Unwanted web sites appearing

SMQ · 02-20-2009, 06:07 AM

Im a running windows XP, IE6 and have recently downloaded McAfee AV as part of my BT Broadband package. For the last week or so whilst browsing, unwanted websites have appeared-these are mostly advertising car insurance and have the letters CiD in the banner.

I have followed your instructions and have attached logs etc-

DDS (Ver_09-02-01.01) - FAT32x86
Run by Stephen McQueen at 12:17:27.20 on 20/02/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1262 [GMT 0:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Stephen McQueen\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://home.bt.yahoo.com/
uSearch Page = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
uSearch Bar = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/sb/*http://uk.yahoo.com/search/ie.html
mDefault_Page_URL = hxxp://global.acer.com
mDefault_Search_URL = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
mSearch Page = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
EB: {2D51D869-C36B-42bd-AE68-0A81BC771FA5} - No File
uRun: [kdx] c:\program files\kontiki\KHost.exe -all
uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0
uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe
uRun: [WINDOW HELP] c:\docume~1\stephe~1\applic~1\knobne~1\soft drv media.exe
mRun: [LaunchApp]
mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe
mRun: [ntiMUI] c:\program files\newtech infosystems\nti cd & dvd-maker 7\ntiMUI.exe
mRun: [<NO NAME>]
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SkyTel] SkyTel.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [eRecoveryService] c:\acer\empowering technology\erecovery\eRAgent.exe
mRun: [REGSHAVE] c:\program files\regshave\REGSHAVE.EXE /AUTORUN
mRun: [4oD] "c:\program files\kontiki\KHost.exe" -all
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [btbb_McciTrayApp] "c:\program files\bt broadband desktop help\btbb\BTHelpNotifier.exe"
mRun: [btbb_wcm_McciTrayApp] "c:\program files\bt broadband desktop help\btbb_wcm\McciTrayApp.exe"
mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Base frag grid bows] c:\documents and settings\all users\application data\cast ping base frag\Spam proc.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab
DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} - hxxp://www.bebo.com/files/BeboUploader.5.1.4.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15-3.cab
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D821DC4A-0814-435E-9820-661C543A4679} - hxxp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-27 207656]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-1-10 206096]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-1-10 358736]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-1-10 144704]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-1-10 605512]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-1-10 79240]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-1-10 35240]
R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-1-10 34152]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-1-10 40488]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\elock2burnerlockdriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\elock2fsctldriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S2 gupdate1c98e0b94672c46;Google Update Service (gupdate1c98e0b94672c46);c:\program files\google\update\GoogleUpdate.exe [2009-2-13 133104]
S2 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2004-11-18 26488]

=============== Created Last 30 ================

==================== Find3M ====================

2009-01-11 09:06 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-12 17:01 3,067,904 -------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-12-06 10:23 15,452,536 a------- c:\program files\IE7-WindowsXP-x86-enu.exe
2008-10-25 13:33 3,338 a------- c:\docume~1\stephe~1\applic~1\wklnhst.dat
2008-09-26 19:56 25,740,144 a------- c:\program files\wmp11-windowsxp-x86-enu.exe
2008-09-17 20:32 67,110,184 a------- c:\program files\iTunes8Setup.exe
2008-06-14 13:53 551 a------- c:\program files\a
2008-05-31 18:59 861,200 a------- c:\program files\yih_setup.exe
2007-06-15 19:15 92,064 a------- c:\documents and settings\stephen mcqueen\mqdmmdm.sys
2007-06-15 19:15 79,328 a------- c:\documents and settings\stephen mcqueen\mqdmserd.sys
2007-06-15 19:15 66,656 a------- c:\documents and settings\stephen mcqueen\mqdmbus.sys
2007-06-15 19:15 9,232 a------- c:\documents and settings\stephen mcqueen\mqdmmdfl.sys
2007-06-15 19:15 6,208 a------- c:\documents and settings\stephen mcqueen\mqdmcmnt.sys
2007-06-15 19:15 5,936 a------- c:\documents and settings\stephen mcqueen\mqdmwhnt.sys
2007-06-15 19:15 4,048 a------- c:\documents and settings\stephen mcqueen\mqdmcr.sys
2007-06-15 19:15 25,600 a------- c:\documents and settings\stephen mcqueen\usbsermptxp.sys
2007-06-15 19:15 22,768 a------- c:\documents and settings\stephen mcqueen\usbsermpt.sys
2005-12-29 10:22 405,504 a------- c:\program files\McciBrowser.exe

============= FINISH: 12:18:53.65 ===============

Hope you can assist in sorting.

**chemist** · 02-21-2009, 12:06 PM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Your hard drive is almost full. Having too little free space on your hard drive can compromise system performance.

Quote:

C: is FIXED (FAT32) - 25 GiB total, 1.858 GiB free.

I suggest you move pictures, music, etc. to an external drive or USB stick if you have one and uninstall any programs that are never or hardly ever used.

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Messenger Plus! Live & Sponsor (CiD)<<This program is known to install the malware that you have, a LOP infection. If the program is a must have, uninstall it, then reinstall it and decline when asked to install the sponsor's software.

Please read this and this

------------------------------------------------------

Download LopSD and Save it to your Desktop.
Double-click LopSD.exe to run it.
Type the letter of your chosen language and press Enter
Click OK to the prompt.
Type 1 and press Enter
Please post the log, lopR.txt, which it creates at C:\lopR.txt in your next reply.

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Get help here

Please post the C:\ComboFix.txt in your next reply for further review.

------------------------------------------------------

SMQ · 02-22-2009, 09:35 AM

I have increased the hard drive space and uninstalled Windows Live Messenger + Sponsor (CID).

I have also run LopSD and ComoboFix, so I've attached the logs from each of them. Just waiting to see if the unwanted ads keep popping up now.

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
BIOS : Ver 1.00PARTTBL
USER : Stephen McQueen ( Administrator )
BOOT : Normal boot
Antivirus : McAfee VirusScan (Activated)
Firewall : McAfee Personal Firewall (Activated)
C:\ (Local Disk) - FAT32 - Total:25 Go (Free:4 Go)
D:\ (Local Disk) - FAT32 - Total:25 Go (Free:5 Go)
E:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 22/02/2009|14:48 )

--------------------\\ Listing folders in APPLIC~1

[19/05/2006|20:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
[16/03/2008|23:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer
[10/05/2006|16:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI
[10/05/2006|16:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[10/05/2006|15:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[29/01/2009|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[04/08/2008|19:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[30/06/2007|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[14/04/2007|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[27/05/2007|18:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[15/02/2009|20:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
[20/03/2008|22:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4
[07/05/2007|18:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[10/05/2006|16:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[28/12/2007|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Driving Test Success
[24/08/2008|08:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[14/12/2008|15:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
[20/03/2008|22:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki
[10/01/2009|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
[10/05/2006|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[10/01/2009|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive
[10/01/2009|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
[08/04/2007|07:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[08/04/2007|12:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[14/02/2008|13:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[08/04/2007|07:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo!
[10/01/2009|22:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[10/05/2006|15:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[10/05/2006|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
[10/01/2009|12:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore

[19/05/2006|20:16] C:\DOCUME~1\STEPHE~1\APPLIC~1\Adobe
[18/04/2007|16:57] C:\DOCUME~1\STEPHE~1\APPLIC~1\AdobeUM
[14/04/2007|10:48] C:\DOCUME~1\STEPHE~1\APPLIC~1\Apple Computer
[10/05/2006|16:14] C:\DOCUME~1\STEPHE~1\APPLIC~1\ATI
[26/05/2007|17:13] C:\DOCUME~1\STEPHE~1\APPLIC~1\Creative
[26/12/2007|12:51] C:\DOCUME~1\STEPHE~1\APPLIC~1\FUJIFILM
[13/04/2007|18:11] C:\DOCUME~1\STEPHE~1\APPLIC~1\FunWebProducts
[11/04/2007|20:30] C:\DOCUME~1\STEPHE~1\APPLIC~1\Google
[16/03/2008|23:55] C:\DOCUME~1\STEPHE~1\APPLIC~1\Help
[10/05/2006|16:03] C:\DOCUME~1\STEPHE~1\APPLIC~1\Identities
[04/08/2008|20:29] C:\DOCUME~1\STEPHE~1\APPLIC~1\InstallShield
[05/05/2008|13:38] C:\DOCUME~1\STEPHE~1\APPLIC~1\LimeWire
[08/04/2007|06:38] C:\DOCUME~1\STEPHE~1\APPLIC~1\Macromedia
[10/05/2006|15:51] C:\DOCUME~1\STEPHE~1\APPLIC~1\Microsoft
[10/01/2009|12:16] C:\DOCUME~1\STEPHE~1\APPLIC~1\Motive
[26/04/2008|10:56] C:\DOCUME~1\STEPHE~1\APPLIC~1\Mozilla
[10/04/2007|12:26] C:\DOCUME~1\STEPHE~1\APPLIC~1\Real
[08/04/2007|14:34] C:\DOCUME~1\STEPHE~1\APPLIC~1\Screenshot Sender
[25/12/2007|13:11] C:\DOCUME~1\STEPHE~1\APPLIC~1\SecuROM
[19/06/2007|21:28] C:\DOCUME~1\STEPHE~1\APPLIC~1\Sun
[26/04/2008|10:58] C:\DOCUME~1\STEPHE~1\APPLIC~1\Talkback
[18/04/2007|19:49] C:\DOCUME~1\STEPHE~1\APPLIC~1\Template
[08/04/2007|07:31] C:\DOCUME~1\STEPHE~1\APPLIC~1\Yahoo!

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[22/02/2009 11:34][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[15/02/2009 01:33][--a------] C:\WINDOWS\tasks\McDefragTask.job
[01/02/2009 01:00][--a------] C:\WINDOWS\tasks\McQcTask.job
[22/02/2009 14:24][--a------] C:\WINDOWS\tasks\Google Software Updater.job
[21/11/2008 23:46][--a------] C:\WINDOWS\tasks\Low Battery Alarm Program.job
[19/02/2009 09:51][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[22/02/2009 11:34][--ah-----] C:\WINDOWS\tasks\SA.DAT
[04/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[10/05/2006|16:23] C:\Program Files\Acer
[10/05/2006|16:20] C:\Program Files\Acer Inc
[10/05/2006|16:21] C:\Program Files\Adobe
[14/04/2007|10:47] C:\Program Files\Apple Software Update
[10/05/2006|16:04] C:\Program Files\ATI Technologies
[29/01/2009|10:38] C:\Program Files\Bonjour
[10/01/2009|22:47] C:\Program Files\BT Broadband Desktop Help
[08/04/2007|07:27] C:\Program Files\BT Home Hub
[10/01/2009|22:45] C:\Program Files\BTHomeHub
[17/02/2009|21:11] C:\Program Files\CA Yahoo! Anti-Spy
[10/05/2006|15:51] C:\Program Files\Common Files
[10/05/2006|15:56] C:\Program Files\ComPlus Applications
[07/11/2008|14:39] C:\Program Files\CONEXANT
[07/05/2007|14:28] C:\Program Files\Creative
[07/05/2007|18:07] C:\Program Files\Creative Installation Information
[23/07/2008|18:01] C:\Program Files\Creatures 2
[10/05/2006|16:23] C:\Program Files\CyberLink
[20/05/2006|11:23] C:\Program Files\DIFX
[17/06/2007|14:44] C:\Program Files\directx
[08/08/2007|16:47] C:\Program Files\EA GAMES
[11/04/2007|20:29] C:\Program Files\Google
[10/05/2006|16:04] C:\Program Files\InstallShield Installation Information
[10/05/2006|15:56] C:\Program Files\Internet Explorer
[29/01/2009|10:45] C:\Program Files\iPod
[29/01/2009|10:45] C:\Program Files\iTunes
[19/06/2007|21:26] C:\Program Files\Java
[20/03/2008|22:07] C:\Program Files\Kontiki
[08/04/2007|06:49] C:\Program Files\Launch Manager
[10/01/2009|12:35] C:\Program Files\McAfee
[10/01/2009|12:35] C:\Program Files\McAfee.com
[10/05/2006|15:55] C:\Program Files\Messenger
[08/04/2007|14:33] C:\Program Files\Messenger Plus! Live
[18/02/2008|20:36] C:\Program Files\Microsoft ActiveSync
[15/02/2008|10:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[10/05/2006|15:58] C:\Program Files\microsoft frontpage
[08/04/2007|07:00] C:\Program Files\Microsoft Office
[08/02/2009|09:56] C:\Program Files\Microsoft Silverlight
[08/04/2007|07:00] C:\Program Files\Microsoft Works
[18/02/2008|20:33] C:\Program Files\Microsoft.NET
[10/05/2006|15:57] C:\Program Files\Movie Maker
[26/04/2008|10:56] C:\Program Files\Mozilla Firefox
[20/02/2009|10:47] C:\Program Files\MSBuild
[15/11/2008|15:54] C:\Program Files\MSECache
[10/05/2006|15:55] C:\Program Files\MSN
[10/05/2006|15:55] C:\Program Files\MSN Gaming Zone
[08/04/2007|12:17] C:\Program Files\MSN Messenger
[12/11/2008|23:29] C:\Program Files\MSXML 4.0
[13/04/2007|17:55] C:\Program Files\MyWebSearch
[10/05/2006|15:57] C:\Program Files\NetMeeting
[10/05/2006|16:29] C:\Program Files\NewTech Infosystems
[23/07/2008|16:06] C:\Program Files\Norton Security Scan
[10/05/2006|15:56] C:\Program Files\Online Services
[10/05/2006|15:57] C:\Program Files\Outlook Express
[29/01/2009|10:34] C:\Program Files\QuickTime
[10/04/2007|12:27] C:\Program Files\Real
[10/05/2006|16:14] C:\Program Files\Realtek
[20/02/2009|10:47] C:\Program Files\Reference Assemblies
[05/05/2007|17:56] C:\Program Files\Samsung
[08/04/2007|07:42] C:\Program Files\Symantec
[08/04/2007|06:48] C:\Program Files\Synaptics
[10/05/2006|16:03] C:\Program Files\Uninstall Information
[10/06/2007|18:36] C:\Program Files\Windows Live
[08/04/2007|21:40] C:\Program Files\Windows Media Connect 2
[10/05/2006|15:56] C:\Program Files\Windows Media Player
[10/05/2006|15:55] C:\Program Files\Windows NT
[10/05/2006|15:57] C:\Program Files\WindowsUpdate
[10/05/2006|15:58] C:\Program Files\xerox
[08/04/2007|07:28] C:\Program Files\Yahoo!

--------------------\\ Listing Folders in C:\Program Files\Common Files

[04/08/2008|19:45] C:\Program Files\Common Files\Adobe
[30/06/2007|15:47] C:\Program Files\Common Files\Apple
[10/05/2006|16:08] C:\Program Files\Common Files\ATI Technologies
[07/05/2007|18:07] C:\Program Files\Common Files\Creative
[18/02/2008|20:34] C:\Program Files\Common Files\DESIGNER
[10/05/2006|16:03] C:\Program Files\Common Files\InstallShield
[19/06/2007|21:16] C:\Program Files\Common Files\Java
[10/05/2006|16:30] C:\Program Files\Common Files\LightScribe
[10/01/2009|12:35] C:\Program Files\Common Files\McAfee
[10/05/2006|15:51] C:\Program Files\Common Files\Microsoft Shared
[10/01/2009|22:47] C:\Program Files\Common Files\Motive
[10/05/2006|15:57] C:\Program Files\Common Files\MSSoap
[10/05/2006|16:30] C:\Program Files\Common Files\NewTech Infosystems
[10/05/2006|15:51] C:\Program Files\Common Files\ODBC
[10/04/2007|12:27] C:\Program Files\Common Files\Real
[31/05/2008|19:08] C:\Program Files\Common Files\scanner
[10/05/2006|15:57] C:\Program Files\Common Files\Services
[10/05/2006|15:51] C:\Program Files\Common Files\SpeechEngines
[09/07/2007|12:09] C:\Program Files\Common Files\SWF Studio
[08/04/2007|07:42] C:\Program Files\Common Files\Symantec Shared
[10/05/2006|15:56] C:\Program Files\Common Files\System
[14/02/2008|13:02] C:\Program Files\Common Files\WindowsLiveInstaller
[24/08/2008|08:53] C:\Program Files\Common Files\xing shared

--------------------\\ Process

( 59 Processes )

iexplore.exe ~ [PID:2348]

--------------------\\ Searching with S_Lop

C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp\bis111.exe

--------------------\\ Searching for Lop Files - Folders

C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@advertising[1].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@uk.seafight.bigpoint[1].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@bigpoint[1].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@adin.bigpoint[2].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@uk.seafight.bigpoint[1].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@888[1].txt
C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@888[2].txt

--------------------\\ Searching within the Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-22 14:50:14
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\STEPHE~1\My Documents\Home Stuff\Leah's stuff\Songs\02 Crack The Shutters.m4a

[F:506][D:23]-> C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp
[F:180][D:0]-> C:\DOCUME~1\STEPHE~1\Cookies
[F:3716][D:8]-> C:\DOCUME~1\STEPHE~1\LOCALS~1\TEMPOR~1\content.IE5
[F:245][D:36]-> C:\Recycled

1 - "C:\Lop SD\LopR_1.txt" - 22/02/2009|14:51 - Option : [1]

--------------------\\ Scan completed at 14:51:37

ComboFix 09-02-21.01 - Stephen McQueen 2009-02-22 16:03:19.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1398 [GMT 0:00]
Running from: c:\documents and settings\Stephen McQueen\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Stephen McQueen\Application Data\FunWebProducts
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc10.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc109.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc129.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc131.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc17.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc18.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc19.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1A.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1B.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1C.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc25.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc28.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc2A.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc3E.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc4D.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc5.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc50.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc6D.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc73.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc8.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc89.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc9.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccA5.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccBA.tmp
c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccDB.tmp
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-01-22 to 2009-02-22 )))))))))))))))))))))))))))))))
.

2009-02-22 14:47 . 2009-02-22 14:47 <DIR> d-------- C:\Lop SD
2009-02-20 12:21 . 2009-02-20 12:34 250 --a------ c:\windows\gmer.ini
2009-02-20 10:48 . 2009-02-20 10:48 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-20 10:47 . 2009-02-20 10:47 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-20 10:47 . 2009-02-20 10:47 <DIR> d-------- c:\program files\MSBuild
2009-02-20 10:43 . 2008-07-06 12:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-20 10:43 . 2008-07-06 12:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-20 10:43 . 2008-07-06 10:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-20 10:43 . 2008-07-06 12:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-20 10:43 . 2008-07-06 12:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-20 10:43 . 2008-07-06 12:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-20 10:43 . 2008-07-06 12:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-17 21:11 . 2009-02-17 21:11 <DIR> d-------- c:\program files\CA Yahoo! Anti-Spy
2009-02-15 20:05 . 2009-02-15 20:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Cast ping base frag
2009-02-08 09:56 . 2009-02-08 09:56 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\program files\iTunes
2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\program files\iPod
2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-29 10:38 . 2009-01-29 10:38 <DIR> d-------- c:\program files\Bonjour
2009-01-29 10:34 . 2009-01-29 10:34 <DIR> d-------- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-11 09:06 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-10 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-10 22:47 --------- d-----w c:\program files\Common Files\Motive
2009-01-10 22:47 --------- d-----w c:\program files\BT Broadband Desktop Help
2009-01-10 22:45 --------- d-----w c:\program files\BTHomeHub
2009-01-10 12:52 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2009-01-10 12:41 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
2009-01-10 12:35 --------- d-----w c:\program files\McAfee.com
2009-01-10 12:35 --------- d-----w c:\program files\McAfee
2009-01-10 12:35 --------- d-----w c:\program files\Common Files\McAfee
2009-01-10 12:16 --------- d-----w c:\documents and settings\Stephen McQueen\Application Data\Motive
2009-01-10 12:16 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-01-10 12:09 --------- d-----w c:\documents and settings\All Users\Application Data\Motive
2008-12-12 17:01 3,067,904 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-12-06 10:23 15,452,536 ----a-w c:\program files\IE7-WindowsXP-x86-enu.exe
2008-10-25 13:33 3,338 ----a-w c:\documents and settings\Stephen McQueen\Application Data\wklnhst.dat
2008-09-26 19:56 25,740,144 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe
2008-09-17 20:32 67,110,184 ----a-w c:\program files\iTunes8Setup.exe
2008-06-14 13:53 551 ----a-w c:\program files\a
2008-05-31 18:59 861,200 ----a-w c:\program files\yih_setup.exe
2007-06-15 19:15 92,064 ----a-w c:\documents and settings\Stephen McQueen\mqdmmdm.sys
2007-06-15 19:15 9,232 ----a-w c:\documents and settings\Stephen McQueen\mqdmmdfl.sys
2007-06-15 19:15 79,328 ----a-w c:\documents and settings\Stephen McQueen\mqdmserd.sys
2007-06-15 19:15 66,656 ----a-w c:\documents and settings\Stephen McQueen\mqdmbus.sys
2007-06-15 19:15 6,208 ----a-w c:\documents and settings\Stephen McQueen\mqdmcmnt.sys
2007-06-15 19:15 5,936 ----a-w c:\documents and settings\Stephen McQueen\mqdmwhnt.sys
2007-06-15 19:15 4,048 ----a-w c:\documents and settings\Stephen McQueen\mqdmcr.sys
2007-06-15 19:15 25,600 ----a-w c:\documents and settings\Stephen McQueen\usbsermptxp.sys
2007-06-15 19:15 22,768 ----a-w c:\documents and settings\Stephen McQueen\usbsermpt.sys
2005-12-29 10:22 405,504 ----a-w c:\program files\McciBrowser.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 53248]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"4oD"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-24 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-11 136600]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" [2008-09-11 1517056]
"btbb_wcm_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe" [2008-08-28 1516032]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-27 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\System32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-01-10 206096]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-04 14336]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S2 gupdate1c98e0b94672c46;Google Update Service (gupdate1c98e0b94672c46);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 133104]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{253d0d44-e868-11db-a068-0016d4191b28}]
\Shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d04fc44f-e591-11db-a05a-806d6172696f}]
\Shell\AutoRun\command - D:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-13 18:46]

2009-02-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

2009-02-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

2009-02-22 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 18:47]

2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-REGSHAVE - c:\program files\REGSHAVE\REGSHAVE.EXE
HKLM-Run-LaunchApp - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://home.bt.yahoo.com/
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-22 16:04:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(592)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-02-22 16:06:49
ComboFix-quarantined-files.txt 2009-02-22 16:06:48

Pre-Run: 4,453,056,512 bytes free
Post-Run: 5,402,361,856 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

220 --- E O F --- 2009-02-20 10:35:58

**chemist** · 02-22-2009, 12:09 PM

Hello SMQ. Please tell us how your system is behaving after doing the following.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist:

LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the codebox below into Notepad:

Code:

Folder::
c:\documents and settings\All Users\Application Data\Cast ping base frag

DDS::
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000

Driver::
eLock2BurnerLockDriver
eLock2FSCTLDriver

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop.
Scroll down to where it says Java Runtime Environment (JRE) 6 Update 12 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
Click the Download button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement
Click Continue The page will refresh.
Click on the link to download Windows Offline Installation and Save the file to your Desktop.
Close any programs you may have running - especially your web browser.
Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java.
Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u12-windows-i586-p.exe to install the newest version.

After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button.
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
  - Trace and Log Files
- Click OK on Delete Temporary Files Window.
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
- Click OK to leave the Temporary Files Window.
- Click OK to leave the Java Control Panel.
- Delete jre-6u12-windows-i586-p.exe from your desktop.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

ComboFix.txt
Kaspersky report
report on system behavior

SMQ · 02-23-2009, 06:47 AM

All instructions carried out.
No unwanted sites have appeared whilst browsing since first measures caried out to delete the Messenger plus with the sponsor link.
Browsing seems to be better.

Combofix report + Kapersky scan report attached.

KASPERSKY ONLINE SCANNER 7 REPORT
Monday, February 23, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, February 23, 2009 06:42:42
Records in database: 1833498

Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\
E:\
F:\

Scan statistics
Files scanned 91495
Threat name 1
Infected objects 1
Suspicious objects 0
Duration of the scan 02:30:12

File name Threat name Threats count
C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1

The selected area was scanned.

Thanks for all assistance so far.

Cheers.

**chemist** · 02-23-2009, 07:10 AM

Hello again, SMQ.

Go to Start > Run and copy/paste the following into the Run box and click OK:

cmd /c del /a/f/q "C:\Program Files\MSN Messenger\riched20.dll"

A DOS window will open and close again, this is normal.

------------------------------------------------------

Please download HijackThis and Save it to your Desktop.

Alternate link

Double-click on the file you just downloaded. Click 'Run' or 'Install' and follow the prompts to install.

It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double-click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit 'Scan' and then click on 'Save log'.
3. Please post the HijackThis log in your next reply. Do not fix anything in HijackThis since they may be harmless.
4. Close HijackThis now please.

------------------------------------------------------

SMQ · 02-23-2009, 01:17 PM

Hi-jack this log below-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:46, on 23/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe"
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=27986
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c98e0b94672c46) (gupdate1c98e0b94672c46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 12644 bytes

Still no issues with unwanted sites!

Again thanks for help.

Cheers.

**chemist** · 02-23-2009, 02:46 PM

Hello again, SMQ.

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html

Please remember to close all other windows, including browsers then click Fix checked.

Click 'Scan' and then click 'Save log'. Please post the new HijackThis log in your next reply.

Please close HijackThis now.

------------------------------------------------------

SMQ · 02-24-2009, 07:47 AM

Chemist,

Hijackthis log attached as requested-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:41:46, on 24/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (file missing)
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe"
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe"
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=27986
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c98e0b94672c46) (gupdate1c98e0b94672c46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 12249 bytes

Cheers.

**chemist** · 02-24-2009, 08:34 AM

Congratulations. Well done! Your logs appear clean. You should be good to go.

Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
PC Safety and Security--What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

SMQ · 02-24-2009, 02:47 PM

Many thanks- its been a bit of an education!

Cheers

**chemist** · 02-24-2009, 03:22 PM

You're welcome, SMQ! Glad to have helped.

02-22-2009, 09:35 AM	#3 (permalink)
SMQ Registered User Join Date: Feb 2009 Posts: 6 OS: winxp	Re: Unwanted web sites appearing I have increased the hard drive space and uninstalled Windows Live Messenger + Sponsor (CID). I have also run LopSD and ComoboFix, so I've attached the logs from each of them. Just waiting to see if the unwanted ads keep popping up now. --------------------\\ Lop S&D 4.2.5-0 XP/Vista Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3 X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 ) BIOS : Ver 1.00PARTTBL USER : Stephen McQueen ( Administrator ) BOOT : Normal boot Antivirus : McAfee VirusScan (Activated) Firewall : McAfee Personal Firewall (Activated) C:\ (Local Disk) - FAT32 - Total:25 Go (Free:4 Go) D:\ (Local Disk) - FAT32 - Total:25 Go (Free:5 Go) E:\ (CD or DVD) "C:\Lop SD" ( MAJ : 19-12-2008\|23:40 ) Option : [1] ( 22/02/2009\|14:48 ) --------------------\\ Listing folders in APPLIC~1 [19/05/2006\|20:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe [16/03/2008\|23:11] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Apple Computer [10/05/2006\|16:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ATI [10/05/2006\|16:03] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities [10/05/2006\|15:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [29/01/2009\|10:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} [04/08/2008\|19:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [30/06/2007\|15:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple [14/04/2007\|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer [27/05/2007\|18:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software [15/02/2009\|20:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag [20/03/2008\|22:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Channel4 [07/05/2007\|18:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative [10/05/2006\|16:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink [28/12/2007\|19:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Driving Test Success [24/08/2008\|08:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google [14/12/2008\|15:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater [20/03/2008\|22:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kontiki [10/01/2009\|12:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee [10/05/2006\|15:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [10/01/2009\|12:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Motive [10/01/2009\|12:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor [08/04/2007\|07:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec [08/04/2007\|12:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage [14/02/2008\|13:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller [08/04/2007\|07:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\yahoo! [10/01/2009\|22:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion [10/05/2006\|15:51] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft [10/05/2006\|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [10/01/2009\|12:52] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore [19/05/2006\|20:16] C:\DOCUME~1\STEPHE~1\APPLIC~1\Adobe [18/04/2007\|16:57] C:\DOCUME~1\STEPHE~1\APPLIC~1\AdobeUM [14/04/2007\|10:48] C:\DOCUME~1\STEPHE~1\APPLIC~1\Apple Computer [10/05/2006\|16:14] C:\DOCUME~1\STEPHE~1\APPLIC~1\ATI [26/05/2007\|17:13] C:\DOCUME~1\STEPHE~1\APPLIC~1\Creative [26/12/2007\|12:51] C:\DOCUME~1\STEPHE~1\APPLIC~1\FUJIFILM [13/04/2007\|18:11] C:\DOCUME~1\STEPHE~1\APPLIC~1\FunWebProducts [11/04/2007\|20:30] C:\DOCUME~1\STEPHE~1\APPLIC~1\Google [16/03/2008\|23:55] C:\DOCUME~1\STEPHE~1\APPLIC~1\Help [10/05/2006\|16:03] C:\DOCUME~1\STEPHE~1\APPLIC~1\Identities [04/08/2008\|20:29] C:\DOCUME~1\STEPHE~1\APPLIC~1\InstallShield [05/05/2008\|13:38] C:\DOCUME~1\STEPHE~1\APPLIC~1\LimeWire [08/04/2007\|06:38] C:\DOCUME~1\STEPHE~1\APPLIC~1\Macromedia [10/05/2006\|15:51] C:\DOCUME~1\STEPHE~1\APPLIC~1\Microsoft [10/01/2009\|12:16] C:\DOCUME~1\STEPHE~1\APPLIC~1\Motive [26/04/2008\|10:56] C:\DOCUME~1\STEPHE~1\APPLIC~1\Mozilla [10/04/2007\|12:26] C:\DOCUME~1\STEPHE~1\APPLIC~1\Real [08/04/2007\|14:34] C:\DOCUME~1\STEPHE~1\APPLIC~1\Screenshot Sender [25/12/2007\|13:11] C:\DOCUME~1\STEPHE~1\APPLIC~1\SecuROM [19/06/2007\|21:28] C:\DOCUME~1\STEPHE~1\APPLIC~1\Sun [26/04/2008\|10:58] C:\DOCUME~1\STEPHE~1\APPLIC~1\Talkback [18/04/2007\|19:49] C:\DOCUME~1\STEPHE~1\APPLIC~1\Template [08/04/2007\|07:31] C:\DOCUME~1\STEPHE~1\APPLIC~1\Yahoo! --------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks [22/02/2009 11:34][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job [15/02/2009 01:33][--a------] C:\WINDOWS\tasks\McDefragTask.job [01/02/2009 01:00][--a------] C:\WINDOWS\tasks\McQcTask.job [22/02/2009 14:24][--a------] C:\WINDOWS\tasks\Google Software Updater.job [21/11/2008 23:46][--a------] C:\WINDOWS\tasks\Low Battery Alarm Program.job [19/02/2009 09:51][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job [22/02/2009 11:34][--ah-----] C:\WINDOWS\tasks\SA.DAT [04/08/2004 05:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini --------------------\\ Listing Folders in C:\Program Files [10/05/2006\|16:23] C:\Program Files\Acer [10/05/2006\|16:20] C:\Program Files\Acer Inc [10/05/2006\|16:21] C:\Program Files\Adobe [14/04/2007\|10:47] C:\Program Files\Apple Software Update [10/05/2006\|16:04] C:\Program Files\ATI Technologies [29/01/2009\|10:38] C:\Program Files\Bonjour [10/01/2009\|22:47] C:\Program Files\BT Broadband Desktop Help [08/04/2007\|07:27] C:\Program Files\BT Home Hub [10/01/2009\|22:45] C:\Program Files\BTHomeHub [17/02/2009\|21:11] C:\Program Files\CA Yahoo! Anti-Spy [10/05/2006\|15:51] C:\Program Files\Common Files [10/05/2006\|15:56] C:\Program Files\ComPlus Applications [07/11/2008\|14:39] C:\Program Files\CONEXANT [07/05/2007\|14:28] C:\Program Files\Creative [07/05/2007\|18:07] C:\Program Files\Creative Installation Information [23/07/2008\|18:01] C:\Program Files\Creatures 2 [10/05/2006\|16:23] C:\Program Files\CyberLink [20/05/2006\|11:23] C:\Program Files\DIFX [17/06/2007\|14:44] C:\Program Files\directx [08/08/2007\|16:47] C:\Program Files\EA GAMES [11/04/2007\|20:29] C:\Program Files\Google [10/05/2006\|16:04] C:\Program Files\InstallShield Installation Information [10/05/2006\|15:56] C:\Program Files\Internet Explorer [29/01/2009\|10:45] C:\Program Files\iPod [29/01/2009\|10:45] C:\Program Files\iTunes [19/06/2007\|21:26] C:\Program Files\Java [20/03/2008\|22:07] C:\Program Files\Kontiki [08/04/2007\|06:49] C:\Program Files\Launch Manager [10/01/2009\|12:35] C:\Program Files\McAfee [10/01/2009\|12:35] C:\Program Files\McAfee.com [10/05/2006\|15:55] C:\Program Files\Messenger [08/04/2007\|14:33] C:\Program Files\Messenger Plus! Live [18/02/2008\|20:36] C:\Program Files\Microsoft ActiveSync [15/02/2008\|10:00] C:\Program Files\Microsoft CAPICOM 2.1.0.2 [10/05/2006\|15:58] C:\Program Files\microsoft frontpage [08/04/2007\|07:00] C:\Program Files\Microsoft Office [08/02/2009\|09:56] C:\Program Files\Microsoft Silverlight [08/04/2007\|07:00] C:\Program Files\Microsoft Works [18/02/2008\|20:33] C:\Program Files\Microsoft.NET [10/05/2006\|15:57] C:\Program Files\Movie Maker [26/04/2008\|10:56] C:\Program Files\Mozilla Firefox [20/02/2009\|10:47] C:\Program Files\MSBuild [15/11/2008\|15:54] C:\Program Files\MSECache [10/05/2006\|15:55] C:\Program Files\MSN [10/05/2006\|15:55] C:\Program Files\MSN Gaming Zone [08/04/2007\|12:17] C:\Program Files\MSN Messenger [12/11/2008\|23:29] C:\Program Files\MSXML 4.0 [13/04/2007\|17:55] C:\Program Files\MyWebSearch [10/05/2006\|15:57] C:\Program Files\NetMeeting [10/05/2006\|16:29] C:\Program Files\NewTech Infosystems [23/07/2008\|16:06] C:\Program Files\Norton Security Scan [10/05/2006\|15:56] C:\Program Files\Online Services [10/05/2006\|15:57] C:\Program Files\Outlook Express [29/01/2009\|10:34] C:\Program Files\QuickTime [10/04/2007\|12:27] C:\Program Files\Real [10/05/2006\|16:14] C:\Program Files\Realtek [20/02/2009\|10:47] C:\Program Files\Reference Assemblies [05/05/2007\|17:56] C:\Program Files\Samsung [08/04/2007\|07:42] C:\Program Files\Symantec [08/04/2007\|06:48] C:\Program Files\Synaptics [10/05/2006\|16:03] C:\Program Files\Uninstall Information [10/06/2007\|18:36] C:\Program Files\Windows Live [08/04/2007\|21:40] C:\Program Files\Windows Media Connect 2 [10/05/2006\|15:56] C:\Program Files\Windows Media Player [10/05/2006\|15:55] C:\Program Files\Windows NT [10/05/2006\|15:57] C:\Program Files\WindowsUpdate [10/05/2006\|15:58] C:\Program Files\xerox [08/04/2007\|07:28] C:\Program Files\Yahoo! --------------------\\ Listing Folders in C:\Program Files\Common Files [04/08/2008\|19:45] C:\Program Files\Common Files\Adobe [30/06/2007\|15:47] C:\Program Files\Common Files\Apple [10/05/2006\|16:08] C:\Program Files\Common Files\ATI Technologies [07/05/2007\|18:07] C:\Program Files\Common Files\Creative [18/02/2008\|20:34] C:\Program Files\Common Files\DESIGNER [10/05/2006\|16:03] C:\Program Files\Common Files\InstallShield [19/06/2007\|21:16] C:\Program Files\Common Files\Java [10/05/2006\|16:30] C:\Program Files\Common Files\LightScribe [10/01/2009\|12:35] C:\Program Files\Common Files\McAfee [10/05/2006\|15:51] C:\Program Files\Common Files\Microsoft Shared [10/01/2009\|22:47] C:\Program Files\Common Files\Motive [10/05/2006\|15:57] C:\Program Files\Common Files\MSSoap [10/05/2006\|16:30] C:\Program Files\Common Files\NewTech Infosystems [10/05/2006\|15:51] C:\Program Files\Common Files\ODBC [10/04/2007\|12:27] C:\Program Files\Common Files\Real [31/05/2008\|19:08] C:\Program Files\Common Files\scanner [10/05/2006\|15:57] C:\Program Files\Common Files\Services [10/05/2006\|15:51] C:\Program Files\Common Files\SpeechEngines [09/07/2007\|12:09] C:\Program Files\Common Files\SWF Studio [08/04/2007\|07:42] C:\Program Files\Common Files\Symantec Shared [10/05/2006\|15:56] C:\Program Files\Common Files\System [14/02/2008\|13:02] C:\Program Files\Common Files\WindowsLiveInstaller [24/08/2008\|08:53] C:\Program Files\Common Files\xing shared --------------------\\ Process ( 59 Processes ) iexplore.exe ~ [PID:2348] --------------------\\ Searching with S_Lop C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp\bis111.exe --------------------\\ Searching for Lop Files - Folders C:\DOCUME~1\ALLUSE~1\APPLIC~1\Cast ping base frag C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@advertising[1].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@uk.seafight.bigpoint[1].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@bigpoint[1].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@adin.bigpoint[2].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@uk.seafight.bigpoint[1].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@888[1].txt C:\DOCUME~1\STEPHE~1\Cookies\stephen mcqueen@888[2].txt --------------------\\ Searching within the Registry [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] ..... OK ! --------------------\\ Checking the Hosts file Hosts file CLEAN --------------------\\ Searching for hidden files with Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-22 14:50:14 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\STEPHE~1\My Documents\Home Stuff\Leah's stuff\Songs\02 Crack The Shutters.m4a [F:506][D:23]-> C:\DOCUME~1\STEPHE~1\LOCALS~1\Temp [F:180][D:0]-> C:\DOCUME~1\STEPHE~1\Cookies [F:3716][D:8]-> C:\DOCUME~1\STEPHE~1\LOCALS~1\TEMPOR~1\content.IE5 [F:245][D:36]-> C:\Recycled 1 - "C:\Lop SD\LopR_1.txt" - 22/02/2009\|14:51 - Option : [1] --------------------\\ Scan completed at 14:51:37 ComboFix 09-02-21.01 - Stephen McQueen 2009-02-22 16:03:19.1 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1918.1398 [GMT 0:00] Running from: c:\documents and settings\Stephen McQueen\Desktop\ComboFix.exe AV: McAfee VirusScan On-access scanning disabled (Updated) FW: McAfee Personal Firewall enabled * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Stephen McQueen\Application Data\FunWebProducts c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc10.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc109.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc129.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc131.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc17.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc18.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc19.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1A.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1B.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc1C.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc25.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc28.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc2A.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc3E.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc4D.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc5.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc50.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc6D.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc73.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc8.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc89.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mcc9.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccA5.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccBA.tmp c:\documents and settings\Stephen McQueen\Local Settings\Temporary Internet Files\mccDB.tmp c:\program files\MyWebSearch c:\program files\MyWebSearch\bar\History\search2 c:\program files\MyWebSearch\bar\Settings\s_pid.dat c:\program files\MyWebSearch\bar\Settings\setting2.htm c:\program files\MyWebSearch\bar\Settings\settings.dat D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2009-01-22 to 2009-02-22 ))))))))))))))))))))))))))))))) . 2009-02-22 14:47 . 2009-02-22 14:47 <DIR> d-------- C:\Lop SD 2009-02-20 12:21 . 2009-02-20 12:34 250 --a------ c:\windows\gmer.ini 2009-02-20 10:48 . 2009-02-20 10:48 <DIR> d-------- c:\windows\system32\XPSViewer 2009-02-20 10:47 . 2009-02-20 10:47 <DIR> d-------- c:\program files\Reference Assemblies 2009-02-20 10:47 . 2009-02-20 10:47 <DIR> d-------- c:\program files\MSBuild 2009-02-20 10:43 . 2008-07-06 12:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll 2009-02-20 10:43 . 2008-07-06 12:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-20 10:43 . 2008-07-06 10:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-20 10:43 . 2008-07-06 12:06 575,488 --------- c:\windows\system32\xpsshhdr.dll 2009-02-20 10:43 . 2008-07-06 12:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-20 10:43 . 2008-07-06 12:06 117,760 --------- c:\windows\system32\prntvpt.dll 2009-02-20 10:43 . 2008-07-06 12:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-17 21:11 . 2009-02-17 21:11 <DIR> d-------- c:\program files\CA Yahoo! Anti-Spy 2009-02-15 20:05 . 2009-02-15 20:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Cast ping base frag 2009-02-08 09:56 . 2009-02-08 09:56 <DIR> d-------- c:\program files\Microsoft Silverlight 2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\program files\iTunes 2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\program files\iPod 2009-01-29 10:45 . 2009-01-29 10:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-01-29 10:38 . 2009-01-29 10:38 <DIR> d-------- c:\program files\Bonjour 2009-01-29 10:34 . 2009-01-29 10:34 <DIR> d-------- c:\program files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-11 09:06 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-01-10 22:50 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-01-10 22:47 --------- d-----w c:\program files\Common Files\Motive 2009-01-10 22:47 --------- d-----w c:\program files\BT Broadband Desktop Help 2009-01-10 22:45 --------- d-----w c:\program files\BTHomeHub 2009-01-10 12:52 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2009-01-10 12:41 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor 2009-01-10 12:35 --------- d-----w c:\program files\McAfee.com 2009-01-10 12:35 --------- d-----w c:\program files\McAfee 2009-01-10 12:35 --------- d-----w c:\program files\Common Files\McAfee 2009-01-10 12:16 --------- d-----w c:\documents and settings\Stephen McQueen\Application Data\Motive 2009-01-10 12:16 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-01-10 12:09 --------- d-----w c:\documents and settings\All Users\Application Data\Motive 2008-12-12 17:01 3,067,904 ------w c:\windows\system32\dllcache\mshtml.dll 2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys 2008-12-06 10:23 15,452,536 ----a-w c:\program files\IE7-WindowsXP-x86-enu.exe 2008-10-25 13:33 3,338 ----a-w c:\documents and settings\Stephen McQueen\Application Data\wklnhst.dat 2008-09-26 19:56 25,740,144 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe 2008-09-17 20:32 67,110,184 ----a-w c:\program files\iTunes8Setup.exe 2008-06-14 13:53 551 ----a-w c:\program files\a 2008-05-31 18:59 861,200 ----a-w c:\program files\yih_setup.exe 2007-06-15 19:15 92,064 ----a-w c:\documents and settings\Stephen McQueen\mqdmmdm.sys 2007-06-15 19:15 9,232 ----a-w c:\documents and settings\Stephen McQueen\mqdmmdfl.sys 2007-06-15 19:15 79,328 ----a-w c:\documents and settings\Stephen McQueen\mqdmserd.sys 2007-06-15 19:15 66,656 ----a-w c:\documents and settings\Stephen McQueen\mqdmbus.sys 2007-06-15 19:15 6,208 ----a-w c:\documents and settings\Stephen McQueen\mqdmcmnt.sys 2007-06-15 19:15 5,936 ----a-w c:\documents and settings\Stephen McQueen\mqdmwhnt.sys 2007-06-15 19:15 4,048 ----a-w c:\documents and settings\Stephen McQueen\mqdmcr.sys 2007-06-15 19:15 25,600 ----a-w c:\documents and settings\Stephen McQueen\usbsermptxp.sys 2007-06-15 19:15 22,768 ----a-w c:\documents and settings\Stephen McQueen\usbsermpt.sys 2005-12-29 10:22 405,504 ----a-w c:\program files\McciBrowser.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 53248] "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946] "LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-06-23 602112] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696] "4oD"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-24 185896] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-11 136600] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208] "btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" [2008-09-11 1517056] "btbb_wcm_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe" [2008-08-28 1516032] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-07-11 223984] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "RTHDCPL"="RTHDCPL.EXE" [2006-06-27 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\WINDOWS\\System32\\dpvsetup.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-01-10 206096] R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-08-04 14336] S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?] S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?] S2 gupdate1c98e0b94672c46;Google Update Service (gupdate1c98e0b94672c46);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 133104] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{253d0d44-e868-11db-a068-0016d4191b28}] \Shell\AutoRun\command - F:\setupSNK.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d04fc44f-e591-11db-a05a-806d6172696f}] \Shell\AutoRun\command - D:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder 2009-02-22 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-13 18:46] 2009-02-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10] 2009-02-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10] 2009-02-22 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-13 18:47] 2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - ORPHANS REMOVED - - - - HKLM-Run-REGSHAVE - c:\program files\REGSHAVE\REGSHAVE.EXE HKLM-Run-LaunchApp - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://home.bt.yahoo.com/ mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/http://uk.docs.yahoo.com/info/bt_side.html uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057 uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab . ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-22 16:04:46 Windows 5.1.2600 Service Pack 3 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(592) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-02-22 16:06:49 ComboFix-quarantined-files.txt 2009-02-22 16:06:48 Pre-Run: 4,453,056,512 bytes free Post-Run: 5,402,361,856 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer 220 --- E O F --- 2009-02-20 10:35:58 Last edited by SMQ; 02-22-2009 at 09:38 AM.

02-22-2009, 12:09 PM	#4 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,591 OS: XP SP3	Re: Unwanted web sites appearing Hello SMQ. Please tell us how your system is behaving after doing the following. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via the Add or Remove Programs section of your Control Panel if they still exist: LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code: Folder:: c:\documents and settings\All Users\Application Data\Cast ping base frag DDS:: mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/http://uk.docs.yahoo.com/info/bt_side.html Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Symantec PIF AlertEng"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000000 Driver:: eLock2BurnerLockDriver eLock2FSCTLDriver Save this Notepad file as CFScript.txt* to your Desktop and then close the file. Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Download the latest version of Java Runtime Environment (JRE) 6 and Save it to your Desktop. Scroll down to where it says Java Runtime Environment (JRE) 6 Update 12 The Java SE Runtime Environment (JRE) allows end-users to run Java applications. Click the Download button to the right. Select the Windows platform from the dropdown menu. Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement Click Continue The page will refresh. Click on the link to download Windows Offline Installation and Save the file to your Desktop. Close any programs you may have running - especially your web browser. Go to Start(or My Computer) > Control Panel and double-click on Add or Remove Programs and remove all older versions of Java. Click (highlight) any item with Java Runtime Environment (JRE, J2SE, Java(TM) SE or Java(TM) 6) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u12-windows-i586-p.exe to install the newest version. After the install is complete, go back to your Control Panel(using Classic View) and click the Java icon. (looks like a coffee cup) On the General tab, under Temporary Internet Files, click the Settings button. Next, click on the Delete Files button. There are two options in the window to clear the cache - Leave BOTH Checked Applications and Applets Trace and Log Files Click OK on Delete Temporary Files Window. Note: This deletes ALL the Downloaded Applications and Applets from the CACHE Click OK to leave the Temporary Files Window. Click OK to leave the Java Control Panel. Delete jre-6u12-windows-i586-p.exe from your desktop. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at any Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report report on system behavior __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

02-23-2009, 07:10 AM	#6 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,591 OS: XP SP3	Re: Unwanted web sites appearing Hello again, SMQ. Go to Start > Run and copy/paste the following into the Run box and click OK: cmd /c del /a/f/q "C:\Program Files\MSN Messenger\riched20.dll" A DOS window will open and close again, this is normal. ------------------------------------------------------ Please download HijackThis and Save it to your Desktop. Alternate link Double-click on the file you just downloaded. Click 'Run' or 'Install' and follow the prompts to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double-click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit 'Scan' and then click on 'Save log'. 3. Please post the HijackThis log in your next reply. Do not fix anything in HijackThis since they may be harmless. 4. Close HijackThis now please. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

02-23-2009, 01:17 PM	#7 (permalink)
SMQ Registered User Join Date: Feb 2009 Posts: 6 OS: winxp	Re: Unwanted web sites appearing Hi-jack this log below- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:58:46, on 23/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Acer\Empowering Technology\eRecovery\eRAgent.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\YAHOO!\browser\ycommon.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (file missing) O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe" O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0 O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=27986 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Update Service (gupdate1c98e0b94672c46) (gupdate1c98e0b94672c46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing) O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 12644 bytes Still no issues with unwanted sites! Again thanks for help. Cheers.

02-23-2009, 02:46 PM	#8 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,591 OS: XP SP3	Re: Unwanted web sites appearing Hello again, SMQ. Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html Please remember to close all other windows, including browsers then click Fix checked. Click 'Scan' and then click 'Save log'. Please post the new HijackThis log in your next reply. Please close HijackThis now. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

02-24-2009, 07:47 AM	#9 (permalink)
SMQ Registered User Join Date: Feb 2009 Posts: 6 OS: winxp	Re: Unwanted web sites appearing Chemist, Hijackthis log attached as requested- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:41:46, on 24/02/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Acer\Empowering Technology\eRecovery\eRAgent.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=2057 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (file missing) O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe" O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0 O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/...oUploader5.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/downlo...BundleId=27986 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Update Service (gupdate1c98e0b94672c46) (gupdate1c98e0b94672c46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing) O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 12249 bytes Cheers.

02-24-2009, 08:34 AM	#10 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,591 OS: XP SP3	Re: Unwanted web sites appearing Congratulations. Well done! Your logs appear clean. You should be good to go. Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How Did I Get Infected In The First Place? by TonyKlein PC Safety and Security--What Do I Need? To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here Keep your antivirus program and antispyware programs updated and scan with them on a regular basis. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

02-24-2009, 02:47 PM	#11 (permalink)
SMQ Registered User Join Date: Feb 2009 Posts: 6 OS: winxp	Re: Unwanted web sites appearing Many thanks- its been a bit of an education! Cheers

02-24-2009, 03:22 PM	#12 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,591 OS: XP SP3	Re: Unwanted web sites appearing You're welcome, SMQ! Glad to have helped. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE