|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
|
|
LinkBack | Thread Tools |
11-05-2009, 10:03 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2008
Posts: 3
OS: xp
|
no internet connection, virus?
here is my dds report along with my other reports. i can't seem to get online due to something. I always get a yellow exclamation on the network connectivity on the computer showing limited connection. my desktop is ok but it's just connecting to the internet is difficult. I can get online with my laptop with no problem. running XP. and i have removed avg, comodo, i wonder if those are causing a problem also, thanks guys...
DDS (Ver_09-10-26.01) - NTFSx86 Run by Stephanie at 22:27:09.53 on Thu 11/05/2009 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.209 [GMT -6:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Norton AntiVirus *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\Program Files\AVG\AVG8\avgrsx.exe svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe K:\TECH SUPPORT\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = localhost;*.local mSearchAssistant = hxxp://www.google.com BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll TB: {196C3A46-4758-433D-A600-802C804AF39C} - No File TB: {7EFBC57C-CD57-481F-B794-648FCE9C9116} - No File TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe IE: &Search IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168911456234 DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Filter: text/html - {f63df3ab-c13c-4826-955e-e0527a35da2e} - Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxsrvc.dll AppInit_DLLs: cru629.dat SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, mcenspc.dll LSA: Notification Packages = scecli scecli ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\stepha~1.000\applic~1\mozilla\firefox\profiles\b6ltonqd.default\ ---- FIREFOX POLICIES ---- c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox 3.6 beta 1\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox 3.6 beta 1\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", true); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox 3.6 beta 1\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-31 64160] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-4 335240] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-4 108552] R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-11-11 87056] R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-11-11 24208] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-8-5 9968] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-8-5 74480] S0 Tyfd45;Tyfd45; [x] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-8-5 7408] S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456] =============== Created Last 30 ================ 2009-11-01 23:51:35 0 d-----w- c:\program files\Mozilla Firefox 3.6 Beta 1 2009-10-30 04:18:41 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-10-30 03:48:54 0 d-----w- c:\windows\system32\scripting 2009-10-30 03:48:47 0 d-----w- c:\windows\l2schemas 2009-10-30 03:48:46 0 d-----w- c:\windows\system32\en 2009-10-30 02:11:10 0 d-sh--w- c:\documents and settings\stephanie.your-2s4kn5k0h3.000\PrivacIE 2009-10-30 02  32 0 d-sh--w- c:\documents and settings\stephanie.your-2s4kn5k0h3.000\IECompatCache2009-10-30 01:32:07 0 d-sh--w- c:\documents and settings\stephanie.your-2s4kn5k0h3.000\IETldCache 2009-10-30 01:24:28 0 d-----w- c:\windows\ie8updates 2009-10-30 01:16:32 0 dc-h--w- c:\windows\ie8 2009-10-30 01:11:39 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-10-30 01:11:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-10-30 01:11:18 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll ==================== Find3M ==================== 2009-10-02 02:31:17 46800 ---ha-w- c:\windows\system32\mlfcache.dat 2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-02 16:36:02 19715 ----a-w- c:\docume~1\alluse~1\applic~1\devo.com 2009-09-02 16:36:02 19094 ----a-w- c:\program files\common files\bylisu.pif 2009-09-02 16:36:02 16908 ----a-w- c:\program files\common files\sywufa.bat 2009-09-02 16:36:02 15311 ----a-w- c:\docume~1\alluse~1\applic~1\delov.bat 2009-09-02 16:36:02 15041 ----a-w- c:\docume~1\stepha~1.000\applic~1\tyjo.scr 2009-09-02 16:36:02 12731 ----a-w- c:\program files\common files\orily.com 2009-09-02 16:36:02 11565 ----a-w- c:\program files\common files\pucin.sys 2009-09-01 16:47:32 15606 ----a-w- c:\docume~1\alluse~1\applic~1\rywavoj.vbs 2009-09-01 02:16:29 17939 ----a-w- c:\program files\common files\xemogoni.bat 2009-09-01 02:16:29 17152 ----a-w- c:\program files\common files\kizikigo.bin 2009-09-01 02:16:29 16067 ----a-w- c:\windows\hawytef.dat 2009-09-01 02:16:29 13162 ----a-w- c:\docume~1\alluse~1\applic~1\ufole.scr 2009-09-01 02:16:29 13157 ----a-w- c:\windows\muhevupi.com 2009-09-01 02:16:29 12616 ----a-w- c:\docume~1\alluse~1\applic~1\danewix.com 2009-09-01 02:16:29 12247 ----a-w- c:\windows\johoteh.reg 2009-09-01 02:16:28 12149 ----a-w- c:\windows\urexi.sys 2009-08-31 23:10:31 19421 ----a-w- c:\program files\common files\ryjitu.dat 2009-08-31 23:10:31 18896 ----a-w- c:\program files\common files\epiz.db 2009-08-31 23:10:31 18675 ----a-w- c:\windows\pyxagy.com 2009-08-31 23:10:31 18239 ----a-w- c:\docume~1\alluse~1\applic~1\paxan.com 2009-08-31 23:10:31 17506 ----a-w- c:\windows\system32\avemudy.dll 2009-08-31 23:10:31 16396 ----a-w- c:\program files\common files\ucunarapy.dat 2009-08-31 23:10:31 16372 ----a-w- c:\windows\ucesihic.bat 2009-08-31 23:10:31 15668 ----a-w- c:\program files\common files\ogarewyv.dl 2009-08-31 23:10:31 14311 ----a-w- c:\windows\axakiqivud.pif 2009-08-31 23:10:31 13820 ----a-w- c:\docume~1\alluse~1\applic~1\ajomynemo.reg 2009-08-31 23:10:31 12326 ----a-w- c:\program files\common files\namuneliro.bin 2009-08-31 23:10:31 10885 ----a-w- c:\windows\system32\abebuhiv.dll 2009-08-31 13:54:36 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-08-29 08:08:21 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-27 15:15:29 11395 ----a-w- c:\windows\iwigu.reg 2009-08-27 15:15:28 12457 ----a-w- c:\windows\gygipuleh.reg 2009-08-27 15:15:28 12440 ----a-w- c:\program files\common files\uxuzeko.exe 2009-08-27 15:15:28 10717 ----a-w- c:\docume~1\alluse~1\applic~1\imuhycyxe.exe 2009-08-27 15:15:27 17100 ----a-w- c:\windows\oxarox.pif 2009-08-27 15:15:27 12370 ----a-w- c:\windows\system32\odep.vbs 2009-08-27 15:15:26 16076 ----a-w- c:\docume~1\stepha~1.000\applic~1\sohusap.pif 2009-08-27 15:15:26 10418 ----a-w- c:\windows\system32\xocygo.dat 2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll ============= FINISH: 22:28:44.90 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-10-2009, 10:58 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,697
OS: XP SP3
|
Re: no internet connection, virus?
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Download ComboFix and the Microsoft file to a USB drive on another computer and transfer the files to your desktop. ------------------------------------------------------ Please download ComboFix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. Also, ComboFix will not address certain types of malware unless the RC is installed. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Do not be concerned that this file is for SP2 if you have SP3. It will work just fine on your system. Save it as it is originally named to your Desktop. Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt, in your next reply. Please re-enable your antivirus before posting the ComboFix.txt log. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: C:\Qoobox\Add-Remove Programs.txt A text file should open. Please attach that file to your next reply. ------------------------------------------------------ |
|
|
|
|
11-16-2009, 05:39 PM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,697
OS: XP SP3
|
Re: no internet connection, virus?
Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here:
IMPORTANT - Read This Before Posting For Malware Removal Help ------------------------------------------------------ |
|
|
|
| Thread Tools | |
|
|
