Tech Support Forum - View Single Post - Google Hijacked by virus....browser shuts down

dcogent1 · 11-16-2008, 10:41 AM

ok, finally....I had bit torrent but removed it as was a requirement before asking for help in this forum...Any how a couple of wierd things happend...I didnt do the steps in the order they were posted, hope that wasnt the reason...first I did java(uninstall, deleted files), then I ran the combo fix (dragging and dropping the coppied txt in the body of your last response)...it got funny at this point because combo fix didnt restart my cpu....it still generated a report which I saved ( I also submitted the file as asked, to bleeping computer website).....after that I just had my desktop backround showing with no desktop icons, start menu, or anything else except my mouse pointer....the whole screen was just my backround....I left it like that thinking that it would eventually restart but nothing, so I manually restarted it and the ran AFT...Kaspersky did not save to my computer, it just saved and scanned from the internet...once it was finished it found no infected files, however i saved the report even though there was nothing in it....I hope I didnt do anything wrong....here are the two logs....I have a busy one today so I won't be back until later this evening(PST) .....thanks for all your help and patience so far, I know it takes alot......you guys rock, big time!!!

ComboFix 08-11-14.01 - Josh 2008-11-16 1:12:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.5 [GMT -8:00]
Running from: c:\documents and settings\Josh\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Josh\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\Tasks\AECA9864913D0938.job
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\Schedule Task Weekly.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\josh\Applic~1\inside~1
c:\docume~1\josh\Applic~1\inside~1\995D53A2
c:\windows\Tasks\AECA9864913D0938.job
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
c:\windows\Tasks\Schedule Task Weekly.job

.
((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2008-11-16 00:46 . 2008-11-16 00:32 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-16 00:46 . 2008-11-16 00:32 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-16 00:29 . 2008-11-16 00:29 <DIR> d-------- c:\program files\Java
2008-11-15 23:33 . 2008-11-16 00:02 <DIR> d-------- c:\windows\LastGood
2008-11-15 18:13 . 2008-11-15 18:13 <DIR> d-------- c:\program files\Avira
2008-11-15 18:13 . 2008-11-15 18:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-14 16:23 . 2008-11-14 16:39 250 --a------ c:\windows\gmer.ini
2008-11-14 05:23 . 2008-11-14 09:48 <DIR> d-------- c:\documents and settings\Josh\Application Data\Spyware Terminator
2008-11-14 05:23 . 2008-11-14 05:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-14 05:23 . 2008-11-14 07:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator
2008-11-14 05:23 . 2008-11-14 05:23 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys
2008-11-14 05:22 . 2008-11-14 07:15 <DIR> d-------- c:\program files\Spyware Terminator
2008-11-14 05:21 . 2008-11-14 05:22 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-14 05:21 . 2008-11-14 05:21 <DIR> d-------- c:\documents and settings\Josh\Application Data\SUPERAntiSpyware.com
2008-11-14 05:19 . 2008-11-14 05:19 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-13 03:56 . 2008-09-04 09:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 03:55 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\scripting
2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\en
2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\bits
2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\l2schemas
2008-11-02 19:21 . 2008-11-02 19:24 <DIR> d-------- c:\windows\ServicePackFiles
2008-11-02 19:00 . 2008-11-02 19:00 <DIR> d-------- c:\windows\EHome
2008-11-02 13:08 . 2008-10-03 09:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2008-11-02 13:08 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2008-11-02 13:08 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2008-11-02 13:08 . 2008-08-25 23:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2008-11-02 13:08 . 2008-08-25 23:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2008-11-02 13:08 . 2008-08-25 23:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2008-11-02 13:08 . 2008-08-25 23:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2008-11-02 13:08 . 2008-08-25 23:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2008-11-02 13:08 . 2008-08-25 00:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2008-11-02 11:03 . 2008-11-02 11:03 <DIR> d-------- c:\program files\Alwil Software
2008-11-02 11:03 . 2003-03-18 13:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2008-11-02 08:54 . 2004-08-04 04:00 999 -----c--- c:\windows\system32\dllcache\bktrh.gif
2008-11-02 08:12 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-11-02 08:12 . 2008-06-13 03:05 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-11-02 08:12 . 2008-06-13 03:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-02 08:12 . 2008-08-14 02:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys
2008-11-02 08:11 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-02 08:11 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-02 08:11 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-11-02 08:11 . 2008-04-11 11:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-11-02 08:11 . 2008-05-08 06:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-11-02 08:10 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-02 08:10 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-02 08:07 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-14 23:27 --------- d-----w c:\program files\BitTorrent
2008-11-14 23:26 --------- d-----w c:\program files\VstPlugins
2008-11-14 23:26 --------- d-----w c:\program files\Image-Line
2008-11-14 16:30 --------- d-----w c:\program files\Google
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 -c--a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2008-11-15_23.10.22.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-04-29 07:04:40 917,504 ----a-r c:\windows\LastGood\system\cmids3d.dll
+ 2001-11-23 04:08:20 712,704 ----a-r c:\windows\LastGood\system32\a3d.dll
+ 2001-11-23 04:08:20 712,704 ----a-r c:\windows\LastGood\system32\Audio3D.dll
+ 2002-11-02 04:08:20 53,248 ----a-r c:\windows\LastGood\system32\cmuda.dll
+ 2002-11-01 09:11:20 451,599 ----a-r c:\windows\LastGood\system32\drivers\cmuda.sys
+ 2008-04-13 18:45:14 60,160 ----a-w c:\windows\LastGood\system32\drivers\drmk.sys
+ 2008-04-13 19:16:36 141,056 ----a-w c:\windows\LastGood\system32\drivers\ks.sys
+ 2008-04-13 19:19:41 146,048 ----a-w c:\windows\LastGood\system32\drivers\portcls.sys
+ 2008-04-13 18:45:15 49,408 ----a-w c:\windows\LastGood\system32\drivers\stream.sys
+ 2008-04-14 00:11:56 4,096 ----a-w c:\windows\LastGood\system32\ksuser.dll
+ 2002-08-13 10:42:24 28,672 ----a-r c:\windows\LastGood\system32\udaprop.dll
+ 2008-04-14 00:12:45 23,552 ----a-w c:\windows\LastGood\system32\wdmaud.drv
- 2002-04-29 07:04:40 917,504 ----a-r c:\windows\system\cmids3d.dll
+ 2002-04-30 06:04:40 917,504 ----a-w c:\windows\system\cmids3d.dll
+ 2004-02-18 01:51:56 1,458,176 ----a-w c:\windows\system\SmWizard.exe
- 2001-11-23 04:08:20 712,704 -c--a-r c:\windows\system32\a3d.dll
+ 2001-11-24 03:08:20 712,704 ----a-w c:\windows\system32\a3d.dll
- 2001-11-23 04:08:20 712,704 -c--a-r c:\windows\system32\Audio3D.dll
+ 2001-11-24 03:08:20 712,704 ----a-w c:\windows\system32\Audio3D.dll
+ 2003-02-19 09:26:28 28,672 ----a-w c:\windows\system32\cmirmdrv.dll
+ 2004-04-24 06:02:10 233,472 ----a-w c:\windows\system32\cmirmdrv.exe
- 2002-11-02 04:08:20 53,248 ----a-r c:\windows\system32\cmuda.dll
+ 2006-06-16 09:03:48 172,032 ----a-w c:\windows\system32\cmuda.dll
- 2001-11-23 04:08:20 712,704 -c--a-w c:\windows\system32\dllcache\a3d.dll
+ 2001-11-24 03:08:20 712,704 -c--a-w c:\windows\system32\dllcache\a3d.dll
+ 2008-04-13 18:45:14 60,160 -c--a-w c:\windows\system32\dllcache\drmk.sys
+ 2008-04-13 19:16:36 141,056 -c--a-w c:\windows\system32\dllcache\ks.sys
+ 2008-04-14 00:11:56 4,096 -c--a-w c:\windows\system32\dllcache\ksuser.dll
+ 2008-04-13 19:19:42 146,048 -c--a-w c:\windows\system32\dllcache\portcls.sys
+ 2008-04-13 18:45:16 49,408 -c--a-w c:\windows\system32\dllcache\stream.sys
- 2002-11-01 09:11:20 451,599 ----a-r c:\windows\system32\drivers\cmuda.sys
+ 2006-06-10 06:58:22 1,373,120 ----a-w c:\windows\system32\drivers\cmuda.sys
- 2008-04-13 19:19:41 146,048 ----a-w c:\windows\system32\drivers\portcls.sys
+ 2008-04-13 19:19:42 146,048 ----a-w c:\windows\system32\drivers\portcls.sys
- 2008-04-13 18:45:15 49,408 ----a-w c:\windows\system32\drivers\stream.sys
+ 2008-04-13 18:45:16 49,408 ----a-w c:\windows\system32\drivers\stream.sys
- 2005-04-13 09:19:56 49,248 -c--a-w c:\windows\system32\java.exe
+ 2008-11-16 08:32:37 144,792 ----a-w c:\windows\system32\java.exe
- 2005-04-13 09:20:04 49,250 -c--a-w c:\windows\system32\javaw.exe
+ 2008-11-16 08:32:38 144,792 ----a-w c:\windows\system32\javaw.exe
- 2005-04-13 10:48:54 127,078 -c--a-w c:\windows\system32\javaws.exe
+ 2008-11-16 08:32:38 148,888 ----a-w c:\windows\system32\javaws.exe
- 2007-10-11 22:12:48 1,468,968 ----a-w c:\windows\system32\LegitCheckControl.DLL
+ 2008-03-21 02

36 1,480,232 ----a-w c:\windows\system32\LegitCheckControl.dll
+ 2001-11-23 04:08:20 712,704 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\Audio3D.dll
+ 2002-04-29 07:04:40 917,504 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmids3d.dll
+ 2002-11-02 04:08:20 53,248 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmuda.dll
+ 2002-11-01 09:11:20 451,599 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmuda.sys
+ 2008-04-13 18:45:14 60,160 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\drmk.sys
+ 2008-04-13 19:16:36 141,056 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ks.sys
+ 2008-04-14 00:11:56 4,096 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll
+ 2008-04-13 19:19:41 146,048 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\portcls.sys
+ 2008-04-13 18:45:15 49,408 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\stream.sys
+ 2008-04-14 00:12:45 23,552 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\wdmaud.drv
+ 2002-08-13 10:42:24 28,672 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\udaprop.dll
- 2002-08-13 10:42:24 28,672 ----a-r c:\windows\system32\udaprop.dll
+ 2003-04-25 04:29:08 32,768 ----a-w c:\windows\system32\udaprop.dll
+ 2008-11-16 08:46:47 16,384 ----atw c:\windows\temp\Perflib_Perfdata_a18.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-13 169984]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-16 136600]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"= xgusb.cpl
"midi2"= xgusb.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2002-04-04 12:03 188416 c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]
--a------ 2002-04-04 12:01 335872 c:\windows\system32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD04]
--a------ 2002-04-04 12:04 49152 c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTpatch]
-ra------ 2002-10-30 01:40 28672 c:\windows\htpatch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig]
--a------ 2008-04-13 16:12 169984 c:\windows\pchealth\helpctr\binaries\msconfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
--a------ 2002-04-11 03:19 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSUSBRG]
--a------ 2002-07-12 02:15 106496 c:\windows\SiSUSBrg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
--a------ 2008-11-14 05:23 1783808 c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-09-03 14:07 1576176 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-05-10 23:15 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE]
--a------ 2002-06-04 22:17 167936 c:\windows\system32\pctspk.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-14 141312]

*Newly Created Service* - JAVAQUICKSTARTERSERVICE
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 01:17:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-16 1:21:24
ComboFix-quarantined-files.txt 2008-11-16 09:21:19
ComboFix2.txt 2008-11-16 07:11:42

Pre-Run: 29,264,760,832 bytes free
Post-Run: 29,286,543,360 bytes free

263 --- E O F --- 2008-11-14 05:27:28

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, November 16, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, November 16, 2008 13:43:47
Records in database: 1387799
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 35387
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:13:29

No malware has been detected. The scan area is clean.

The selected area was scanned.

11-16-2008, 10:41 AM	#8 (permalink)
dcogent1 Registered User Join Date: Nov 2008 Posts: 10 OS: windows xp 2000	Re: Google Hijacked by virus....browser shuts down ok, finally....I had bit torrent but removed it as was a requirement before asking for help in this forum...Any how a couple of wierd things happend...I didnt do the steps in the order they were posted, hope that wasnt the reason...first I did java(uninstall, deleted files), then I ran the combo fix (dragging and dropping the coppied txt in the body of your last response)...it got funny at this point because combo fix didnt restart my cpu....it still generated a report which I saved ( I also submitted the file as asked, to bleeping computer website).....after that I just had my desktop backround showing with no desktop icons, start menu, or anything else except my mouse pointer....the whole screen was just my backround....I left it like that thinking that it would eventually restart but nothing, so I manually restarted it and the ran AFT...Kaspersky did not save to my computer, it just saved and scanned from the internet...once it was finished it found no infected files, however i saved the report even though there was nothing in it....I hope I didnt do anything wrong....here are the two logs....I have a busy one today so I won't be back until later this evening(PST) .....thanks for all your help and patience so far, I know it takes alot......you guys rock, big time!!! ComboFix 08-11-14.01 - Josh 2008-11-16 1:12:08.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.5 [GMT -8:00] Running from: c:\documents and settings\Josh\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Josh\Desktop\CFScript.txt * Created a new restore point FILE :: c:\windows\Tasks\AECA9864913D0938.job c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job c:\windows\Tasks\Schedule Task Weekly.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\josh\Applic~1\inside~1 c:\docume~1\josh\Applic~1\inside~1\995D53A2 c:\windows\Tasks\AECA9864913D0938.job c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job c:\windows\Tasks\Schedule Task Weekly.job . ((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 ))))))))))))))))))))))))))))))) . 2008-11-16 00:46 . 2008-11-16 00:32 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-16 00:46 . 2008-11-16 00:32 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-16 00:29 . 2008-11-16 00:29 <DIR> d-------- c:\program files\Java 2008-11-15 23:33 . 2008-11-16 00:02 <DIR> d-------- c:\windows\LastGood 2008-11-15 18:13 . 2008-11-15 18:13 <DIR> d-------- c:\program files\Avira 2008-11-15 18:13 . 2008-11-15 18:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira 2008-11-14 16:23 . 2008-11-14 16:39 250 --a------ c:\windows\gmer.ini 2008-11-14 05:23 . 2008-11-14 09:48 <DIR> d-------- c:\documents and settings\Josh\Application Data\Spyware Terminator 2008-11-14 05:23 . 2008-11-14 05:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-14 05:23 . 2008-11-14 07:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spyware Terminator 2008-11-14 05:23 . 2008-11-14 05:23 141,312 --a------ c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-14 05:22 . 2008-11-14 07:15 <DIR> d-------- c:\program files\Spyware Terminator 2008-11-14 05:21 . 2008-11-14 05:22 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-14 05:21 . 2008-11-14 05:21 <DIR> d-------- c:\documents and settings\Josh\Application Data\SUPERAntiSpyware.com 2008-11-14 05:19 . 2008-11-14 05:19 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-13 03:56 . 2008-09-04 09:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-13 03:55 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\scripting 2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\en 2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\system32\bits 2008-11-02 19:24 . 2008-11-02 19:24 <DIR> d-------- c:\windows\l2schemas 2008-11-02 19:21 . 2008-11-02 19:24 <DIR> d-------- c:\windows\ServicePackFiles 2008-11-02 19:00 . 2008-11-02 19:00 <DIR> d-------- c:\windows\EHome 2008-11-02 13:08 . 2008-10-03 09:41 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-11-02 13:08 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-11-02 13:08 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-11-02 13:08 . 2008-08-25 23:24 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-11-02 13:08 . 2008-08-25 23:24 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-11-02 13:08 . 2008-08-25 23:24 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-11-02 13:08 . 2008-08-25 23:24 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-11-02 13:08 . 2008-08-25 23:24 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-11-02 13:08 . 2008-08-25 00:38 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-11-02 11:03 . 2008-11-02 11:03 <DIR> d-------- c:\program files\Alwil Software 2008-11-02 11:03 . 2003-03-18 13:20 1,060,864 --a------ c:\windows\system32\MFC71.dll 2008-11-02 08:54 . 2004-08-04 04:00 999 -----c--- c:\windows\system32\dllcache\bktrh.gif 2008-11-02 08:12 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-11-02 08:12 . 2008-06-13 03:05 272,128 --------- c:\windows\system32\drivers\bthport.sys 2008-11-02 08:12 . 2008-06-13 03:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-11-02 08:12 . 2008-08-14 02:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys 2008-11-02 08:11 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-02 08:11 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-02 08:11 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-11-02 08:11 . 2008-04-11 11:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll 2008-11-02 08:11 . 2008-05-08 06:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys 2008-11-02 08:10 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-02 08:10 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-02 08:07 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-14 23:27 --------- d-----w c:\program files\BitTorrent 2008-11-14 23:26 --------- d-----w c:\program files\VstPlugins 2008-11-14 23:26 --------- d-----w c:\program files\Image-Line 2008-11-14 16:30 --------- d-----w c:\program files\Google 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 43,544 -c--a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll . ((((((((((((((((((((((((((((( snapshot@2008-11-15_23.10.22.54 ))))))))))))))))))))))))))))))))))))))))) . + 2002-04-29 07:04:40 917,504 ----a-r c:\windows\LastGood\system\cmids3d.dll + 2001-11-23 04:08:20 712,704 ----a-r c:\windows\LastGood\system32\a3d.dll + 2001-11-23 04:08:20 712,704 ----a-r c:\windows\LastGood\system32\Audio3D.dll + 2002-11-02 04:08:20 53,248 ----a-r c:\windows\LastGood\system32\cmuda.dll + 2002-11-01 09:11:20 451,599 ----a-r c:\windows\LastGood\system32\drivers\cmuda.sys + 2008-04-13 18:45:14 60,160 ----a-w c:\windows\LastGood\system32\drivers\drmk.sys + 2008-04-13 19:16:36 141,056 ----a-w c:\windows\LastGood\system32\drivers\ks.sys + 2008-04-13 19:19:41 146,048 ----a-w c:\windows\LastGood\system32\drivers\portcls.sys + 2008-04-13 18:45:15 49,408 ----a-w c:\windows\LastGood\system32\drivers\stream.sys + 2008-04-14 00:11:56 4,096 ----a-w c:\windows\LastGood\system32\ksuser.dll + 2002-08-13 10:42:24 28,672 ----a-r c:\windows\LastGood\system32\udaprop.dll + 2008-04-14 00:12:45 23,552 ----a-w c:\windows\LastGood\system32\wdmaud.drv - 2002-04-29 07:04:40 917,504 ----a-r c:\windows\system\cmids3d.dll + 2002-04-30 06:04:40 917,504 ----a-w c:\windows\system\cmids3d.dll + 2004-02-18 01:51:56 1,458,176 ----a-w c:\windows\system\SmWizard.exe - 2001-11-23 04:08:20 712,704 -c--a-r c:\windows\system32\a3d.dll + 2001-11-24 03:08:20 712,704 ----a-w c:\windows\system32\a3d.dll - 2001-11-23 04:08:20 712,704 -c--a-r c:\windows\system32\Audio3D.dll + 2001-11-24 03:08:20 712,704 ----a-w c:\windows\system32\Audio3D.dll + 2003-02-19 09:26:28 28,672 ----a-w c:\windows\system32\cmirmdrv.dll + 2004-04-24 06:02:10 233,472 ----a-w c:\windows\system32\cmirmdrv.exe - 2002-11-02 04:08:20 53,248 ----a-r c:\windows\system32\cmuda.dll + 2006-06-16 09:03:48 172,032 ----a-w c:\windows\system32\cmuda.dll - 2001-11-23 04:08:20 712,704 -c--a-w c:\windows\system32\dllcache\a3d.dll + 2001-11-24 03:08:20 712,704 -c--a-w c:\windows\system32\dllcache\a3d.dll + 2008-04-13 18:45:14 60,160 -c--a-w c:\windows\system32\dllcache\drmk.sys + 2008-04-13 19:16:36 141,056 -c--a-w c:\windows\system32\dllcache\ks.sys + 2008-04-14 00:11:56 4,096 -c--a-w c:\windows\system32\dllcache\ksuser.dll + 2008-04-13 19:19:42 146,048 -c--a-w c:\windows\system32\dllcache\portcls.sys + 2008-04-13 18:45:16 49,408 -c--a-w c:\windows\system32\dllcache\stream.sys - 2002-11-01 09:11:20 451,599 ----a-r c:\windows\system32\drivers\cmuda.sys + 2006-06-10 06:58:22 1,373,120 ----a-w c:\windows\system32\drivers\cmuda.sys - 2008-04-13 19:19:41 146,048 ----a-w c:\windows\system32\drivers\portcls.sys + 2008-04-13 19:19:42 146,048 ----a-w c:\windows\system32\drivers\portcls.sys - 2008-04-13 18:45:15 49,408 ----a-w c:\windows\system32\drivers\stream.sys + 2008-04-13 18:45:16 49,408 ----a-w c:\windows\system32\drivers\stream.sys - 2005-04-13 09:19:56 49,248 -c--a-w c:\windows\system32\java.exe + 2008-11-16 08:32:37 144,792 ----a-w c:\windows\system32\java.exe - 2005-04-13 09:20:04 49,250 -c--a-w c:\windows\system32\javaw.exe + 2008-11-16 08:32:38 144,792 ----a-w c:\windows\system32\javaw.exe - 2005-04-13 10:48:54 127,078 -c--a-w c:\windows\system32\javaws.exe + 2008-11-16 08:32:38 148,888 ----a-w c:\windows\system32\javaws.exe - 2007-10-11 22:12:48 1,468,968 ----a-w c:\windows\system32\LegitCheckControl.DLL + 2008-03-21 0236 1,480,232 ----a-w c:\windows\system32\LegitCheckControl.dll + 2001-11-23 04:08:20 712,704 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\Audio3D.dll + 2002-04-29 07:04:40 917,504 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmids3d.dll + 2002-11-02 04:08:20 53,248 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmuda.dll + 2002-11-01 09:11:20 451,599 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\cmuda.sys + 2008-04-13 18:45:14 60,160 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\drmk.sys + 2008-04-13 19:16:36 141,056 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ks.sys + 2008-04-14 00:11:56 4,096 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll + 2008-04-13 19:19:41 146,048 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\portcls.sys + 2008-04-13 18:45:15 49,408 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\stream.sys + 2008-04-14 00:12:45 23,552 ----a-w c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\wdmaud.drv + 2002-08-13 10:42:24 28,672 ----a-r c:\windows\system32\ReinstallBackups\0002\DriverFiles\udaprop.dll - 2002-08-13 10:42:24 28,672 ----a-r c:\windows\system32\udaprop.dll + 2003-04-25 04:29:08 32,768 ----a-w c:\windows\system32\udaprop.dll + 2008-11-16 08:46:47 16,384 ----atw c:\windows\temp\Perflib_Perfdata_a18.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-13 169984] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-16 136600] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "midi1"= xgusb.cpl "midi2"= xgusb.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2002-04-04 12:03 188416 c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04] --a------ 2002-04-04 12:01 335872 c:\windows\system32\hphmon04.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD04] --a------ 2002-04-04 12:04 49152 c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTpatch] -ra------ 2002-10-30 01:40 28672 c:\windows\htpatch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSConfig] --a------ 2008-04-13 16:12 169984 c:\windows\pchealth\helpctr\binaries\msconfig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] --a------ 2002-04-11 03:19 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSUSBRG] --a------ 2002-07-12 02:15 106496 c:\windows\SiSUSBrg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator] --a------ 2008-11-14 05:23 1783808 c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] --a------ 2008-09-03 14:07 1576176 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-05-10 23:15 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTVOICE] --a------ 2002-06-04 22:17 167936 c:\windows\system32\pctspk.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-14 141312] Newly Created Service - JAVAQUICKSTARTERSERVICE . - - - - ORPHANS REMOVED - - - - HKLM-Run-Cmaudio - cmicnfg.cpl ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-16 01:17:51 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-11-16 1:21:24 ComboFix-quarantined-files.txt 2008-11-16 09:21:19 ComboFix2.txt 2008-11-16 07:11:42 Pre-Run: 29,264,760,832 bytes free Post-Run: 29,286,543,360 bytes free 263 --- E O F --- 2008-11-14 05:27:28 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, November 16, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, November 16, 2008 13:43:47 Records in database: 1387799 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 35387 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:13:29 No malware has been detected. The scan area is clean. The selected area was scanned.