Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help Request.


  • This topic is locked This topic is locked
2 replies to this topic

#1 l3lackRose

l3lackRose

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:28 PM

Posted 21 January 2010 - 03:09 PM

Every few seconds iexplore opens in the background and somtimes plays ads, just as well I cannot use Explore for anything as it doesn't let me vist any site at all. Have this dds thing, not sure if it will help.


DDS (Ver_09-12-01.01) - NTFSx86
Run by Administrator at 14:59:53.21 on Thu 01/21/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.159 [GMT -5:00]

AV: Malware Defense *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\Common Files\AOL\1263342939\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe
C:\PROGRA~1\FREEDO~1\fdm.exe
c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Administrator\My Documents\Ad-AwareInstallation.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mia3C.tmp\Ad-AwareInstallation.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
C:\Program Files\Internet Explorer\iexplore.exe

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=70026
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mWinlogon: Userinit=c:\windows\system32\userinit.exe,,SKEYS /I
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: CDNSCacheObj Object: {376892ae-1825-4e5f-9f85-23f9640051cc} - c:\windows\mplayerplgn.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [AOL Fast Start] "c:\program files\aol 9.0\AOL.EXE" -b
mRun: [USRpdA] c:\windows\system32\usrmlnka.exe runservices \device\3cpipe-USRpdA
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s
mRun: [HostManager] c:\program files\common files\aol\1263342939\ee\AOLSoftware.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\bitcomet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {AD9E6088-E00B-42f9-9F0C-8480525D234E} - {FF5073C0-28A0-4223-9BDF-59FF020FE77C}
Trusted Zone: bleepingcomputer.com\download
Trusted Zone: thepiratebay.org
DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - hxxp://www.comcastsupport.com/sdccommon/download/tgctlsr.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} - hxxp://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\4w5gl4x2.default\
FF - prefs.js: browser.search.selectedEngine - DAEMON Search
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\4w5gl4x2.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\program files\free download manager\firefox\extension\components\vmsfdmff.dll
FF - component: c:\program files\search settings\ff\components\SearchSettingsFF.dll
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2010-1-15 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-1-15 20560]
S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2010-1-15 138680]
S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2010-1-15 254040]
S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2010-1-15 352920]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

=============== Created Last 30 ================

2010-01-21 19:29:13 0 dc----w- c:\program files\Trend Micro
2010-01-21 19:22:18 0 dc----w- c:\program files\TrendMicro
2010-01-21 05:38:41 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll
2010-01-21 04:34:48 0 dc----w- c:\windows\ERUNT
2010-01-21 02:59:38 0 dc----w- C:\SDFix
2010-01-20 03:13:02 34342 -c--a-w- c:\windows\DIIUnin.dat
2010-01-20 03:12:59 94208 -c--a-w- c:\windows\DIIUnin.exe
2010-01-20 03:12:59 2829 -c--a-w- c:\windows\DIIUnin.pif
2010-01-20 03:04:05 0 dc----w- c:\program files\Diablo II
2010-01-18 08:33:16 0 dc----w- c:\docume~1\admini~1\applic~1\Free Download Manager
2010-01-18 08:33:10 0 dc----w- c:\docume~1\alluse~1\applic~1\FreeDownloadManager.ORG
2010-01-18 08:33:09 0 dc----w- c:\program files\Free Download Manager
2010-01-17 22:04:28 9216 -c--a-w- c:\windows\system32\ffnd.exe
2010-01-17 21:55:37 0 dc----w- c:\docume~1\admini~1\applic~1\FreeFixer
2010-01-17 21:55:33 0 dc----w- c:\program files\FreeFixer
2010-01-15 22:08:28 0 dc----w- c:\program files\Malware Defense
2010-01-15 00:47:09 0 dc----w- c:\docume~1\admini~1\applic~1\Search Settings
2010-01-15 00:47:05 0 dc----w- c:\docume~1\admini~1\applic~1\Dealio
2010-01-15 00:45:07 0 dc----w- c:\program files\Search Settings
2010-01-15 00:44:47 0 dc----w- c:\program files\Application Updater
2010-01-15 00:44:45 0 dc----w- c:\program files\Dealio Toolbar
2010-01-15 00:44:13 0 dc----w- c:\windows\system32\custom matrices
2010-01-15 00:44:02 0 dc----w- c:\windows\system32\QuickTime
2010-01-15 00:44:02 0 dc----w- c:\windows\system32\C2MP
2010-01-15 00:43:26 0 dc----w- c:\program files\Media Player Classic
2010-01-15 00:38:54 0 dc----w- c:\docume~1\alluse~1\applic~1\Viewpoint
2010-01-15 00:38:51 0 dc----w- c:\program files\Viewpoint
2010-01-13 16:34:55 10920 -c--a-w- C:\aolconnfix.exe
2010-01-13 00:38:35 0 dc----w- c:\docume~1\admini~1\applic~1\AOL
2010-01-13 00:38:23 715 -c--a-w- c:\windows\aolback.exe.lnk
2010-01-13 00:38:04 0 dc----w- c:\program files\common files\aolback
2010-01-13 00:37:48 0 dc----w- c:\program files\common files\Nullsoft
2010-01-13 00:36:29 33588 -c--a-r- c:\windows\system32\drivers\wanatw4.sys
2010-01-13 00:35:32 0 dc----w- c:\program files\common files\aolshare
2010-01-13 00:35:32 0 dc----w- c:\program files\common files\aol
2010-01-13 00:35:32 0 dc----w- c:\program files\AOL 9.0
2010-01-05 03:00:27 0 dc----w- c:\program files\VideoLAN
2010-01-04 21:50:23 0 dc----w- c:\windows\ShellNew
2010-01-04 21:50:19 0 dc----w- c:\program files\AutoIt3
2010-01-01 06:05:43 0 dc----w- C:\GamepotUSA
2009-12-31 07:29:14 20 -c--a-w- c:\windows\GKLauncherInfo.ini
2009-12-31 07:22:43 0 dc----w- c:\program files\GameKiss
2009-12-29 20:26:03 1089593 -c----w- c:\windows\system32\dllcache\ntprint.cat
2009-12-29 08:02:37 0 dc----w- c:\windows\system32\XPSViewer
2009-12-26 08:05:06 0 dc----w- C:\e626e8a5beb1c554c9b9e894b5a4a5
2009-12-26 08:04:39 0 dc----w- C:\27f0c4a48867b7236064327f006d792b
2009-12-25 08:02:23 0 dc----w- C:\d837796b1de23c001a
2009-12-25 08:01:53 0 dc----w- C:\772b8ae2fb0f60bdbdf1e3c21786ff4d
2009-12-24 13:43:38 0 dc----w- c:\program files\NeoDownloader
2009-12-24 08:02:38 0 dc----w- C:\3453ce076261b86026558c1b37
2009-12-24 08:02:23 0 dc----w- C:\6f147ce012d03fcd05c58b927eb7df54
2009-12-23 08:49:29 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-12-23 08:49:29 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-12-23 08:49:29 117760 -c----w- c:\windows\system32\prntvpt.dll
2009-12-23 08:49:28 575488 -c----w- c:\windows\system32\xpsshhdr.dll
2009-12-23 08:49:28 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-12-23 08:49:28 1676288 -c----w- c:\windows\system32\xpssvcs.dll
2009-12-23 08:49:28 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-12-23 08:49:27 0 dc----w- C:\ef9ad799e90d00acb5e7a5663d12a380
2009-12-23 08:43:37 0 dc----w- C:\3c8ec80c3fd4fdf993c9817a49
2009-12-23 08:43:29 0 dc----w- C:\be30bcd2c03f76c45218b99d960b69
2009-12-23 08:00:44 0 dc----w- C:\978aa0c04d96542c9c5761b7145cde97
2009-12-23 08:00:33 0 dc----w- C:\3bf69d8b7f234d71f4762a0d
2009-12-23 01:00:35 21840 -c--atw- c:\windows\system32\SIntfNT.dll
2009-12-23 01:00:35 17212 -c--atw- c:\windows\system32\SIntf32.dll
2009-12-23 01:00:35 12067 -c--atw- c:\windows\system32\SIntf16.dll

==================== Find3M ====================

2009-12-28 00:34:39 365 -c--a-w- c:\program files\conquer.ini
2009-12-02 17:02:50 1632887 -c--a-w- c:\windows\system32\ffmpegmt.dll
2009-12-02 16:56:10 4840081 -c--a-w- c:\windows\system32\libavcodec.dll
2009-11-27 16:37:05 47104 -c--a-w- c:\windows\system32\KMVIDC32.DLL
2009-11-05 07:12:07 98304 -c--a-w- c:\windows\system32\CmdLineExt.dll
2009-11-04 18:45:44 611638 -c--a-w- c:\windows\system32\libmplayer.dll
2009-11-04 18:43:20 324096 -c--a-w- c:\windows\system32\TomsMoComp_ff.dll
2009-11-03 20:11:22 113152 -c--a-w- c:\windows\system32\ff_unrar.dll
2009-11-03 20:11:00 146944 -c--a-w- c:\windows\system32\ff_tremor.dll
2009-11-03 20:10:42 183296 -c--a-w- c:\windows\system32\ff_samplerate.dll
2009-11-03 20:09:18 178688 -c--a-w- c:\windows\system32\ff_libmad.dll
2009-11-03 20:08:58 484864 -c--a-w- c:\windows\system32\ff_libfaad2.dll
2009-11-03 20:08:12 257024 -c--a-w- c:\windows\system32\ff_libdts.dll
2009-11-03 20:07:16 142848 -c--a-w- c:\windows\system32\ff_liba52.dll
2009-11-03 19:36:06 145408 -c--a-w- c:\windows\system32\libmpeg2_ff.dll
2009-11-03 19:34:56 100864 -c--a-w- c:\windows\system32\ff_wmv9.dll
2009-11-03 19:34:38 85504 -c--a-w- c:\windows\system32\ff_vfw.dll
2009-11-03 18:07:24 895308 -c--a-w- c:\windows\system32\xvidcore.dll
2009-11-03 18:05:02 957047 -c--a-w- c:\windows\system32\ff_x264.dll
2009-10-29 07:45:38 916480 -c--a-w- c:\windows\system32\wininet.dll
2009-10-27 22:46:26 248320 -c--a-w- c:\windows\system32\ff_kernelDeint.dll
2009-03-13 19:26:53 88 -csh--r- c:\windows\system32\CB6D99BB05.sys
2009-05-18 20:03:21 112928288 -csha-w- c:\windows\system32\drivers\fidbox.dat
2009-04-10 18:17:28 2214944 -csha-w- c:\windows\system32\drivers\fidbox2.dat
2008-12-12 08:15:19 16384 -csha-w- c:\windows\temp\cookies\index.dat
2008-12-12 08:15:19 16384 -csha-w- c:\windows\temp\history\history.ie5\index.dat
2008-12-12 08:15:19 32768 -csha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 15:01:45.53 ===============

Attached Files

  • Attached File  ark.txt   35.97KB   3 downloads


BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:06:28 PM

Posted 24 January 2010 - 12:13 AM


Hello l3lackRose smile.gif Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.


Please keep in mind that we have a large backlog of users just like yourself waiting to be helped so try to be as timely as possible in your replies. Since we do this on a part-time voluntary basis we are limited on how many logs we can respond to and keep open due to time restraints. If you have to be away or can't answer for some other reason just let me know. Thank you for your understanding.



After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.





I need for you to perform the following:


Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan.



    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries




If GMER does not want to run add the following to those that you unchecked and try it again:

  • Registry
  • Files










Note: Please post the log in the reply window and do not make it an attachment. Do this with all subsequent replies unless I ask otherwise.







Thanks,



thewall





If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#3 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:06:28 PM

Posted 30 January 2010 - 10:29 AM

Due to the lack of feedback This Topic is closed.

Should you need it reopened, please contact my by PM. Include the address of this thread in your request.

If you have a new issue, please start a New Topic.

This applies only to the original poster. Everyone else please begin a New Topic.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users