Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I'm being redirected to random sites...


  • Please log in to reply
5 replies to this topic

#1 crisron

crisron

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 17 April 2009 - 09:21 AM

Hi, I would aprpeciate any help you can give. When using Firefox, I keep getting redirected to random sites every once in a while,
the one recurring most often is Skype. I've run AdAware, Spybot and yahoo anti spy, but the problem persists.


DDS (Ver_09-03-16.01) - NTFSx86
Run by Laily at 15:40:40.41 on 17/04/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.2.1033.18.2812.1074 [GMT 1:00]

AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\WacomTouchService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\SMINST\BLService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Pen_Tablet.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\system32\Pen_Tablet.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\conime.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Laily\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://portal.ask4.com/4tv
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=83&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" update "software\cyberlink\youcam\2.0"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

================= FIREFOX ===================

FF - ProfilePath - c:\users\laily\appdata\roaming\mozilla\firefox\profiles\nyeev6n5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-11 64160]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-10-24 34824]
R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-10-24 468224]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 951632]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\sminst\BLService.exe [2008-5-4 341328]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-3-2 1369384]
R2 WacomTouchService;Wacom Touch Service;c:\windows\system32\WacomTouchService.exe [2009-3-2 95528]
R3 enecir;ENE CIR Receiver;c:\windows\system32\drivers\enecir.sys [2008-1-24 52736]
R3 Wacomhidfilter;Wacom HID Filter;c:\windows\system32\drivers\wacomhidfilter.sys [2007-11-5 10536]
R3 WacomVTHid;Virtual Touch Driver;c:\windows\system32\drivers\WacomVTHid.sys [2007-2-22 11312]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-4-15 1153368]

=============== Created Last 30 ================

2009-04-17 15:12 <DIR> --d----- c:\program files\Trend Micro
2009-04-15 22:08 <DIR> --d----- c:\programdata\Spybot - Search & Destroy
2009-04-15 22:08 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-04-15 22:08 <DIR> --d----- c:\progra~2\Spybot - Search & Destroy
2009-04-15 18:21 <DIR> --d----- c:\windows\system32\Adobe
2009-04-14 01:30 <DIR> --d----- c:\program files\CA Yahoo! Anti-Spy
2009-04-14 01:28 <DIR> --d----- c:\program files\common files\Scanner
2009-04-11 18:53 15,688 a------- c:\windows\system32\lsdelete.exe
2009-04-11 18:34 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-04-11 18:32 <DIR> -cd-h--- c:\programdata\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-11 18:32 <DIR> -cd-h--- c:\progra~2\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-11 18:32 <DIR> --d----- c:\programdata\Lavasoft
2009-04-11 18:32 <DIR> --d----- c:\program files\Lavasoft
2009-04-10 18:35 <DIR> --d----- c:\program files\EsetOnlineScanner
2009-04-05 15:36 <DIR> --d----- c:\programdata\TVU Networks
2009-04-05 15:36 <DIR> --d----- c:\progra~2\TVU Networks
2009-04-02 00:41 <DIR> --d----- c:\users\laily\appdata\roaming\Malwarebytes
2009-04-02 00:41 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-02 00:41 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-02 00:41 <DIR> --d----- c:\programdata\Malwarebytes
2009-04-02 00:41 <DIR> --d----- c:\progra~2\Malwarebytes
2009-04-02 00:41 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-24 19:56 <DIR> --d--r-- c:\program files\Skype
2009-03-24 19:56 <DIR> --d----- c:\programdata\Skype
2009-03-23 00:21 <DIR> --d----- c:\program files\Lame for Audacity
2009-03-22 17:15 <DIR> --d----- c:\programdata\FLEXnet
2009-03-22 16:58 <DIR> --d----- c:\program files\common files\Macrovision Shared
2009-03-22 15:48 0 a---h--- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf

==================== Find3M ====================

2009-04-12 10:54 672,380 a------- c:\windows\system32\perfh00C.dat
2009-04-12 10:54 127,578 a------- c:\windows\system32\perfc00C.dat
2009-03-06 12:35 665,600 a------- c:\windows\inf\drvindex.dat
2009-03-06 12:35 86,016 a------- c:\windows\inf\infstrng.dat
2009-03-06 12:35 86,016 a------- c:\windows\inf\infstor.dat
2009-03-06 12:35 51,200 a------- c:\windows\inf\infpub.dat
2009-03-02 09:29 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-02 04:42 319,456 a------- c:\windows\DIFxAPI.dll
2009-03-02 04:42 315,392 a------- c:\windows\HideWin.exe
2009-03-02 04:39 0 a---h--- c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2009-03-01 22:11 0 a--shr-- c:\windows\system32\drivers\103C_HP_cNB_Pavilion tx2500 Notebook PC_Y5335KV_0U_QCNF8274DRQ_E466225-121_4A_I30F1_SQuanta_V97.17_F.05_T080521_WV3-1_L409_M2813_J320_7AMD_8F31_91.90_#090301_N10EC8168_(FE921UA#ABC)_XMOBILE_CN10_Z_2Rev 1.MRK
2009-02-06 19:52 49,504 a------- c:\windows\system32\sirenacm.dll
2008-05-04 10:17 340,236 a------- c:\windows\inf\perflib\040c\perfi.dat
2008-05-04 10:17 340,236 a------- c:\windows\inf\perflib\040c\perfh.dat
2008-05-04 10:17 37,390 a------- c:\windows\inf\perflib\040c\perfd.dat
2008-05-04 10:17 37,390 a------- c:\windows\inf\perflib\040c\perfc.dat
2008-01-21 03:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 17:46:59.01 ===============







Thank you for your help.

Edited by crisron, 17 April 2009 - 05:15 PM.


BC AdBot (Login to Remove)

 


#2 TSalarek

TSalarek

  • Members
  • 135 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Kentucky and Florida, USA
  • Local time:04:21 PM

Posted 17 April 2009 - 11:02 AM

all three of those products are anti-spy/adware...do you have an actual Anti VIRUS that you could run?

MBAM (http://www.malwarebytes.org/) is quick and simple and is my first pick for a diagnostic, but there's plenty of others available too.


using yahoo anti-spy: http://help.yahoo.com/tutorials/yop/olp2/antispy1.html


Listing of Anti-malware products: http://www.bleepingcomputer.com/forums/t/405/antivirus-antimalware-and-antispyware-resources/


someone else will have to do the actual log reviews as I am slammed right now, but this shoud get you started. Good Luck.

Edited by TSalarek, 17 April 2009 - 11:04 AM.


#3 crisron

crisron
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 17 April 2009 - 05:11 PM

hi,
thanks for the reply.

I run nod32 as anti-virus and I also have malwarebytes installed too. None seem to find a problem.

#4 crisron

crisron
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 20 April 2009 - 08:09 AM

I've run several more scans since I posted, and I get rid of the few, if any, things that come up, but then when I scan again, the same things are back.
Any ideas?

#5 PCFanboy52

PCFanboy52

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:21 PM

Posted 20 April 2009 - 10:40 PM

You could possibly have the notorious "Cool Web Search".

#6 crisron

crisron
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 21 April 2009 - 12:44 PM

doesn't sound like something i'd like to have...any tips on how to deal with it?

I don't know if this is a side effect of what I have or not, but my laptop has started stuttering (freezing every few seconds for a bit) and I think the fan seems to be overworking. Any ideas?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users