|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-09-2007, 10:19 AM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 39
OS: XP
|
Constant Pop-ups
Hi there.
I've been having alot of Pop-ups for the last few months - up until now it has really p***ed me off. Pop-ups from Celldorado, Sex-Explorer, Spyware-secure, stuff like that. I use IE7. No spyware remover can detect it. That's why i came here. Deckard's System Scanner v20070905.67 Run by Nick on 2007-10-09 18:03:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 14: 2007-10-09 17:04:00 UTC - RP130 - Deckard's System Scanner Restore Point 13: 2007-10-09 13:45:57 UTC - RP129 - Installed Battlefield 2 Patch v1.41 12: 2007-10-09 12:38:21 UTC - RP128 - Installed Battlefield 2 Patch v1.41 11: 2007-10-09 11:35:01 UTC - RP127 - Configured VeohTV BETA 10: 2007-10-08 15:21:05 UTC - RP126 - Installed Battlefield 2(TM) -- First Restore Point -- 1: 2007-09-28 15:32:01 UTC - RP117 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive C: has 11.44 GiB (less than 15%) free. -- HijackThis (run as Nick.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:05:35, on 09/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\KSE\nHancer 32bit\nHancerService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Downloads\Software\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\Nick.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [mtbhflryee] c:\windows\system32\mtbhflryee.exe mtbhflryee O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: nHancer Support (nHancer) - KSE - Korndörfer Software Engineering - C:\Program Files\KSE\nHancer 32bit\nHancerService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 5478 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 oreans32 - c:\windows\system32\drivers\oreans32.sys R1 StyleXPHelper - c:\program files\tgtsoft\stylexp\stylexphelper.exe <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R2 TBPanel - c:\windows\system32\drivers\tbpanel.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R3 mcdbus (Driver for MagicISO SCSI Host Controller) - c:\windows\system32\drivers\mcdbus.sys <Not Verified; MagicISO, Inc.; MagicISO SCSI Host Controller> S0 szkg - c:\windows\system32\drivers\szkg.sys (file missing) S3 Cardex - c:\windows\system32\drivers\tbpanel.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> S3 NTProcDrv (Process creation detector for NT.) - c:\documents and settings\nick\desktop\ntprocdrv.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 nHancer (nHancer Support) - "c:\program files\kse\nhancer 32bit\nhancerservice.exe" <Not Verified; KSE - Korndörfer Software Engineering; nHancer> R2 StyleXPService - "c:\program files\tgtsoft\stylexp\stylexpservice.exe" <Not Verified; ; StyleXPService Module> S3 AresChatServer (Ares Chatroom server) - c:\program files\ares\chatserver.exe <Not Verified; Ares Development Group; Ares Chat Server> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: PCI Simple Communications Controller Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200014F1&REV_00\4&1F7DBC9F&0&10F0 Manufacturer: Name: PCI Simple Communications Controller PNP Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200014F1&REV_00\4&1F7DBC9F&0&10F0 Service: Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\B083D0FEA0A Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\B083D0FEA0A Service: NIC1394 Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Multimedia Audio Controller Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_A0021458&REV_02\3&13C0B0C5&0&FD Manufacturer: Name: Multimedia Audio Controller PNP Device ID: PCI\VEN_8086&DEV_24D5&SUBSYS_A0021458&REV_02\3&13C0B0C5&0&FD Service: Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Microsoft Loopback Adapter Device ID: ROOT\NET\0000 Manufacturer: Microsoft Name: Microsoft Loopback Adapter PNP Device ID: ROOT\NET\0000 Service: msloop -- Scheduled Tasks ------------------------------------------------------------- 2007-10-08 11:48:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-09-09 and 2007-10-09 ----------------------------- 2007-10-09 17:58:24 0 d-------- C:\ie-spyad_zo 2007-10-09 17:56:07 0 d-------- C:\Program Files\SpywareBlaster 2007-10-09 16:50:51 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-09 10:08:28 0 d-------- C:\Documents and Settings\Nick\Application Data\Dev-Cpp 2007-10-09 10:08:09 0 d-------- C:\Dev-Cpp 2007-10-07 10:35:11 0 d-------- C:\Program Files\World of Warcraft 2007-10-07 10:35:11 0 d-------- C:\Documents and Settings\Nick\Application Data\WoWUploader 2007-10-07 10:35:10 0 d-------- C:\Program Files\WOWUploader 2007-10-07 09:58:15 1970176 --a------ C:\WINDOWS\system32\d3dx9.dll 2007-10-07 09:58:15 679936 --a------ C:\WINDOWS\system32\D3DX81ab.dll <Not Verified; Generated by JEDI; D3DX81> 2007-10-07 09:58:14 0 d-------- C:\Program Files\Cheat Engine 2007-10-01 09:13:08 0 d-------- C:\Documents and Settings\Nick\Application Data\Free Download Manager 2007-10-01 09:13:05 0 d-------- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG 2007-09-30 07:44:09 0 d-------- C:\WINDOWS\RegisteredPackages 2007-09-29 12:25:23 0 d-------- C:\Program Files\Common Files\Real 2007-09-29 12:25:22 0 d-------- C:\Documents and Settings\Nick\Application Data\Real 2007-09-28 17:05:50 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2007-09-28 17:05:50 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2007-09-28 17:05:40 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2007-09-28 17:05:40 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-28 17:05:40 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-28 17:05:40 739840 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-28 17:05:08 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-28 03:13:37 0 d-------- C:\Program Files\Windows Media Connect 2 2007-09-28 03:13:14 0 d-------- C:\3711eb845a30de831b1c9e5eb22ba406 2007-09-28 03:12:44 0 d-------- C:\67669fd8fd4ae22647f60fa821e04626 2007-09-28 03:12:41 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-09-28 03:10:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Kontiki 2007-09-28 03:10:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Channel4 2007-09-24 12:56:24 0 d-------- C:\Program Files\Rockstar Games 2007-09-24 08:54:55 0 d-------- C:\Program Files\MSXML 4.0 2007-09-24 08:31:00 0 d-------- C:\Documents and Settings\Nick\Application Data\ECSoftware 2007-09-24 08:30:41 0 d-------- C:\Program Files\HexEdit 2007-09-24 08:13:56 0 d-------- C:\Documents and Settings\All Users\Application Data\HHD Software 2007-09-24 08:13:30 0 d-------- C:\Program Files\HHD Software 2007-09-20 06:55:07 135168 --a------ C:\WINDOWS\system32\DSKernel2.dll <Not Verified; LEAD Technologies, Inc.; LEADTOOLS Multimedia Filter Pack> 2007-09-20 06:54:58 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2007-09-20 06:54:40 0 d-------- C:\Program Files\Replay Converter 2007-09-20 06:53:50 0 d-------- C:\Documents and Settings\Nick\Application Data\GetRightToGo 2007-09-19 11:30:11 0 d-------- C:\Documents and Settings\Nick\Application Data\Apple Computer 2007-09-19 11:29:55 0 d-------- C:\Program Files\iPod 2007-09-19 11:29:51 0 d-------- C:\Program Files\iTunes 2007-09-19 11:29:05 0 d-------- C:\Program Files\QuickTime 2007-09-19 11:29:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-19 11:28:49 0 d-------- C:\Program Files\Apple Software Update 2007-09-19 11:28:27 0 d-------- C:\Program Files\Common Files\Apple 2007-09-19 11:28:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-09-18 09:48:14 0 d-------- C:\Program Files\Bullfrog 2007-09-17 04:37:38 0 d-------- C:\Program Files\Sierra 2007-09-16 08:53:15 0 d-------- C:\Program Files\Electronic Arts 2007-09-16 08:47:13 0 d-------- C:\Program Files\ACR 2007-09-15 22:53:14 0 d-------- C:\Program Files\Free Download Manager 2007-09-14 05:16:51 506 --a------ C:\WINDOWS\eReg.dat 2007-09-13 21:19:54 0 d-------- C:\WINDOWS\Downloaded Installations 2007-09-12 16:44:26 0 d-------- C:\Program Files\KONAMI 2007-09-12 07:01:19 0 d--h----- C:\WINDOWS\PIF 2007-09-11 13:02:11 0 d-------- C:\Program Files\WinAce 2007-09-11 02:17:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Test Drive Unlimited 2007-09-10 02:21:43 92544 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys <Not Verified; MagicISO, Inc.; MagicISO SCSI Host Controller> 2007-09-10 02:21:42 0 d-------- C:\Program Files\MagicDisc 2007-09-09 05:49:28 38160 --a------ C:\WINDOWS\system32\LMRTREND.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System> 2007-09-09 05:49:27 182032 --a------ C:\WINDOWS\system32\dxtmsft3.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System> 2007-09-09 05:49:23 63488 --a------ C:\WINDOWS\system32\unam4ie.exe <Not Verified; Microsoft Corporation; DirectShow> 2007-09-09 05:49:21 10240 --a------ C:\WINDOWS\system32\vidx16.dll 2007-09-09 05:49:21 194320 --a------ C:\WINDOWS\system32\qcut.dll <Not Verified; Microsoft Corporation; DirectShow> 2007-09-09 05:49:20 4608 --a------ C:\WINDOWS\system32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-09-09 05:49:20 2272 --a------ C:\WINDOWS\system32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-09-09 05:48:13 0 d-------- C:\Program Files\Red Storm Entertainment 2007-09-09 05:41:28 0 d-------- C:\Program Files\MagicISO 2007-09-09 04:04:24 0 d-------- C:\Program Files\XoftSpySE -- Find3M Report --------------------------------------------------------------- 2007-10-09 18:05:25 0 d-------- C:\Program Files\Trend Micro 2007-10-09 14:59:05 0 d-------- C:\Program Files\Ares 2007-10-09 12:35:36 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-10-08 16:21:06 0 d-------- C:\Program Files\EA GAMES 2007-10-08 13:27:59 0 d-------- C:\Documents and Settings\Nick\Application Data\teamspeak2 2007-10-08 13:27:09 0 d-------- C:\Documents and Settings\Nick\Application Data\Xfire 2007-10-04 14:42:34 0 d-------- C:\Program Files\Xfire 2007-10-03 09:31:53 0 d-------- C:\Program Files\DivX 2007-10-02 10:21:34 0 d-------- C:\Program Files\Common Files 2007-10-02 08:09:32 0 d-------- C:\Documents and Settings\Nick\Application Data\LimeWire 2007-09-29 08:24:16 32 --a------ C:\WINDOWS\go 2007-09-28 17:07:52 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-09-17 09:55:58 0 d-------- C:\Program Files\Common Files\InstallShield 2007-09-17 05:21:00 262144 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32> 2007-09-17 05:21:00 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (C) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library> 2007-09-16 06:22:45 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-16 06:22:26 0 d-------- C:\Program Files\AGEIA Technologies 2007-09-16 04:16:18 0 d-------- C:\Program Files\Warcraft III 2007-09-12 16:44:06 0 d-------- C:\Program Files\Call of Duty Game of the Year Edition 2007-09-12 16:42:29 0 d-------- C:\Program Files\Silkroad 2007-09-10 16:43:54 0 d-------- C:\Program Files\EA Sports 2007-09-08 17:53:12 0 dr-h----- C:\Documents and Settings\Nick\Application Data\SecuROM 2007-09-08 06:55:08 0 d-------- C:\Documents and Settings\Nick\Application Data\Adobe 2007-09-08 05:05:26 0 d-------- C:\Program Files\Common Files\Vbox 2007-09-08 05:05:20 0 d-------- C:\Program Files\Common Files\Adobe 2007-09-07 04:29:03 0 d-------- C:\Program Files\GameSpy Arcade 2007-09-05 15:36:00 0 d-------- C:\Program Files\Common Files\DirectX 2007-09-05 15:34:12 0 d-------- C:\Program Files\THQ 2007-09-05 04:13:03 0 d-------- C:\Program Files\BitTorrent 2007-09-03 02:38:40 0 d-------- C:\Program Files\Hide IP Platinum 2007-08-31 17  14 0 d-------- C:\Documents and Settings\Nick\Application Data\dvdcss2007-08-30 23:54:04 0 d-------- C:\Documents and Settings\Nick\Application Data\DivX 2007-08-30 15:04:13 0 d-------- C:\Program Files\PCFriendly 2007-08-30 15:04:13 0 d-------- C:\Program Files\InterActual 2007-08-30 03:35:57 0 d-------- C:\Documents and Settings\Nick\Application Data\BitTorrent 2007-08-30 02:05:14 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-08-27 17:26:27 0 d-------- C:\Program Files\Monolith Productions 2007-08-26 22:15:19 0 d-------- C:\Documents and Settings\Nick\Application Data\Talkback 2007-08-26 22:15:16 0 d-------- C:\Documents and Settings\Nick\Application Data\Mozilla 2007-08-25 02:28:16 0 d-------- C:\Program Files\TGTSoft 2007-08-25 02:07:45 0 d-------- C:\Program Files\PokerStars 2007-08-24 02:49:09 0 d-------- C:\Program Files\Deepblue7 2007-08-21 11:58:33 0 d-------- C:\Documents and Settings\Nick\Application Data\uTorrent 2007-08-21 00:52:20 0 d-------- C:\Program Files\Gpotato 2007-08-20 02:51:24 0 d-------- C:\Documents and Settings\Nick\Application Data\Media Player Classic 2007-08-19 00:49:15 0 d-------- C:\Program Files\STOPzilla! 2007-08-15 16:42:54 0 d-------- C:\Documents and Settings\Nick\Application Data\Ventrilo 2007-08-15 16:41:51 0 d-------- C:\Program Files\Ventrilo 2007-08-15 01:49:16 0 d-------- C:\Program Files\MobMapUpdater 2007-08-13 16:08:41 0 d-------- C:\Program Files\CoD RconTool 2007-08-12 19:59:41 0 d-------- C:\Documents and Settings\Nick\Application Data\Macromedia 2007-08-11 22:33:01 0 d-------- C:\Documents and Settings\Nick\Application Data\ieSpell 2007-08-11 22:32:16 0 d-------- C:\Program Files\ieSpell 2007-08-11 19:07:34 0 d-------- C:\Program Files\LimeWire 2007-08-11 19:07:18 0 d-------- C:\Program Files\Java 2007-07-31 04:00:57 4096 --a------ C:\WINDOWS\d3dx.dat 2007-07-22 01:25:10 62 --ahs---- C:\Documents and Settings\Nick\Application Data\desktop.ini 2007-07-22 00:42:36 0 -rahs---- C:\MSDOS.SYS 2007-07-22 00:42:36 0 -rahs---- C:\IO.SYS 2007-07-22 00:42:36 0 --a------ C:\CONFIG.SYS 2007-07-22 00:42:36 0 --a------ C:\AUTOEXEC.BAT 2007-07-22 00:39:49 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-07-19 17:22:56 77824 --a------ C:\WINDOWS\system32\PgmrX120.dll <Not Verified; ; PgmrX120 Module> 2007-07-19 17:22:56 163840 --a------ C:\WINDOWS\system32\Pgmr120.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [31/08/2006 10:47] "nwiz"="nwiz.exe" [31/08/2006 10:47 C:\WINDOWS\system32\nwiz.exe] "DXM6Patch_981116"="C:\WINDOWS\p_981116.exe" [30/11/1998 18:04] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "mtbhflryee"="c:\windows\system32\mtbhflryee.exe" [31/07/2007 20:13] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [29/06/2007 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [14/09/2007 10:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 13:00] "ares"="C:\Program Files\Ares\Ares.exe" [16/07/2007 22:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^MagicDisc.lnk] path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Registration Ghost Recon Advanced Warfighter® 2.LNK] path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Registration Ghost Recon Advanced Warfighter® 2.LNK backup=C:\WINDOWS\pss\Registration Ghost Recon Advanced Warfighter® 2.LNKStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] C:\WINDOWS\TBPanel.exe /A [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mtbhflryee] c:\windows\system32\mtbhflryee.exe mtbhflryee [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Alarm Clock] C:\Program Files\PC Alarm Clock\pcalarmclock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c7e73bc1-37e9-11dc-8e2b-806d6172696f}] AutoRun\command- D:\Autorun.exe -- End of Deckard's System Scanner: finished at 2007-10-09 18 55 ------------
|
|
     |
| Sponsored Links |
|
10-12-2007, 08:57 AM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant Pop-ups
Hello, and Welcome to TSF.
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Please do not ask for help via Private Message. |
|
|
|
|
10-12-2007, 10:11 AM
|
#4 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 39
OS: XP
|
Re: Constant Pop-ups
ComboFix 07-10-12.4 - Nick 2007-10-12 18:05:22.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1704 [GMT 1:00] Running from: C:\Documents and Settings\Nick\desktop\combofix.exe Command switches used :: /killall * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\pack.epk C:\WINDOWS\system32\mtbhflryee.dat C:\WINDOWS\system32\mtbhflryee.exe C:\WINDOWS\system32\mtbhflryee_nav.dat C:\WINDOWS\system32\mtbhflryee_navps.dat C:\WINDOWS\system32\nvs2.inf . ((((((((((((((((((((((((( Files Created from 2007-09-12 to 2007-10-12 ))))))))))))))))))))))))))))))) . 2007-10-12 18:05 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-09 18:03 <DIR> d-------- C:\Deckard 2007-10-09 17:58 <DIR> d-------- C:\ie-spyad_zo 2007-10-09 17:56 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-09 16:50 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-09 10:08 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\Dev-Cpp 2007-10-09 10:08 <DIR> d-------- C:\Dev-Cpp 2007-10-07 10:35 <DIR> d-------- C:\Program Files\WOWUploader 2007-10-07 10:35 <DIR> d-------- C:\Program Files\World of Warcraft 2007-10-07 10:35 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\WoWUploader 2007-10-07 09:58 <DIR> d-------- C:\Program Files\Cheat Engine 2007-10-07 09:58 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll 2007-10-07 09:58 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll 2007-10-01 09:13 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\Free Download Manager 2007-10-01 09:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG 2007-09-29 12:25 <DIR> d-------- C:\Program Files\Common Files\Real 2007-09-28 17:08 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 17:07 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-09-28 17:07 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-09-28 03:13 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2007-09-28 03:12 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2007-09-28 03:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kontiki 2007-09-28 03:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Channel4 2007-09-24 12:56 <DIR> d-------- C:\Program Files\Rockstar Games 2007-09-24 08:54 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-09-24 08:35 <DIR> d-------- C:\Documents and Settings\Gtasasav\GTA San Andreas User Files 2007-09-24 08:31 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\ECSoftware 2007-09-24 08:30 <DIR> d-------- C:\Program Files\HexEdit 2007-09-24 08:13 <DIR> d-------- C:\Program Files\HHD Software 2007-09-24 08:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HHD Software 2007-09-20 06:55 1,936,528 --a------ C:\WINDOWS\system32\ltmm15.dll 2007-09-20 06:55 135,168 --a------ C:\WINDOWS\system32\DSKernel2.dll 2007-09-20 06:54 <DIR> d-------- C:\Program Files\Replay Converter 2007-09-20 06:54 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-09-20 06:53 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\GetRightToGo 2007-09-19 11:30 <DIR> d-------- C:\Documents and Settings\Nick\Application Data\Apple Computer 2007-09-19 11:29 <DIR> d-------- C:\Program Files\QuickTime 2007-09-19 11:29 <DIR> d-------- C:\Program Files\iTunes 2007-09-19 11:29 <DIR> d-------- C:\Program Files\iPod 2007-09-19 11:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-19 11:28 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-09-19 11:28 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-19 11:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2007-09-18 09:48 <DIR> d-------- C:\Program Files\Bullfrog 2007-09-17 04:37 <DIR> d-------- C:\Program Files\Sierra 2007-09-16 08:53 <DIR> d-------- C:\Program Files\Electronic Arts 2007-09-16 08:47 <DIR> d-------- C:\Program Files\ACR 2007-09-15 22:53 <DIR> d-------- C:\Program Files\Free Download Manager 2007-09-14 05:16 506 --a------ C:\WINDOWS\eReg.dat 2007-09-13 21:19 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-12 16:44 <DIR> d-------- C:\Program Files\KONAMI 2007-09-12 07:01 <DIR> d--h----- C:\WINDOWS\PIF . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-12 13:11 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-10-12 13:09 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-10-10 08:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-10 08:31 --------- d-----w C:\Program Files\EA GAMES 2007-10-10 07:27 --------- d-----w C:\Program Files\Ares 2007-10-09 17:05 --------- d-----w C:\Program Files\Trend Micro 2007-10-09 09:38 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-10-08 12:27 --------- d-----w C:\Documents and Settings\Nick\Application Data\Xfire 2007-10-08 12:27 --------- d-----w C:\Documents and Settings\Nick\Application Data\teamspeak2 2007-10-04 13:42 --------- d-----w C:\Program Files\Xfire 2007-10-03 08:31 --------- d-----w C:\Program Files\DivX 2007-10-02 07:09 --------- d-----w C:\Documents and Settings\Nick\Application Data\LimeWire 2007-09-29 11:25 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2007-09-29 11:25 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2007-09-28 16:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2007-09-28 16:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 16:05 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 16:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-09-28 16:05 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 16:05 739,840 ----a-w C:\WINDOWS\system32\DivX.dll 2007-09-28 16:05 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 16:05 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-09-28 16:05 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 16:05 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-09-28 16:05 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-09-28 16:05 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-09-28 16:05 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-17 10:02 --------- d-----w C:\Program Files\WinAce 2007-09-17 08:55 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-17 04:21 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-09-17 04:21 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2007-09-17 03:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-09-16 05:22 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-09-16 05:22 --------- d-----w C:\Program Files\AGEIA Technologies 2007-09-16 03:16 --------- d-----w C:\Program Files\Warcraft III 2007-09-12 15:44 --------- d-----w C:\Program Files\Call of Duty Game of the Year Edition 2007-09-12 15:42 --------- d-----w C:\Program Files\Silkroad 2007-09-11 01:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Test Drive Unlimited 2007-09-10 15:43 --------- d-----w C:\Program Files\EA Sports 2007-09-10 01:21 --------- d-----w C:\Program Files\MagicDisc 2007-09-09 04:49 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-09-09 04:48 --------- d-----w C:\Program Files\Red Storm Entertainment 2007-09-09 04:41 --------- d-----w C:\Program Files\MagicISO 2007-09-09 04:31 --------- d-----w C:\Program Files\XoftSpySE 2007-09-08 16:53 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-09-08 16:53 --------- d--h--r C:\Documents and Settings\Nick\Application Data\SecuROM 2007-09-08 04:05 --------- d-----w C:\Program Files\Common Files\Vbox 2007-09-08 04:05 --------- d-----w C:\Program Files\Common Files\Adobe 2007-09-07 03:29 --------- d-----w C:\Program Files\GameSpy Arcade 2007-09-05 14:36 --------- d-----w C:\Program Files\Common Files\DirectX 2007-09-05 14:34 --------- d-----w C:\Program Files\THQ 2007-09-05 03:13 --------- d-----w C:\Program Files\BitTorrent 2007-09-05 01:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2007-09-05 00:46 92,544 ----a-w C:\WINDOWS\system32\drivers\mcdbus.sys 2007-09-04 22:24 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-09-03 01:38 --------- d-----w C:\Program Files\Hide IP Platinum 2007-08-31 16:06 --------- d-----w C:\Documents and Settings\Nick\Application Data\dvdcss 2007-08-30 22:54 --------- d-----w C:\Documents and Settings\Nick\Application Data\DivX 2007-08-30 14:04 --------- d-----w C:\Program Files\PCFriendly 2007-08-30 14:04 --------- d-----w C:\Program Files\InterActual 2007-08-30 02:35 --------- d-----w C:\Documents and Settings\Nick\Application Data\BitTorrent 2007-08-30 01:05 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-08-27 16:26 --------- d-----w C:\Program Files\Monolith Productions 2007-08-26 21:15 --------- d-----w C:\Documents and Settings\Nick\Application Data\Talkback 2007-08-25 01:28 --------- d-----w C:\Program Files\TGTSoft 2007-08-25 01:07 --------- d-----w C:\Program Files\PokerStars 2007-08-24 01:49 --------- d-----w C:\Program Files\Deepblue7 2007-08-21 23:44 33,952 ----a-w C:\WINDOWS\system32\drivers\oreans32.sys 2007-08-21 12:43 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire 2007-08-21 10:58 --------- d-----w C:\Documents and Settings\Nick\Application Data\uTorrent 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-20 23:52 --------- d-----w C:\Program Files\Gpotato 2007-08-20 19:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7 2007-08-20 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-08-20 01:51 --------- d-----w C:\Documents and Settings\Nick\Application Data\Media Player Classic 2007-08-18 23:49 --------- d-----w C:\Program Files\STOPzilla! 2007-08-18 23:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\STOPzilla! 2007-08-15 15:42 --------- d-----w C:\Documents and Settings\Nick\Application Data\Ventrilo 2007-08-15 15:41 --------- d-----w C:\Program Files\Ventrilo 2007-08-15 12:56 5,120 ----a-w C:\WINDOWS\system32\drivers\23F3C66C-1946-46E5-8E13-20E002EDA22E.cxv 2007-08-15 00:49 --------- d-----w C:\Program Files\MobMapUpdater 2007-08-13 15:08 --------- d-----w C:\Program Files\CoD RconTool 2007-07-30 18:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 18:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 18:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 18:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 18:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 18:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 18:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 18:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-26 02:53 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-07-26 02:53 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe 2007-07-26 02:53 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe 2007-07-19 16:22 77,824 ----a-w C:\WINDOWS\system32\PgmrX120.dll 2007-07-19 16:22 163,840 ----a-w C:\WINDOWS\system32\Pgmr120.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-31 10:47] "nwiz"="nwiz.exe" [2006-08-31 10:47 C:\WINDOWS\system32\nwiz.exe] "DXM6Patch_981116"="C:\WINDOWS\p_981116.exe" [1998-11-30 18:04] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-14 10:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00] "ares"="C:\Program Files\Ares\Ares.exe" [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^MagicDisc.lnk] path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^Registration Ghost Recon Advanced Warfighter® 2.LNK] path=C:\Documents and Settings\Nick\Start Menu\Programs\Startup\Registration Ghost Recon Advanced Warfighter® 2.LNK backup=C:\WINDOWS\pss\Registration Ghost Recon Advanced Warfighter® 2.LNKStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] C:\WINDOWS\TBPanel.exe /A [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mtbhflryee] c:\windows\system32\mtbhflryee.exe mtbhflryee [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Alarm Clock] C:\Program Files\PC Alarm Clock\pcalarmclock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys S3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys S3 NTProcDrv;Process creation detector for NT.;\??\C:\Documents and Settings\Nick\Desktop\NtProcDrv.sys . Contents of the 'Scheduled Tasks' folder "2007-10-08 10:48:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-12 18:07:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-12 18:07:45 . --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:11:27, on 12/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\KSE\nHancer 32bit\nHancerService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: nHancer Support (nHancer) - KSE - Korndörfer Software Engineering - C:\Program Files\KSE\nHancer 32bit\nHancerService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 5072 bytes |
|
|
|
|
10-12-2007, 10:39 AM
|
#5 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant Pop-ups
Your popups should be abated. Please let me know if this is the case. We have more work to do.
P2P - I see you have P2P software ( Limewire, Ares 2.0.9 ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. --------------------------------------------------------------------------------------------- Copy and paste the following into Notepad (don't forget to copy and paste REGEDIT4): Quote:
 Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards. --------------------------------------------------------------------------------------------- I see no evidence of an AntiVirus program on your system. This must be resolved. Connecting to the Internet without antivirus protection is a "Welcome" doormat for malware. It can take as little as eight seconds to infect an unprotected computer. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out. --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
--------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the licence, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
|
10-12-2007, 01:52 PM
|
#6 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 39
OS: XP
|
Re: Constant Pop-ups
Sorry for the long wait, took a very long time to scan.
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Friday, October 12, 2007 9:50:06 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 12/10/2007 Kaspersky Anti-Virus database records: 435152 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ Scan Statistics: Total number of scanned objects: 94331 Number of viruses found: 2 Number of infected objects: 4 Number of suspicious objects: 0 Duration of the scan process: 01:31:08 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\backup\WINDOWS\Downloaded Program Files\gsda.dll Infected: not-a-virus:Downloader.Win32.SpyGame skipped C:\Deckard\System Scanner\backup\WINDOWS\temp\NSIS_Install_igb.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped C:\Deckard\System Scanner\backup\WINDOWS\temp\NSIS_Install_igb.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.bw skipped C:\Deckard\System Scanner\backup\WINDOWS\temp\NSIS_Install_igb.exe NSIS: infected - 2 skipped C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Nick\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Nick\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\History\History.IE5\MSHist012007101220071013\index.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\Free Download Manager\tic1.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\Free Download Manager\tic3.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\Free Download Manager\tic5.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\Free Download Manager\tic6.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\~DF3916.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\~DF3922.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\~DFB688.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temp\~DFB69F.tmp Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Nick\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Nick\My Documents\New Folder\Glider.exe Object is locked skipped C:\Documents and Settings\Nick\My Documents\Somerthing Different\Glider.exe Object is locked skipped C:\Documents and Settings\Nick\My Documents\Something\Glider.exe Object is locked skipped C:\Documents and Settings\Nick\My Documents\Something\yknkftz.exe Object is locked skipped C:\Documents and Settings\Nick\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Nick\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Nick\UserData\index.dat Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{807008CD-A97B-4B11-A9E1-88E2F381FD76}\RP142\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:50:35, on 12/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\KSE\nHancer 32bit\nHancerService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: nHancer Support (nHancer) - KSE - Korndörfer Software Engineering - C:\Program Files\KSE\nHancer 32bit\nHancerService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 6358 bytes |
|
|
|
|
10-12-2007, 02:26 PM
|
#7 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant Pop-ups
Please go to: VirusTotal
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
|
10-12-2007, 02:36 PM
|
#8 (permalink) |
|
Registered User
Join Date: Oct 2007
Posts: 39
OS: XP
|
Re: Constant Pop-ups
Oh, just to say, Glider is infact safe. It's an AFK bot for WoW. Alot of people use it and also find that their anti virus finds it as a virus. Search it in google.
My results anyhow : 0 bytes size received / Se ha recibido un archivo vacio 0 bytes size received / Se ha recibido un archivo vacio Get the same message for both.. |
|
|
|
|
10-12-2007, 03:53 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 32,559
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant Pop-ups
I use Google, and many other resources. The fact that it's locked caused suspicion.
I was relatively sure about glider, but when a randomly named executable file is locked, it deserves investigation. It may well be associated with glider, though, as it's in the same folder. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures (including deletion of the Deckard finds by Kaspersky) and reset System Restore points. ------------------------------------------------------------------------------------------------------------------------------- Other than that..... Your logs appear clean.You should be good to go. We still have a few items to address. Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs if you don't have them already:
Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Please do not ask for help via Private Message. |
|
|
|
| Thread Tools | |
|
|
-> Run -> paste in the following single line command & click OK
