Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Probably Google-analytics redirector


  • This topic is locked This topic is locked
6 replies to this topic

#1 LeJeune

LeJeune

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:46 PM

Posted 01 August 2010 - 02:44 PM


DDS (Ver_10-03-17.01) - NTFSx86
Run by Landon at 14:33:45.23 on Sun 08/01/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1022.422 [GMT -5:00]

SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\srvany.exe
C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe
C:\Windows\KMService.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Landon\Downloads\Defogger.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Landon\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [<NO NAME>]
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\landon\appdata\roaming\mozilla\firefox\profiles\qx91mnum.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\progra~1\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\landon\appdata\local\google\update\1.2.183.29\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 KMService;KMService;c:\windows\system32\srvany.exe [2010-7-6 8192]
R2 MotoHelper.exe;Motorola Helper;c:\program files\motorola\moto helper service\MotoHelper.exe [2010-4-21 6656]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2010-7-7 1153368]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-6-24 92008]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2009-12-3 625224]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-11-5 230912]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 PavPrSrv;Panda Process Protection Service;"c:\program files\common files\panda software\pavshld\pavprsrv.exe" --> c:\program files\common files\panda software\pavshld\pavprsrv.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 hxctlflt;hxctlflt;c:\windows\system32\drivers\hxctlflt.sys [2010-7-16 99968]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-1-21 30963576]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-6-19 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-1-29 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-5-8 42752]
S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2009-10-27 23936]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-6-8 1343400]

=============== Created Last 30 ================

2010-08-01 19:30:23 0 ----a-w- c:\users\landon\defogger_reenable
2010-08-01 19:19:00 0 d-----w- c:\program files\Trend Micro
2010-07-27 02:07:30 198656 ----a-w- c:\windows\system32\Comdlg32.ocx
2010-07-27 01:37:49 0 d-----w- c:\program files\IDoser v4
2010-07-25 21:17:18 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2010-07-22 06:30:55 0 d-----w- c:\users\landon\appdata\roaming\Malwarebytes
2010-07-22 06:30:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-22 06:30:46 0 d-----w- c:\programdata\Malwarebytes
2010-07-22 06:30:45 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-22 06:30:45 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-22 02:11:59 0 d-----w- c:\programdata\Apple Computer
2010-07-22 02:10:32 0 d-----w- c:\programdata\Apple
2010-07-21 18:11:20 0 d-----w- c:\program files\common files\MSSoap
2010-07-21 18:10:18 8455168 ----a-w- c:\windows\system32\Mototools_Software_Update_3.0.5.msi
2010-07-21 18:10:14 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motport_01007.Wdf
2010-07-21 18:10:12 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01007.Wdf
2010-07-21 18:10:07 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgpfl_01007.Wdf
2010-07-21 18:10:07 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motccgp_01007.Wdf
2010-07-21 18:09:25 0 d-----w- c:\program files\common files\Motorola Shared
2010-07-21 18:09:05 1729024 ----a-w- c:\windows\system32\Motorola_End_User_Driver_Installation_4.6.0.msi
2010-07-21 18:07:54 0 d-----w- c:\programdata\Motorola
2010-07-21 18:07:42 0 d-----w- c:\program files\Motorola
2010-07-17 04:43:37 0 d-----w- c:\program files\common files\DivX Shared
2010-07-17 04:41:08 0 d-----w- c:\program files\DivX
2010-07-17 04:40:12 0 d-----w- c:\programdata\DivX
2010-07-16 22:39:08 57344 ----a-w- c:\windows\system32\vsnpstd3.dll
2010-07-16 22:39:07 99968 ----a-w- c:\windows\system32\drivers\hxctlflt.sys
2010-07-16 22:39:07 53248 ----a-w- c:\windows\system32\csnpstd3.dll
2010-07-16 22:39:07 15478 ----a-w- c:\windows\snpstd3.ini
2010-07-16 22:39:07 13003 ----a-w- c:\windows\snpstd3.src
2010-07-16 22:39:07 10371072 ----a-w- c:\windows\system32\drivers\snpstd3.sys
2010-07-16 22:38:55 374056 ----a-w- c:\windows\system32\HWLMSET2.exe
2010-07-16 22:38:55 15144 ----a-w- c:\windows\system32\HWLMSET2PS.dll
2010-07-16 22:29:10 0 d-----w- c:\program files\Hercules
2010-07-10 21:11:57 0 d-----w- c:\program files\Amazon
2010-07-07 22:55:50 0 d-----w- c:\programdata\Hewlett-Packard
2010-07-07 17:00:52 17 --sha-r- C:\win7.ld
2010-07-07 17:00:51 43256 ----a-w- c:\windows\Logo.bmp
2010-07-07 17:00:51 203464 --sha-r- C:\grldr
2010-07-07 08:54:42 0 d-----w- c:\program files\common files\xing shared
2010-07-07 08:54:28 0 d-----w- c:\programdata\Real
2010-07-07 08:54:28 0 d-----w- c:\program files\common files\Real
2010-07-07 05:15:17 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-07-07 05:15:17 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-07-07 05:13:24 0 d-----w- c:\programdata\Sun
2010-07-07 05:12:52 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-07 04:51:37 0 d-----w- C:\EasyActivatorTemp
2010-07-07 04:16:55 0 d-----w- c:\windows\Panther
2010-07-07 03:28:04 8192 ----a-w- c:\windows\system32\srvany.exe
2010-07-07 03:28:04 77824 ----a-w- c:\windows\KMService.exe
2010-07-07 03:20:30 0 d-----w- c:\program files\Microsoft Synchronization Services
2010-07-07 03:20:00 0 d-----w- c:\windows\PCHEALTH
2010-07-07 03:19:59 0 d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-07-07 03:18:48 0 d-----w- c:\program files\Microsoft Visual Studio 8
2010-07-07 03:17:49 0 d-----w- c:\program files\Microsoft Analysis Services
2010-07-07 03:16:23 0 d-----w- c:\programdata\Microsoft Help
2010-07-07 03:12:35 0 d-----w- c:\program files\gBurner
2010-07-07 02:50:10 0 d-----w- c:\programdata\TomTom
2010-07-07 02:49:50 0 d-----w- c:\users\landon\appdata\roaming\TomTom
2010-07-07 02:49:26 0 d-----w- c:\program files\CCleaner
2010-07-07 02:48:50 0 d-----w- c:\program files\TomTom International B.V
2010-07-07 02:48:39 0 d-----w- c:\program files\TomTom HOME 2
2010-07-07 02:45:35 0 d-----w- c:\program files\TomTom DesktopSuite
2010-07-07 02:24:12 0 d-----w- c:\program files\uTorrent
2010-07-07 02:23:54 0 d-----w- c:\users\landon\appdata\roaming\uTorrent
2010-07-07 02:19:26 1908 ----a-w- c:\windows\diagwrn.xml
2010-07-07 02:19:26 1908 ----a-w- c:\windows\diagerr.xml
2010-07-07 02:16:59 0 d-----w- c:\programdata\Adobe
2010-07-07 02:16:01 0 d-----w- c:\programdata\NOS
2010-07-07 02:07:45 0 d-----w- c:\program files\VideoLAN
2010-07-07 02:02:51 0 d-----w- c:\programdata\NVIDIA
2010-07-07 02:00:17 0 d-----w- c:\programdata\TrueSuite
2010-07-07 02:00:14 0 d-----w- c:\windows\system32\wocaffe
2010-07-07 02:00:14 0 d-----w- c:\program files\TrueSuite
2010-07-07 02:00:08 0 d-----w- c:\programdata\Downloaded Installations
2010-07-07 01:59:59 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ATSwpWDF_01009.Wdf
2010-07-07 01:58:50 797216 ----a-w- c:\windows\system32\nvcplui.exe
2010-07-07 01:58:50 420384 ----a-w- c:\windows\system32\nvcpl.cpl
2010-07-07 01:58:50 1108512 ----a-w- c:\windows\system32\nvcpluir.dll
2010-07-07 01:58:49 453152 ----a-w- c:\windows\system32\nvuninst.exe
2010-07-07 01:53:10 1286456 ----a-w- c:\windows\system32\ntdll.dll
2010-07-07 01:53:09 641536 ----a-w- c:\windows\system32\CPFilters.dll
2010-07-07 01:53:09 417792 ----a-w- c:\windows\system32\msdri.dll
2010-07-07 01:53:09 204288 ----a-w- c:\windows\system32\MSNP.ax
2010-07-07 01:53:09 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2010-07-07 01:45:52 3 ----a-w- c:\windows\7Loader.TAG
2010-07-07 01:41:18 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
2010-07-07 01:41:00 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-07-07 01:31:23 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-07-07 01:31:23 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-07-07 01:31:23 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-07-07 01:31:23 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-07-07 01:31:23 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-07-07 01:27:04 0 d-----w- c:\windows\system32\wbem\Performance
2010-07-07 01:26:42 791434 ----a-w- c:\windows\system32\PerfStringBackup.INI
2010-07-07 01:25:13 0 d-----w- c:\windows\system32\URTTEMP
2010-07-07 01:25:03 0 d-sh--w- c:\windows\Installer
2010-07-07 01:24:11 0 d-sh--w- C:\Recovery

==================== Find3M ====================

2010-07-08 02:31:47 409088 ----a-w- c:\windows\system32\systemcpl.dll
2010-07-08 02:31:47 13824 ----a-w- c:\windows\system32\slwga.dll
2010-07-08 02:31:46 811520 ----a-w- c:\windows\system32\user32.dll
2010-07-07 08:54:30 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-06-09 00:48:27 977920 ----a-w- c:\windows\system32\wininet.dll
2010-06-09 00:48:07 2048 ----a-w- c:\windows\system32\tzres.dll
2010-06-09 00:47:53 427520 ----a-w- c:\windows\system32\vbscript.dll
2010-06-09 00:47:35 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-06-09 00:47:35 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2010-06-09 00:47:19 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-06-09 00:47:19 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-06-09 00:47:18 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-06-09 00:47:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-09 00:47:06 293888 ----a-w- c:\windows\system32\atmfd.dll
2010-06-09 00:46:26 3954568 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-06-09 00:46:26 3899280 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-09 00:46:13 2326528 ----a-w- c:\windows\system32\win32k.sys
2010-06-09 00:46:00 67584 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-09 00:45:48 132608 ----a-w- c:\windows\system32\cabview.dll
2010-06-09 00:45:35 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-06-09 00:45:35 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2010-06-09 00:45:35 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2010-06-09 00:45:35 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-06-09 00:45:34 369152 ----a-w- c:\windows\system32\secproc.dll
2010-06-09 00:45:34 320512 ----a-w- c:\windows\system32\RMActivate.exe
2010-06-09 00:45:33 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2010-06-09 00:45:33 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2010-06-09 00:45:18 172032 ----a-w- c:\windows\system32\wintrust.dll
2010-06-09 00:45:05 740864 ----a-w- c:\windows\system32\inetcomm.dll
2010-06-09 00:44:24 465408 ----a-w- c:\windows\system32\psisdecd.dll
2010-06-09 00:44:08 285696 ----a-w- c:\windows\system32\winlogon.exe
2010-06-09 00:44:08 2614272 ----a-w- c:\windows\explorer.exe
2010-06-09 00:43:39 84992 ----a-w- c:\windows\system32\drivers\sdbus.sys
2010-06-09 00:43:39 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2010-06-09 00:43:11 91648 ----a-w- c:\windows\system32\avifil32.dll
2010-06-09 00:43:11 84480 ----a-w- c:\windows\system32\mciavi32.dll
2010-06-09 00:43:11 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2010-06-09 00:43:11 31744 ----a-w- c:\windows\system32\msvidc32.dll
2010-06-09 00:43:11 22016 ----a-w- c:\windows\system32\msyuv.dll
2010-06-09 00:43:11 13312 ----a-w- c:\windows\system32\msrle32.dll
2010-06-09 00:43:11 1328640 ----a-w- c:\windows\system32\quartz.dll
2010-06-09 00:43:11 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2010-06-09 00:42:57 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys
2010-06-09 00:42:45 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-06-09 00:42:32 34816 ----a-w- c:\windows\system32\msasn1.dll
2010-06-09 00:42:12 507568 ----a-w- c:\windows\system32\winload.exe
2010-06-09 00:42:12 442920 ----a-w- c:\windows\system32\winresume.exe
2010-06-09 00:42:12 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2010-06-09 00:42:11 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2010-06-09 00:42:11 1320960 ----a-w- c:\windows\system32\CertEnroll.dll
2010-06-09 00:41:49 70656 ----a-w- c:\windows\system32\fontsub.dll
2010-06-09 00:41:49 108544 ----a-w- c:\windows\system32\t2embed.dll
2010-06-09 00:41:36 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
2010-06-09 00:41:35 310784 ----a-w- c:\windows\system32\drivers\srv.sys
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 14:34:37.55 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:11:46 PM

Posted 09 August 2010 - 12:49 PM

Welcome to the BleepingComputer Forums.

Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again.
  1. Double click on RSIT.exe to run RSIT.
  2. Click Continue at the disclaimer screen.
  3. Please post the contents of log.txt.
Thank you for your patience.

Please see Preparation Guide for use before posting about your potential Malware problem.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.

Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so.

While we are working on your HijackThis log, please:
  1. Reply to this thread; do not start another!
  2. Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so.
  3. Do not run any other tool until instructed to do so!
  4. Let me know if any of the links do not work or if any of the tools do not work.
  5. Tell me about problems or symptoms that occur during the fix.
  6. Do not run any other programs or open any other windows while doing a fix.
  7. Ask any questions that you have regarding the fix(es), the infection(s), the performance of your computer, etc.
Thanks.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#3 LeJeune

LeJeune
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:46 PM

Posted 09 August 2010 - 04:57 PM

Logfile of random's system information tool 1.08 (written by random/random)
Run by Landon at 2010-08-09 16:54:36
Microsoft Windows 7 Ultimate
System drive C: has 46 GB (61%) free of 76 GB
Total RAM: 1022 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:54:55 PM, on 8/9/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Landon\Downloads\RSIT.exe
C:\Program Files\trend micro\Landon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: Motorola Helper (MotoHelper.exe) - Motorola - C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 4974 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1191086385-334440590-2038039181-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1191086385-334440590-2038039181-1000UA.job
C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
C:\Windows\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-07-07 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-07 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-03-06 92704]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-19 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE /s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamserviceOG]
C:\Program Files\Hercules\Deluxe Optical Glass\XtrCtrl.exe [2010-05-26 2913576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-02 1144104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Landon\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-06 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2009-03-06 13605408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCANINICIO]
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-07-07 202256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-06-24 247144]

C:\Users\Landon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-09 16:52:51 ----D---- C:\rsit
2010-08-05 14:51:37 ----D---- C:\Users\Landon\AppData\Roaming\LimeWire
2010-08-05 14:50:59 ----D---- C:\Program Files\LimeWire
2010-08-01 14:19:00 ----D---- C:\Program Files\Trend Micro
2010-07-26 20:37:49 ----D---- C:\Program Files\IDoser v4
2010-07-22 01:38:49 ----A---- C:\Windows\ntbtlog.txt
2010-07-22 01:30:55 ----D---- C:\Users\Landon\AppData\Roaming\Malwarebytes
2010-07-22 01:30:48 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-07-22 01:30:46 ----D---- C:\ProgramData\Malwarebytes
2010-07-22 01:30:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-07-22 01:30:45 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-07-21 21:12:00 ----D---- C:\Program Files\QuickTime
2010-07-21 21:11:59 ----D---- C:\ProgramData\Apple Computer
2010-07-21 21:10:49 ----D---- C:\Program Files\Common Files\Apple
2010-07-21 21:10:32 ----D---- C:\ProgramData\Apple
2010-07-21 21:10:32 ----D---- C:\Program Files\Apple Software Update
2010-07-21 13:11:20 ----D---- C:\Program Files\Common Files\MSSoap
2010-07-21 13:09:25 ----D---- C:\Program Files\Common Files\Motorola Shared
2010-07-21 13:07:54 ----D---- C:\ProgramData\Motorola
2010-07-21 13:07:42 ----D---- C:\Program Files\Motorola
2010-07-17 00:02:48 ----D---- C:\Users\Landon\AppData\Roaming\vlc
2010-07-16 23:43:37 ----D---- C:\Program Files\Common Files\DivX Shared
2010-07-16 23:41:08 ----D---- C:\Program Files\DivX
2010-07-16 23:40:12 ----D---- C:\ProgramData\DivX
2010-07-16 17:39:08 ----A---- C:\Windows\system32\vsnpstd3.dll
2010-07-16 17:39:07 ----A---- C:\Windows\system32\drivers\snpstd3.sys
2010-07-16 17:39:07 ----A---- C:\Windows\system32\drivers\hxctlflt.sys
2010-07-16 17:39:07 ----A---- C:\Windows\system32\csnpstd3.dll
2010-07-16 17:39:07 ----A---- C:\Windows\snpstd3.ini
2010-07-16 17:38:55 ----A---- C:\Windows\system32\HWLMSET2PS.dll
2010-07-16 17:38:55 ----A---- C:\Windows\system32\HWLMSET2.exe
2010-07-16 17:29:10 ----D---- C:\Program Files\Hercules
2010-07-16 17:28:59 ----D---- C:\Users\Landon\AppData\Roaming\InstallShield
2010-07-15 17:09:16 ----HD---- C:\Program Files\InstallShield Installation Information
2010-07-10 16:12:15 ----D---- C:\Users\Landon\AppData\Roaming\Amazon
2010-07-10 16:11:57 ----D---- C:\Program Files\Amazon

======List of files/folders modified in the last 1 months======

2010-08-09 16:54:39 ----D---- C:\Windows\Temp
2010-08-09 16:53:05 ----D---- C:\Windows\Prefetch
2010-08-09 15:45:51 ----SHD---- C:\System Volume Information
2010-08-09 13:08:57 ----D---- C:\Windows\System32
2010-08-09 13:08:57 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-08 21:30:09 ----D---- C:\Users\Landon\AppData\Roaming\uTorrent
2010-08-08 16:22:19 ----D---- C:\Windows\system32\config
2010-08-05 16:10:59 ----SHD---- C:\$Recycle.Bin
2010-08-05 14:50:59 ----RD---- C:\Program Files
2010-08-02 18:41:46 ----D---- C:\ProgramData\NOS
2010-08-01 15:31:36 ----D---- C:\Windows\inf
2010-08-01 14:19:01 ----SHD---- C:\Windows\Installer
2010-08-01 14:19:01 ----SD---- C:\Users\Landon\AppData\Roaming\Microsoft
2010-07-26 21:05:46 ----D---- C:\Windows\system
2010-07-25 16:17:18 ----D---- C:\Windows\system32\drivers
2010-07-25 16:16:13 ----D---- C:\Windows\system32\drivers\UMDF
2010-07-23 18:03:13 ----D---- C:\Program Files\Mozilla Firefox
2010-07-23 17:28:19 ----D---- C:\Windows
2010-07-23 17:27:23 ----D---- C:\Program Files\Common Files
2010-07-23 16:49:34 ----HD---- C:\ProgramData
2010-07-22 01:42:00 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-07-22 01:33:16 ----D---- C:\Windows\debug
2010-07-21 13:11:39 ----D---- C:\Windows\winsxs
2010-07-21 13:11:20 ----D---- C:\Program Files\Internet Explorer
2010-07-21 13:09:52 ----D---- C:\Windows\system32\DriverStore
2010-07-21 13:09:52 ----D---- C:\Windows\system32\catroot
2010-07-21 13:09:48 ----D---- C:\Windows\system32\catroot2
2010-07-20 18:24:54 ----D---- C:\Windows\system32\drivers\etc
2010-07-16 17:39:49 ----D---- C:\Windows\twain_32
2010-07-15 17:01:35 ----D---- C:\Windows\system32\Tasks
2010-07-15 16:55:45 ----SD---- C:\ProgramData\Microsoft
2010-07-15 16:45:54 ----D---- C:\ProgramData\Real
2010-07-12 00:52:35 ----D---- C:\ProgramData\Adobe
2010-07-12 00:52:11 ----D---- C:\Users\Landon\AppData\Roaming\Adobe
2010-07-11 18:17:59 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-13 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-13 387584]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-13 1035776]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-12-03 625224]
R3 EMSCR;EMSCR; C:\Windows\system32\DRIVERS\EMS7SK.sys [2006-02-16 60928]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-11-05 230912]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-06-08 84992]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD); C:\Windows\system32\DRIVERS\snp2sxp.sys [2006-03-22 10220032]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-13 30720]
S1 ShldDrv;Panda File Shield Driver; C:\Windows\System32\DRIVERS\ShlDrv51.sys []
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-13 8704]
S2 PavProc;Panda Process Protection Driver; \??\C:\Windows\system32\DRIVERS\PavProc.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-13 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-13 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 hxctlflt;hxctlflt; C:\Windows\system32\DRIVERS\hxctlflt.sys [2009-02-09 99968]
S3 motccgp;Motorola USB Composite Device Driver; C:\Windows\system32\DRIVERS\motccgp.sys [2009-06-19 19712]
S3 motccgpfl;MotCcgpFlService; C:\Windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]
S3 MotDev;Motorola Inc. USB Device; C:\Windows\system32\DRIVERS\motodrv.sys [2009-05-08 42752]
S3 motmodem;Motorola USB CDC ACM Driver; C:\Windows\system32\DRIVERS\motmodem.sys [2009-10-27 23936]
S3 MotoSwitchService;MotoSwitch Service; C:\Windows\system32\DRIVERS\motswch.sys [2007-11-02 6400]
S3 motport;Motorola USB Diagnostic Port; C:\Windows\system32\DRIVERS\motport.sys [2009-10-27 23936]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-13 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-13 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-13 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-13 52304]
S3 SNPSTD3;Hercules Deluxe Optical Glass; C:\Windows\system32\DRIVERS\snpstd3.sys [2007-07-17 10371072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-13 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-13 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-13 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-13 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-13 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-13 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-13 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-13 20992]
R2 KMService;KMService; C:\Windows\system32\srvany.exe [2003-04-18 8192]
R2 MotoHelper.exe;Motorola Helper; C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe [2010-04-21 6656]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-03-06 203296]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 PavPrSrv;Panda Process Protection Service; C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-13 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------


#4 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:11:46 PM

Posted 10 August 2010 - 06:47 AM

The item(s) below indicate(s) you have installed .

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

Since the nature of P2P programs are counter productive to restoring your PC to a healthy state, I ask that you remove P2P file sharing programs prior to my providing you with malware removal assistance. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer.

The people who design and distribute malware will use any method to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular method is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known vulnerabilities.
To remove the P2P program:
  1. Click Start > Control Panel.
  2. In Control Panel, double-click Add or Remove Programs.
  3. In Add or Remove Programs, highlight , click Remove.
  4. Close the Add or Remove Programs and the Control Panel windows.
  5. Using Windows Explorer (Windows key+e), search for the folder. If the program folder is still there, select/highlight . DELETE it. (File > Delete.) If Windows is not installed on the C drive, replace C:\ with the appropriate drive letter.
  6. Close Windows Explorer.
There is a Video showing how to uninstall a program (Grinler) detailing how to add or remove program in Windows for those who find a visual aid appealing. NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

I am not asking you to do remove the P2P program(s) without giving you good reasons for doing so.
  1. P2P programs form a direct conduit on to your computer.
  2. P2P security measures are easily circumvented.
  3. Some P2P programs will share everything on the computer with anyone by default. If your P2P program is not configured correctly, you may be sharing more files than you realize.
  4. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.
  5. P2P programs have always been a target of malware writers. There are more Viruses, Worms and Trojans being distributed with the downloaded files.
  6. P2P programs connected to a network can be used to spread malware, share private documents, or use the file server to both store and forward malware.
  7. Many of the files in P2P networks are copyrighted and legal action could result.
  8. Pedophiles can use P2P communities to distribute child porn materials or attempt to make contact with children.
  9. This article from InfoWorld, Seattle Man Arrested For P To P ID Theft, illustrates perfectly the dangers of a poorly configured P2P program.
  10. Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.
  11. When you use them, you are downloading software from an unknown source directly onto your computer bypassing your Firewall and Anti-Virus software. Many of these Downloads are being targeted to carry infections.

References for the risk of these programs are:If you continue to use P2P programs, you will probably get infected again.

Please uninstall all P2P programs and post a new HijackThis log.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#5 LeJeune

LeJeune
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:46 PM

Posted 10 August 2010 - 12:09 PM

Logfile of random's system information tool 1.08 (written by random/random)
Run by Landon at 2010-08-10 12:03:11
Microsoft Windows 7 Ultimate
System drive C: has 46 GB (61%) free of 76 GB
Total RAM: 1022 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:03:33 PM, on 8/10/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskhost.exe
C:\Users\Landon\AppData\Local\Google\Update\1.2.183.29\GoogleCrashHandler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Landon\Downloads\RSIT.exe
C:\Program Files\trend micro\Landon.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: Motorola Helper (MotoHelper.exe) - Motorola - C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 4900 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1191086385-334440590-2038039181-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1191086385-334440590-2038039181-1000UA.job
C:\Windows\tasks\Spybot - Search & Destroy - Scheduled Task.job
C:\Windows\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2010-07-07 341600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-07-07 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-03-06 92704]
""= []
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-19 35760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\APVXDWIN.EXE /s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamserviceOG]
C:\Program Files\Hercules\Deluxe Optical Glass\XtrCtrl.exe [2010-05-26 2913576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-06-02 1144104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Landon\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-06 136176]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2009-03-06 13605408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCANINICIO]
C:\Program Files\Panda Security\Panda Antivirus Pro 2010\Inicio.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-07-07 202256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [2010-06-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-08-09 16:52:51 ----D---- C:\rsit
2010-08-05 14:50:59 ----D---- C:\Program Files\LimeWire
2010-08-01 14:19:00 ----D---- C:\Program Files\Trend Micro
2010-07-26 20:37:49 ----D---- C:\Program Files\IDoser v4
2010-07-22 01:38:49 ----A---- C:\Windows\ntbtlog.txt
2010-07-22 01:30:55 ----D---- C:\Users\Landon\AppData\Roaming\Malwarebytes
2010-07-22 01:30:48 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2010-07-22 01:30:46 ----D---- C:\ProgramData\Malwarebytes
2010-07-22 01:30:45 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-07-22 01:30:45 ----A---- C:\Windows\system32\drivers\mbam.sys
2010-07-21 21:12:00 ----D---- C:\Program Files\QuickTime
2010-07-21 21:11:59 ----D---- C:\ProgramData\Apple Computer
2010-07-21 21:10:49 ----D---- C:\Program Files\Common Files\Apple
2010-07-21 21:10:32 ----D---- C:\ProgramData\Apple
2010-07-21 21:10:32 ----D---- C:\Program Files\Apple Software Update
2010-07-21 13:11:20 ----D---- C:\Program Files\Common Files\MSSoap
2010-07-21 13:09:25 ----D---- C:\Program Files\Common Files\Motorola Shared
2010-07-21 13:07:54 ----D---- C:\ProgramData\Motorola
2010-07-21 13:07:42 ----D---- C:\Program Files\Motorola
2010-07-17 00:02:48 ----D---- C:\Users\Landon\AppData\Roaming\vlc
2010-07-16 23:43:37 ----D---- C:\Program Files\Common Files\DivX Shared
2010-07-16 23:41:08 ----D---- C:\Program Files\DivX
2010-07-16 23:40:12 ----D---- C:\ProgramData\DivX
2010-07-16 17:39:08 ----A---- C:\Windows\system32\vsnpstd3.dll
2010-07-16 17:39:07 ----A---- C:\Windows\system32\drivers\snpstd3.sys
2010-07-16 17:39:07 ----A---- C:\Windows\system32\drivers\hxctlflt.sys
2010-07-16 17:39:07 ----A---- C:\Windows\system32\csnpstd3.dll
2010-07-16 17:39:07 ----A---- C:\Windows\snpstd3.ini
2010-07-16 17:38:55 ----A---- C:\Windows\system32\HWLMSET2PS.dll
2010-07-16 17:38:55 ----A---- C:\Windows\system32\HWLMSET2.exe
2010-07-16 17:29:10 ----D---- C:\Program Files\Hercules
2010-07-16 17:28:59 ----D---- C:\Users\Landon\AppData\Roaming\InstallShield
2010-07-15 17:09:16 ----HD---- C:\Program Files\InstallShield Installation Information

======List of files/folders modified in the last 1 months======

2010-08-10 12:03:15 ----D---- C:\Windows\Temp
2010-08-10 12:00:00 ----D---- C:\Windows\Prefetch
2010-08-10 11:55:27 ----D---- C:\Windows\system32\drivers\etc
2010-08-10 11:54:23 ----D---- C:\Windows\System32
2010-08-10 11:54:23 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-08-09 19:04:29 ----D---- C:\Windows\system32\config
2010-08-09 15:45:51 ----SHD---- C:\System Volume Information
2010-08-08 21:30:09 ----D---- C:\Users\Landon\AppData\Roaming\uTorrent
2010-08-05 16:10:59 ----SHD---- C:\$Recycle.Bin
2010-08-05 14:50:59 ----RD---- C:\Program Files
2010-08-02 18:41:46 ----D---- C:\ProgramData\NOS
2010-08-01 15:31:36 ----D---- C:\Windows\inf
2010-08-01 14:19:01 ----SHD---- C:\Windows\Installer
2010-08-01 14:19:01 ----SD---- C:\Users\Landon\AppData\Roaming\Microsoft
2010-07-26 21:05:46 ----D---- C:\Windows\system
2010-07-25 16:17:18 ----D---- C:\Windows\system32\drivers
2010-07-25 16:16:13 ----D---- C:\Windows\system32\drivers\UMDF
2010-07-23 18:03:13 ----D---- C:\Program Files\Mozilla Firefox
2010-07-23 17:28:19 ----D---- C:\Windows
2010-07-23 17:27:23 ----D---- C:\Program Files\Common Files
2010-07-23 16:49:34 ----HD---- C:\ProgramData
2010-07-22 01:42:00 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-07-22 01:33:16 ----D---- C:\Windows\debug
2010-07-21 13:11:39 ----D---- C:\Windows\winsxs
2010-07-21 13:11:20 ----D---- C:\Program Files\Internet Explorer
2010-07-21 13:09:52 ----D---- C:\Windows\system32\DriverStore
2010-07-21 13:09:52 ----D---- C:\Windows\system32\catroot
2010-07-21 13:09:48 ----D---- C:\Windows\system32\catroot2
2010-07-16 17:39:49 ----D---- C:\Windows\twain_32
2010-07-15 17:01:35 ----D---- C:\Windows\system32\Tasks
2010-07-15 16:55:45 ----SD---- C:\ProgramData\Microsoft
2010-07-15 16:45:54 ----D---- C:\ProgramData\Real
2010-07-12 00:52:35 ----D---- C:\ProgramData\Adobe
2010-07-12 00:52:11 ----D---- C:\Users\Landon\AppData\Roaming\Adobe
2010-07-11 18:17:59 ----D---- C:\Windows\system32\wdi

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-13 173648]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-13 387584]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2009-07-13 1035776]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver; C:\Windows\System32\Drivers\ATSwpWDF.sys [2009-12-03 625224]
R3 EMSCR;EMSCR; C:\Windows\system32\DRIVERS\EMS7SK.sys [2006-02-16 60928]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-11-05 230912]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-06-08 84992]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD); C:\Windows\system32\DRIVERS\snp2sxp.sys [2006-03-22 10220032]
R3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-13 30720]
S1 ShldDrv;Panda File Shield Driver; C:\Windows\System32\DRIVERS\ShlDrv51.sys []
S2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-13 8704]
S2 PavProc;Panda Process Protection Driver; \??\C:\Windows\system32\DRIVERS\PavProc.sys []
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-13 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\DRIVERS\amdagp.sys [2009-07-13 53312]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 hxctlflt;hxctlflt; C:\Windows\system32\DRIVERS\hxctlflt.sys [2009-02-09 99968]
S3 motccgp;Motorola USB Composite Device Driver; C:\Windows\system32\DRIVERS\motccgp.sys [2009-06-19 19712]
S3 motccgpfl;MotCcgpFlService; C:\Windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 8320]
S3 MotDev;Motorola Inc. USB Device; C:\Windows\system32\DRIVERS\motodrv.sys [2009-05-08 42752]
S3 motmodem;Motorola USB CDC ACM Driver; C:\Windows\system32\DRIVERS\motmodem.sys [2009-10-27 23936]
S3 MotoSwitchService;MotoSwitch Service; C:\Windows\system32\DRIVERS\motswch.sys [2007-11-02 6400]
S3 motport;Motorola USB Diagnostic Port; C:\Windows\system32\DRIVERS\motport.sys [2009-10-27 23936]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-13 12368]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-13 133120]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-13 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\DRIVERS\sisagp.sys [2009-07-13 52304]
S3 SNPSTD3;Hercules Deluxe Optical Glass; C:\Windows\system32\DRIVERS\snpstd3.sys [2007-07-17 10371072]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-13 28224]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-13 35840]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\DRIVERS\viaagp.sys [2009-07-13 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-13 52736]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-13 175824]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-13 17920]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2009-07-13 34944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-13 20992]
R2 KMService;KMService; C:\Windows\system32\srvany.exe [2003-04-18 8192]
R2 MotoHelper.exe;Motorola Helper; C:\Program Files\Motorola\Moto Helper Service\MotoHelper.exe [2010-04-21 6656]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-03-06 203296]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 TomTomHOMEService;TomTomHOMEService; C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 PavPrSrv;Panda Process Protection Service; C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe []
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-13 20992]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2010-03-18 35160]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-13 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-08 1343400]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------




As far as limewire goes I had all of the sharing folders and what not set up correctly to not allow access to the other more important files on my comp. I had the permissions and what not set up to not allow any of that. I had dloaded it a few weeks ago for one thing I was looking for but i have ony run it once i think and havent dloaded anything from it I think I may have just used if for a search. I removed it though and was planning on doing so anyway I just hadnt gotten around to it yet. The main thing that is going on with the computer that its doing is when I have a browser open it randomly redirects to videocop.com and the other computers in the house are doing this as well so I fear that the problem may be a network jumper. Anyway I hope this info may help you a bit.

#6 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:11:46 PM

Posted 10 August 2010 - 02:28 PM

Step 1

Often redirection is caused by a DNS and Hosts file hijack. Flush and restore both.

Clean Hosts File
    * Access folder C:\WINDOWS\SYSTEM32\DRIVERS\ETC in Explorer.
  1. Open file HOSTS in Notepad . Before making changes, do a Save As and save a backup of this file as HOSTS.BAK .
  2. Reopen the HOSTS file.
  3. Delete all entries in this file except for the following and any other entries you are sure have legitimate uses:

    127.0.0.1 localhost
  4. Save the file.
Note: If you use customized Hosts Files such as the mvps hosts file, you will need to download and install it again. Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE.

Step 2

Flush DNS:
  1. Open up a command prompt Start > Run > "cmd.exe" > OK.
  2. Type in the command ipconfig /flushdns.
Step 3

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • If TDSSKiller does not run, try renaming it.
  • To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  • Click the Start Scan button.
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.
Please post a new HijackThis log.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#7 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:11:46 PM

Posted 21 August 2010 - 10:18 AM

This subject is now closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.

You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users