|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-14-2008, 07:08 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Pop-ups when starting IE or firefox
I have a little problem with pop-ups at the moment. When I start Firefox then a pop in IE comes up and same is with strating Internet Explorer 7.
Here is HijackThis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:08:15, on 14.01.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Launchy\Launchy.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 5601 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-17-2008, 05:07 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hello and welcome to TSF.
 Sorry for the delayed response. If you have not received help elsewhere and still need help please follow the instructions in IMPORTANT - Read This Before Posting A Log and post the two text files, main.txt and extra.txt produced by the Deckard's System Scanner (formerly Comboscan), as it has been a while since you posted.
__________________
My services are free. However, you can donate to TSF to help keep it running.   Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 05:24 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
yes, I still need help. Thank you for replying.
Here are the new logs: MAIN.TXT Deckard's System Scanner v20071014.68 Run by Administrator on 2008-01-18 14:17:59 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 12: 2008-01-18 12:18:02 UTC - RP12 - Deckard's System Scanner Restore Point 11: 2008-01-17 17:05:59 UTC - RP11 - Installed ATI Catalyst Control Center 10: 2008-01-16 20:39:04 UTC - RP10 - Software Distribution Service 3.0 9: 2008-01-16 18:27:04 UTC - RP9 - Installed Adobe Photoshop CS2 8: 2008-01-16 14:05:57 UTC - RP8 - Installed Call of Duty(R) 4 - Modern Warfare(TM) -- First Restore Point -- 1: 2008-01-14 20:30:47 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:18:23, on 18.01.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Launchy\Launchy.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\ADMINI~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6465 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080112-151224-905 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) -- File Associations ----------------------------------------------------------- .bat - batfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,71 .inf - inffile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69 .ini - inifile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69 .txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,70 -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 atitray - c:\program files\ray adams\ati tray tools\atitray.sys R1 LHidKEE - c:\windows\system32\drivers\lhidkee.sys R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu> S3 catchme - c:\docume~1\admini~1\locals~1\temp\catchme.sys (file missing) S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> S3 FXDrv32 - e:\fxdrv32.sys (file missing) S3 LHidUsbK (Logitech SetPoint USB Receiver device driver) - c:\windows\system32\drivers\lhidusbk.sys <Not Verified; Logitech, Inc.; Logitech SetPoint(TM)> S3 LMouKE (Logitech SetPoint Mouse Filter Driver) - c:\windows\system32\drivers\lmouke.sys (file missing) S3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> S3 AresChatServer (Ares Chatroom server) - c:\program files\ares\chatserver.exe <Not Verified; Ares Development Group; Ares Chat Server> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-01-11 20:49:07 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-12-18 and 2008-01-18 ----------------------------- 2008-01-17 19:10:43 0 d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-01-17 19:10:16 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-01-16 20:28:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2008-01-16 20:27:59 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-01-16 19:43:52 0 d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-01-16 18:48:53 0 d-------- C:\Program Files\PowerISO 2008-01-16 16:13:55 0 d-------- C:\WINDOWS\system32\LogFiles 2008-01-16 16  43 0 d-------- C:\Program Files\Activision2008-01-16 16:05:30 0 d--hs---- C:\WINDOWS\ftpcache 2008-01-16 15:44:01 0 d-------- C:\WINDOWS\%DownloadedProgramFiles% 2008-01-15 09:40:41 0 d-------- C:\Program Files\Common Files\NSV 2008-01-14 21:48:59 2392 --a------ C:\WINDOWS\system32\tmp.reg 2008-01-14 21:19:19 0 d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2008-01-14 21:19:18 0 d-------- C:\Documents and Settings\Administrator\Application Data\Logitech 2008-01-14 21:17:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2008-01-14 21:17:55 0 d-------- C:\Program Files\Common Files\Logishrd 2008-01-14 21:17:51 0 d-------- C:\Program Files\Logitech 2008-01-14 21:07:46 0 d---s---- C:\Documents and Settings\Administrator\Recent 2008-01-14 21:01:10 0 d-------- C:\Program Files\Winamp 2008-01-14 21:01:10 0 d-------- C:\Documents and Settings\Administrator\Application Data\Winamp 2008-01-14 16:32:43 0 d-------- C:\Program Files\game 2008-01-13 22:11:30 0 d-------- C:\WINDOWS\ERUNT 2008-01-13 21:58:44 0 d-------- C:\WINDOWS\system32\appmgmt 2008-01-13 20:51:26 0 d-------- C:\WINDOWS\CSC 2008-01-13 20:34:28 0 d-------- C:\Program Files\MoveOnBoot 2008-01-13 20:34:28 0 d-------- C:\Program Files\Common Files\Gibinsoft Shared 2008-01-13 20:18:58 0 d-------- C:\WINDOWS\BDOSCAN8 2008-01-13 14:05:08 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-01-13 02:34:26 0 d-------- C:\Program Files\Bethesda Softworks 2008-01-13 01:38:11 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-01-13 00:58:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\Styler 2008-01-13 00:57:37 0 d-------- C:\Program Files\Styler 2008-01-13 00:44:28 0 d-------- C:\Program Files\Common Files\Stardock 2008-01-13 00:31:25 0 d-------- C:\VISTA PACK 2 2008-01-13 00:17:58 0 d-------- C:\Program Files\Stardock 2008-01-12 23:22:10 0 d-------- C:\Program Files\Driver Cleaner Pro 2008-01-12 20:38:03 0 d-------- C:\Program Files\Steam 2008-01-12 14:15:20 0 d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue 2008-01-12 14:15:15 0 d-------- C:\Program Files\Uniblue 2008-01-12 13:25:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-12 13:21:35 0 d-------- C:\Program Files\Ares 2008-01-12 13:20:04 0 d-------- C:\Program Files\Trend Micro 2008-01-12 13:16:35 2855 --a------ C:\WINDOWS\system32\mem.PIF 2008-01-12 13:16:35 0 d--h----- C:\WINDOWS\PIF 2008-01-12 12:19:27 0 d-------- C:\Program Files\Lavasoft 2008-01-12 12:19:27 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-12 11:45:11 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-01-12 11:44:45 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-01-12 11:44:45 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-01-12 11:44:15 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-12 11:38:05 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-12 11:30:55 0 d-------- C:\Program Files\SystemRequirementsLab 2008-01-12 11:30:47 0 d-------- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab 2008-01-12 11:30:41 0 d-------- C:\WINDOWS\Sun 2008-01-12 11:29:05 0 d-------- C:\Program Files\Java 2008-01-12 11:29:03 0 d-------- C:\Program Files\Common Files\Java 2008-01-12 11:28:35 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun 2008-01-11 22:50:22 0 d-------- C:\Program Files\CCleaner 2008-01-11 22:45:49 0 d-------- C:\Documents and Settings\Administrator\Application Data\Launchy 2008-01-11 22:45:44 0 d-------- C:\Program Files\Launchy 2008-01-11 22:34:53 0 d-------- C:\OC Programmid 2008-01-11 22:32:00 0 d-------- C:\Program Files\FOXCONN 2008-01-11 21:41:22 0 d-------- C:\WINDOWS\system32\PreInstall 2008-01-11 20:49:57 0 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer 2008-01-11 20:49:47 0 d-------- C:\Program Files\iPod 2008-01-11 20:49:44 0 d-------- C:\Program Files\iTunes 2008-01-11 20:49:16 0 d-------- C:\Program Files\QuickTime 2008-01-11 20:49:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-01-11 20:49:04 0 d-------- C:\Program Files\Apple Software Update 2008-01-11 20:48:34 0 d-------- C:\Program Files\Common Files\Apple 2008-01-11 20:48:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-01-11 20:43:23 86144 --a------ C:\WINDOWS\system32\drivers\LHidKEE.sys 2008-01-11 20:43:12 0 d-------- C:\Documents and Settings\Administrator\Application Data\BSplayer PRO 2008-01-11 20:43:10 0 d-------- C:\Program Files\Webteh 2008-01-11 20:36:15 164352 --a------ C:\WINDOWS\system32\unrar.dll 2008-01-11 20:36:08 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-01-11 20:36:07 0 d-------- C:\Program Files\K-Lite Codec Pack 2008-01-11 20:23:45 352 --ah----- C:\WINDOWS\nod32fixtemdono.reg 2008-01-11 20:22:54 0 d-------- C:\Documents and Settings\Administrator\Application Data\ESET 2008-01-11 20:21:26 0 d-------- C:\Documents and Settings\All Users\Application Data\ESET 2008-01-11 20:00:54 0 d-------- C:\WINDOWS\system32\Futuremark 2008-01-11 20:00:54 3972 -----n--- C:\WINDOWS\system32\drivers\PciBus.sys 2008-01-11 20:00:54 21664 --a------ C:\WINDOWS\system32\drivers\Entech.sys <Not Verified; EnTech Taiwan; PowerStrip> 2008-01-11 20:00:20 0 d-------- C:\Program Files\Futuremark 2008-01-11 19:52:59 0 d-------- C:\Program Files\Lavalys 2008-01-11 19:48:20 0 d-------- C:\WINDOWS\RegisteredPackages 2008-01-11 19:47:32 0 d-------- C:\Documents and Settings\Administrator\Application Data\WinRAR 2008-01-11 19:43:35 0 d-------- C:\Program Files\uTorrent 2008-01-11 19:43:05 0 d-------- C:\Documents and Settings\Administrator\Application Data\uTorrent 2008-01-11 19:38:20 0 d-------- C:\Documents and Settings\Administrator\Application Data\atitray 2008-01-11 19:38:07 0 d-------- C:\Program Files\Ray Adams 2008-01-11 19:23:30 0 d-------- C:\Downloads 2008-01-11 19:19:55 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-01-11 19:18:47 0 d-------- C:\WINDOWS\system32\RTCOM 2008-01-11 19:18:13 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-01-11 19:15:48 0 d-------- C:\WINDOWS\system32\xircom 2008-01-11 19:15:47 0 d-------- C:\Program Files\microsoft frontpage 2008-01-11 19:15:18 0 d-------- C:\WINDOWS\Prefetch 2008-01-11 19:10:17 0 d-------- C:\WINDOWS\ServicePackFiles 2008-01-11 18:36:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-01-11 18:33:00 36608 --a------ C:\WINDOWS\system32\drivers\LHidUsbK.sys <Not Verified; Logitech, Inc.; Logitech SetPoint(TM)> 2008-01-11 18:23:47 0 d-------- C:\Program Files\Messenger Plus! Live 2008-01-11 18:19:25 0 d-------- C:\Documents and Settings\Administrator\Contacts 2008-01-11 18:17:00 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-01-11 18:16:55 0 d-------- C:\Program Files\Common Files\Adobe 2008-01-11 18 33 0 d-------- C:\Program Files\Microsoft ActiveSync2008-01-11 18 03 0 d-------- C:\WINDOWS\SHELLNEW2008-01-11 18:05:53 0 d-------- C:\Program Files\Microsoft.NET 2008-01-11 18:04:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro 2008-01-11 18:03:40 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-01-11 18:03:13 0 d-------- C:\Program Files\Windows Live 2008-01-11 18:03:06 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-11 18:02:53 0 d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-01-11 18:02:27 0 d-------- C:\Program Files\DAEMON Tools Pro 2008-01-11 18:00:21 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-01-11 17:55:02 0 d--hs---- C:\WINDOWS\Installer 2008-01-11 17:55:01 0 d-------- C:\Program Files\Common Files\ODBC 2008-01-11 17:54:55 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-01-11 17:54:54 0 dr------- C:\Program Files 2008-01-11 17:54:54 0 d-------- C:\Program Files\Common Files 2008-01-11 17:54:12 0 d--h----- C:\Documents and Settings\Default User\Templates 2008-01-11 17:54:12 0 dr------- C:\Documents and Settings\Default User\Start Menu 2008-01-11 17:54:12 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2008-01-11 17:54:12 0 d--h----- C:\Documents and Settings\Default User\Recent 2008-01-11 17:54:12 0 d--h----- C:\Documents and Settings\Default User\PrintHood 2008-01-11 17:54:12 0 d--h----- C:\Documents and Settings\Default User\NetHood 2008-01-11 17:54:12 0 d-------- C:\Documents and Settings\Default User\My Documents 2008-01-11 17:54:12 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2008-01-11 17:54:12 0 d-------- C:\Documents and Settings\Default User\Favorites 2008-01-11 17:54:12 0 d-------- C:\Documents and Settings\Default User\Desktop 2008-01-11 17:54:12 0 d---s---- C:\Documents and Settings\Default User\Cookies 2008-01-11 17:54:12 0 d--h----- C:\Documents and Settings\All Users\Templates 2008-01-11 17:54:12 0 dr------- C:\Documents and Settings\All Users\Start Menu 2008-01-11 17:54:12 0 d-------- C:\Documents and Settings\All Users\Favorites 2008-01-11 17:54:12 0 dr------- C:\Documents and Settings\All Users\Documents 2008-01-11 17:54:12 0 d-------- C:\Documents and Settings\All Users\Desktop 2008-01-11 17:53:57 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-01-11 17:53:57 0 d-------- C:\WINDOWS\system32\CatRoot 2008-01-11 17:53:52 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2008-01-11 17:53:52 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2008-01-11 17:53:52 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2008-01-11 17:53:52 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-01-11 17:53:19 0 d--hs---- C:\System Volume Information 2008-01-11 17:53:19 0 d-------- C:\Documents and Settings 2008-01-11 17:47:01 0 d-------- C:\WINDOWS 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\WinSxS 2008-01-11 17:47:01 0 dr------- C:\WINDOWS\Web 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\twain_32 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\wins 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\wbem 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\usmt 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\spool 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\ShellExt 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\Setup 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\ras 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\oobe 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\npp 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\mui 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\inetsrv 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\IME 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\icsxml 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\ias 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\export 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\drivers 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-01-11 17:47:01 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\dhcp 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\config 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\3076 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\2052 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1054 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1042 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1041 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1037 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1033 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1031 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1028 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system32\1025 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\system 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\security 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Resources 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\repair 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Provisioning 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\PeerNet 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\pchealth 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\mui 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\msapps 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\msagent 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Media 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\java 2008-01-11 17:47:01 0 d--h----- C:\WINDOWS\inf 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\ime 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Help 2008-01-11 17:47:01 0 dr--s---- C:\WINDOWS\Fonts 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\ehome 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Driver Cache 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Debug 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Cursors 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Connection Wizard 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\Config 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\AppPatch 2008-01-11 17:47:01 0 d-------- C:\WINDOWS\addins 2008-01-11 17:12:28 0 d-------- C:\WINDOWS\system32\Lang 2008-01-11 17:11:25 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-01-11 17:11:14 0 d-------- C:\Documents and Settings\Administrator\Application Data\InstallShield 2008-01-11 17:10:30 0 d-------- C:\Program Files\AMD 2008-01-11 16:51:26 0 d-------- C:\WINDOWS\Downloaded Installations 2008-01-11 16:46:52 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2008-01-11 16:46:52 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2008-01-11 16:46:49 1279 --a------ C:\WINDOWS\mozver.dat 2008-01-11 16:45:53 0 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-01-11 16:45:45 0 --a------ C:\WINDOWS\nsreg.dat 2008-01-11 16:45:44 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla 2008-01-11 16:33:45 0 d-------- C:\Documents and Settings\Administrator\Application Data\ATI 2008-01-11 16:31:15 593920 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart> 2008-01-11 16:15:35 0 d-------- C:\WINDOWS\OPTIONS 2008-01-11 16:13:53 0 d-------- C:\Program Files\Realtek 2008-01-11 16:13:08 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-01-11 16:12:55 0 d-------- C:\Program Files\ATI Technologies 2008-01-11 16:12:53 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-01-11 16:12:20 0 d-------- C:\Program Files\Common Files\InstallShield 2008-01-11 16:12:10 0 d-------- C:\ATI 2008-01-11 16:08:59 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-01-11 16:07:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities 2008-01-11 16:07:14 0 d--h----- C:\Documents and Settings\Administrator\Templates 2008-01-11 16:07:14 0 dr------- C:\Documents and Settings\Administrator\Start Menu 2008-01-11 16:07:14 0 dr-h----- C:\Documents and Settings\Administrator\SendTo 2008-01-11 16:07:14 0 d--h----- C:\Documents and Settings\Administrator\PrintHood 2008-01-11 16:07:14 2883584 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT 2008-01-11 16:07:14 0 d--h----- C:\Documents and Settings\Administrator\NetHood 2008-01-11 16:07:14 0 dr------- C:\Documents and Settings\Administrator\My Documents 2008-01-11 16:07:14 0 d--h----- C:\Documents and Settings\Administrator\Local Settings 2008-01-11 16:07:14 0 d---s---- C:\Documents and Settings\Administrator\Favorites 2008-01-11 16:07:14 0 d-------- C:\Documents and Settings\Administrator\Desktop 2008-01-11 16:07:14 0 d--hs---- C:\Documents and Settings\Administrator\Cookies 2008-01-11 16:07:14 0 dr-h----- C:\Documents and Settings\Administrator\Application Data 2008-01-11 16:07:07 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-01-11 16 59 0 d---s---- C:\WINDOWS\system32\Microsoft2008-01-11 16 58 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT2008-01-11 16 58 0 d--h----- C:\Documents and Settings\LocalService\Local Settings2008-01-11 16 58 0 d--hs---- C:\Documents and Settings\LocalService\Cookies2008-01-11 16 58 0 d-------- C:\Documents and Settings\LocalService\Application Data2008-01-11 16 58 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft2008-01-11 16 54 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT2008-01-11 16 54 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings2008-01-11 16 54 0 d---s---- C:\Documents and Settings\NetworkService\Cookies2008-01-11 16 54 0 d-------- C:\Documents and Settings\NetworkService\Application Data2008-01-11 16 54 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft2008-01-11 16 03 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT2008-01-11 16:05:57 0 -rahs---- C:\MSDOS.SYS 2008-01-11 16:05:57 0 -rahs---- C:\IO.SYS 2008-01-11 16:05:57 0 --a------ C:\CONFIG.SYS 2008-01-11 16:05:57 0 --a------ C:\AUTOEXEC.BAT 2008-01-11 16:04:57 0 d--hs---- C:\Documents and Settings\All Users\DRM 2008-01-11 16:04:49 0 dr------- C:\WINDOWS\Offline Web Pages 2008-01-11 16:04:49 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-01-11 16:04:41 0 d--h----- C:\Program Files\WindowsUpdate 2008-01-11 16:04:16 0 d-------- C:\WINDOWS\system32\DirectX 2008-01-11 16:03:26 0 d---s---- C:\WINDOWS\Tasks 2008-01-11 16:03:25 0 d-------- C:\Program Files\Common Files\MSSoap 2008-01-11 16:03:20 0 d-------- C:\WINDOWS\srchasst 2008-01-11 16:03:19 0 d-------- C:\WINDOWS\system32\Macromed 2008-01-11 16:03:08 0 d-------- C:\Program Files\Movie Maker 2008-01-11 16:02:57 0 d-------- C:\WINDOWS\system32\Restore 2008-01-11 16:02:17 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-01-11 16:02:03 0 d-------- C:\WINDOWS\Registration 2008-01-11 16:01:56 0 d-------- C:\Program Files\Online Services 2008-01-11 16:01:50 0 d-------- C:\Program Files\Messenger 2008-01-11 16:01:44 0 d-------- C:\Program Files\MSN Gaming Zone 2008-01-11 16:00:52 0 d-------- C:\Program Files\Windows NT 2008-01-11 16:00:48 0 d-------- C:\WINDOWS\system32\MsDtc 2008-01-11 16:00:46 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2008-01-11 17:54:12 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini 2007-10-25 10:26:48 53248 --a------ C:\WINDOWS\bdoscandel.exe 2007-10-20 20:17:08 39424 --a------ C:\WINDOWS\runtime.exe <Not Verified; NirSoft; IE PassView> 2007-10-19 19:43:58 491520 --a------ C:\WINDOWS\dependencies.exe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [23.07.2007 11:06] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10.10.2007 19:51] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [21.09.2007 03:10 C:\WINDOWS\KHALMNPR.Exe] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [21.12.2007 08:21] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [11.12.2007 10:56] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [11.12.2007 12:10] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25.09.2007 01:11] "RTHDCPL"="RTHDCPL.EXE" [20.12.2007 16:47 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [21.09.2007 03:10 C:\WINDOWS\KHALMNPR.Exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [10.11.2006 12:35] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [22.05.2007 11:04] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13.10.2004 18:24] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [03.08.2004 23:56] C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [16.03.2005 19:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [11.01.2008 22:45:44] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [14.01.2008 21:18:07] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20.12.2006 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19.04.2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 15.11.2007 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-01-18 14:19:13 ------------ |
|
|
|
|
01-18-2008, 07:13 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hi,
Nothing in the logs suggests the cause of the popups so far. We'll have a deeper look. First, I would like to warn you about p2p file sharing which is one of the main sources of infection. I see that you are using Varez and uTorrent. The nature of P2P filesharing is so that even if one is using a "clean" program, many of the files downloaded from non-documented sources have the potential of being infected. So, regardless of whether one is using a "clean" program, one may still be prone to infection by malware because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. Also by default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple, file sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. I recommend very strongly that you remove them from your system via Add/Remove Programs in Control Panel. ================================ Submit a file to Jotti Please go here : http://virusscan.jotti.org/ On top of the page there is a field to add the filepath, copy and paste this filepath: c:\windows\system32\drivers\lhidkee.sys Then hit Submit The scan will take a while before the result comes up so please be patient. Then copy the result and post it here in this thread. If Jotti's service load is too high, you can use the following scanner instead: http://www.virustotal.com/xhtml/index_en.html ================================= Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix **Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop** Link 1 Link 2 Link 3 -------------------------------------------------------------------- 1. Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. 2. Disable all anti virus and anti malware programs and disconnect from the internet. -------------------------------------------------------------------- Double click on ComboFix.exe & follow the prompts.
Note: Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 08:04 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
There is a problem with submitting file to Jotti and Virustotal. They both say that 0 bytes sent and nothing happens. Waited quite long for something, but still...nothing. I disabled ESET Personal Firewall and tried then and still it said 0 bytes sent.
Here are ComboFix log and HijackThis log: ComboFix: ComboFix 08-01-18.4 - Administrator 2008-01-18 16:49:07.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1257.1.1033.18.1525 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete . ((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))) . 2008-01-18 16:51 . 2008-01-18 16:51 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk 2008-01-18 16:30 . 2008-01-18 16:30 <DIR> d-------- C:\Program Files\DivX 2008-01-18 14:17 . 2008-01-18 14:17 <DIR> d-------- C:\Deckard 2008-01-17 19:10 . 2008-01-17 19:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-01-17 19:10 . 2008-01-17 19:10 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-01-16 20:28 . 2008-01-16 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2008-01-16 20:27 . 2008-01-16 20:27 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-01-16 19:43 . 2008-01-16 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-01-16 18:48 . 2008-01-16 18:48 <DIR> d-------- C:\Program Files\PowerISO 2008-01-16 16:14 . 2008-01-16 20:44 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-01-16 16:14 . 2008-01-16 16:14 22,328 --a------ C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys 2008-01-16 16:13 . 2008-01-16 16:13 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-01-16 16:13 . 2008-01-16 20:44 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-01-16 16:13 . 2008-01-16 20:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-01-16 16:13 . 2008-01-16 16:13 319 --a------ C:\WINDOWS\game.ini 2008-01-16 16:06 . 2008-01-16 16:06 <DIR> d-------- C:\Program Files\Activision 2008-01-16 16:05 . 2008-01-16 16:05 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-01-16 15:44 . 2008-01-16 15:44 <DIR> d-------- C:\WINDOWS\%DownloadedProgramFiles% 2008-01-16 15:41 . 2006-07-27 13:52 367 --a------ C:\WINDOWS\system32\LegitCheckControl.inf 2008-01-15 09:40 . 2008-01-15 09:40 <DIR> d-------- C:\Program Files\Common Files\NSV 2008-01-14 21:48 . 2008-01-14 21:51 2,392 --a------ C:\WINDOWS\system32\tmp.reg 2008-01-14 21:19 . 2008-01-14 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2008-01-14 21:19 . 2008-01-14 21:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Logitech 2008-01-14 21:18 . 2007-11-15 10:06 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll 2008-01-14 21:18 . 2007-11-15 10:07 170,512 --a------ C:\WINDOWS\system32\kemutb.dll 2008-01-14 21:18 . 2007-11-15 10:07 141,840 --a------ C:\WINDOWS\system32\KemUtil.dll 2008-01-14 21:18 . 2007-11-15 10:07 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll 2008-01-14 21:18 . 2007-11-15 10:07 76,304 --a------ C:\WINDOWS\system32\KemXML.dll 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-01-14 21:17 . 2008-01-14 21:17 <DIR> d-------- C:\Program Files\Logitech 2008-01-14 21:17 . 2008-01-14 21:18 <DIR> d-------- C:\Program Files\Common Files\Logishrd 2008-01-14 21:17 . 2008-01-14 21:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2008-01-14 21:13 . 2008-01-16 15:45 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-01-14 21:01 . 2008-01-14 21:01 <DIR> d-------- C:\Program Files\Winamp 2008-01-14 21:01 . 2008-01-14 21:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Winamp 2008-01-14 16:32 . 2008-01-14 16:32 <DIR> d-------- C:\Program Files\game 2008-01-13 22:11 . 2008-01-13 22:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-13 20:34 . 2008-01-13 20:34 <DIR> d-------- C:\Program Files\MoveOnBoot 2008-01-13 20:34 . 2008-01-13 20:34 <DIR> d-------- C:\Program Files\Common Files\Gibinsoft Shared 2008-01-13 20:18 . 2008-01-13 20:40 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-01-13 14:05 . 2008-01-13 14:05 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-01-13 02:49 . 2008-01-18 15:26 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-01-13 02:34 . 2008-01-13 02:34 <DIR> d-------- C:\Program Files\Bethesda Softworks 2008-01-13 01:38 . 2008-01-13 01:38 315,392 --a------ C:\WINDOWS\HideWin.exe 2008-01-13 01:38 . 2005-05-03 18:43 69,632 --a------ C:\WINDOWS\Alcmtr.exe 2008-01-13 01:38 . 2007-11-14 15:18 553 --a------ C:\WINDOWS\USetup.iss 2008-01-13 00:58 . 2008-01-13 00:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Styler 2008-01-13 00:57 . 2008-01-13 21:58 <DIR> d-------- C:\Program Files\Styler 2008-01-13 00:44 . 2008-01-13 00:44 <DIR> d-------- C:\Program Files\Common Files\Stardock 2008-01-13 00:40 . 2008-01-13 00:40 0 --------- C:\WINDOWS\WB.ini 2008-01-13 00:31 . 2008-01-13 00:48 <DIR> d-------- C:\VISTA PACK 2 2008-01-13 00:17 . 2008-01-13 14:05 <DIR> d-------- C:\Program Files\Stardock 2008-01-13 00:17 . 2007-07-11 15:06 42,672 --------- C:\WINDOWS\system32\wbsys.dll 2008-01-12 23:22 . 2008-01-12 23:22 <DIR> d-------- C:\Program Files\Driver Cleaner Pro 2008-01-12 20:38 . 2008-01-15 17:16 <DIR> d-------- C:\Program Files\Steam 2008-01-12 15:18 . 2000-05-21 23:00 647,872 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-01-12 15:18 . 1999-05-06 16:00 140,288 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-01-12 15:18 . 2000-05-21 22:00 83,144 --a------ C:\WINDOWS\system32\picclp32.ocx 2008-01-12 15:18 . 2001-04-26 16:12 57,399 --a------ C:\WINDOWS\system32\Registry.ocx 2008-01-12 14:15 . 2008-01-12 14:15 <DIR> d-------- C:\Program Files\Uniblue 2008-01-12 14:15 . 2008-01-12 14:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue 2008-01-12 13:25 . 2008-01-12 13:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-12 13:21 . 2008-01-12 13:21 <DIR> d-------- C:\Program Files\Ares 2008-01-12 13:20 . 2008-01-12 13:20 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-12 13:17 . 2001-08-23 13:00 39,274 --a------ C:\WINDOWS\system32\mem.exe 2008-01-12 13:16 . 2008-01-12 13:16 <DIR> d--h----- C:\WINDOWS\PIF 2008-01-12 13:16 . 2008-01-12 13:16 2,855 --a------ C:\WINDOWS\system32\mem.PIF 2008-01-12 12:58 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 12:19 . 2008-01-12 12:19 <DIR> d-------- C:\Program Files\Lavasoft 2008-01-12 12:19 . 2008-01-12 12:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-12 12:03 . 2008-01-17 22:15 293 --a------ C:\WINDOWS\wininit.ini 2008-01-12 11:45 . 2008-01-12 11:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-01-12 11:44 . 2008-01-17 22:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-01-12 11:44 . 2008-01-12 12:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-12 11:44 . 2008-01-12 11:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-01-12 11:38 . 2008-01-12 12:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\WINDOWS\Sun 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab 2008-01-12 11:29 . 2008-01-12 11:29 <DIR> d-------- C:\Program Files\Java 2008-01-12 11:29 . 2008-01-12 11:29 <DIR> d-------- C:\Program Files\Common Files\Java 2008-01-12 11:29 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-12 00:40 . 2006-08-21 11:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys 2008-01-12 00:40 . 2006-08-21 11:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe 2008-01-12 00:40 . 2006-08-21 14:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll 2008-01-11 22:50 . 2008-01-11 22:50 <DIR> d-------- C:\Program Files\CCleaner 2008-01-11 22:45 . 2008-01-11 22:45 <DIR> d-------- C:\Program Files\Launchy 2008-01-11 22:45 . 2008-01-11 22:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Launchy 2008-01-11 22:34 . 2008-01-16 18:10 <DIR> d-------- C:\OC Programmid 2008-01-11 22:32 . 2008-01-11 22:32 <DIR> d-------- C:\Program Files\FOXCONN 2008-01-11 21:50 . 2007-07-09 15:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-11 21:45 . 2006-12-07 07:29 2,374,472 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll 2008-01-11 21:13 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-11 21:13 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-11 21:13 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-11 20:54 . 2006-06-29 08:05 23,552 --a------ C:\WINDOWS\system32\normaliz.dll 2008-01-11 20:54 . 2006-09-01 08:44 8,798 --a------ C:\WINDOWS\system32\icrav03.rat 2008-01-11 20:50 . 2008-01-18 16:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-17 17:06 --------- d-----w C:\Program Files\ATI Technologies 2008-01-16 14:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-12 23:38 --------- d-----w C:\Program Files\Realtek 2008-01-11 20:24 --------- d-----w C:\Program Files\AMD 2008-01-11 15:11 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield 2008-01-11 14:45 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Talkback 2008-01-11 14:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ATI 2008-01-11 14:31 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-21 03:53 2,843,136 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-12-21 02:17 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2007-12-20 16:00 4,637,696 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys 2007-12-20 14:47 16,860,672 ----a-w C:\WINDOWS\RTHDCPL.exe 2007-11-20 17:09 104,320 ----a-w C:\WINDOWS\system32\drivers\Rtnicxp.sys 2007-11-20 16:15 1,826,816 ----a-w C:\WINDOWS\SkyTel.exe 2007-11-07 15:31 1,191,936 ----a-w C:\WINDOWS\RtlUpd.exe 2007-10-25 08:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe 2007-10-20 18:17 39,424 ----a-w C:\WINDOWS\runtime.exe 2007-10-19 17:43 491,520 ----a-w C:\WINDOWS\dependencies.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04 521128] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "RTHDCPL"="RTHDCPL.EXE" [2007-12-20 16:47 16860672 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-01-11 22:45:44] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-14 21:18:07] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 11:04] R1 LHidKEE;LHidKEE;C:\WINDOWS\system32\drivers\LHidKEE.sys [2008-01-11 20:43] S3 FXDrv32;FXDrv32;E:\FXDrv32.sys [] S3 FXExSS;FXExSS;C:\Program Files\FOXCONN\FOX ONE\FXExSS32.sys [2007-01-24 16:04] . Contents of the 'Scheduled Tasks' folder "2008-01-11 18:49:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-18 16:51:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156] -> C:\Program Files\Ray Adams\ATI Tray Tools\raphook.dll . Completion time: 2008-01-18 16:52:46 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-18 14:52:31 . 2008-01-16 20:39:44 --- E O F --- HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:57:25, on 18.01.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Launchy\Launchy.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Trend Micro\HijackThis\scan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6513 bytes |
|
|
|
|
01-18-2008, 09:41 AM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hi,
Before we continue with the cleaning process, you need to know that this machine does not have the Windows XP Recovery Console installed. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Go to Microsoft's website => http://support.microsoft.com/kb/310994 Select the download that's appropriate for your Operating System  Download the file & save it as it's originally named (don't give it another name), next to ComboFix.exe.  Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log. Please do not reboot your machine until we have reviewed the log.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 11:10 AM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
Here it is:
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn D:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons |
|
|
|
|
01-18-2008, 12:12 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hi,
Looks good. You can go ahead and reboot now. Open notepad (Start>All programs>accessories>notepad ). and copy/paste the text in the quotebox below into it (It must be notepad, not wordpad, or it won't work): Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/211657-pop-ups-when-starting-ie-firefox.html#post1273539 Collect:: C:\WINDOWS\system32\drivers\LHidKEE.sys File:: C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\ativpsrm.bin Driver:: LHidKEE  Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 01:16 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Thank you. We got the file. Can you please post the Combofix.txt.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 01:26 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
Well, I can say, that I'm not getting pop-ups anymore.
ComboFix log: ComboFix 08-01-18.4 - Administrator 2008-01-18 21:39:46.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1257.1.1033.18.1569 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\ativpsrm.bin C:\WINDOWS\system32\drivers\core.cache.dsk . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\ativpsrm.bin C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\LHidKEE.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_LHIDKEE -------\LHidKEE ((((((((((((((((((((((((( Files Created from 2007-12-18 to 2008-01-18 ))))))))))))))))))))))))))))))) . 2008-01-18 16:30 . 2008-01-18 16:30 <DIR> d-------- C:\Program Files\DivX 2008-01-18 14:17 . 2008-01-18 14:17 <DIR> d-------- C:\Deckard 2008-01-17 19:10 . 2008-01-17 19:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-01-16 20:28 . 2008-01-16 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2008-01-16 20:27 . 2008-01-16 20:27 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2008-01-16 19:43 . 2008-01-16 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-01-16 18:48 . 2008-01-16 18:48 <DIR> d-------- C:\Program Files\PowerISO 2008-01-16 16:14 . 2008-01-16 20:44 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-01-16 16:14 . 2008-01-16 16:14 22,328 --a------ C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys 2008-01-16 16:13 . 2008-01-16 16:13 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-01-16 16:13 . 2008-01-16 20:44 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-01-16 16:13 . 2008-01-16 20:44 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-01-16 16:13 . 2008-01-16 16:13 319 --a------ C:\WINDOWS\game.ini 2008-01-16 16:06 . 2008-01-16 16:06 <DIR> d-------- C:\Program Files\Activision 2008-01-16 16:05 . 2008-01-16 16:05 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-01-16 15:44 . 2008-01-16 15:44 <DIR> d-------- C:\WINDOWS\%DownloadedProgramFiles% 2008-01-16 15:41 . 2006-07-27 13:52 367 --a------ C:\WINDOWS\system32\LegitCheckControl.inf 2008-01-15 09:40 . 2008-01-15 09:40 <DIR> d-------- C:\Program Files\Common Files\NSV 2008-01-14 21:48 . 2008-01-14 21:51 2,392 --a------ C:\WINDOWS\system32\tmp.reg 2008-01-14 21:19 . 2008-01-14 21:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2008-01-14 21:19 . 2008-01-14 21:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Logitech 2008-01-14 21:18 . 2007-11-15 10:06 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll 2008-01-14 21:18 . 2007-11-15 10:07 170,512 --a------ C:\WINDOWS\system32\kemutb.dll 2008-01-14 21:18 . 2007-11-15 10:07 141,840 --a------ C:\WINDOWS\system32\KemUtil.dll 2008-01-14 21:18 . 2007-11-15 10:07 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll 2008-01-14 21:18 . 2007-11-15 10:07 76,304 --a------ C:\WINDOWS\system32\KemXML.dll 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2008-01-14 21:18 . 2008-01-14 21:18 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-01-14 21:17 . 2008-01-14 21:17 <DIR> d-------- C:\Program Files\Logitech 2008-01-14 21:17 . 2008-01-14 21:18 <DIR> d-------- C:\Program Files\Common Files\Logishrd 2008-01-14 21:17 . 2008-01-14 21:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2008-01-14 21:13 . 2008-01-16 15:45 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-01-14 21:01 . 2008-01-14 21:01 <DIR> d-------- C:\Program Files\Winamp 2008-01-14 21:01 . 2008-01-14 21:04 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Winamp 2008-01-14 16:32 . 2008-01-14 16:32 <DIR> d-------- C:\Program Files\game 2008-01-13 22:11 . 2008-01-13 22:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-01-13 20:34 . 2008-01-13 20:34 <DIR> d-------- C:\Program Files\MoveOnBoot 2008-01-13 20:34 . 2008-01-13 20:34 <DIR> d-------- C:\Program Files\Common Files\Gibinsoft Shared 2008-01-13 20:18 . 2008-01-13 20:40 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-01-13 14:05 . 2008-01-13 14:05 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-01-13 02:49 . 2008-01-18 15:26 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-01-13 02:34 . 2008-01-13 02:34 <DIR> d-------- C:\Program Files\Bethesda Softworks 2008-01-13 01:38 . 2008-01-13 01:38 315,392 --a------ C:\WINDOWS\HideWin.exe 2008-01-13 01:38 . 2005-05-03 18:43 69,632 --a------ C:\WINDOWS\Alcmtr.exe 2008-01-13 01:38 . 2007-11-14 15:18 553 --a------ C:\WINDOWS\USetup.iss 2008-01-13 00:58 . 2008-01-13 00:58 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Styler 2008-01-13 00:57 . 2008-01-13 21:58 <DIR> d-------- C:\Program Files\Styler 2008-01-13 00:44 . 2008-01-13 00:44 <DIR> d-------- C:\Program Files\Common Files\Stardock 2008-01-13 00:40 . 2008-01-13 00:40 0 --------- C:\WINDOWS\WB.ini 2008-01-13 00:31 . 2008-01-13 00:48 <DIR> d-------- C:\VISTA PACK 2 2008-01-13 00:17 . 2008-01-13 14:05 <DIR> d-------- C:\Program Files\Stardock 2008-01-13 00:17 . 2007-07-11 15:06 42,672 --------- C:\WINDOWS\system32\wbsys.dll 2008-01-12 23:22 . 2008-01-12 23:22 <DIR> d-------- C:\Program Files\Driver Cleaner Pro 2008-01-12 20:38 . 2008-01-15 17:16 <DIR> d-------- C:\Program Files\Steam 2008-01-12 15:18 . 2000-05-21 23:00 647,872 --a------ C:\WINDOWS\system32\MSCOMCT2.OCX 2008-01-12 15:18 . 1999-05-06 16:00 140,288 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-01-12 15:18 . 2000-05-21 22:00 83,144 --a------ C:\WINDOWS\system32\picclp32.ocx 2008-01-12 15:18 . 2001-04-26 16:12 57,399 --a------ C:\WINDOWS\system32\Registry.ocx 2008-01-12 14:15 . 2008-01-12 14:15 <DIR> d-------- C:\Program Files\Uniblue 2008-01-12 14:15 . 2008-01-12 14:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue 2008-01-12 13:25 . 2008-01-12 13:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-12 13:21 . 2008-01-12 13:21 <DIR> d-------- C:\Program Files\Ares 2008-01-12 13:20 . 2008-01-12 13:20 <DIR> d-------- C:\Program Files\Trend Micro 2008-01-12 13:17 . 2001-08-23 13:00 39,274 --a------ C:\WINDOWS\system32\mem.exe 2008-01-12 13:16 . 2008-01-12 13:16 <DIR> d--h----- C:\WINDOWS\PIF 2008-01-12 13:16 . 2008-01-12 13:16 2,855 --a------ C:\WINDOWS\system32\mem.PIF 2008-01-12 12:58 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-12 12:19 . 2008-01-12 12:19 <DIR> d-------- C:\Program Files\Lavasoft 2008-01-12 12:19 . 2008-01-12 12:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-01-12 12:03 . 2008-01-17 22:15 293 --a------ C:\WINDOWS\wininit.ini 2008-01-12 11:45 . 2008-01-12 11:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-01-12 11:44 . 2008-01-17 22:27 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-01-12 11:44 . 2008-01-12 12:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-12 11:44 . 2008-01-12 11:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-01-12 11:38 . 2008-01-12 12:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\WINDOWS\Sun 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-01-12 11:30 . 2008-01-12 11:30 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SystemRequirementsLab 2008-01-12 11:29 . 2008-01-12 11:29 <DIR> d-------- C:\Program Files\Java 2008-01-12 11:29 . 2008-01-12 11:29 <DIR> d-------- C:\Program Files\Common Files\Java 2008-01-12 11:29 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-12 00:40 . 2006-08-21 11:14 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys 2008-01-12 00:40 . 2006-08-21 11:14 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe 2008-01-12 00:40 . 2006-08-21 14:21 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll 2008-01-11 22:50 . 2008-01-11 22:50 <DIR> d-------- C:\Program Files\CCleaner 2008-01-11 22:45 . 2008-01-11 22:45 <DIR> d-------- C:\Program Files\Launchy 2008-01-11 22:45 . 2008-01-11 22:45 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Launchy 2008-01-11 22:34 . 2008-01-16 18:10 <DIR> d-------- C:\OC Programmid 2008-01-11 22:32 . 2008-01-11 22:32 <DIR> d-------- C:\Program Files\FOXCONN 2008-01-11 21:50 . 2007-07-09 15:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-11 21:45 . 2006-12-07 07:29 2,374,472 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll 2008-01-11 21:13 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-11 21:13 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-11 21:13 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-11 20:54 . 2006-06-29 08:05 23,552 --a------ C:\WINDOWS\system32\normaliz.dll 2008-01-11 20:54 . 2006-09-01 08:44 8,798 --a------ C:\WINDOWS\system32\icrav03.rat 2008-01-11 20:50 . 2008-01-18 21:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-11 20:50 . 2008-01-11 20:50 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-11 20:49 . 2008-01-11 20:49 <DIR> d-------- C:\Program Files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-17 17:06 --------- d-----w C:\Program Files\ATI Technologies 2008-01-16 14:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-12 23:38 --------- d-----w C:\Program Files\Realtek 2008-01-11 20:24 --------- d-----w C:\Program Files\AMD 2008-01-11 15:11 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield 2008-01-11 14:45 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Talkback 2008-01-11 14:33 --------- d-----w C:\Documents and Settings\Administrator\Application Data\ATI 2008-01-11 14:31 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-12-21 03:53 2,843,136 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-12-21 02:17 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2007-12-20 16:00 4,637,696 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys 2007-12-20 14:47 16,860,672 ----a-w C:\WINDOWS\RTHDCPL.exe 2007-11-20 17:09 104,320 ----a-w C:\WINDOWS\system32\drivers\Rtnicxp.sys 2007-11-20 16:15 1,826,816 ----a-w C:\WINDOWS\SkyTel.exe 2007-11-07 15:31 1,191,936 ----a-w C:\WINDOWS\RtlUpd.exe 2007-10-25 08:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe 2007-10-20 18:17 39,424 ----a-w C:\WINDOWS\runtime.exe 2007-10-19 17:43 491,520 ----a-w C:\WINDOWS\dependencies.exe . ((((((((((((((((((((((((((((( snapshot@2008-01-18_16.52.25.12 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-18 14:49:01 225,280 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-18 19:39:40 225,280 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-18 14:49:01 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-18 19:39:40 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-18 14:49:01 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-18 19:39:41 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-18 14:49:01 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-18 19:39:41 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-18 14:49:02 2,658,304 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT + 2008-01-18 19:39:41 2,658,304 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT - 2008-01-18 14:49:02 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-18 19:39:41 221,184 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2000-08-31 06:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04 521128] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "RTHDCPL"="RTHDCPL.EXE" [2007-12-20 16:47 16860672 C:\WINDOWS\RTHDCPL.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:56 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Launchy.lnk - C:\Program Files\Launchy\Launchy.exe [2008-01-11 22:45:44] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-14 21:18:07] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 11:04] S3 FXDrv32;FXDrv32;E:\FXDrv32.sys [] S3 FXExSS;FXExSS;C:\Program Files\FOXCONN\FOX ONE\FXExSS32.sys [2007-01-24 16:04] . Contents of the 'Scheduled Tasks' folder "2008-01-11 18:49:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-18 21:42:41 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156] -> C:\Program Files\Ray Adams\ATI Tray Tools\raphook.dll . Completion time: 2008-01-18 21:43:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-18 19:43:39 ComboFix2.txt 2008-01-18 14:52:46 . 2008-01-16 20:39:44 --- E O F --- |
|
|
|
|
01-18-2008, 02:07 PM
|
#12 (permalink) | |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hi,
Quote:
 Go to Start>Control Panel>Add/Remove Programs and remove if Kaspersky online scanner is present prior to downloading the most up-to-date one. Now run this online scan using Internet Explorer: Kaspersky Online Scanner from http://www.kaspersky.com/kos/eng/par...avwebscan.html Next Click on Launch Kaspersky Online Scanner You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
*Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans for no conflicts and to speed up scan time. Please don't go surfing while your resident protection is disabled! Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware app you use. Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. Or use Firefox with IE-Tab plugin.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 Last edited by amateur; 01-18-2008 at 02:10 PM. |
|
|
|
|
|
01-18-2008, 02:11 PM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Please notice that I edited to change the link for Kaspersky online scanner.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 03:45 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
Ok. I'm done with Kaspersky Online Scanner.
Here is the log: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Saturday, January 19, 2008 12:42:57 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 18/01/2008 Kaspersky Anti-Virus database records: 488677 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 44988 Number of viruses found: 0 Number of infected objects: 0 Number of suspicious objects: 0 Duration of the scan process: 00:34:48 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\4nq6m2rz.default\cert8.db Object is locked skipped C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\just_grazy@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\just_grazy@hotmail.com\shadow\members.stg Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008011820080119\index.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DFCF0F.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DFCF1C.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DFD89B.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temp\~DFD8A8.tmp Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Charon\CACHE.NDB Object is locked skipped C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Logs\epfwlog.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Logs\virlog.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\ESET\ESET Smart Security\Logs\warnlog.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\RTHDCPL_Dump.txt Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{059B8598-D374-4D20-B438-3D35167A211E}\RP16\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. |
|
|
|
|
01-18-2008, 03:49 PM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
The report looks good. Please post a fresh HijackThis log and let me know how the computer is running now.
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-18-2008, 03:53 PM
|
#16 (permalink) |
|
Registered User
Join Date: Jan 2008
Posts: 9
OS: Windows XP, SP2
|
Re: Pop-ups when starting IE or firefox
Here's the log!
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 0:52:08, on 19.01.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Launchy\Launchy.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\scan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [amd_dc_opt] "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6559 bytes |
|
|
|
|
01-18-2008, 04:05 PM
|
#17 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
Hi,
Java has recently updated. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java:
=========================== Your logs are clean, so if all is well, please proceed with the following:
Here are some steps to make your surfing more secure in future: Make your Internet Explorer more secure - This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialise and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. Avoid p2p file sharing and illegal sites, because that's where most malware is present. * Don't click on links inside popups. * Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware. * Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware. ================================== A colleague of ours has excellent information and tips on the prevention of malware here and more on improving speed/system performance after malware removal here . If you want to fight back the Malware Writers, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved. Happy Surfing!
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
|
01-19-2008, 05:04 AM
|
#19 (permalink) |
|
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Jun 2006
Location: USA
Posts: 7,318
OS: XP SP3
|
Re: Pop-ups when starting IE or firefox
You're welcome. Glad we could help. Stay safe!
__________________
My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006 |
|
|
|
| Thread Tools | |
|
|
