
ComboFix-quarantined-files.txt 2009-02-23 17:56:27
ComboFix2.txt 2009-02-23 16:48:51

Pre-Run: 2,486,312,960 bytes free
Post-Run: 2,473,021,440 bytes free

218 --- E O F --- 2008-04-09 16:39:01

#6 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:29 PM

Posted 23 February 2009 - 01:11 PM

Hi,

Go to start > run and copy and paste next command in the field:

sc delete CSML


Hit enter.

Then, * Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#7 mattface

mattface
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:29 AM

Posted 23 February 2009 - 01:14 PM

Thank you very much
i haven't had any popups since the first step and no iexplore.exe processes have appeared in the task manager when i restarted whereas up to 4 would before so i hope it's done the trick

:thumbup2: :)

#8 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:29 PM

Posted 23 February 2009 - 01:16 PM

Glad I could help. :thumbup2:

Please read my Prevention page with lots of info and tips how to prevent this in the future.
And if you want to improve speed/system performance after malware removal, take a look here.
Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#9 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:03:29 PM

Posted 24 February 2009 - 08:44 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users