|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-30-2008, 10:28 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
pop ups and google redirects
I am getting pop ups whenever I open Internet Explorer also when I do a search on google and click on a result it takes me to a site that is related to my search but it is not the same site the link was supposed to take me to. I have tried a few things before I found this site. I downloaded hijackthis and posted my log at hijackthis.de and had hijackthis fix the problems that hijackthis.de said were nasty. Needless to say I still have the problem I just hope I did not make it worse. I tried to follow the 5 steps but I could not complete steps 2 and 4. Thank you for any help. One site that frequently pops up is fubar . com.
Deckard's System Scanner v20071014.68 Run by Randy Tyson on 2008-06-30 22:57:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 3 Restore Point(s) -- 3: 2008-07-01 03:57:44 UTC - RP1017 - Deckard's System Scanner Restore Point 2: 2008-07-01 03:36:26 UTC - RP1016 - Removed MyWay Search Assistant 1: 2008-07-01 03:02:54 UTC - RP1015 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 510 MiB (512 MiB recommended). -- HijackThis (run as Randy Tyson.exe) ----------------------------------------- Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-30 23:01:41 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\Program Files\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\Program Files\McAfee\VirusScan\mcods.exe C:\Program Files\McAfee\MSC\mcpromgr.exe C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe C:\Program Files\McAfee\VirusScan\Mcshield.exe C:\Program Files\McAfee\VirusScan\mcsysmon.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\McAfee\MPS\mps.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe C:\Program Files\Expedia\Expedia Fare Alert\ExpediaFareAlert.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Randy Tyson\Local Settings\Temporary Internet Files\Content.IE5\UR5Y77UW\dss[1].exe C:\Program Files\McAfee\VirusScan\mcvsshld.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: LabelCommand module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {66C36DE5-1028-4270-AB45-BB08C2A45777} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptcl.dll O2 - BHO: (no name) - {84AA61C2-A977-4FD8-9E2F-C768F0387572} - C:\WINDOWS\system32\tuvSIAss.dll O2 - BHO: (no name) - {A7CE8593-7CE5-4F45-B5FB-1D24A7690098} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {CC1D6E0D-5517-44CC-8428-60F748146F12} - C:\WINDOWS\system32\cmsetAC.dll O2 - BHO: (no name) - {F62BA7F1-555D-40FB-A6AC-4C2DD78CA8EB} - C:\WINDOWS\system32\ljJDWqPg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [34b3b0cb] rundll32.exe "C:\WINDOWS\system32\yfmknuma.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Expedia Fare Alert.lnk = C:\Program Files\Expedia\Expedia Fare Alert\ExpediaFareAlert.exe O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Photo Express Calendar Checker SE.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: https://turbotax.com (HKCU) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/downlo...eckControl.cab O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get...irector/sw.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ufirst.webex.com/client/T26L/webex/ieatgpc.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: tuvSIAss - C:\WINDOWS\system32\tuvSIAss.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\Program Files\McAfee\MPS\mps.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell -- End of file - 16092 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) -------------------- backup-20080628-121312-437 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE backup-20080628-121312-918 R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll backup-20080628-121313-204 O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll backup-20080628-121313-239 O2 - BHO: (no name) - {205B3110-DECF-481E-A2CF-BC206E8751B6} - C:\WINDOWS\system32\efcDTJaw.dll (file missing) backup-20080628-121313-425 R3 - URLSearchHook: (no name) - - (no file) backup-20080628-121313-652 O2 - BHO: (no name) - {A7CE8593-7CE5-4F45-B5FB-1D24A7690098} - C:\WINDOWS\system32\khfDttRh.dll (file missing) backup-20080628-121313-937 O2 - BHO: (no name) - {32FE193E-A250-4A0B-86C2-8E70E3272172} - C:\WINDOWS\system32\ddcBUkJy.dll (file missing) backup-20080628-121313-947 O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/40...02/Coupons.cab backup-20080630-112034-146 O2 - BHO: (no name) - {A7CE8593-7CE5-4F45-B5FB-1D24A7690098} - C:\WINDOWS\system32\khfDttRh.dll (file missing) backup-20080630-112034-178 O2 - BHO: LabelCommand module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - (no file) backup-20080630-112034-875 O2 - BHO: (no name) - {66C36DE5-1028-4270-AB45-BB08C2A45777} - C:\WINDOWS\system32\nnnkLedC.dll (file missing) backup-20080630-213435-222 O4 - HKCU\..\Run: [WinSpywareProtect] "C:\Documents and Settings\All Users\Application Data\Adsl Software Ltd\WinSpywareProtect\Winspywareprotect.exe" /autorun backup-20080630-213435-295 R3 - URLSearchHook: (no name) - - (no file) backup-20080630-213435-408 O4 - HKCU\..\Run: [Antivirus2008y] C:\Program Files\Antivirus2008y\antvrs.exe backup-20080630-213435-544 O4 - HKCU\..\Run: [SearchAndDestroyT] C:\Program Files\Search And Destroy\SearchAndDestroy.exe backup-20080630-213435-722 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE backup-20080630-214926-756 O4 - HKLM\..\Run: [PCPrivacyCleaner] C:\Program Files\PCPrivacyCleaner\pcpc.exe backup-20080630-214926-955 O4 - Startup: RegistryDefender.lnk = C:\Program Files\Registry Defender Platinum\RegistryDefender.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 sdcplh - c:\windows\system32\drivers\sdcplh.sys <Not Verified; ; SDCPLH> R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> R3 Eplpdx02 - c:\windows\system32\drivers\eplpdx02.sys <Not Verified; MK Systems CO., LTD.; MK Systems LPT I/O Driver for Windows2000> R3 EPPSCSIx (EPPSCSI Driver) - c:\windows\system32\drivers\eppscan.sys <Not Verified; EPPSCAN WDM Driver; EPPSCAN Parallel Port Device Driver> S0 AEC6710D - c:\windows\system32\drivers\aec6710d.sys <Not Verified; Microsoft Corporation; Microsoft® Windows NT(TM) Operating System> S3 4ea74d3a-5cf9-4fc1-bfba-d90edec1b51a - d:\cds300\cds300.dll (file missing) S3 BVRPMPR5 (BVRPMPR5 NDIS Protocol Driver) - c:\windows\system32\drivers\bvrpmpr5.sys <Not Verified; BVRP Software; BVRPNDIS Rawether for Windows> S3 SDDMI2 - c:\windows\system32\ddmi2.sys <Not Verified; Gteko Ltd.; DDMI> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe <Not Verified; Canon Inc.; > R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-06-30 20:04:25 450 --a------ C:\WINDOWS\Tasks\RegCure Program Check.job 2008-06-30 17:59:30 384 --a------ C:\WINDOWS\Tasks\RegCure.job 2008-06-29 23:27:28 432 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{C20027EF-5EA7-476D-B064-B9F3C81F3552}.job 2008-06-24 12:31:03 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-06-15 01:00:01 350 --a------ C:\WINDOWS\Tasks\McDefragTask.job 2008-06-01 01:00:11 342 --a------ C:\WINDOWS\Tasks\McQcTask.job -- Files created between 2008-05-30 and 2008-06-30 ----------------------------- 2008-06-30 22:52:31 91520 --a------ C:\WINDOWS\system32\yfmknuma.dll 2008-06-30 22:49:52 0 d-------- C:\ie-spyad_zo 2008-06-30 22:47:44 0 d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43:20 0 d-------- C:\Program Files\Panda Security 2008-06-30 22:43:17 0 d-------- C:\WINDOWS\LastGood 2008-06-30 20:16:54 0 d-------- C:\Program Files\Registry Defender Platinum 2008-06-30 18:45:37 91520 -----n--- C:\WINDOWS\system32\qfbqnjya.dll 2008-06-30 18:44:52 237727 --ahs---- C:\WINDOWS\system32\CcJmlnmp.ini2 2008-06-30 18:44:42 318208 --a------ C:\WINDOWS\system32\pmnlmJcC.dll 2008-06-30 18:32:48 0 d-------- C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y 2008-06-30 18:32:31 0 d-------- C:\Program Files\Antivirus2008y 2008-06-30 18:16:06 0 d-------- C:\Program Files\PCPrivacyCleaner 2008-06-30 17:59:11 0 d-------- C:\Program Files\RegCure 2008-06-30 17:32:56 239389 --ahs---- C:\WINDOWS\system32\BKUELkkj.ini2 2008-06-30 17:32:44 318208 --a------ C:\WINDOWS\system32\jkkLEUKB.dll 2008-06-30 11:07:37 239803 --ahs---- C:\WINDOWS\system32\gPqWDJjl.ini2 2008-06-30 11:07:25 318208 --a------ C:\WINDOWS\system32\ljJDWqPg.dll 2008-06-30 00:09:14 92032 --a------ C:\WINDOWS\system32\vwanyecf.dll 2008-06-29 23:23:05 239776 --ahs---- C:\WINDOWS\system32\YJTtwyay.ini2 2008-06-28 22:50:12 245480 --ahs---- C:\WINDOWS\system32\CdeLknnn.ini2 2008-06-27 23:21:58 1532 --ahs---- C:\WINDOWS\system32\hRttDfhk.ini2 2008-06-27 22:27:23 238346 --ahs---- C:\WINDOWS\system32\yJkUBcdd.ini2 2008-06-27 21:17:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:47:57 0 --a------ C:\WINDOWS\system32\MSVolume.dll 2008-06-27 20:46:35 0 d-------- C:\Program Files\Search And Destroy 2008-06-27 18:35:06 241103 --ahs---- C:\WINDOWS\system32\DMUFeMoq.ini2 2008-06-27 18:29:30 0 d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-27 11:16:48 237641 --ahs---- C:\WINDOWS\system32\waJTDcfe.ini2 2008-06-27 11:15:32 91008 --a------ C:\WINDOWS\system32\lirgeriu.dll 2008-06-27 07:26:15 92032 --a------ C:\WINDOWS\system32\wdhdcugg.dll 2008-06-26 21:57:37 88576 --a------ C:\WINDOWS\system32\cmsetAC.dll 2008-06-26 21:57:17 92032 --a------ C:\WINDOWS\system32\vaxddabj.dll 2008-06-26 21:57:05 112128 --a------ C:\WINDOWS\system32\wwqmxwaw.exe 2008-06-26 21:54:03 238926 --ahs---- C:\WINDOWS\system32\NTDJmUvw.ini2 2008-06-26 21:52:22 0 d-------- C:\Program Files\LabelCommand 2008-06-26 11:20:43 92032 --a------ C:\WINDOWS\system32\jmkpjges.dll 2008-06-26 11:15:52 92032 --a------ C:\WINDOWS\system32\jbqinawn.dll 2008-06-26 07:26:15 91520 --a------ C:\WINDOWS\system32\wrlbidln.dll 2008-06-24 23:53:10 241791 --ahs---- C:\WINDOWS\system32\RtBaHRqr.ini2 2008-06-24 23:47:39 28288 --a------ C:\WINDOWS\system32\tuvSIAss.dll 2008-06-24 23:44:06 0 d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd 2008-06-24 10:45:43 0 d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44:53 0 d-------- C:\Program Files\TextPad 5 2008-06-15 13:40:01 0 d-------- C:\Documents and Settings\Jane Tyson\Application Data\Mozilla 2008-05-30 14:02:24 0 d-------- C:\Program Files\Common Files\Avery 2008-05-30 14:02:16 0 d-------- C:\Program Files\Avery Wizard 3.1 -- Find3M Report --------------------------------------------------------------- 2008-05-30 14:50:39 0 d-------- C:\Program Files\Paint Shop Pro 5 2008-05-30 14:04:25 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-05-30 14:02:24 0 d-------- C:\Program Files\Common Files 2008-05-24 20:36:35 0 d-------- C:\Program Files\iTunes 2008-05-24 20:36:21 0 d-------- C:\Program Files\iPod 2008-05-24 20:33:31 0 d-------- C:\Program Files\QuickTime 2008-05-24 20:26:31 0 d-------- C:\Program Files\Apple Software Update -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18CB1A7B-94CD-4582-8022-ADA16851E44B}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66C36DE5-1028-4270-AB45-BB08C2A45777}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84AA61C2-A977-4FD8-9E2F-C768F0387572}] 06/24/2008 11:47 PM 28288 --a------ C:\WINDOWS\system32\tuvSIAss.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A7CE8593-7CE5-4F45-B5FB-1D24A7690098}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC1D6E0D-5517-44CC-8428-60F748146F12}] 08/04/2004 05:00 AM 88576 --a------ C:\WINDOWS\system32\cmsetAC.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F62BA7F1-555D-40FB-A6AC-4C2DD78CA8EB}] 06/30/2008 11:07 AM 318208 --a------ C:\WINDOWS\system32\ljJDWqPg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [10/14/2004 07:42 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [07/12/2007 04:00 AM] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [02/23/2005 04:19 PM] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 04:50 PM] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 04:50 PM] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [01/27/2005 01:02 AM] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [05/31/2005 05:33 AM] "mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [03/15/2005 09:58 AM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [09/20/2005 10:35 AM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [09/20/2005 10:32 AM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [09/20/2005 10:36 AM] "PE2CKFNT SE"="C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [07/03/1998 01:51 PM] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [06/06/2006 10:07 AM] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [09/24/2005 12:08 AM] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [11/15/2007 10:24 AM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [11/15/2007 10:23 AM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "34b3b0cb"="C:\WINDOWS\system32\yfmknuma.dll" [06/30/2008 10:52 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [05/25/2007 01:04 AM] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Documents and Settings\Randy Tyson\Start Menu\Programs\Startup\ Expedia Fare Alert.lnk - C:\Program Files\Expedia\Expedia Fare Alert\ExpediaFareAlert.exe [9/4/2006 9:32:33 PM] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [10/26/2006 8:24:54 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [10/8/2005 2:34:34 AM] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [10/8/2005 2:29:00 AM] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [9/24/2005 12:28:44 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 3:15:54 AM] Photo Express Calendar Checker SE.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe [3/3/2006 5:31:27 PM] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [11/11/2004 11:59:36 AM] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{84AA61C2-A977-4FD8-9E2F-C768F0387572}"= C:\WINDOWS\system32\tuvSIAss.dll [06/24/2008 11:47 PM 28288] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvSIAss] tuvSIAss.dll 06/24/2008 11:47 PM 28288 C:\WINDOWS\system32\tuvSIAss.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\ljJDWqPg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" -- End of Deckard's System Scanner: finished at 2008-06-30 23:04:24 ------------ |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-03-2008, 03:16 PM
|
#2 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
Hello and welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Quote:
Save to the Desktop and then Run from the Desktop. Thanks. ------------------------------------------------------ Quote:
We suggest uninstalling them via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folder if it still exists: C:\Program Files\Viewpoint ------------------------------------------------------ Please download Combofix and Save it to your Desktop. **Note: It is important that it is saved directly to your desktop** First, we need to install the Windows Recovery Console. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Download the file from this Microsoft page: http://www.microsoft.com/downloads/d...displaylang=en Save it as it is originally named, to the desktop, next to ComboFix.exe Now close all open windows and programs, including all antivirus and antispyware programs. Get help here  Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console. As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return. ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ You are using an outdated version of HijackThis. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version. Please download HijackThis and Save it to your Desktop. Alternate link Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double-click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Please post the HijackThis log in your next reply. Do not fix anything in HijackThis since they may be harmless. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
||
|
|
|
|
07-03-2008, 09:54 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
ComboFix 08-07-03.1 - Zach Tyson 2008-07-03 22:22:23.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.180 [GMT -5:00]Running from: C:\Documents and Settings\Zach Tyson\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Program Files\Antivirus2008y C:\Program Files\Antivirus2008y\antvrs.exe C:\Program Files\PCPrivacyCleaner C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\mcrh.tmp . ((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 ))))))))))))))))))))))))))))))) . 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\McAfee 2008-06-30 22:56 . 2008-06-30 22:56 <DIR> d-------- C:\Deckard 2008-06-30 22:49 . 2008-06-30 22:49 <DIR> d-------- C:\ie-spyad_zo 2008-06-30 22:47 . 2008-06-30 22:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43 . 2008-06-30 22:43 <DIR> d-------- C:\Program Files\Panda Security 2008-06-30 20:16 . 2008-07-03 21:02 <DIR> d-------- C:\Program Files\Registry Defender Platinum 2008-06-30 18:32 . 2008-06-30 18:32 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y 2008-06-28 22:49 . 2008-06-28 22:49 318,720 --a------ C:\WINDOWS\system32\nnnkLedC.dll_old 2008-06-27 21:17 . 2008-06-27 21:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-27 21:17 . 2008-06-27 22:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:46 . 2008-06-27 22:11 <DIR> d-------- C:\Program Files\Search And Destroy 2008-06-27 18:29 . 2008-06-27 18:29 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-26 21:57 . 2008-06-26 21:57 112,128 --a------ C:\WINDOWS\system32\wwqmxwaw.exe 2008-06-26 21:52 . 2008-06-29 23:46 <DIR> d-------- C:\Program Files\LabelCommand 2008-06-24 23:44 . 2008-06-24 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd 2008-06-24 10:45 . 2008-06-24 10:45 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44 . 2008-06-24 10:44 <DIR> d-------- C:\Program Files\TextPad 5 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 02:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-04 02:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-06-09 01:32 --------- d-----w C:\Documents and Settings\Jane Tyson\Application Data\Winamp 2008-05-30 19:50 --------- d-----w C:\Program Files\Paint Shop Pro 5 2008-05-30 19:40 --------- d-----w C:\Program Files\Avery Wizard 3.1 2008-05-30 19:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-30 19:02 --------- d-----w C:\Program Files\Common Files\Avery 2008-05-25 01:36 --------- d-----w C:\Program Files\iTunes 2008-05-25 01:36 --------- d-----w C:\Program Files\iPod 2008-05-25 01:33 --------- d-----w C:\Program Files\QuickTime 2008-05-25 01:26 --------- d-----w C:\Program Files\Apple Software Update 2008-05-14 08:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2006-12-26 18:18 5,297,976 ----a-w C:\Program Files\picasaweb-current-setup.exe 2006-08-03 01:28 987,136 ----a-w C:\Program Files\SAFlashPlayer.exe 2006-07-17 02:33 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-10-13 14:15 2,625,400 ----a-w C:\Program Files\comcast_photoshow_deluxe_4.exe . Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:53, on 2008-07-03 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\McAfee\MBK\MBackMonitor.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\Canon\CAL\CALMAIN.exe c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {66C36DE5-1028-4270-AB45-BB08C2A45777} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: (no name) - {84AA61C2-A977-4FD8-9E2F-C768F0387572} - C:\WINDOWS\system32\tuvSIAss.dll (file missing) O2 - BHO: (no name) - {A7CE8593-7CE5-4F45-B5FB-1D24A7690098} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - {F62BA7F1-555D-40FB-A6AC-4C2DD78CA8EB} - C:\WINDOWS\system32\ljJDWqPg.dll (file missing) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [34b3b0cb] rundll32.exe "C:\WINDOWS\system32\okmppwqm.dll",b O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [Wise-FTP Scheduler] C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ufirst.webex.com/client/T26L/webex/ieatgpc.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL O20 - Winlogon Notify: tuvSIAss - tuvSIAss.dll (file missing) O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 13962 bytes |
|
|
|
|
07-03-2008, 10:17 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
It appears that you did not post the entire ComboFix log.
Go Start > Run and copy/paste the following single-line command into the Run box and click OK. C:\Combofix.txt Please post the entire log in your next repy. |
|
|
|
|
07-05-2008, 10:12 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
When I paste C:\Combofix.txt into Run and click OK it gives me a message that says, "Windows cannot find 'C:\Combofix.txt'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search." I found the file I think you are talking about here 'C:\Combofix\Combofix.txt'. I checked the last line of it and the last line of the log I copied and pasted on my last post and it appears to be the same, but I will post it again in case I missed something.
ComboFix 08-07-03.1 - Zach Tyson 2008-07-03 22:22:23.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.180 [GMT -5:00]Running from: C:\Documents and Settings\Zach Tyson\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Program Files\Antivirus2008y C:\Program Files\Antivirus2008y\antvrs.exe C:\Program Files\PCPrivacyCleaner C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\mcrh.tmp . ((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 ))))))))))))))))))))))))))))))) . 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\McAfee 2008-06-30 22:56 . 2008-06-30 22:56 <DIR> d-------- C:\Deckard 2008-06-30 22:49 . 2008-06-30 22:49 <DIR> d-------- C:\ie-spyad_zo 2008-06-30 22:47 . 2008-06-30 22:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43 . 2008-06-30 22:43 <DIR> d-------- C:\Program Files\Panda Security 2008-06-30 20:16 . 2008-07-03 21:02 <DIR> d-------- C:\Program Files\Registry Defender Platinum 2008-06-30 18:32 . 2008-06-30 18:32 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y 2008-06-28 22:49 . 2008-06-28 22:49 318,720 --a------ C:\WINDOWS\system32\nnnkLedC.dll_old 2008-06-27 21:17 . 2008-06-27 21:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-27 21:17 . 2008-06-27 22:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:46 . 2008-06-27 22:11 <DIR> d-------- C:\Program Files\Search And Destroy 2008-06-27 18:29 . 2008-06-27 18:29 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-26 21:57 . 2008-06-26 21:57 112,128 --a------ C:\WINDOWS\system32\wwqmxwaw.exe 2008-06-26 21:52 . 2008-06-29 23:46 <DIR> d-------- C:\Program Files\LabelCommand 2008-06-24 23:44 . 2008-06-24 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd 2008-06-24 10:45 . 2008-06-24 10:45 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44 . 2008-06-24 10:44 <DIR> d-------- C:\Program Files\TextPad 5 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 02:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-04 02:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-06-09 01:32 --------- d-----w C:\Documents and Settings\Jane Tyson\Application Data\Winamp 2008-05-30 19:50 --------- d-----w C:\Program Files\Paint Shop Pro 5 2008-05-30 19:40 --------- d-----w C:\Program Files\Avery Wizard 3.1 2008-05-30 19:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-30 19:02 --------- d-----w C:\Program Files\Common Files\Avery 2008-05-25 01:36 --------- d-----w C:\Program Files\iTunes 2008-05-25 01:36 --------- d-----w C:\Program Files\iPod 2008-05-25 01:33 --------- d-----w C:\Program Files\QuickTime 2008-05-25 01:26 --------- d-----w C:\Program Files\Apple Software Update 2008-05-14 08:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2006-12-26 18:18 5,297,976 ----a-w C:\Program Files\picasaweb-current-setup.exe 2006-08-03 01:28 987,136 ----a-w C:\Program Files\SAFlashPlayer.exe 2006-07-17 02:33 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-10-13 14:15 2,625,400 ----a-w C:\Program Files\comcast_photoshow_deluxe_4.exe . |
|
|
|
|
07-05-2008, 10:44 PM
|
#6 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
I am getting a window that opens up when I open my profile with RUNDLL in the title and it says, "Error loading C:\WINDOWS\system32\okmppwqm.dll The specified module could not be found." I click OK and everything functions normally.
|
|
|
|
|
07-05-2008, 11:30 PM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
You are not posting the entire log in your posts.
Please navigate to your C:\ drive and double-click on ComboFix.txt Please press Ctrl A then Ctrl C and then Ctrl P in the Reply to Thread window. |
|
|
|
|
07-06-2008, 10:45 AM
|
#8 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
When I press Ctrl P it acts as if I was asking it to print so I just right clicked and pressed paste in Quick Reply after pressing Ctrl A and Ctrl C in ComboFix.txt.
ComboFix 08-07-03.1 - Zach Tyson 2008-07-03 22:22:23.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.180 [GMT -5:00]Running from: C:\Documents and Settings\Zach Tyson\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Program Files\Antivirus2008y C:\Program Files\Antivirus2008y\antvrs.exe C:\Program Files\PCPrivacyCleaner C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\mcrh.tmp . ((((((((((((((((((((((((( Files Created from 2008-06-04 to 2008-07-04 ))))))))))))))))))))))))))))))) . 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\McAfee 2008-06-30 22:56 . 2008-06-30 22:56 <DIR> d-------- C:\Deckard 2008-06-30 22:49 . 2008-06-30 22:49 <DIR> d-------- C:\ie-spyad_zo 2008-06-30 22:47 . 2008-06-30 22:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43 . 2008-06-30 22:43 <DIR> d-------- C:\Program Files\Panda Security 2008-06-30 20:16 . 2008-07-03 21:02 <DIR> d-------- C:\Program Files\Registry Defender Platinum 2008-06-30 18:32 . 2008-06-30 18:32 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y 2008-06-28 22:49 . 2008-06-28 22:49 318,720 --a------ C:\WINDOWS\system32\nnnkLedC.dll_old 2008-06-27 21:17 . 2008-06-27 21:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-27 21:17 . 2008-06-27 22:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:46 . 2008-06-27 22:11 <DIR> d-------- C:\Program Files\Search And Destroy 2008-06-27 18:29 . 2008-06-27 18:29 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-26 21:57 . 2008-06-26 21:57 112,128 --a------ C:\WINDOWS\system32\wwqmxwaw.exe 2008-06-26 21:52 . 2008-06-29 23:46 <DIR> d-------- C:\Program Files\LabelCommand 2008-06-24 23:44 . 2008-06-24 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd 2008-06-24 10:45 . 2008-06-24 10:45 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44 . 2008-06-24 10:44 <DIR> d-------- C:\Program Files\TextPad 5 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 02:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-04 02:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-06-09 01:32 --------- d-----w C:\Documents and Settings\Jane Tyson\Application Data\Winamp 2008-05-30 19:50 --------- d-----w C:\Program Files\Paint Shop Pro 5 2008-05-30 19:40 --------- d-----w C:\Program Files\Avery Wizard 3.1 2008-05-30 19:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-30 19:02 --------- d-----w C:\Program Files\Common Files\Avery 2008-05-25 01:36 --------- d-----w C:\Program Files\iTunes 2008-05-25 01:36 --------- d-----w C:\Program Files\iPod 2008-05-25 01:33 --------- d-----w C:\Program Files\QuickTime 2008-05-25 01:26 --------- d-----w C:\Program Files\Apple Software Update 2008-05-14 08:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2006-12-26 18:18 5,297,976 ----a-w C:\Program Files\picasaweb-current-setup.exe 2006-08-03 01:28 987,136 ----a-w C:\Program Files\SAFlashPlayer.exe 2006-07-17 02:33 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-10-13 14:15 2,625,400 ----a-w C:\Program Files\comcast_photoshow_deluxe_4.exe . |
|
|
|
|
07-06-2008, 02:41 PM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
Double-click combofix.exe to run it again and past the ComboFix.txt log that it produces in your next reply.
|
|
|
|
|
07-06-2008, 03:34 PM
|
#10 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
ComboFix 08-07-03.1 - Zach Tyson 2008-07-06 16:15:52.3 - NTFSx86
Running from: C:\Documents and Settings\Zach Tyson\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Program Files\Antivirus2008y C:\Program Files\Antivirus2008y\antvrs.exe C:\Program Files\PCPrivacyCleaner C:\WINDOWS\cookies.ini C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\mcrh.tmp . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-03 22:53 . 2008-07-03 22:53 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\McAfee 2008-06-30 22:56 . 2008-06-30 22:56 <DIR> d-------- C:\Deckard 2008-06-30 22:49 . 2008-06-30 22:49 <DIR> d-------- C:\ie-spyad_zo 2008-06-30 22:47 . 2008-06-30 22:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43 . 2008-06-30 22:43 <DIR> d-------- C:\Program Files\Panda Security 2008-06-30 20:16 . 2008-07-03 21:02 <DIR> d-------- C:\Program Files\Registry Defender Platinum 2008-06-30 18:32 . 2008-06-30 18:32 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y 2008-06-28 22:49 . 2008-06-28 22:49 318,720 --a------ C:\WINDOWS\system32\nnnkLedC.dll_old 2008-06-27 21:17 . 2008-06-27 21:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-27 21:17 . 2008-06-27 22:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:46 . 2008-06-27 22:11 <DIR> d-------- C:\Program Files\Search And Destroy 2008-06-27 18:29 . 2008-06-27 18:29 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-26 21:57 . 2008-06-26 21:57 112,128 --a------ C:\WINDOWS\system32\wwqmxwaw.exe 2008-06-26 21:52 . 2008-06-29 23:46 <DIR> d-------- C:\Program Files\LabelCommand 2008-06-24 23:44 . 2008-06-24 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd 2008-06-24 10:45 . 2008-06-24 10:45 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44 . 2008-06-24 10:44 <DIR> d-------- C:\Program Files\TextPad 5 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 02:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-04 02:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-06-09 01:32 --------- d-----w C:\Documents and Settings\Jane Tyson\Application Data\Winamp 2008-05-30 19:50 --------- d-----w C:\Program Files\Paint Shop Pro 5 2008-05-30 19:40 --------- d-----w C:\Program Files\Avery Wizard 3.1 2008-05-30 19:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-30 19:02 --------- d-----w C:\Program Files\Common Files\Avery 2008-05-25 01:36 --------- d-----w C:\Program Files\iTunes 2008-05-25 01:36 --------- d-----w C:\Program Files\iPod 2008-05-25 01:33 --------- d-----w C:\Program Files\QuickTime 2008-05-25 01:26 --------- d-----w C:\Program Files\Apple Software Update 2008-05-14 08:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 03:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2006-12-26 18:18 5,297,976 ----a-w C:\Program Files\picasaweb-current-setup.exe 2006-08-03 01:28 987,136 ----a-w C:\Program Files\SAFlashPlayer.exe 2006-07-17 02:33 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-10-13 14:15 2,625,400 ----a-w C:\Program Files\comcast_photoshow_deluxe_4.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-06-06 10:07 40960] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-25 01:04 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "Wise-FTP Scheduler"="C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe" [2004-05-12 11:47 542720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 19:42 1404928] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02 86016] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 05:33 122941] "mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2005-03-15 09:58 53248] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688] "PE2CKFNT SE"="C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [1998-07-03 13:51 25088] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-06-06 10:07 40960] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 00:08 49152] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 14:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 12:22 20480] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 18:15 366400] C:\Documents and Settings\Jane Tyson\Start Menu\Programs\Startup\ Forget Me Not Reminders.lnk - C:\CACARD\FMREMIND.EXE [2006-03-02 21:51:52 6224] MEMonitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-12-28 16:30:08 947544] C:\Documents and Settings\Randy Tyson\Start Menu\Programs\Startup\ Expedia Fare Alert.lnk - C:\Program Files\Expedia\Expedia Fare Alert\ExpediaFareAlert.exe [2006-09-04 21:32:33 696320] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] C:\Documents and Settings\Zach Tyson\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-10-08 02:34:34 156784] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-08 02:29:00 24576] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 00:28:44 282624] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 03:15:54 65588] Photo Express Calendar Checker SE.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe [2006-03-03 17:31:27 55296] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36 806912] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0\\waol.exe"= "C:\\Program Files\\Microsoft Plus! Photo Story 2 LE\\PS2Trial.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R3 EPPSCSIx;EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys [2002-03-06 14:20] S0 AEC6710D;AEC6710D;C:\WINDOWS\system32\drivers\AEC6710D.sys [1998-05-15 06:29] S3 4ea74d3a-5cf9-4fc1-bfba-d90edec1b51a;4ea74d3a-5cf9-4fc1-bfba-d90edec1b51a;D:\CDS300\cds300.dll [] . Contents of the 'Scheduled Tasks' folder "2008-07-01 17:31:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-15 06:00:01 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-07-01 06:00:01 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2008-07-06 03:55:40 C:\WINDOWS\Tasks\User_Feed_Synchronization-{C20027EF-5EA7-476D-B064-B9F3C81F3552}.job" - C:\WINDOWS\system32\msfeedssync.exe . - - - - ORPHANS REMOVED - - - - BHO-{66C36DE5-1028-4270-AB45-BB08C2A45777} - (no file) BHO-{84AA61C2-A977-4FD8-9E2F-C768F0387572} - C:\WINDOWS\system32\tuvSIAss.dll BHO-{A7CE8593-7CE5-4F45-B5FB-1D24A7690098} - (no file) BHO-{F62BA7F1-555D-40FB-A6AC-4C2DD78CA8EB} - C:\WINDOWS\system32\ljJDWqPg.dll HKCU-Run-RssReader - C:\Program Files\RssReader\RssReader.exe HKLM-Run-34b3b0cb - C:\WINDOWS\system32\okmppwqm.dll ShellExecuteHooks-{84AA61C2-A977-4FD8-9E2F-C768F0387572} - C:\WINDOWS\system32\tuvSIAss.dll Notify-tuvSIAss - tuvSIAss.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-06 16:22:15 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-06 16:28:44 ComboFix-quarantined-files.txt 2008-07-06 21:28:33 Pre-Run: 39,602,659,328 bytes free Post-Run: 39,597,166,592 bytes free 180 --- E O F --- 2008-06-21 08:02:11 |
|
|
|
|
07-06-2008, 06:03 PM
|
#11 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
Hello again, zchtyson. Please tell us how your system is behaving after doing the following.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript into ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. If you use dial-up for the internet, skip this step and let me know. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior |
|
|
|
|
|
07-06-2008, 11:37 PM
|
#12 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
My system is behaving normally. I have not noticed any problems. The problems I had are gone. A couple things happened while I was following the steps you gave me. When doing the ComboFix scan my desktop went blank which I know is normal, but it remained blank after the scan was over. I had to manually restart the computer. Everything came back after the computer was restarted. MSN is now my homepage, but I did not set it as my homepage. Other than that there have been no problems.
ComboFix 08-07-03.1 - Zach Tyson 2008-07-06 20:50:49.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.224 [GMT -5:00]Running from: C:\Documents and Settings\Zach Tyson\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Zach Tyson\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\nnnkLedC.dll_old C:\WINDOWS\system32\wwqmxwaw.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080626215045562.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080627183106281.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080629231906984.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080629234628812.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080630000608796.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080630084033734.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080630172956390.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080630174711015.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\LOG\20080630200743640.log C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Documents and Settings\Randy Tyson\Application Data\Antivirus2008y C:\Program Files\LabelCommand C:\Program Files\LabelCommand\LabelCommand.dll C:\Program Files\LabelCommand\uninstall.dat C:\Program Files\LabelCommand\Uninstall.exe C:\WINDOWS\system32\nnnkLedC.dll_old C:\WINDOWS\system32\wwqmxwaw.exe . ((((((((((((((((((((((((( Files Created from 2008-06-07 to 2008-07-07 ))))))))))))))))))))))))))))))) . 2008-07-06 17:43 . 2008-07-06 17:43 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\McAfee 2008-07-03 22:53 . 2008-07-03 22:53 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-03 21:18 . 2008-07-03 21:18 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\McAfee 2008-06-30 22:56 . 2008-06-30 22:56 <DIR> d-------- C:\Deckard 2008-06-30 22:49 . 2008-06-30 22:49 <DIR> d-------- C:\ie-spyad_zo 2008-06-30 22:47 . 2008-06-30 22:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-30 22:43 . 2008-06-30 22:43 <DIR> d-------- C:\Program Files\Panda Security 2008-06-30 20:16 . 2008-07-03 21:02 <DIR> d-------- C:\Program Files\Registry Defender Platinum 2008-06-27 21:17 . 2008-06-27 21:17 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-27 21:17 . 2008-06-27 22:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-27 20:46 . 2008-06-27 22:11 <DIR> d-------- C:\Program Files\Search And Destroy 2008-06-27 18:29 . 2008-06-27 18:29 <DIR> d-------- C:\Documents and Settings\Randy Tyson\Application Data\Lavasoft 2008-06-24 10:45 . 2008-06-24 10:45 <DIR> d-------- C:\Documents and Settings\Zach Tyson\Application Data\Helios 2008-06-24 10:44 . 2008-06-24 10:44 <DIR> d-------- C:\Program Files\TextPad 5 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --a------ C:\WINDOWS\system32\drivers\bthport.sys 2008-06-10 22:46 . 2008-06-13 08:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-04 02:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-06-09 01:32 --------- d-----w C:\Documents and Settings\Jane Tyson\Application Data\Winamp 2008-05-30 19:50 --------- d-----w C:\Program Files\Paint Shop Pro 5 2008-05-30 19:40 --------- d-----w C:\Program Files\Avery Wizard 3.1 2008-05-30 19:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-30 19:02 --------- d-----w C:\Program Files\Common Files\Avery 2008-05-25 01:36 --------- d-----w C:\Program Files\iTunes 2008-05-25 01:36 --------- d-----w C:\Program Files\iPod 2008-05-25 01:33 --------- d-----w C:\Program Files\QuickTime 2008-05-25 01:26 --------- d-----w C:\Program Files\Apple Software Update 2008-05-14 08:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-24 03:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2006-12-26 18:18 5,297,976 ----a-w C:\Program Files\picasaweb-current-setup.exe 2006-08-03 01:28 987,136 ----a-w C:\Program Files\SAFlashPlayer.exe 2006-07-17 02:33 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2005-10-13 14:15 2,625,400 ----a-w C:\Program Files\comcast_photoshow_deluxe_4.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-06-06 10:07 40960] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-25 01:04 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "Wise-FTP Scheduler"="C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe" [2004-05-12 11:47 542720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 19:42 1404928] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02 86016] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 05:33 122941] "mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2005-03-15 09:58 53248] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 10:35 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 10:32 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 10:36 114688] "PE2CKFNT SE"="C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [1998-07-03 13:51 25088] "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2006-06-06 10:07 40960] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-09-24 00:08 49152] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 14:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 12:22 20480] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 18:15 366400] C:\Documents and Settings\Jane Tyson\Start Menu\Programs\Startup\ Forget Me Not Reminders.lnk - C:\CACARD\FMREMIND.EXE [2006-03-02 21:51:52 6224] MEMonitor.lnk - C:\Program Files\Verizon Wireless\V CAST Music Manager\MEMonitor.exe [2007-12-28 16:30:08 947544] C:\Documents and Settings\Randy Tyson\Start Menu\Programs\Startup\ Expedia Fare Alert.lnk - C:\Program Files\Expedia\Expedia Fare Alert\ExpediaFareAlert.exe [2006-09-04 21:32:33 696320] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] C:\Documents and Settings\Zach Tyson\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2005-10-08 02:34:34 156784] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-08 02:29:00 24576] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 00:28:44 282624] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 03:15:54 65588] Photo Express Calendar Checker SE.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe [2006-03-03 17:31:27 55296] QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36 806912] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0\\waol.exe"= "C:\\Program Files\\Microsoft Plus! Photo Story 2 LE\\PS2Trial.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R3 EPPSCSIx;EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys [2002-03-06 14:20] S0 AEC6710D;AEC6710D;C:\WINDOWS\system32\drivers\AEC6710D.sys [1998-05-15 06:29] S3 4ea74d3a-5cf9-4fc1-bfba-d90edec1b51a;4ea74d3a-5cf9-4fc1-bfba-d90edec1b51a;D:\CDS300\cds300.dll [] . Contents of the 'Scheduled Tasks' folder "2008-07-01 17:31:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-15 06:00:01 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-07-01 06:00:01 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2008-07-06 03:55:40 C:\WINDOWS\Tasks\User_Feed_Synchronization-{C20027EF-5EA7-476D-B064-B9F3C81F3552}.job" - C:\WINDOWS\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-06 20:57:03 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-06 21:02:32 ComboFix-quarantined-files.txt 2008-07-07 02:02:12 ComboFix2.txt 2008-07-06 21:28:45 Pre-Run: 39,561,277,440 bytes free Post-Run: 39,559,589,888 bytes free 179 --- E O F --- 2008-06-21 08:02:11 -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Monday, July 7, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, July 06, 2008 18:57:34 Records in database: 918909 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 104531 Threat name: 8 Infected objects: 14 Suspicious objects: 0 Duration of the scan: 01:57:19 File name / Threat name / Threats count C:\Deckard\System Scanner\backup\DOCUME~1\RANDYT~1\LOCALS~1\Temp\media.php Infected: Trojan.Win32.Vapsup.hel 3 C:\Deckard\System Scanner\backup\DOCUME~1\RANDYT~1\LOCALS~1\Temp\media.php Infected: Trojan.Win32.Vapsup.hcq 1 C:\Deckard\System Scanner\backup\DOCUME~1\RANDYT~1\LOCALS~1\Temp\media.php Infected: Trojan.Win32.Vapsup.hbm 1 C:\Deckard\System Scanner\backup\DOCUME~1\RANDYT~1\LOCALS~1\Temp\media.php Infected: Trojan.Win32.Vapsup.hbn 1 C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe.vir Infected: not-a-virus:FraudTool.Win32.WinSpywareProtect.al 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jkkLEUKB.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lirgeriu.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ljJDWqPg.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\nnnkLedC.dll_old.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\okmppwqm.dll.vir Infected: Trojan.Win32.Monder.alm 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pmnlmJcC.dll.vir Infected: Trojan.Win32.Monderb.gen 1 C:\QooBox\Quarantine\C\WINDOWS\system32\vwanyecf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zvs 1 The selected area was scanned. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:26:12 AM, on 7/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\McAfee\MBK\MBackMonitor.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\iPod\bin\iPodService.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [Wise-FTP Scheduler] C:\Program Files\AceBIT\WISE-FTP\WF_Scheduler.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/download...2/axofupld.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ufirst.webex.com/client/T26L/webex/ieatgpc.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 12919 bytes |
|
|
|
|
07-07-2008, 06:42 AM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
Hello vzwrep. If you wish to change your home page, go Start > Control Panel > Internet Options and change your home page.
Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky log, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
07-07-2008, 08:25 PM
|
#14 (permalink) |
|
Registered User
Join Date: Jun 2008
Posts: 8
OS: xp sp 2
|
Re: pop ups and google redirects
I am currently downloading critical updates from Microsoft. I have three of the five programs listed. I will be downloading the other two. Everything is working great. Thank you so much for your help!
|
|
|
|
|
07-07-2008, 08:42 PM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,586
OS: XP SP3
|
Re: pop ups and google redirects
I just noticed I called you by another user in my last post. My apologies.
You're very welcome! Glad to be of help. 
|
|
|
|
| Thread Tools | |
|
|
