|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
06-29-2008, 02:49 PM
|
#1 (permalink) |
|
Registered User
Join Date: Feb 2006
Posts: 156
OS: Win XP
|
Some sites/addresses blocked
Firts description - some sites/addresses are somehow "blocked". For example, when I enter google, type anything and press search, it starts loading but never loads anything. It just keeps loading. Same goes with few more site/addresses, for example gmail.
Another thing - when I download a file via Mozilla 3 download manager and double click on a downloaded file, it does not run as it should, instead I receive a dialog window that asks me to choose a program to run that file (even in case of .exe files). I bellieve that's all. Obviously I've caught something. In task manager I can see rundll32.exe processes. In Hijack I can see some suspicious entries... I've ran 5 steps, but failed to run panda scan - when installing, my antivirus (Avira) detected W95/Blumblebee.1738 virus :| Here's DSS log: Deckard's System Scanner v20071014.68 Run by JarekCz on 2008-06-29 23:36:10 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 11: 2008-06-29 21:36:14 UTC - RP90 - Deckard's System Scanner Restore Point 10: 2008-06-29 08:44:28 UTC - RP89 - System Checkpoint 9: 2008-06-28 05:09:07 UTC - RP88 - Last known good configuration 8: 2008-06-28 05:09:05 UTC - RP87 - SPTD setup V1.55 7: 2008-06-28 05:09:05 UTC - RP86 - Installed DirectX -- First Restore Point -- 1: 2008-06-28 05:09:04 UTC - RP80 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive D: has 1.38 GiB (less than 15%) free. -- HijackThis (run as JarekCz.exe) --------------------------------------------- Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-29 23:38:01 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: D:\WINDOWS\system32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe D:\OpenSA\Apache2\bin\Apache.exe D:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe D:\OpenSA\Apache2\bin\Apache.exe D:\WINDOWS\explorer.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe D:\Program Files\AutoConnect\AutoConnect.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\DynDNS Updater\DynDNS.exe E:\Download\dss.exe E:\Instalki\*Różne\JarekCz.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - D:\WINDOWS\system32\ddcBTNFV.dll O2 - BHO: (no name) - {A7BFECED-850B-48C5-A099-BEDF116C56AF} - D:\WINDOWS\system32\qoMcyaXR.dll O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [BMe7092d04] Rundll32.exe "D:\WINDOWS\system32\rqmqltej.dll",s O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DynDNS Updater] "D:\Program Files\DynDNS Updater\DynDNS.exe" O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: check-ip-changed.bat O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{C7647385-9D41-44E9-A961-8E914D046F29}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - D:\Program Files\Belarc\Advisor\System\BAVoilaX.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - D:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\Program Files\Common Files\Skype\Skype4COM.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - D:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: ddcBTNFV - D:\WINDOWS\system32\ddcBTNFV.dll O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apache2 - Apache Software Foundation - D:\OpenSA\Apache2\bin\Apache.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 5330 bytes -- HijackThis Fixed Entries (E:\Instalki\RNE~1\backups\) ----------------------- backup-20080629-230932-243 O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - D:\WINDOWS\system32\ddcBTNFV.dll backup-20080629-230932-347 O2 - BHO: (no name) - {A7BFECED-850B-48C5-A099-BEDF116C56AF} - D:\WINDOWS\system32\qoMcyaXR.dll backup-20080629-230933-123 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe backup-20080629-230933-260 O4 - HKLM\..\Run: [BMe7092d04] Rundll32.exe "D:\WINDOWS\system32\rqmqltej.dll",s backup-20080629-230933-447 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe backup-20080629-230933-470 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) backup-20080629-230933-656 O4 - HKLM\..\Run: [a8e5e2b0] rundll32.exe "D:\WINDOWS\system32\mhnuajgb.dll",b backup-20080629-230933-729 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) backup-20080629-230933-771 O20 - Winlogon Notify: ddcBTNFV - D:\WINDOWS\SYSTEM32\ddcBTNFV.dll backup-20080629-231018-244 O4 - HKLM\..\Run: [BMe7092d04] Rundll32.exe "D:\WINDOWS\system32\rqmqltej.dll",s backup-20080629-231018-519 O20 - Winlogon Notify: ddcBTNFV - D:\WINDOWS\SYSTEM32\ddcBTNFV.dll backup-20080629-231018-573 O2 - BHO: (no name) - {A7BFECED-850B-48C5-A099-BEDF116C56AF} - D:\WINDOWS\system32\qoMcyaXR.dll backup-20080629-231018-843 O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - D:\WINDOWS\system32\ddcBTNFV.dll -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BANTExt (Belarc SMBios Access) - d:\windows\system32\drivers\bantext.sys R1 PCLEPCI - d:\windows\system32\drivers\pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI> R3 ASAPIW2K - d:\windows\system32\drivers\asapiw2k.sys <Not Verified; VOB Computersysteme GmbH; asapi> R3 MarvinBus (Pinnacle Marvin Bus) - d:\windows\system32\drivers\marvinbus.sys <Not Verified; Pinnacle Systems GmbH; Pinnacle Marvin Discrete> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - "d:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation> R2 Apache2 - "d:\opensa\apache2\bin\apache.exe" -k runservice <Not Verified; Apache Software Foundation; Apache HTTP Server> R2 StarWindServiceAE (StarWind AE Service) - d:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Ethernet Controller Device ID: PCI\VEN_1969&DEV_1048&SUBSYS_82261043&REV_B0\4&625283&0&00E5 Manufacturer: Name: Ethernet Controller PNP Device ID: PCI\VEN_1969&DEV_1048&SUBSYS_82261043&REV_B0\4&625283&0&00E5 Service: -- Scheduled Tasks ------------------------------------------------------------- 2008-06-29 22:48:02 264 --a------ D:\WINDOWS\Tasks\ipresub.job 2008-06-26 23:53:20 338 --a------ D:\WINDOWS\Tasks\New Task.job -- Files created between 2008-05-29 and 2008-06-29 ----------------------------- 2008-06-29 23:26:45 0 d-------- D:\Documents and Settings\All Users\Application Data\TEMP 2008-06-29 23:25:31 0 d-------- D:\Program Files\SpywareBlaster 2008-06-29 23:21:38 0 d-------- D:\Program Files\Panda Security 2008-06-29 19:11:15 82432 --a------ D:\WINDOWS\system32\mhnuajgb.dll 2008-06-29 19:11:08 90624 --a------ D:\WINDOWS\system32\rqmqltej.dll 2008-06-28 19:15:11 81920 -----n--- D:\WINDOWS\system32\egnfyipo.dll 2008-06-28 19:12:12 90624 --a------ D:\WINDOWS\system32\turhxbby.dll 2008-06-28 07:08:54 434488 --ahs---- D:\WINDOWS\system32\RXaycMoq.ini2 2008-06-28 07:08:51 319488 --a------ D:\WINDOWS\system32\qoMcyaXR.dll 2008-06-28 07  07 25088 --a------ D:\WINDOWS\system32\ddcDWpnm.dll2008-06-28 07:04:37 25088 --a------ D:\WINDOWS\system32\ddcCSIcc.dll 2008-06-28 07:01:22 25088 --a------ D:\WINDOWS\system32\ddcBTNFV.dll 2008-06-26 23:32:19 0 d-------- D:\Program Files\JitBit 2008-06-16 09:11:04 0 d-------- D:\Program Files\IrfanView 2008-06-15 10:04:11 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Diino 2008-06-15 10:04:08 0 d-------- D:\Program Files\Diino 2008-06-11 10:14:29 0 d-------- D:\Program Files\OpenAL 2008-06-11 09:02:34 409600 --a------ D:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32> 2008-06-11 09:02:34 114688 --a------ D:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (C) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library> 2008-06-11 05:59:23 0 d-------- D:\Filmy 2008-06-10 20:53:20 0 dr-h----- D:\Documents and Settings\JarekCz\Application Data\SecuROM 2008-06-10 19:30:24 0 d-------- D:\Documents and Settings\JarekCz\Application Data\InstallShield 2008-06-10 18:18:26 401408 --a------ D:\WINDOWS\system32\pvmjpg30.dll <Not Verified; Pegasus Imaging Corporation; PICVideo Codec Suite> 2008-06-10 18:18:19 44544 --a------ D:\WINDOWS\system32\msxml4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1> 2008-06-10 18:18:00 155721 -----n--- D:\WINDOWS\system32\RALMain.dll <Not Verified; Pinnacle Systems GmbH; Register Abstraction Layer> 2008-06-10 18:18:00 73728 -----n--- D:\WINDOWS\system32\MMAviAx.dll <Not Verified; Pinnacle Systems GmbH; miroVIDEO MFP> 2008-06-10 18:18:00 32768 -----n--- D:\WINDOWS\system32\MLPagAx.dll <Not Verified; Pinnacle Systems GmbH; MLPag DLL> 2008-06-10 18:18:00 204881 -----n--- D:\WINDOWS\system32\DiskIO.dll <Not Verified; Pinnacle Systems GmbH; Media File Sequencer> 2008-06-10 18:18:00 126976 -----n--- D:\WINDOWS\system32\AVIPrAx.dll <Not Verified; Pinnacle Systems GmbH; miroVIDEO AFP> 2008-06-10 18:17:48 884736 -----n--- D:\WINDOWS\system32\LMUIRes.dll <Not Verified; Fellowes, Inc.; MediaFACE> 2008-06-10 18:17:48 12288 -----n--- D:\WINDOWS\system32\LMLRes.dll <Not Verified; Fellowes, Inc.; MediaFACE> 2008-06-10 18:16:07 0 d-------- D:\WINDOWS\Cache 2008-06-10 18:13:56 0 d-------- D:\WINDOWS\system32\URTTEMP 2008-06-10 18:10:06 0 d-------- D:\Program Files\SmartSound Software 2008-06-10 18:10:06 0 d-------- D:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2008-06-10 18:09:20 0 d-------- D:\WINDOWS\RegisteredPackages 2008-06-10 18:08:25 138752 --a------ D:\WINDOWS\system32\mase32.dll 2008-06-10 18:08:25 57856 --a------ D:\WINDOWS\system32\masd32.dll 2008-06-10 18:08:25 136192 --a------ D:\WINDOWS\system32\mamc32.dll <Not Verified; ; MAMC32 Dynamic Link Library> 2008-06-10 18:08:25 196096 --a------ D:\WINDOWS\system32\macd32.dll <Not Verified; ; MACD32 Dynamic Link Library> 2008-06-10 18:08:24 27648 --a------ D:\WINDOWS\system32\ma32.dll 2008-06-10 18:08:11 0 d-------- D:\Program Files\DivX 2008-06-10 18:08:10 171008 --a------ D:\WINDOWS\system32\drivers\MarvinBus.sys <Not Verified; Pinnacle Systems GmbH; Pinnacle Marvin Discrete> 2008-06-10 18:08:04 41219 --a------ D:\WINDOWS\RSETPATH.exe <Not Verified; Pinnacle Systems; Pinnacle Systems RSETPATH> 2008-06-10 18 58 0 d-------- D:\WINDOWS\Downloaded Installations2008-06-10 18 53 49152 --a------ D:\WINDOWS\system32\PCLEGetGuid.dll <Not Verified; Pinnacle Systems; Guid_dll>2008-06-10 18 22 0 d-------- D:\Documents and Settings\All Users\Application Data\Pinnacle Studio2008-06-10 18:05:04 0 d-------- D:\Documents and Settings\All Users\Application Data\Pinnacle 2008-06-10 18:05:03 0 d-------- D:\Program Files\Pinnacle 2008-06-10 18:04:58 14165 --a------ D:\WINDOWS\system32\drivers\Pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI> 2008-06-07 10:25:03 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Skype 2008-06-07 10:25:00 0 d-------- D:\Program Files\Common Files\Skype 2008-06-07 10:25:00 0 d-------- D:\Documents and Settings\All Users\Application Data\Skype 2008-06-07 10:24:49 0 d-------- D:\Program Files\Skype 2008-06-06 02:18:25 0 d-------- D:\Program Files\MSXML 4.0 2008-06-05 18:51:39 0 d-------- D:\WINDOWS\SHELLNEW 2008-06-05 18:51:38 0 d-------- D:\Program Files\Microsoft.NET 2008-06-04 15:51:42 0 d-------- D:\Documents and Settings\All Users\Application Data\Adobe 2008-06-04 15:51:34 0 d-------- D:\Program Files\Common Files\Adobe 2008-06-04 13:15:57 0 d-------- D:\Program Files\Samsung 2008-06-04 13:15:57 0 d-------- D:\Documents and Settings\All Users\Application Data\Samsung 2008-06-04 05:28:46 0 d-------- D:\Program Files\uTorrent 2008-06-04 05:28:42 0 d-------- D:\Documents and Settings\JarekCz\Application Data\uTorrent 2008-06-04 04:24:04 0 d-------- D:\WINDOWS\Logs 2008-06-04 03:32:31 0 d--h----- D:\WINDOWS\system32\GroupPolicy 2008-06-03 14:41:05 0 d-------- D:\Program Files\Seagate 2008-06-03 14:33:34 0 d-------- D:\Program Files\Common Files\Wise Installation Wizard 2008-06-03 13:43:30 0 d-------- D:\Program Files\Lavalys 2008-06-02 08:50:30 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Kana Solution 2008-06-02 08:50:26 0 d-------- D:\Program Files\DynDNS Updater 2008-06-02 08:44:06 0 d-------- D:\Documents and Settings\JarekCz\Application Data\ActiveState 2008-06-02 08:42:04 0 d-------- D:\WINDOWS\system32\appmgmt 2008-06-02 08:38:43 0 d-------- D:\OpenSA 2008-06-02 08:37:19 0 d-------- D:\Perl 2008-06-02 07:41:29 0 d-------- D:\WINDOWS\system32\logs 2008-06-02 07:34:40 3840 --a------ D:\WINDOWS\system32\drivers\BANTExt.sys 2008-06-02 07:34:40 0 d-------- D:\Program Files\Belarc 2008-06-02 04:47:47 442368 -ra------ D:\WINDOWS\system32\vp6vfw.dll <Not Verified; On2.com; On2_VP6> 2008-06-02 03:01:19 0 d-------- D:\Documents and Settings\JarekCz\Application Data\DAEMON Tools Pro 2008-06-02 03:01:13 0 d-------- D:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-06-02 02:59:55 0 d-------- D:\Program Files\DAEMON Tools Pro 2008-06-02 01:19:50 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Opera 2008-06-02 01:19:47 0 d-------- D:\Program Files\Opera 2008-06-01 22:50:46 0 d-------- D:\WINDOWS\system32\CatRoot_bak 2008-06-01 21:51:24 0 d-------- D:\WINDOWS\network diagnostic 2008-06-01 21:43:35 0 d-------- D:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2008-06-01 21:43:26 106496 --a------ D:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-06-01 21:43:26 155648 --a------ D:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-06-01 21:43:26 471040 -----n--- D:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-06-01 21:43:26 262144 -----n--- D:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-06-01 21:43:26 1568768 -----n--- D:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-06-01 21:43:25 0 d-------- D:\Program Files\Common Files\Ahead 2008-06-01 21:43:25 0 d-------- D:\Program Files\Ahead 2008-06-01 21:42:27 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Macromedia 2008-06-01 21:42:27 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Adobe 2008-06-01 17:37:53 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Help 2008-06-01 15:28:09 0 d-------- D:\Program Files\7-Zip 2008-06-01 15:25:45 0 d-------- D:\Program Files\Alcohol Soft 2008-06-01 15:25:04 0 d-------- D:\WINDOWS\system32\PreInstall 2008-06-01 15:25:02 0 d--h----- D:\WINDOWS\$hf_mig$ 2008-06-01 10:43:07 716272 --a------ D:\WINDOWS\system32\drivers\sptd.sys 2008-06-01 10:40:16 0 d-------- D:\Program Files\eMule 2008-06-01 09:50:53 0 d-------- D:\WINDOWS\pss 2008-06-01 05:54:24 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Media Player Classic 2008-06-01 05:53:49 0 d-------- D:\Program Files\MPC 2008-06-01 05:52:18 217088 --a------ D:\WINDOWS\system32\yv12vfw.dll <Not Verified; www.helixcommunity.org; Helix YV12 YUV Codec> 2008-06-01 05:52:18 180224 --a------ D:\WINDOWS\system32\xvidvfw.dll 2008-06-01 05:52:18 765952 --a------ D:\WINDOWS\system32\xvidcore.dll 2008-06-01 05:52:17 3596288 --a------ D:\WINDOWS\system32\qt-dx331.dll 2008-06-01 05:52:17 196608 --a------ D:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-06-01 05:52:17 73728 --a------ D:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-06-01 05:52:08 10752 --a------ D:\WINDOWS\system32\ff_vfw.dll 2008-06-01 05:52:06 0 d-------- D:\Program Files\K-Lite Codec Pack 2008-06-01 03:52:04 0 d-------- D:\Documents and Settings\JarekCz\Application Data\foobar2000 2008-06-01 03:52:01 0 d-------- D:\Program Files\foobar2000 2008-06-01 02:22:55 0 --a------ D:\WINDOWS\nsreg.dat 2008-06-01 02:22:52 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Mozilla 2008-06-01 02:22:50 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Gadu-Gadu 2008-06-01 02:22:08 0 d-------- D:\Documents and Settings\JarekCz\Gadu-Gadu 2008-06-01 02:22:01 0 d-------- D:\Program Files\Gadu-Gadu 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\UC.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\RAR.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\PKZIP.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\PKUNZIP.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\NOCLOSE.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\LHA.PIF 2008-06-01 02:14:11 545 --a------ D:\WINDOWS\ARJ.PIF 2008-06-01 02:14:11 0 d-------- D:\Program Files\totalcmd 2008-06-01 02:13:35 0 d-------- D:\Program Files\Thomson 2008-06-01 02:03:26 0 d-------- D:\WINDOWS\nview 2008-06-01 01:59:49 0 d-------- D:\WINDOWS\system32\Lang 2008-06-01 01:58:49 49152 -r------- D:\WINDOWS\system32\ChCfg.exe 2008-06-01 01:58:35 0 d-------- D:\WINDOWS\system32\RTCOM 2008-06-01 01:57:45 0 d-------- D:\Program Files\Realtek 2008-06-01 01:57:44 0 d--h----- D:\Program Files\InstallShield Installation Information 2008-06-01 01:57:42 520192 -r------- D:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-06-01 01:57:42 315392 --a------ D:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-06-01 01:57:37 0 d-------- D:\Program Files\Common Files\InstallShield 2008-06-01 01:56:19 0 d-------- D:\WINDOWS\ASUSInstAll 2008-06-01 01:51:42 0 d-------- D:\WINDOWS\system32\drivers\system32 2008-06-01 01:51:42 0 d-------- D:\WINDOWS\system32\drivers\INF 2008-06-01 01:51:06 0 d-------- D:\WINDOWS\system32\ReinstallBackups 2008-06-01 01:51:04 0 d------c- D:\WINDOWS\system32\DRVSTORE 2008-06-01 01:51:04 0 d-------- D:\Program Files\Intel 2008-06-01 01:50:48 0 d-------- D:\Intel 2008-06-01 01:49:02 10288 --a------ D:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-06-01 01:46:52 0 d-------- D:\Documents and Settings\JarekCz\Application Data\Identities 2008-06-01 01:46:34 0 d--h----- D:\Documents and Settings\JarekCz\Templates 2008-06-01 01:46:34 0 dr------- D:\Documents and Settings\JarekCz\Start Menu 2008-06-01 01:46:34 0 dr-h----- D:\Documents and Settings\JarekCz\SendTo 2008-06-01 01:46:34 0 dr-h----- D:\Documents and Settings\JarekCz\Recent 2008-06-01 01:46:34 0 d--h----- D:\Documents and Settings\JarekCz\PrintHood 2008-06-01 01:46:34 7340032 --ah----- D:\Documents and Settings\JarekCz\NTUSER.DAT 2008-06-01 01:46:34 0 d--h----- D:\Documents and Settings\JarekCz\NetHood 2008-06-01 01:46:34 0 dr------- D:\Documents and Settings\JarekCz\My Documents 2008-06-01 01:46:34 0 d--h----- D:\Documents and Settings\JarekCz\Local Settings 2008-06-01 01:46:34 0 dr------- D:\Documents and Settings\JarekCz\Favorites 2008-06-01 01:46:34 0 d-------- D:\Documents and Settings\JarekCz\Desktop 2008-06-01 01:46:34 0 d--hs---- D:\Documents and Settings\JarekCz\Cookies 2008-06-01 01:46:34 0 dr-h----- D:\Documents and Settings\JarekCz\Application Data 2008-06-01 01:45:55 0 d-------- D:\WINDOWS\SoftwareDistribution 2008-06-01 01:45:53 0 d---s---- D:\WINDOWS\system32\Microsoft 2008-06-01 01:45:53 0 d-------- D:\WINDOWS\Prefetch 2008-06-01 01:45:52 262144 --ah----- D:\Documents and Settings\LocalService\NTUSER.DAT 2008-06-01 01:45:52 0 d--h----- D:\Documents and Settings\LocalService\Local Settings 2008-06-01 01:45:52 0 d--hs---- D:\Documents and Settings\LocalService\Cookies 2008-06-01 01:45:52 0 d-------- D:\Documents and Settings\LocalService\Application Data 2008-06-01 01:45:52 0 d---s---- D:\Documents and Settings\LocalService\Application Data\Microsoft 2008-06-01 01:44:34 262144 --ah----- D:\Documents and Settings\NetworkService\NTUSER.DAT 2008-06-01 01:44:34 0 d--h----- D:\Documents and Settings\NetworkService\Local Settings 2008-06-01 01:44:34 0 d--hs---- D:\Documents and Settings\NetworkService\Cookies 2008-06-01 01:44:34 0 d-------- D:\Documents and Settings\NetworkService\Application Data 2008-06-01 01:44:34 0 d---s---- D:\Documents and Settings\NetworkService\Application Data\Microsoft 2008-06-01 01:41:46 0 d-------- D:\WINDOWS\system32\xircom 2008-06-01 01:41:46 0 d-------- D:\Program Files\microsoft frontpage 2008-06-01 01:41:38 225280 ---h----- D:\Documents and Settings\Default User\NTUSER.DAT 2008-06-01 01:40:43 0 d--hs---- D:\Documents and Settings\All Users\DRM 2008-06-01 01:40:36 0 dr------- D:\WINDOWS\Offline Web Pages 2008-06-01 01:40:36 0 d---s---- D:\WINDOWS\Downloaded Program Files 2008-06-01 01:40:29 0 d--h----- D:\Program Files\WindowsUpdate 2008-06-01 01:40:07 0 d-------- D:\WINDOWS\system32\DirectX 2008-06-01 01:39:25 0 d---s---- D:\WINDOWS\Tasks 2008-06-01 01:39:23 0 d-------- D:\Program Files\Common Files\MSSoap 2008-06-01 01:39:19 0 d-------- D:\WINDOWS\srchasst 2008-06-01 01:39:18 0 d-------- D:\WINDOWS\system32\Macromed 2008-06-01 01:39:07 0 d-------- D:\Program Files\Movie Maker 2008-06-01 01:38:57 0 d-------- D:\WINDOWS\system32\Restore 2008-06-01 01:38:18 21640 --a------ D:\WINDOWS\system32\emptyregdb.dat 2008-06-01 01:38:05 0 d-------- D:\WINDOWS\Registration 2008-06-01 01:37:59 0 d-------- D:\Program Files\Online Services 2008-06-01 01:37:53 0 d-------- D:\Program Files\Messenger 2008-06-01 01:37:48 0 d-------- D:\Program Files\MSN Gaming Zone 2008-06-01 01:36:56 0 d-------- D:\Program Files\Windows NT 2008-06-01 01:36:52 0 d-------- D:\WINDOWS\system32\MsDtc 2008-06-01 01:36:50 0 d-------- D:\WINDOWS\system32\Com 2008-05-31 18:31:25 0 d--hs---- D:\WINDOWS\Installer 2008-05-31 18:31:25 0 d-------- D:\Program Files\Common Files\ODBC 2008-05-31 18:31:21 0 d-------- D:\Program Files\Common Files\SpeechEngines 2008-05-31 18:31:20 0 dr------- D:\Program Files 2008-05-31 18:31:20 0 d-------- D:\Program Files\Common Files 2008-05-31 18:30:53 0 d--h----- D:\Documents and Settings\Default User\Templates 2008-05-31 18:30:53 0 dr------- D:\Documents and Settings\Default User\Start Menu 2008-05-31 18:30:53 0 dr-h----- D:\Documents and Settings\Default User\SendTo 2008-05-31 18:30:53 0 d--h----- D:\Documents and Settings\Default User\Recent 2008-05-31 18:30:53 0 d--h----- D:\Documents and Settings\Default User\PrintHood 2008-05-31 18:30:53 0 d--h----- D:\Documents and Settings\Default User\NetHood 2008-05-31 18:30:53 0 d-------- D:\Documents and Settings\Default User\My Documents 2008-05-31 18:30:53 0 dr-h----- D:\Documents and Settings\Default User\Local Settings 2008-05-31 18:30:53 0 d-------- D:\Documents and Settings\Default User\Favorites 2008-05-31 18:30:53 0 d-------- D:\Documents and Settings\Default User\Desktop 2008-05-31 18:30:53 0 d---s---- D:\Documents and Settings\Default User\Cookies 2008-05-31 18:30:53 0 d--h----- D:\Documents and Settings\All Users\Templates 2008-05-31 18:30:53 0 dr------- D:\Documents and Settings\All Users\Start Menu 2008-05-31 18:30:53 0 d-------- D:\Documents and Settings\All Users\Favorites 2008-05-31 18:30:53 0 dr------- D:\Documents and Settings\All Users\Documents 2008-05-31 18:30:53 0 d-------- D:\Documents and Settings\All Users\Desktop 2008-05-31 18:29:02 0 d-------- D:\WINDOWS\system32\CatRoot2 2008-05-31 18:29:02 0 d-------- D:\WINDOWS\system32\CatRoot 2008-05-31 18:28:57 0 dr-h----- D:\Documents and Settings\Default User\Application Data 2008-05-31 18:28:57 0 d---s---- D:\Documents and Settings\Default User\Application Data\Microsoft 2008-05-31 18:28:57 0 dr-h----- D:\Documents and Settings\All Users\Application Data 2008-05-31 18:28:57 0 d---s---- D:\Documents and Settings\All Users\Application Data\Microsoft 2008-05-31 18:28:33 0 d-------- D:\Documents and Settings 2008-05-31 18:28:32 0 d--hs---- D:\System Volume Information 2008-05-31 18:20:29 0 d-------- D:\WINDOWS 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\WinSxS 2008-05-31 18:20:29 0 dr------- D:\WINDOWS\Web 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\twain_32 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\wins 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\wbem 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\usmt 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\spool 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\ShellExt 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\Setup 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\ras 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\oobe 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\npp 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\mui 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\inetsrv 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\IME 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\icsxml 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\ias 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\export 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\drivers 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\drivers\etc 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\drivers\disdn 2008-05-31 18:20:29 0 dr-hs--c- D:\WINDOWS\system32\dllcache 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\dhcp 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\config 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\3com_dmi 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\3076 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\2052 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1054 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1042 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1041 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1037 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1033 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1031 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1028 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system32\1025 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\system 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\security 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Resources 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\repair 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Provisioning 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\PeerNet 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\pchealth 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\mui 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\msapps 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\msagent 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Media 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\java 2008-05-31 18:20:29 0 d--h----- D:\WINDOWS\inf 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\ime 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Help 2008-05-31 18:20:29 0 dr--s---- D:\WINDOWS\Fonts 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\ehome 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Driver Cache 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Debug 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Cursors 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Connection Wizard 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\Config 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\AppPatch 2008-05-31 18:20:29 0 d-------- D:\WINDOWS\addins 2008-05-31 17:19:27 0 d-------- D:\Program Files\Avira 2008-05-31 17:19:27 0 d-------- D:\Documents and Settings\All Users\Application Data\Avira 2008-05-31 17:16:53 0 d-------- D:\Program Files\AutoConnect 2008-05-31 17:16:26 0 d-------- D:\WINDOWS\system32\SoftwareDistribution -- Find3M Report --------------------------------------------------------------- 2008-05-31 18:30:53 62 --ahs---- D:\Documents and Settings\JarekCz\Application Data\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056}] 2008-06-28 07:01 25088 --a------ D:\WINDOWS\system32\ddcBTNFV.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A7BFECED-850B-48C5-A099-BEDF116C56AF}] 2008-06-28 07:08 319488 --a------ D:\WINDOWS\system32\qoMcyaXR.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Alcmtr"="ALCMTR.EXE" [2005-05-03 20:43 D:\WINDOWS\Alcmtr.exe] "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2008-02-19 10:35] "nwiz"="nwiz.exe" [2008-02-19 10:35 D:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2008-02-19 10:35] "avgnt"="D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-01 02:23] "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 20:50] "KernelFaultCheck"="D:\WINDOWS\system32\dumprep 0 -k" [] "Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16] "PinnacleDriverCheck"="D:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26] "BMe7092d04"="D:\WINDOWS\system32\rqmqltej.dll" [2008-06-29 19:11] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="D:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] "DynDNS Updater"="D:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 19:32] "MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] "AlcoholAutomount"="D:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 17:58] D:\Documents and Settings\JarekCz\Start Menu\Programs\Startup\ check-ip-changed.bat [2008-06-02 08:47:47] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056}"= D:\WINDOWS\system32\ddcBTNFV.dll [2008-06-28 07:01 25088] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcBTNFV] ddcBTNFV.dll 2008-06-28 07:01 25088 D:\WINDOWS\system32\ddcBTNFV.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 D:\WINDOWS\system32\qoMcyaXR [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon -- End of Deckard's System Scanner: finished at 2008-06-29 23:39:55 ------------ Last edited by jarekexe : 06-29-2008 at 02:51 PM. |
|
     |
|
07-01-2008, 08:14 PM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Re: Some sites/addresses blocked
Hi jarekexe,
Sorry for the delay in looking into your log, as we are extremely busy in this section of the forums. If you still require assistance and are not seeking help elsewhere, then please carry out my instructions. Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription. -------------------------------------------------------------- Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix IMPORTANT: Make sure you install the Recovery Console before running ComboFix. Reply back with the following:
__________________
 Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
07-01-2008, 09:45 PM
|
#3 (permalink) | |
|
Registered User
Join Date: Feb 2006
Posts: 156
OS: Win XP
|
Re: Some sites/addresses blocked
Hello,
Thanks for an answer. I have a problem though, the link that you gave me is blocked in my PC as well. Same as Microsoft's guide on how to install recovery console. I've found guide to recovery console elswhere, could you confirm that this is the right thing to do: Quote:
|
|
|
|
|
|
07-01-2008, 09:52 PM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Re: Some sites/addresses blocked
Hi,
**Save it directly to your desktop** **** Do not run ComboFix.exe yet **** 2. Visit the following link: here Download the file & save it as its originally named, next to ComboFix.exe.  Now close all open windows and programs, including all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
07-02-2008, 10:08 AM
|
#5 (permalink) |
|
Registered User
Join Date: Feb 2006
Posts: 156
OS: Win XP
|
Re: Some sites/addresses blocked
ComboFix:
ComboFix 08-06-30.2 - JarekCz 2008-07-02 18:49:18.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1486 [GMT 2:00] Running from: E:\Download\ComboFix.exe Command switches used :: E:\Download\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe * Created a new restore point * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\WINDOWS\BMe7092d04.txt D:\WINDOWS\cookies.ini D:\WINDOWS\pskt.ini D:\WINDOWS\system32\adtrayyj.ini D:\WINDOWS\system32\bgjaunhm.ini D:\WINDOWS\system32\jhbmwmaq.ini D:\WINDOWS\system32\mcrh.tmp D:\WINDOWS\system32\opiyfnge.ini D:\WINDOWS\system32\qoMcyaXR.dll D:\WINDOWS\system32\RXaycMoq.ini D:\WINDOWS\system32\RXaycMoq.ini2 D:\WINDOWS\system32\rywgnees.ini D:\WINDOWS\system32\seengwyr.dll . ((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 ))))))))))))))))))))))))))))))) . 2008-07-01 22:47 . 2008-07-01 22:47 <DIR> d-------- D:\Program Files\ESET 2008-07-01 22:47 . 2008-07-01 22:47 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\ESET 2008-06-29 23:36 . 2008-06-29 23:36 <DIR> d-------- D:\Deckard 2008-06-29 23:26 . 2008-06-29 23:26 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\TEMP 2008-06-29 23:25 . 2008-06-29 23:27 <DIR> d-------- D:\Program Files\SpywareBlaster 2008-06-29 23:21 . 2008-07-01 15:55 <DIR> d-------- D:\Program Files\Panda Security 2008-06-28 19:12 . 2008-07-02 14:50 110,419 --a------ D:\WINDOWS\BMe7092d04.xml 2008-06-26 23:32 . 2008-06-26 23:32 <DIR> d-------- D:\Program Files\JitBit 2008-06-23 16:25 . 2008-06-23 16:25 278,984 --a------ D:\WINDOWS\system32\drivers\atksgt.sys 2008-06-23 16:25 . 2008-06-23 16:25 25,416 --a------ D:\WINDOWS\system32\drivers\lirsgt.sys 2008-06-16 09:11 . 2008-06-16 09:11 <DIR> d-------- D:\Program Files\IrfanView 2008-06-15 10:04 . 2008-06-15 10:04 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\Diino 2008-06-15 09:58 . 2004-08-03 23:08 26,496 --a--c--- D:\WINDOWS\system32\dllcache\usbstor.sys 2008-06-11 11:33 . 2008-06-13 15:10 272,128 --------- D:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 11:33 . 2008-06-13 15:10 272,128 -----c--- D:\WINDOWS\system32\dllcache\bthport.sys 2008-06-11 10:14 . 2008-06-11 10:14 <DIR> d-------- D:\Program Files\OpenAL 2008-06-11 09:02 . 2008-06-11 10:14 409,600 --a------ D:\WINDOWS\system32\wrap_oal.dll 2008-06-11 09:02 . 2008-06-11 10:14 114,688 --a------ D:\WINDOWS\system32\OpenAL32.dll 2008-06-10 20:53 . 2008-06-10 20:53 <DIR> dr-h----- D:\Documents and Settings\JarekCz\Application Data\SecuROM 2008-06-10 20:53 . 2008-07-01 16:45 108,144 --a------ D:\WINDOWS\system32\CmdLineExt.dll 2008-06-10 19:30 . 2008-06-10 19:30 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\InstallShield 2008-06-10 19:13 . 2008-06-10 19:13 51 --a------ D:\WINDOWS\system32\blue.SITENAME 2008-06-10 19:08 . 2008-06-10 19:14 455 --a------ D:\WINDOWS\VFO.VST 2008-06-10 18:17 . 2004-03-03 11:50 2,079,232 --a------ D:\WINDOWS\system32\LTCLR13s.dll 2008-06-10 18:16 . 2008-06-10 18:16 <DIR> d-------- D:\WINDOWS\Cache 2008-06-10 18:16 . 2003-03-19 04:04 765,952 --a------ D:\WINDOWS\system32\msvcp71d.dll 2008-06-10 18:16 . 2003-03-19 04:03 544,768 --a------ D:\WINDOWS\system32\msvcr71d.dll 2008-06-10 18:13 . 2008-06-10 18:13 <DIR> d-------- D:\WINDOWS\system32\URTTEMP 2008-06-10 18:10 . 2008-06-10 18:10 <DIR> d-------- D:\Program Files\SmartSound Software 2008-06-10 18:10 . 2008-06-10 18:10 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\SmartSound Software Inc 2008-06-10 18:08 . 2008-06-10 18:08 <DIR> d-------- D:\Program Files\DivX 2008-06-10 18:08 . 2003-11-25 05:02 196,096 --a------ D:\WINDOWS\system32\macd32.dll 2008-06-10 18:08 . 2005-06-02 19:28 171,008 --a------ D:\WINDOWS\system32\drivers\MarvinBus.sys 2008-06-10 18:08 . 2003-11-25 05:02 138,752 --a------ D:\WINDOWS\system32\mase32.dll 2008-06-10 18:08 . 2003-11-25 05:02 136,192 --a------ D:\WINDOWS\system32\mamc32.dll 2008-06-10 18:08 . 2004-07-02 16:28 89,088 --a------ D:\WINDOWS\system32\atl71.dll 2008-06-10 18:08 . 2004-07-02 16:28 84,992 --a------ D:\WINDOWS\system32\ATL70.DLL 2008-06-10 18:08 . 2003-11-25 05:02 57,856 --a------ D:\WINDOWS\system32\masd32.dll 2008-06-10 18:08 . 2004-02-24 12:04 41,219 --a------ D:\WINDOWS\RSETPATH.exe 2008-06-10 18:08 . 2003-11-25 05:02 27,648 --a------ D:\WINDOWS\system32\ma32.dll 2008-06-10 18:08 . 2008-06-10 19:16 1,208 --a------ D:\WINDOWS\VFO.INI 2008-06-10 18:06 . 2008-06-10 18:07 <DIR> d-------- D:\WINDOWS\Downloaded Installations 2008-06-10 18:06 . 2008-06-10 19:13 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Pinnacle Studio 2008-06-10 18:05 . 2008-06-10 18:05 <DIR> d-------- D:\Program Files\Pinnacle 2008-06-10 18:05 . 2008-06-10 19:13 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Pinnacle 2008-06-10 18:04 . 2005-02-09 11:59 14,165 --a------ D:\WINDOWS\system32\drivers\Pclepci.sys 2008-06-07 10:25 . 2008-06-07 10:25 <DIR> d-------- D:\Program Files\Common Files\Skype 2008-06-07 10:25 . 2008-06-08 07:00 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\Skype 2008-06-07 10:25 . 2008-06-07 10:25 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Skype 2008-06-07 10:24 . 2008-06-07 10:25 <DIR> d-------- D:\Program Files\Skype 2008-06-06 02:18 . 2008-06-06 02:18 <DIR> d-------- D:\Program Files\MSXML 4.0 2008-06-05 18:52 . 2003-06-19 01:31 17,920 --a------ D:\WINDOWS\system32\mdimon.dll 2008-06-05 18:52 . 2008-06-05 18:52 412 --a------ D:\WINDOWS\ODBC.INI 2008-06-05 18:51 . 2008-06-05 18:51 <DIR> d-------- D:\WINDOWS\SHELLNEW 2008-06-05 18:51 . 2008-06-05 18:51 <DIR> d-------- D:\Program Files\Microsoft.NET 2008-06-05 13:18 . 2008-07-02 13:40 69 --a------ D:\WINDOWS\NeroDigital.ini 2008-06-04 15:51 . 2008-06-04 15:51 <DIR> d-------- D:\Program Files\Common Files\Adobe 2008-06-04 13:29 . 2005-08-24 07:39 137,884 -ra------ D:\WINDOWS\system32\drivers\sscdmdm.sys 2008-06-04 13:29 . 2005-08-24 07:39 80,272 -ra------ D:\WINDOWS\system32\drivers\sscdbus.sys 2008-06-04 13:29 . 2005-08-24 07:39 11,877 -ra------ D:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-06-04 13:29 . 2005-08-24 07:39 11,877 -ra------ D:\WINDOWS\system32\drivers\sscdcm.sys 2008-06-04 13:29 . 2005-08-24 07:39 11,188 -ra------ D:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-06-04 13:29 . 2005-08-24 07:39 11,188 -ra------ D:\WINDOWS\system32\drivers\sscdwh.sys 2008-06-04 13:29 . 2005-08-24 07:39 10,864 -ra------ D:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-06-04 13:15 . 2008-06-04 13:15 <DIR> d-------- D:\Program Files\Samsung 2008-06-04 13:15 . 2008-06-04 13:15 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Samsung 2008-06-04 05:28 . 2008-06-04 05:28 <DIR> d-------- D:\Program Files\uTorrent 2008-06-04 05:28 . 2008-07-02 13:24 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\uTorrent 2008-06-04 04:24 . 2008-06-04 04:24 <DIR> d-------- D:\WINDOWS\Logs 2008-06-04 03:32 . 2008-06-04 03:32 <DIR> d--h----- D:\WINDOWS\system32\GroupPolicy 2008-06-03 14:41 . 2008-06-03 14:41 <DIR> d-------- D:\Program Files\Seagate 2008-06-02 08:50 . 2008-07-02 00:03 <DIR> d-------- D:\Program Files\DynDNS Updater 2008-06-02 08:50 . 2008-06-02 08:50 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\Kana Solution 2008-06-02 08:44 . 2008-06-02 08:44 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\ActiveState 2008-06-02 08:38 . 2008-06-02 08:38 <DIR> d-------- D:\OpenSA 2008-06-02 08:37 . 2008-06-02 08:41 <DIR> d-------- D:\Perl 2008-06-02 07:41 . 2008-06-02 07:41 <DIR> d-------- D:\WINDOWS\system32\logs 2008-06-02 07:24 . 2008-07-02 16:41 201 --a------ D:\WINDOWS\wcx_ftp.ini 2008-06-02 04:47 . 2004-08-18 10:34 442,368 -ra------ D:\WINDOWS\system32\vp6vfw.dll 2008-06-02 03:01 . 2008-06-02 03:01 <DIR> d-------- D:\Documents and Settings\JarekCz\Application Data\DAEMON Tools Pro 2008-06-02 03:01 . 2008-06-02 03:01 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-06-02 02:59 . 2008-06-02 03:03 <DIR> d-------- D:\Program Files\DAEMON Tools Pro 2008-06-02 01:19 . 2008-06-02 01:19 <DIR> d-------- D:\Program Files\Opera . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-02 16:55 --------- d-----w D:\Program Files\AutoConnect 2008-07-01 21:11 --------- d-----w D:\Documents and Settings\All Users\Application Data\Avira 2008-07-01 10:16 --------- d-----w D:\Documents and Settings\JarekCz\Application Data\foobar2000 2008-06-30 15:11 --------- d--h--w D:\Program Files\InstallShield Installation Information 2008-06-28 05:02 716,272 ----a-w D:\WINDOWS\system32\drivers\sptd.sys 2008-06-24 16:52 --------- d-----w D:\Program Files\eMule 2008-06-04 11:15 --------- d-----w D:\Program Files\Common Files\InstallShield 2008-06-03 00:52 --------- d-----w D:\Program Files\Gadu-Gadu 2008-06-02 00:18 --------- d-----w D:\Program Files\totalcmd 2008-06-01 19:43 --------- d-----w D:\Program Files\Common Files\Ahead 2008-06-01 19:43 --------- d-----w D:\Program Files\Ahead 2008-06-01 13:28 --------- d-----w D:\Program Files\7-Zip 2008-06-01 13:25 --------- d-----w D:\Program Files\Alcohol Soft 2008-06-01 03:54 --------- d-----w D:\Documents and Settings\JarekCz\Application Data\Media Player Classic 2008-06-01 03:53 --------- d-----w D:\Program Files\MPC 2008-06-01 03:52 --------- d-----w D:\Program Files\K-Lite Codec Pack 2008-06-01 01:56 --------- d-----w D:\Program Files\foobar2000 2008-06-01 00:22 --------- d-----w D:\Documents and Settings\JarekCz\Application Data\Gadu-Gadu 2008-06-01 00:13 --------- d-----w D:\Program Files\Thomson 2008-05-31 23:57 315,392 ----a-w D:\WINDOWS\HideWin.exe 2008-05-31 23:57 --------- d-----w D:\Program Files\Realtek 2008-05-31 23:51 --------- d-----w D:\Program Files\Intel 2008-05-31 23:41 --------- d-----w D:\Program Files\microsoft frontpage 2008-05-08 12:28 202,752 ----a-w D:\WINDOWS\system32\drivers\rmcast.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="D:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27 295424] "ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360] "DynDNS Updater"="D:\Program Files\DynDNS Updater\DynDNS.exe" [2006-09-17 19:32 1352704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2008-02-19 10:35 13500416] "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2008-02-19 10:35 86016] "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 20:50 155648] "PinnacleDriverCheck"="D:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26 406016] "egui"="D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-11-14 15:05 1410304] "nwiz"="nwiz.exe" [2008-02-19 10:35 1626112 D:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] D:\Documents and Settings\JarekCz\Start Menu\Programs\Startup\ check-ip-changed.bat [2008-06-02 08:47:47 58] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= vdrcodec.dll "vidc.yv12"= yv12vfw.dll "VIDC.MJPG"= Pvmjpg30.dll "VIDC.PIM1"= pclepim1.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-08-06 18:45 877568 D:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-03-21 16:49 16126464 D:\WINDOWS\RTHDCPL.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "D:\\OpenSA\\Apache2\\bin\\Apache.exe"= "C:\\Perl\\bin\\perl.exe"= "D:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\Program Files\\Skype\\Phone\\Skype.exe"= "E:\\Kamera\\Pinnacle\\programs\\RM.exe"= "E:\\Kamera\\Pinnacle\\programs\\Studio.exe"= "E:\\Kamera\\Pinnacle\\programs\\PMSRegisterFile.exe"= "E:\\Kamera\\Pinnacle\\programs\\umi.exe"= "E:\\Gry\\nwn2\\nwn2main.exe"= "E:\\Gry\\nwn2\\nwn2main_amdxp.exe"= "E:\\Gry\\nwn2\\nwupdate.exe"= "E:\\Gry\\nwn2\\nwn2server.exe"= "E:\\Gry\\civ 4\\Civilization4.exe"= "E:\\Gry\\civ 4\\Warlords\\Civ4Warlords.exe"= "E:\\Gry\\civ 4\\Warlords\\Civ4Warlords_PitBoss.exe"= "E:\\Gry\\civ 4\\Beyond the Sword\\Civ4BeyondSword.exe"= "E:\\Gry\\civ 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"= R1 epfwtdir;epfwtdir;D:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-11-14 15:06] . Contents of the 'Scheduled Tasks' folder "2008-07-02 16:48:03 D:\WINDOWS\Tasks\ipresub.job" - c:\perl\bin\perl.exe D:\OpenSA\Apache2\heartbeat.pl "2008-06-26 21:53:20 D:\WINDOWS\Tasks\New Task.job" - D:\Documents and Settings\JarekCz\Desktop\1.exe . - - - - ORPHANS REMOVED - - - - BHO-{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - (no file) HKLM-Run-a8e5e2b0 - D:\WINDOWS\system32\seengwyr.dll HKLM-Run-BMe7092d04 - D:\WINDOWS\system32\fshbrmdd.dll ShellExecuteHooks-{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - (no file) Notify-ddcBTNFV - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-02 18:55:26 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . D:\OpenSA\Apache2\bin\Apache.exe D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\wdfmgr.exe D:\OpenSA\Apache2\bin\Apache.exe D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\rundll32.exe D:\WINDOWS\system32\rundll32.exe . ************************************************************************** . Completion time: 2008-07-02 18:57:00 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-02 16:56:58 Pre-Run: 3,440,582,656 bytes free Post-Run: 3,523,616,768 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(3)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Nowy" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Stary" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 237 --- E O F --- 2008-06-20 20:44:31 HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:02:26, on 2008-07-02 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\OpenSA\Apache2\bin\Apache.exe D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe D:\WINDOWS\system32\nvsvc32.exe D:\OpenSA\Apache2\bin\Apache.exe D:\WINDOWS\system32\RUNDLL32.EXE D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe D:\Program Files\AutoConnect\AutoConnect.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\DynDNS Updater\DynDNS.exe D:\WINDOWS\explorer.exe D:\WINDOWS\system32\notepad.exe D:\WINDOWS\system32\mspaint.exe D:\WINDOWS\system32\svchost.exe D:\Program Files\totalcmd\TOTALCMD.EXE D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\NOTEPAD.EXE D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] D:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DynDNS Updater] "D:\Program Files\DynDNS Updater\DynDNS.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: check-ip-changed.bat O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C7647385-9D41-44E9-A961-8E914D046F29}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apache2 - Apache Software Foundation - D:\OpenSA\Apache2\bin\Apache.exe O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - D:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing) -- End of file - 4111 bytes Few more things: At the beginning of Combofix scan, I received "Installation failed" error. Although after clicking OK, it finishsed all the scanns without any problem. After restart I received 2 errors:  And I keep getting messages like this one:  Additionally, before the combofix scans, something kept turning off windows automatic updates :| |
|
|
|
|
07-02-2008, 08:11 PM
|
#6 (permalink) |
|
Analyst, Security Team
Join Date: Sep 2006
Location: Ontario, Canada
Posts: 2,566
OS: Windows XP Pro
|
Re: Some sites/addresses blocked
Hello,
Those messages should stop after you restart your computer again. -------------------------------------------------------------- Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK. -------------------------------------------------------------- Please delete the following file: D:\WINDOWS\BMe7092d04.xml -------------------------------------------------------------- Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
__________________
Proud Member of ASAP Proud Member of UNITE Keep this forum alive - if you've been helped at this forum, please do consider a donation. Thank you for your support. Donation link for Tech Support Forum |
|
|
|
|
07-03-2008, 06:44 AM
|
#7 (permalink) | ||
|
Registered User
Join Date: Feb 2006
Posts: 156
OS: Win XP
|
Re: Some sites/addresses blocked
Hello, I've deleted the file. Regarding Kaspersky scan, it seems that there's a newer version, as I couldn't find all the settings you mentioned. It looked like that:  I've also performed 2 scans: - critical area - my computer So Im posting 2 reports: Quote:
----------------------------------------------------------------------- Quote:
|
