Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Facebook and Yahoo connection problems


  • This topic is locked This topic is locked
28 replies to this topic

#1 acethrowin1

acethrowin1

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 23 December 2009 - 04:16 PM

Ok first let me start by telling you that I am not very computer savvy. I am here because I have exhausted my resources and God bless you for trying to help.

I am running Windows Vista Home Pro 6.0

About a week ago I became unable to connect to my facebook account (http://www.facebook.com), my yahoo mail account (login.yahoo.com) , and my poker site (www.pureplay.com)

This is what happens with facebook. I can get to the login page, input my email and pw, and then I get "Diagnose Connection Problems"

With yahoo: I can get on yahoo.com but when I click on check mail I get the same error.

With PurePlay.com I can get to the screen where I put in my email and pw but when I click login, I get the "diagnose connection problems again."

The only thing I can think of that changed is that a windows update was done just prior.

Things I have tried:

1. Running diff browsers: same error in Firefox and Chrome

2. Running diff AV/spyware programs (Spybot, Avast, AntiVir) I have come up with nothing. (I note that probly a week before the problem, I became infected with the AV virus which I stupidly downloaded I dunno if you know what im talking about but its a program that mimics a real antivirus program, tells you that you're infected, asks you for money, ect and I did a search online on how to remove it and removed the recommended registry entries and then the problem appeared to clear)

3. I tried doing a system restore, twice! Which failed twice!

4. I tried accessing the sites from searching Google, then clicking that link. The pages are still unaccessable.

5. I tried entering secure sites i.e. https://www.google.com still not working.

6. I tried uninstalling Adobe, flash and Java. Then reinstalled the latest versions. No change.

I AM able to access mobile versions of facebook and yahoo. But this is annoying. the mobile facebook gives me no live feed and I cant use apps. The mobile version of yahoo does not allow me to attach docs. I can use a proxy (I have been using pleasant proxy) to view live feed on fb and to get to yahoo mail. But it has not helped me get onto PurePlay.com

I tried clearing cookies, history, cache.

I tried disconnecting the router and DSL cable and restarting the computer and plugging them back in (to no avail.)

I am really clueless! Even if this is an easy fix and totally obvious I really would be so grateful to get things back to normal and I miss my poker :(

I don't really understand DNS stuff but since that was on the checklist I checked the sites and this is what I got:

Your main page redirects to another location. Several search engines will be unable to index your site

While speaking to f.mx.mail.yahoo.com [98.137.54.237] received status 421 instead of 220


Some of your MX do not work properly


Your start page is a redirect to another URL. This can confuse some search engines.


While speaking to SMTP server, CheckDNS received an unexpected SMTP status code. Test is marked as failed.

Master DNS defined by SOA (mname.facebook.com) was not found among NS records

THIS IS JIBBERISH to me but hope it will make sense to you.



Here is my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:17:17 AM, on 12/19/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\System32\notepad.exe
C:\Windows\System32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Program Files\iWin\tbiWi1.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll
O3 - Toolbar: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Program Files\iWin\tbiWi1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
O9 - Extra button: MasterCook Web Import Bar - {E6EF5071-7647-4E85-9785-87B6CF5CB561} - C:\Windows\system32\shdocvw.dll
O13 - Gopher Prefix:
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...tDetection2.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6F86646-8A1F-4FA3-B4AF-7531341EE00D}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iWinTrusted - iWin Inc. - C:\Program Files\iWin Games\iWinTrusted.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
O23 - Service: lxct_device - - C:\Windows\system32\lxctcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - PC Tools - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 11780 bytes

Thanks for any help or suggestions.

:( Mary

BC AdBot (Login to Remove)

 


#2 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 04 January 2010 - 08:23 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


And

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.

    First Location
    Second Location
    Third Location

  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Posted Image
m0le is a proud member of UNITE

#3 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 09 January 2010 - 07:45 PM

Since this issue appears to be resolved ... this topic has been closed. Glad we could help. :(

If you're the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
Posted Image
m0le is a proud member of UNITE

#4 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 09 January 2010 - 09:05 PM

Thanks for the PM.

Please stop RootRepeal's scan and try this instead.

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.


Then

Please copy the contents of the code box below, open notepad and paste it there. On the top toolbar in notepad select file, then save as. In the box that opens type in peek.bat for the file name. Right below that click the down arrow in the line for save as and select all files. Save this to your desktop and close notepad.

@ECHO OFF
DIR /a/s C:\WINDOWS\scecli.dll C:\WINDOWS\netlogon.dll C:\WINDOWS\eventlog.dll C:\Windows\cngaudit.dll >Log.txt
START Log.txt
DEL %0

Locate the peek.bat icon on your desktop and double click it. Then copy and paste the resulting log in your next reply.


Finally let's see if any rogue antiviruses are still hiding away

Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

If any of these programs don't run, don't run as they should or you have any problems or questions then just reply to this post.

Thanks.
Posted Image
m0le is a proud member of UNITE

#5 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 10 January 2010 - 02:10 AM

DDSSCR


DDS (Ver_09-12-01.01) - NTFSx86
Run by Carol at 4:14:03.06 on Fri 01/08/2010
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1353 [GMT -5:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\lxctcoms.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\aol\1170865100\ee\aolsoftware.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Carol\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uStart Page = hxxp://m.www.yahoo.com/
uDefault_Page_URL = hxxp://www.msn.com
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0983.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: MasterCook Bar: {c92041c1-6d22-4069-ba0e-66246aa752b0} - c:\windows\system32\shdocvw.dll
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RMTray.exe /H
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [<NO NAME>]
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [SSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HostManager] c:\program files\common files\aol\1170865100\ee\AOLSoftware.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [ALUAlert] c:\program files\symantec\liveupdate\ALuNotify.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks basic edition\norton cleanup\WCQuick.lnk
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\programs\partygaming\partypoker\RunApp.exe
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
IE: {E6EF5071-7647-4E85-9785-87B6CF5CB561} - {C92041C1-6D22-4069-BA0E-66246AA752B0} - c:\windows\system32\shdocvw.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {C6F86646-8A1F-4FA3-B4AF-7531341EE00D} = 208.67.222.222,208.67.220.220
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\carol\appdata\roaming\mozilla\firefox\profiles\z0gg784v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={D5E7E7AF-F7E4-0396-C5E3-B4BEF5D71D83}&q=
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\users\carol\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-12-7 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-7 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-12-7 53328]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-12-7 138680]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-11-20 583640]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-12-7 352920]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008]
S3 rootrepeal2;rootrepeal2;c:\windows\system32\drivers\rootrepeal2.sys [2010-1-7 34816]
S3 rootrepeal3;rootrepeal3;c:\windows\system32\drivers\rootrepeal3.sys [2010-1-7 34816]
S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2007-12-26 1251720]

=============== Created Last 30 ================

2010-01-07 22:10:06 34816 ----a-w- c:\windows\system32\drivers\rootrepeal3.sys
2010-01-07 22:09:56 34816 ----a-w- c:\windows\system32\drivers\rootrepeal2.sys
2010-01-07 21:10:13 17448 ----a-w- c:\users\carol\DDS.scr
2010-01-05 23:00:36 0 d--h--w- c:\windows\msdownld.tmp
2010-01-02 06:34:34 0 d-----w- c:\program files\SpeedFan
2010-01-02 06:34:14 45 ----a-w- c:\windows\system32\initdebug.nfo
2009-12-28 22:03:47 524288 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TMContainer00000000000000000002.regtrans-ms
2009-12-28 22:03:47 524288 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TMContainer00000000000000000001.regtrans-ms
2009-12-28 22:03:46 65536 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TM.blf
2009-12-27 00:53:44 0 d-----w- c:\program files\ScreenSwarm
2009-12-26 05:18:52 0 d-----w- c:\programdata\SUPERAntiSpyware.com
2009-12-26 05:17:52 0 d-----w- c:\users\carol\appdata\roaming\SUPERAntiSpyware.com
2009-12-26 05:17:52 0 d-----w- c:\program files\SUPERAntiSpyware
2009-12-26 04:37:29 0 d-----w- c:\programdata\ParetoLogic
2009-12-26 04:37:29 0 d-----w- c:\program files\common files\ParetoLogic
2009-12-26 03:47:22 0 ----a-w- c:\users\carol\ipconfig
2009-12-24 02:15:48 0 d-----w- C:\SDFix
2009-12-24 01:54:18 0 d-----w- c:\windows\pss
2009-12-23 15:39:28 0 d-----w- C:\Microsoft IT Environment Health Scanner
2009-12-19 07:16:48 0 d-----w- c:\program files\CCleaner
2009-12-19 03:12:27 0 d-----w- c:\program files\Trend Micro
2009-12-19 02:15:18 0 d-----w- c:\program files\Microsoft
2009-12-19 02:15:03 0 d-----w- c:\program files\Windows Live SkyDrive
2009-12-19 02:14:32 0 d-----w- c:\windows\PCHEALTH
2009-12-18 21:02:12 0 d-----w- c:\windows\System
2009-12-18 21:00:32 0 d-----w- c:\windows\Media
2009-12-18 20:58:28 0 d-----w- c:\windows\provisioning
2009-12-18 20:58:26 0 d-----w- c:\windows\PLA
2009-12-18 20:58:26 0 d-----w- c:\windows\L2Schemas
2009-12-18 20:57:27 0 d-----w- c:\windows\Branding
2009-12-18 20:57:15 0 d-----w- c:\windows\Help
2009-12-18 20:57:12 0 d-----w- c:\windows\AppPatch
2009-12-18 16:57:08 0 d-----w- c:\windows\Logs
2009-12-18 16:16:34 6520832 ----a-w- c:\users\carol\s-1-5-21-959447114-2711728064-952257928-1000.rrr
2009-12-18 11:36:37 0 d-----w- c:\windows\registration
2009-12-18 11:35:41 0 d-----w- c:\windows\INF
2009-12-18 00:57:25 81920 ----a-w- c:\windows\eSellerateControl350.dll
2009-12-18 00:57:25 356352 ----a-w- c:\windows\eSellerateEngine.dll
2009-12-13 14:42:11 0 d-----w- c:\users\carol\appdata\roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

==================== Find3M ====================

2010-01-04 19:44:48 6144 ----a-w- c:\windows\inf\infstrng.dat
2010-01-04 19:44:48 6144 ----a-w- c:\windows\inf\infpub.dat
2009-12-19 15:11:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 14:37:32 6504 ----a-w- c:\users\carol\appdata\roaming\wklnhst.dat
2009-12-08 03:59:34 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-06 19:28:37 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-06 19:17:28 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-11-24 23:49:48 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-14 03:59:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-11-12 15:02:18 174 --sha-w- c:\program files\desktop.ini
2009-11-12 13:38:30 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-12 13:38:19 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-09 12:31:42 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30:03 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36:45 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-11-04 14:05:10 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-11-03 02:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2007-03-13 05:42:16 774144 ----a-w- c:\program files\RngInterstitial.dll
2009-02-28 01:17:35 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009022720090228\index.dat
2009-10-05 21:19:19 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009092820091005\index.dat

============= FINISH: 4:15:48.08 ===============

DDSpif

DDS (Ver_09-12-01.01) - NTFSx86
Run by Carol at 16:28:04.19 on Thu 01/07/2010
Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1204 [GMT -5:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Search Guard PlusU\sgpupdaters.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\hp\KBD\kbd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\svchost.exe -k hpdevmgmt
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\lxctcoms.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\aol\1170865100\ee\aolsoftware.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\msiexec.exe
C:\Program Files\Registry Mechanic\RMTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Carol\Desktop\ddspif.pif

============== Pseudo HJT Report ===============

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uStart Page = hxxp://m.www.yahoo.com/
uDefault_Page_URL = hxxp://www.msn.com
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0983.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
TB: {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File
EB: MasterCook Bar: {c92041c1-6d22-4069-ba0e-66246aa752b0} - c:\windows\system32\shdocvw.dll
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [RegistryMechanic] c:\program files\registry mechanic\RMTray.exe /H
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [<NO NAME>]
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [SSDMonitor] c:\program files\common files\pc tools\smonitor\SSDMonitor.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HostManager] c:\program files\common files\aol\1170865100\ee\AOLSoftware.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [ALUAlert] c:\program files\symantec\liveupdate\ALuNotify.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks basic edition\norton cleanup\WCQuick.lnk
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\programs\partygaming\partypoker\RunApp.exe
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
IE: {E6EF5071-7647-4E85-9785-87B6CF5CB561} - {C92041C1-6D22-4069-BA0E-66246AA752B0} - c:\windows\system32\shdocvw.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro.cce.hp.com/ChatEntry/downloads/sysinfo.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {C6F86646-8A1F-4FA3-B4AF-7531341EE00D} = 208.67.222.222,208.67.220.220
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\carol\appdata\roaming\mozilla\firefox\profiles\z0gg784v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={D5E7E7AF-F7E4-0396-C5E3-B4BEF5D71D83}&q=
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\users\carol\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-12-7 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-7 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-12-7 53328]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-12-7 138680]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-11-20 583640]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2009-2-19 41008]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-12-7 352920]
S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2007-12-26 1251720]

=============== Created Last 30 ================

2010-01-07 21:10:13 17448 ----a-w- c:\users\carol\DDS.scr
2010-01-05 23:00:36 0 d--h--w- c:\windows\msdownld.tmp
2010-01-02 06:34:34 0 d-----w- c:\program files\SpeedFan
2010-01-02 06:34:14 45 ----a-w- c:\windows\system32\initdebug.nfo
2009-12-28 22:03:47 524288 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TMContainer00000000000000000002.regtrans-ms
2009-12-28 22:03:47 524288 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TMContainer00000000000000000001.regtrans-ms
2009-12-28 22:03:46 65536 --sha-w- c:\users\carol\ntuser.dat{cc64890f-f3f9-11de-9177-00038a000015}.TM.blf
2009-12-27 00:53:44 0 d-----w- c:\program files\ScreenSwarm
2009-12-26 05:18:52 0 d-----w- c:\programdata\SUPERAntiSpyware.com
2009-12-26 05:17:52 0 d-----w- c:\users\carol\appdata\roaming\SUPERAntiSpyware.com
2009-12-26 05:17:52 0 d-----w- c:\program files\SUPERAntiSpyware
2009-12-26 04:37:29 0 d-----w- c:\programdata\ParetoLogic
2009-12-26 04:37:29 0 d-----w- c:\program files\common files\ParetoLogic
2009-12-26 03:47:22 0 ----a-w- c:\users\carol\ipconfig
2009-12-24 02:15:48 0 d-----w- C:\SDFix
2009-12-24 01:54:18 0 d-----w- c:\windows\pss
2009-12-23 15:39:28 0 d-----w- C:\Microsoft IT Environment Health Scanner
2009-12-19 07:16:48 0 d-----w- c:\program files\CCleaner
2009-12-19 03:12:27 0 d-----w- c:\program files\Trend Micro
2009-12-19 02:15:18 0 d-----w- c:\program files\Microsoft
2009-12-19 02:15:03 0 d-----w- c:\program files\Windows Live SkyDrive
2009-12-19 02:14:32 0 d-----w- c:\windows\PCHEALTH
2009-12-18 21:02:12 0 d-----w- c:\windows\System
2009-12-18 21:00:32 0 d-----w- c:\windows\Media
2009-12-18 20:58:28 0 d-----w- c:\windows\provisioning
2009-12-18 20:58:26 0 d-----w- c:\windows\PLA
2009-12-18 20:58:26 0 d-----w- c:\windows\L2Schemas
2009-12-18 20:57:27 0 d-----w- c:\windows\Branding
2009-12-18 20:57:15 0 d-----w- c:\windows\Help
2009-12-18 20:57:12 0 d-----w- c:\windows\AppPatch
2009-12-18 16:57:08 0 d-----w- c:\windows\Logs
2009-12-18 16:16:34 6520832 ----a-w- c:\users\carol\s-1-5-21-959447114-2711728064-952257928-1000.rrr
2009-12-18 11:36:37 0 d-----w- c:\windows\registration
2009-12-18 11:35:41 0 d-----w- c:\windows\INF
2009-12-18 00:57:25 81920 ----a-w- c:\windows\eSellerateControl350.dll
2009-12-18 00:57:25 356352 ----a-w- c:\windows\eSellerateEngine.dll
2009-12-13 14:42:11 0 d-----w- c:\users\carol\appdata\roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-12-09 09:07:53 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-09 09:07:49 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-09 09:07:48 30720 ----a-w- c:\windows\system32\httpapi.dll

==================== Find3M ====================

2010-01-04 19:44:48 6144 ----a-w- c:\windows\inf\infstrng.dat
2010-01-04 19:44:48 6144 ----a-w- c:\windows\inf\infpub.dat
2009-12-19 15:11:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-13 14:37:32 6504 ----a-w- c:\users\carol\appdata\roaming\wklnhst.dat
2009-12-08 03:59:34 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-06 19:28:37 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-06 19:17:28 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-11-24 23:49:48 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-21 06:40:20 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34:39 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34:39 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59:58 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-14 03:59:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-11-12 15:02:18 174 --sha-w- c:\program files\desktop.ini
2009-11-12 13:38:30 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-12 13:38:19 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-04 14:05:10 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-11-03 02:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:17:42 2048 ----a-w- c:\windows\system32\tzres.dll
2007-03-13 05:42:16 774144 ----a-w- c:\program files\RngInterstitial.dll
2009-02-28 01:17:35 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009022720090228\index.dat
2009-10-05 21:19:19 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009092820091005\index.dat

============= FINISH: 16:29:23.28 ===============

win32kdiag

Running from: C:\Users\Carol\Desktop\Win32kDiag.exe

Log file at : C:\Users\Carol\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\Windows'...


peek.bat

Volume in drive C is HP
Volume Serial Number is BC7E-E26C

exe helper

exeHelper by Raktor
Build 20091220
Run at 01:11:08 on 01/10/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

exeHelper by Raktor
Build 20091220
Run at 02:09:28 on 01/10/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Thanks for the help

#6 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 10 January 2010 - 05:31 AM

That doesn't look too bad. The only problem so far is running the rootkit scanner so let's run Combofix to try and remove the threat. First we clear the path with a small program:

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4
  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply
Then

Please download ComboFix from one of these locations:* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Thanks :(
Posted Image
m0le is a proud member of UNITE

#7 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 10 January 2010 - 04:42 PM

Okay this is what happened.

I went ahead and linked to Rkill and saved it to my desktop. I ran the program. The black box appeared but then the desktop (without icons) appeared behind it and the computer froze up. The computer was unresponsive to Ctl Alt Del and this went on for about 45 min, upon which I unplugged the computer and turned it back on.

When I turned it back on, the internet was not working at all. I tried unplugging the router and DSL line and the phone line and reconnecting and this did not help. I did a system restore and the internet returned. I then saved ComboFix to the desktop, and ran Rkill again. The same thing happened as before. I then saved both programs on a disk and rebooted in safe mode and both programs ran fairly quickly. During this it said Avira AV was running and to cut it off. I had previously deleted Avira since I am using Avast now. I was not able to delete Avira. I got this message: "Setup could not determine the feature control file or was not able to read it correctly." I allowed combofix to continue to run and I got the combofix log.

ComboFix 10-01-04.01 - Carol 01/10/2010 15:36:52.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1535 [GMT -5:00]
Running from: E:\Comfix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3858587098-678737914-890489737-500
c:\$recycle.bin\S-1-5-21-959447114-2711728064-952257928-500
c:\program files\Common Files\Uninstall
c:\program files\Search Guard PlusU
c:\program files\Search Guard PlusU\SGPU.ico
c:\program files\Search Guard PlusU\sgpUpdater.exe
c:\program files\Search Guard PlusU\sgpUpdater.xml
c:\program files\Search Guard PlusU\sgpUpdaters.exe
c:\program files\Search Guard PlusU\uninstalSGPU.exe
c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_NDISRD


((((((((((((((((((((((((( Files Created from 2009-12-10 to 2010-01-10 )))))))))))))))))))))))))))))))
.

2010-01-10 20:44 . 2010-01-10 20:47 -------- d-----w- c:\users\Carol\AppData\Local\temp
2010-01-10 20:33 . 2010-01-10 20:46 -------- d-----w- C:\Comfix
2010-01-08 09:18 . 2010-01-08 09:18 -------- d-----w- c:\program files\Immunet Protect
2010-01-05 23:00 . 2010-01-05 23:00 -------- d--h--w- c:\windows\msdownld.tmp
2010-01-05 23:00 . 2010-01-06 12:24 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-03 11:59 . 2010-01-03 11:59 552 ----a-w- c:\users\Carol\AppData\Local\d3d8caps.dat
2010-01-02 06:34 . 2010-01-02 06:34 -------- d-----w- c:\program files\SpeedFan
2009-12-27 00:53 . 2010-01-10 01:11 -------- d-----w- c:\program files\ScreenSwarm
2009-12-27 00:53 . 2009-12-27 00:53 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-26 05:18 . 2009-12-26 05:18 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-12-26 05:17 . 2009-12-26 05:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-12-26 05:17 . 2009-12-26 05:17 -------- d-----w- c:\users\Carol\AppData\Roaming\SUPERAntiSpyware.com
2009-12-26 04:37 . 2009-12-26 18:12 -------- d-----w- c:\programdata\ParetoLogic
2009-12-26 04:37 . 2009-12-26 18:12 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-12-24 02:15 . 2008-11-06 07:03 -------- d-----w- C:\SDFix
2009-12-23 15:39 . 2009-12-23 15:39 -------- d-----w- C:\Microsoft IT Environment Health Scanner
2009-12-19 21:06 . 2009-12-19 21:06 -------- d-----w- c:\program files\NOS
2009-12-19 07:16 . 2009-12-26 19:26 -------- d-----w- c:\program files\CCleaner
2009-12-19 03:12 . 2009-12-26 19:18 -------- d-----w- c:\program files\Trend Micro
2009-12-19 02:15 . 2009-12-26 19:18 -------- d-----w- c:\program files\Microsoft
2009-12-19 02:15 . 2009-12-26 19:26 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-12-19 02:14 . 2009-12-19 02:15 -------- d-----w- c:\program files\Windows Live
2009-12-19 02:14 . 2009-12-19 02:14 -------- d-----w- c:\windows\PCHEALTH
2009-12-18 21:06 . 2009-12-26 19:20 -------- d-----w- c:\program files\Windows Defender
2009-12-18 21:02 . 2009-12-26 19:30 -------- d-----w- c:\windows\System
2009-12-18 21:00 . 2009-12-18 21:03 -------- d-----w- c:\windows\Media
2009-12-18 20:58 . 2009-12-26 19:20 -------- d-----w- c:\windows\provisioning
2009-12-18 20:58 . 2009-12-26 19:20 -------- d-----w- c:\windows\PLA
2009-12-18 20:58 . 2009-12-18 21:05 -------- d-----w- c:\windows\L2Schemas
2009-12-18 20:57 . 2009-12-26 19:20 -------- d-----w- c:\windows\Branding
2009-12-18 20:57 . 2009-12-26 19:20 -------- d-----w- c:\windows\Help
2009-12-18 20:57 . 2010-01-10 20:42 -------- d-----w- c:\windows\AppPatch
2009-12-18 16:57 . 2009-12-23 03:54 -------- d-----w- c:\windows\Logs
2009-12-18 11:35 . 2010-01-10 20:41 -------- d-----w- c:\windows\INF
2009-12-18 11:16 . 2009-12-18 11:16 -------- d-----w- c:\users\Carol\AppData\Local\Apps
2009-12-18 11:16 . 2009-12-28 23:35 -------- d-----w- c:\users\Carol\AppData\Local\Deployment
2009-12-18 00:57 . 2009-10-08 02:36 81920 ----a-w- c:\windows\eSellerateControl350.dll
2009-12-18 00:57 . 2009-10-08 02:36 356352 ----a-w- c:\windows\eSellerateEngine.dll
2009-12-13 14:42 . 2009-12-13 14:42 -------- d-----w- c:\users\Carol\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2098-01-01 06:00 . 2007-12-27 19:07 9096 ----a-w- c:\programdata\Symantec\LiveUpdate\LuRegManifests\Static\LUTPReg.dll
2010-01-10 20:17 . 2009-11-04 14:03 -------- d-----w- c:\users\Carol\AppData\Roaming\Skype
2010-01-10 13:08 . 2009-11-04 14:05 -------- d-----w- c:\users\Carol\AppData\Roaming\skypePM
2010-01-10 12:57 . 2009-11-12 18:59 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-10 12:57 . 2007-03-15 17:20 -------- d-----w- c:\programdata\pdf995
2010-01-08 10:01 . 2007-02-08 01:27 168 ----a-w- c:\windows\popcinfo.dat
2010-01-08 09:54 . 2009-10-03 17:45 -------- d-----w- c:\programdata\Avira
2010-01-08 09:54 . 2009-10-03 17:45 -------- d-----w- c:\program files\Avira
2010-01-01 09:13 . 2009-09-29 19:32 -------- d-----w- c:\users\Carol\AppData\Roaming\uTorrent
2009-12-28 21:57 . 2009-10-10 18:01 -------- d-----w- c:\program files\Palace of Chance
2009-12-27 00:53 . 2009-12-27 00:53 37176 ----a-w- c:\users\Carol\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-26 20:01 . 2006-12-26 09:29 -------- d-----w- c:\program files\Yahoo!
2009-12-26 20:01 . 2008-04-04 19:11 -------- d-----w- c:\users\Carol\AppData\Roaming\Yahoo!
2009-12-26 19:21 . 2009-11-18 19:12 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-26 19:19 . 2007-03-15 17:18 -------- d-----w- c:\program files\TaxCut06
2009-12-26 19:18 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-12-26 19:18 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2009-12-26 19:18 . 2009-11-04 14:00 -------- d-----w- c:\programdata\Skype
2009-12-26 19:18 . 2008-05-25 01:45 -------- d-----w- c:\programdata\Gamesv1005
2009-12-26 19:18 . 2007-08-17 02:38 -------- d-----w- c:\programdata\SpinTop Games
2009-12-26 19:18 . 2006-12-26 09:24 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-26 19:18 . 2009-11-18 18:59 -------- d-----w- c:\programdata\Apple
2009-12-26 19:18 . 2008-06-04 20:45 -------- d-----w- c:\programdata\eBay
2009-12-26 19:18 . 2007-11-05 01:42 -------- d-----w- c:\programdata\PopCap
2009-12-26 19:18 . 2007-02-17 02:58 -------- d-----w- c:\users\Carol\AppData\Roaming\muvee Technologies
2009-12-26 19:18 . 2007-02-17 02:58 -------- d-----w- c:\programdata\muvee Technologies
2009-12-19 15:11 . 2008-12-04 17:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-19 14:46 . 2007-08-10 07:36 -------- d-----w- c:\program files\Java
2009-12-19 07:13 . 2007-04-09 22:11 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-18 10:21 . 2007-08-10 07:37 -------- d-----w- c:\program files\Google
2009-12-13 14:37 . 2007-02-13 00:38 6504 ----a-w- c:\users\Carol\AppData\Roaming\wklnhst.dat
2009-12-08 07:05 . 2009-12-08 07:05 127872 ----a-w- c:\users\Carol\AppData\Roaming\Move Networks\uninstall.exe
2009-12-08 07:05 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Carol\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-12-08 06:02 . 2006-12-26 09:30 -------- d-----w- c:\program files\Symantec
2009-12-08 04:32 . 2009-12-08 04:32 -------- d-----w- c:\program files\Alwil Software
2009-12-08 03:59 . 2009-10-03 17:46 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-06 20:30 . 2009-12-06 20:30 -------- d-----w- c:\programdata\WindowsSearch
2009-12-06 19:28 . 2009-12-06 19:28 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-05 04:10 . 2009-11-20 15:07 -------- d-----w- c:\program files\Common Files\PC Tools
2009-11-30 22:37 . 2009-11-30 22:37 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbFF56.tmp.exe
2009-11-24 23:54 . 2009-12-08 04:32 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:50 . 2009-12-08 04:33 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-12-08 04:33 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-12-08 04:32 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-24 23:49 . 2009-12-08 04:33 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-12-08 04:33 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-12-08 04:33 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-21 06:40 . 2009-12-09 01:08 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 01:08 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2009-12-09 01:08 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2009-12-09 01:08 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-20 15:32 . 2009-11-20 15:32 110864 ----a-w- c:\programdata\MGS\cache\t\type_3reelnormal1_2.6d58a1bcaf1d9165fa0b77fa9598b623.dll
2009-11-20 15:32 . 2009-11-20 15:27 -------- d-----w- c:\programdata\MGS
2009-11-18 19:19 . 2009-11-18 19:14 -------- d-----w- c:\users\Carol\AppData\Roaming\Apple Computer
2009-11-18 19:12 . 2009-11-18 19:12 -------- d-----w- c:\program files\iPod
2009-11-18 19:12 . 2009-11-18 19:05 -------- d-----w- c:\programdata\Apple Computer
2009-11-16 21:25 . 2009-11-16 21:25 -------- d-----w- c:\programdata\CardPlayer
2009-11-16 21:25 . 2009-11-16 21:25 -------- d-----w- c:\program files\CardPlayer
2009-11-14 03:59 . 2009-11-14 03:59 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-11-12 13:38 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-12 13:38 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-09 12:31 . 2009-12-09 09:07 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30 . 2009-12-09 09:07 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36 . 2009-12-09 09:07 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-11-04 14:05 . 2009-11-04 14:05 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-11-03 02:42 . 2009-10-02 23:14 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:17 . 2009-11-26 09:02 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-29 02:58 . 2009-10-29 02:58 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-22 05:08 . 2009-10-22 05:08 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-22 05:05 . 2009-10-22 05:05 86016 ----a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2007-03-13 05:42 . 2007-03-13 05:42 774144 ----a-w- c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 17:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 09:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
2008-10-17 20:52 51048 ----a-w- c:\program files\Common Files\Symantec Shared\CCAPP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-19 07:33 125952 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2006-09-26 00:52 50736 ----a-w- c:\program files\Common Files\aol\1170865100\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-03-12 02:34 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
2006-09-28 13:42 65536 ----a-w- c:\hp\support\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 02:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2005-02-02 15:44 61440 ----a-w- c:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 03:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 22:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2008-05-22 19:49 13539872 ----a-w- c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-05-22 19:49 92704 ----a-w- c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 07:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
2009-10-14 21:42 292824 ----a-w- c:\program files\Registry Mechanic\RMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-01-15 16:26 4874240 ----a-w- c:\windows\RtHDVCpl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 19:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSDMonitor]
2009-10-14 21:42 104408 ----a-w- c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-12-19 15:11 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec PIF AlertEng]
2007-11-29 01:51 583048 ----a-w- c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:(:bb,f6,3f,27,ac,76,ca,01

S1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [12/7/2009 11:33 PM 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [12/7/2009 11:33 PM 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [12/7/2009 11:32 PM 53328]
S3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2/19/2009 12:31 PM 41008]
S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/3/2009 12:46 PM 108289]
S4 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [11/20/2009 10:07 AM 583640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-04 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 16:18]

2010-01-10 c:\windows\Tasks\User_Feed_Synchronization-{6DB8D608-53AA-427C-8B22-C717BB7585D4}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://m.www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
TCP: {C6F86646-8A1F-4FA3-B4AF-7531341EE00D} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\users\Carol\AppData\Roaming\Mozilla\Firefox\Profiles\z0gg784v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={D5E7E7AF-F7E4-0396-C5E3-B4BEF5D71D83}&q=
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Carol\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
WebBrowser-{4E7BD74F-2B8D-469E-85B2-BC27FE9AAE2E} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-RunOnce-<NO NAME> - (no file)
MSConfigStartUp-ALUAlert - c:\program files\Symantec\LiveUpdate\ALuNotify.exe
MSConfigStartUp-HPAdvisor - c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-Microsoft .NET Framework 3.5 SP1 - c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
AddRemove-TREB Removal Tool_is1 - c:\program files\TREB Removal Tool\unins000.exe
AddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - c:\program files\Spybot - Search & Destroy\unins000.exe
AddRemove-{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31} - c:\program files\Full Tilt Poker\uninstall.exe



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-01-10 15:53:54 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-10 20:53

Pre-Run: 223,840,301,056 bytes free
Post-Run: 223,467,134,976 bytes free

- - End Of File - - 980B67440CB6613E6E6CBB3DC6F24CD4

I then rebooted into safe mode with networking. The internet did not work. I then went into system configuration and set it to boot normally. I am now able to access the internet but having the same problems as before.

Thanks for your excellent help.

#8 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 10 January 2010 - 05:23 PM

I think that running system restore may have returned your internet access but may have reinfected you.

Did you run Combofix in safe mode? I think that's what you have said.

Please rerun Combofix in normal mode.


If you lose internet access again then follow these instructions:

Click Start

Type cmd in the Start Search box

Right-click cmd.exe, click Run as administrator, and then press Continue.

Type netsh winsock reset at the command prompt, and then press Enter.

Type exit, and then press Enter.
Posted Image
m0le is a proud member of UNITE

#9 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 10 January 2010 - 06:13 PM

Ok I ran combofix in normal mode. I did lose connectivity. I did the winsock thingy and it prompted me to restart, which I did and the internet was working again after that.

Here is the log

ComboFix 10-01-04.01 - Carol 01/10/2010 17:52:34.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1918.1181 [GMT -5:00]
Running from: E:\Comfix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2009-12-10 to 2010-01-10 )))))))))))))))))))))))))))))))
.

2010-01-10 23:02 . 2010-01-10 23:02 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-01-10 23:02 . 2010-01-10 23:02 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-01-10 23:02 . 2010-01-10 23:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-10 20:53 . 2010-01-10 23:02 -------- d-----w- c:\users\Carol\AppData\Local\temp
2010-01-10 20:33 . 2010-01-10 20:46 -------- d-----w- C:\Comfix
2010-01-08 09:18 . 2010-01-08 09:18 -------- d-----w- c:\program files\Immunet Protect
2010-01-05 23:00 . 2010-01-05 23:00 -------- d--h--w- c:\windows\msdownld.tmp
2010-01-05 23:00 . 2010-01-06 12:24 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-03 11:59 . 2010-01-03 11:59 552 ----a-w- c:\users\Carol\AppData\Local\d3d8caps.dat
2010-01-02 06:34 . 2010-01-02 06:34 -------- d-----w- c:\program files\SpeedFan
2009-12-27 00:53 . 2010-01-10 01:11 -------- d-----w- c:\program files\ScreenSwarm
2009-12-27 00:53 . 2009-12-27 00:53 37176 ----a-w- c:\users\Carol\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-27 00:53 . 2009-12-27 00:53 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-26 05:18 . 2009-12-26 05:18 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-12-26 05:17 . 2009-12-26 05:17 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-12-26 05:17 . 2009-12-26 05:17 -------- d-----w- c:\users\Carol\AppData\Roaming\SUPERAntiSpyware.com
2009-12-26 04:37 . 2009-12-26 18:12 -------- d-----w- c:\programdata\ParetoLogic
2009-12-26 04:37 . 2009-12-26 18:12 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-12-24 02:15 . 2008-11-06 07:03 -------- d-----w- C:\SDFix
2009-12-23 15:39 . 2009-12-23 15:39 -------- d-----w- C:\Microsoft IT Environment Health Scanner
2009-12-19 21:06 . 2009-12-19 21:06 -------- d-----w- c:\program files\NOS
2009-12-19 07:16 . 2009-12-26 19:26 -------- d-----w- c:\program files\CCleaner
2009-12-19 03:12 . 2009-12-26 19:18 -------- d-----w- c:\program files\Trend Micro
2009-12-19 02:15 . 2009-12-26 19:18 -------- d-----w- c:\program files\Microsoft
2009-12-19 02:15 . 2009-12-26 19:26 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-12-19 02:14 . 2009-12-19 02:15 -------- d-----w- c:\program files\Windows Live
2009-12-19 02:14 . 2009-12-19 02:14 -------- d-----w- c:\windows\PCHEALTH
2009-12-18 21:06 . 2009-12-26 19:20 -------- d-----w- c:\program files\Windows Defender
2009-12-18 21:02 . 2009-12-26 19:30 -------- d-----w- c:\windows\System
2009-12-18 21:00 . 2009-12-18 21:03 -------- d-----w- c:\windows\Media
2009-12-18 20:58 . 2009-12-26 19:20 -------- d-----w- c:\windows\provisioning
2009-12-18 20:58 . 2009-12-26 19:20 -------- d-----w- c:\windows\PLA
2009-12-18 20:58 . 2009-12-18 21:05 -------- d-----w- c:\windows\L2Schemas
2009-12-18 20:57 . 2009-12-26 19:20 -------- d-----w- c:\windows\Branding
2009-12-18 20:57 . 2009-12-26 19:20 -------- d-----w- c:\windows\Help
2009-12-18 20:57 . 2010-01-10 22:58 -------- d-----w- c:\windows\AppPatch
2009-12-18 16:57 . 2009-12-23 03:54 -------- d-----w- c:\windows\Logs
2009-12-18 11:35 . 2010-01-10 21:33 -------- d-----w- c:\windows\INF
2009-12-18 11:16 . 2009-12-18 11:16 -------- d-----w- c:\users\Carol\AppData\Local\Apps
2009-12-18 11:16 . 2009-12-28 23:35 -------- d-----w- c:\users\Carol\AppData\Local\Deployment
2009-12-18 00:57 . 2009-10-08 02:36 81920 ----a-w- c:\windows\eSellerateControl350.dll
2009-12-18 00:57 . 2009-10-08 02:36 356352 ----a-w- c:\windows\eSellerateEngine.dll
2009-12-13 14:42 . 2009-12-13 14:42 -------- d-----w- c:\users\Carol\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2098-01-01 06:00 . 2007-12-27 19:07 9096 ----a-w- c:\programdata\Symantec\LiveUpdate\LuRegManifests\Static\LUTPReg.dll
2010-01-10 21:44 . 2009-11-04 14:03 -------- d-----w- c:\users\Carol\AppData\Roaming\Skype
2010-01-10 21:28 . 2009-11-04 14:05 -------- d-----w- c:\users\Carol\AppData\Roaming\skypePM
2010-01-10 12:57 . 2009-11-12 18:59 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-10 12:57 . 2007-03-15 17:20 -------- d-----w- c:\programdata\pdf995
2010-01-08 10:01 . 2007-02-08 01:27 168 ----a-w- c:\windows\popcinfo.dat
2010-01-08 09:54 . 2009-10-03 17:45 -------- d-----w- c:\programdata\Avira
2010-01-08 09:54 . 2009-10-03 17:45 -------- d-----w- c:\program files\Avira
2010-01-01 09:13 . 2009-09-29 19:32 -------- d-----w- c:\users\Carol\AppData\Roaming\uTorrent
2009-12-28 21:57 . 2009-10-10 18:01 -------- d-----w- c:\program files\Palace of Chance
2009-12-26 20:01 . 2006-12-26 09:29 -------- d-----w- c:\program files\Yahoo!
2009-12-26 20:01 . 2008-04-04 19:11 -------- d-----w- c:\users\Carol\AppData\Roaming\Yahoo!
2009-12-26 19:21 . 2009-11-18 19:12 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-26 19:19 . 2007-03-15 17:18 -------- d-----w- c:\program files\TaxCut06
2009-12-26 19:18 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-12-26 19:18 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2009-12-26 19:18 . 2009-11-04 14:00 -------- d-----w- c:\programdata\Skype
2009-12-26 19:18 . 2008-05-25 01:45 -------- d-----w- c:\programdata\Gamesv1005
2009-12-26 19:18 . 2007-08-17 02:38 -------- d-----w- c:\programdata\SpinTop Games
2009-12-26 19:18 . 2006-12-26 09:24 -------- d-----w- c:\program files\Hewlett-Packard
2009-12-26 19:18 . 2009-11-18 18:59 -------- d-----w- c:\programdata\Apple
2009-12-26 19:18 . 2008-06-04 20:45 -------- d-----w- c:\programdata\eBay
2009-12-26 19:18 . 2007-11-05 01:42 -------- d-----w- c:\programdata\PopCap
2009-12-26 19:18 . 2007-02-17 02:58 -------- d-----w- c:\users\Carol\AppData\Roaming\muvee Technologies
2009-12-26 19:18 . 2007-02-17 02:58 -------- d-----w- c:\programdata\muvee Technologies
2009-12-19 15:11 . 2008-12-04 17:05 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-12-19 14:46 . 2007-08-10 07:36 -------- d-----w- c:\program files\Java
2009-12-19 07:13 . 2007-04-09 22:11 -------- d-----w- c:\program files\Common Files\Adobe
2009-12-18 10:21 . 2007-08-10 07:37 -------- d-----w- c:\program files\Google
2009-12-13 14:37 . 2007-02-13 00:38 6504 ----a-w- c:\users\Carol\AppData\Roaming\wklnhst.dat
2009-12-08 07:05 . 2009-12-08 07:05 127872 ----a-w- c:\users\Carol\AppData\Roaming\Move Networks\uninstall.exe
2009-12-08 07:05 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Carol\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-12-08 06:02 . 2006-12-26 09:30 -------- d-----w- c:\program files\Symantec
2009-12-08 04:32 . 2009-12-08 04:32 -------- d-----w- c:\program files\Alwil Software
2009-12-08 03:59 . 2009-10-03 17:46 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-06 20:30 . 2009-12-06 20:30 -------- d-----w- c:\programdata\WindowsSearch
2009-12-06 19:28 . 2009-12-06 19:28 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-12-05 04:10 . 2009-11-20 15:07 -------- d-----w- c:\program files\Common Files\PC Tools
2009-11-30 22:37 . 2009-11-30 22:37 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbFF56.tmp.exe
2009-11-24 23:54 . 2009-12-08 04:32 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:50 . 2009-12-08 04:33 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-11-24 23:50 . 2009-12-08 04:33 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-11-24 23:49 . 2009-12-08 04:32 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-11-24 23:49 . 2009-12-08 04:33 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-12-08 04:33 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-12-08 04:33 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-11-21 06:40 . 2009-12-09 01:08 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 01:08 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2009-12-09 01:08 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2009-12-09 01:08 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-11-20 15:32 . 2009-11-20 15:32 110864 ----a-w- c:\programdata\MGS\cache\t\type_3reelnormal1_2.6d58a1bcaf1d9165fa0b77fa9598b623.dll
2009-11-20 15:32 . 2009-11-20 15:27 -------- d-----w- c:\programdata\MGS
2009-11-18 19:19 . 2009-11-18 19:14 -------- d-----w- c:\users\Carol\AppData\Roaming\Apple Computer
2009-11-18 19:12 . 2009-11-18 19:12 -------- d-----w- c:\program files\iPod
2009-11-18 19:12 . 2009-11-18 19:05 -------- d-----w- c:\programdata\Apple Computer
2009-11-16 21:25 . 2009-11-16 21:25 -------- d-----w- c:\programdata\CardPlayer
2009-11-16 21:25 . 2009-11-16 21:25 -------- d-----w- c:\program files\CardPlayer
2009-11-14 03:59 . 2009-11-14 03:59 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2009-11-12 13:38 . 2006-11-02 10:32 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2009-11-12 13:38 . 2006-11-02 10:32 82432 ----a-w- c:\windows\system32\axaltocm.dll
2009-11-09 12:31 . 2009-12-09 09:07 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30 . 2009-12-09 09:07 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36 . 2009-12-09 09:07 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-11-04 14:05 . 2009-11-04 14:05 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-11-03 02:42 . 2009-10-02 23:14 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 09:17 . 2009-11-26 09:02 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-29 02:58 . 2009-10-29 02:58 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-10-22 05:08 . 2009-10-22 05:08 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-10-22 05:05 . 2009-10-22 05:05 86016 ----a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
2007-03-13 05:42 . 2007-03-13 05:42 774144 ----a-w- c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2009-10-14 292824]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2007-11-29 583048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-19 149280]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2009-10-14 104408]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"HostManager"="c:\program files\Common Files\AOL\1170865100\ee\AOLSoftware.exe" [2006-09-26 50736]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:(:bb,f6,3f,27,ac,76,ca,01

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [12/7/2009 11:33 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [12/7/2009 11:33 PM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [12/7/2009 11:32 PM 53328]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [11/20/2009 10:07 AM 583640]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2/19/2009 12:31 PM 41008]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [10/3/2009 12:46 PM 108289]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-01-04 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 16:18]

2010-01-10 c:\windows\Tasks\User_Feed_Synchronization-{6DB8D608-53AA-427C-8B22-C717BB7585D4}.job
- c:\windows\system32\msfeedssync.exe [2009-12-09 04:59]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://m.www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
TCP: {C6F86646-8A1F-4FA3-B4AF-7531341EE00D} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\users\Carol\AppData\Roaming\Mozilla\Firefox\Profiles\z0gg784v.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={D5E7E7AF-F7E4-0396-C5E3-B4BEF5D71D83}&q=
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Carol\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-10 18:02
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-01-10 18:05:30
ComboFix-quarantined-files.txt 2010-01-10 23:05
ComboFix2.txt 2010-01-10 20:53

Pre-Run: 220,261,269,504 bytes free
Post-Run: 220,266,569,728 bytes free

- - End Of File - - DA61A88061EA0C7DE987BAEF58A465B1

I am still having the same problems as before.

#10 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 10 January 2010 - 07:25 PM

Still having problems getting to certain website after cleaning usually means that the hosts file has been hijacked. HostsXpert will reset the file and should solve the problem.


Please download HostsXpert 4.3
  • Extract (unzip) HostsXpert.zip to a permanent folder on your hard drive such as C:\HostsXpert
  • Double-click HostsXpert.exe to run the program.
  • Click "Restore MS Hosts File".
  • Click OK at the confirmation box.
  • Click "Make Read Only".
  • Click the X to exit the program.
-- Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
Posted Image
m0le is a proud member of UNITE

#11 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 10 January 2010 - 07:54 PM

Unfortunately, that did not help.

#12 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 10 January 2010 - 08:14 PM

Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

If you are using Firefox and this has caused page loading problems then please clear your private data. To do this go
to the Tools menu, select Clear Private Data, and then check Cache. Click Clear Private Data Now.

This could also be Clear Recent History or similar

Then close Firefox and then reopen it.

If that does not fix it try the next steps:


In IE go to Tools, Security and Restricted Sites and see if the site is in there.

In IE tools look in Privacy Sites and see if it is in there.

Also if you are running a firewall check its settings to make sure it isn't blocking the site as well.

You can also flush your DNS cache by using: Start, then search for cmd. Right click cmd.exe and Run As Administrator and type ipconfig /flushdns


Let me know how they go for you.
Posted Image
m0le is a proud member of UNITE

#13 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 10 January 2010 - 10:26 PM

Unfortunately, none of those steps helped. None of the problem sites were in the restricted sites list. I'm not sure how to check Windows Firewall for blocked programs.

#14 m0le

m0le

    Can U Dig It?


  • Malware Response Team
  • 34,527 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London, UK
  • Local time:02:16 PM

Posted 11 January 2010 - 05:27 AM

Click Start Control Panel > Security > Windows Firewall > Change Settings, and click Continue if prompted by UAC.

Click on the Advanced tab.

Check the applications that you wish to unblock.


Is the only remaining problem this site blocking?
Posted Image
m0le is a proud member of UNITE

#15 acethrowin1

acethrowin1
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:16 AM

Posted 11 January 2010 - 07:26 AM

I don't see any programs that would interefere with the websites I want to go to.

Yeah basically I can't get on www.login.yahoo.com, http://player.pureplay.com/cwml/lobby/start.html, or www.login.facebook.com

basically I can't log into these sites that need passwords just these certain sites. I can get on m.facebook.com and m.yahoo.com and I can get into the normal yahoo if my YIM pops up with a new message and I click on that. I can get on facebook with a proxy but then none of the apps work, they don't work on the mobile site either. I can't seem to get on pureplay at all.

my windows live messenger is not working either but I haven't tried uninstalling/reinstalling it yet. I might do that now.

Thanks for your help




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users