|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-20-2009, 09:05 AM
|
#1 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Search Choices get Redirected
Hello, I seemed to have picked up a virus that redirects my choice from the search results list. This happens about once a years it seems. I fail to understand why people think this is funny. I know you can help you have before. Just want to thank you up front for giving up your valuable time to help us fix these problems. Here's the info you require.
DDS (Ver_09-05-14.01) - NTFSx86 Run by Chris at 7:37:56.65 on Sat 06/20/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2376 [GMT -7:00] AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\Program Files\DigitalPersona\Bin\DPWinLct.exe svchost.exe svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\DigitalPersona\Bin\DpHost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\system32\SearchIndexer.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\DigitalPersona\Bin\DPWinLct.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\WINDOWS\Explorer.EXE C:\Program Files\DigitalPersona\Bin\DPAgnt.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NewTech Infosystems\NTI Shadow\Shadow.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Global Audio Control\Global Audio Control.exe C:\Program Files\DigitalPersona\Bin\DPWinLct.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Outlook Express\msimn.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Documents and Settings\Chris\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ig?source=gama&hl=en uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll TB: RefresherBand Class: {b24ba06e-fb7b-4757-95c2-dc01125f750e} - c:\progra~1\yrefre~1\YREFRE~1.DLL TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Shadow] c:\program files\newtech infosystems\nti shadow\Shadow.exe --minimize uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [DPAgnt] c:\program files\digitalpersona\bin\DPAgnt.exe mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe" mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\global~1.lnk - c:\program files\global audio control\Global Audio Control.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\orbit.lnk - c:\program files\orbitdownloader\orbitdm.exe IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll Trusted Zone: turbotax.com DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} - hxxp://www.comcastsupport.com/OneClickFix/tgctlsr.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} - hxxp://download.gigabyte.com.tw/object/Dldrv.ocx DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1204764096390 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200438107390 DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} - file:///C:/Program%20Files/MDT5/AcDcToday.ocx DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} - hxxp://www.digimeld.com/download/digimeldOcx.CAB DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {C6637286-300D-11D4-AE0A-0010830243BD} - file:///C:/Program%20Files/MDT5/InstFred.ocx DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://chill.comcast.net/Gameshell/GameHost/1.0/OberonGameHost.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab DPF: {F281A59C-7B65-11D3-8617-0010830243BD} - file:///C:/Program%20Files/MDT5/AcPreview.ocx Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: avgrsstarter - avgrsstx.dll Notify: DPWLN - c:\windows\system32\DPWLEvHd.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll LSA: Notification Packages = scecli DPPWDFLT ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\chris\applic~1\mozilla\firefox\profiles\1aimw0n6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?gl=all FF - component: c:\documents and settings\chris\application data\mozilla\firefox\profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll FF - plugin: c:\documents and settings\chris\application data\mozilla\firefox\profiles\1aimw0n6.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll ============= SERVICES / DRIVERS =============== R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-5 325896] R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-1-5 27784] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-5 108552] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2008-4-5 353672] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-3 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-3 298776] R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-12-9 13088] R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?] R3 dpK0Bx01;Fingerprint Reader Filter Driver;c:\windows\system32\drivers\dpK0Bx01.sys [2006-9-16 35584] R3 usbdpfp;Fingerprint Reader Class Driver;c:\windows\system32\drivers\usbdpfp.sys [2006-9-16 47360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SFC4;SFC4;c:\windows\system32\drivers\sfc4.sys [2008-1-14 41472] =============== Created Last 30 ================ 2009-06-17 16:42 <DIR> --d----- c:\program files\Global Audio Control 2009-06-15 05:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\91319526 2009-06-15 05:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\11309534 2009-06-07 21:06 <DIR> --d----- c:\program files\Xiph.Org 2009-06-06 14:08 <DIR> --d----- c:\program files\Free AVCHD Converter 2009-06-06 13:48 <DIR> --d----- c:\docume~1\chris\applic~1\4Media Software Studio 2009-06-06 13:30 <DIR> --d----- c:\docume~1\chris\applic~1\GetRightToGo 2009-06-06 13:14 <DIR> --d----- C:\ConverterOutput 2009-06-06 13:13 258,352 a------- c:\windows\system32\unicows.dll 2009-06-06 13:13 60,273 a------- c:\windows\system32\pthreadGC2.dll 2009-06-06 13:13 6,144 a------- c:\windows\system32\ff_acm.acm 2009-06-06 13:13 372,736 a------- c:\windows\system32\xvid.ax 2009-06-06 13:13 <DIR> --d----- c:\program files\Cucusoft 2009-06-06 12:57 <DIR> --d----- c:\program files\iSkysoft 2009-06-06 11:45 <DIR> --d----- C:\Desktop 2009-06-04 13:45 91,136 a------- C:\iexplor520.exe 2009-05-30 22:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\IsolatedStorage 2009-05-30 22:33 <DIR> --d----- c:\program files\BinTube 2009-05-25 11:46 48,128 a------- C:\apnet.exe 2009-05-24 21:12 7,680 a--sh--- c:\windows\Thumbs.db 2009-05-24 21:07 <DIR> --d----- c:\docume~1\chris\applic~1\Windows Search ==================== Find3M ==================== 2009-06-17 18:32 0 a------- c:\windows\system32\drivers\lvuvc.hs 2009-06-17 18:31 0 a------- c:\windows\system32\drivers\logiflt.iad 2009-05-25 00:24 350,208 -------- c:\windows\system32\mssph.dll 2009-05-14 21:00 11,952 a------- c:\windows\system32\avgrsstx.dll 2009-05-14 21:00 325,896 a------- c:\windows\system32\drivers\avgldx86.sys 2009-05-14 20:59 108,552 a------- c:\windows\system32\drivers\avgtdix.sys 2009-05-12 15:12 26,144 a------- c:\windows\system32\spupdsvc.exe 2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll 2009-04-28 21:56 827,392 a------- c:\windows\system32\wininet.dll 2009-04-28 21:55 78,336 a------- c:\windows\system32\ieencode.dll 2009-04-21 00:07 57,344 a------- c:\windows\SSEUninstaller.exe 2009-04-21 00:07 44,544 a------- c:\windows\system32\Gif89.dll 2009-04-21 00:07 32,768 a------- c:\windows\system32\ShellLnkSSE.dll 2009-04-17 05:26 1,847,168 a------- c:\windows\system32\win32k.sys 2009-04-15 07:51 585,216 a------- c:\windows\system32\rpcrt4.dll 2009-03-25 17:53 4,212 a---h--- c:\windows\system32\zllictbl.dat 2008-08-14 18:54 51,480 a------- c:\docume~1\chris\applic~1\GDIPFONTCACHEV1.DAT 2007-02-22 21:08 925,696 a------- c:\program files\GSpot.exe 2007-02-19 16:28 117,974 a----r-- c:\program files\GSpot27.dat 2007-01-16 23:37 10,684 a----r-- c:\program files\ExportFormat.txt 2007-01-16 23:37 3,615 a----r-- c:\program files\license.txt 2008-01-16 22:19 80 a--shr-- c:\windows\system32\35A4D3DF54.dll 2009-01-28 20:41 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009011920090126\index.dat 2009-01-28 20:41 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009012820090129\index.dat ============= FINISH: 7:40:04.07 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-23-2009, 07:33 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
06-23-2009, 11:08 PM
|
#3 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
ComboFix 09-06-23.01 - Chris 06/23/2009 21:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2866 [GMT -7:00] Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\11309534 c:\documents and settings\All Users\Application Data\91319526 c:\windows\desktop c:\windows\system32\drivers\SKYNETkttpltuu.sys c:\windows\system32\SKYNETkacbtwyb.dat c:\windows\system32\SKYNETtutotmix.dll c:\windows\system32\SKYNETwylwnesp.dll c:\windows\system32\SKYNETyunqffer.dat c:\windows\TEMP\logishrd\LVPrcInj02.dll c:\documents and settings\All Users\Application Data\11309534\11309534.exe c:\documents and settings\All Users\Application Data\11309534\11309534.glu c:\documents and settings\All Users\Application Data\91319526\91319526.exe c:\windows\desktop\CKMAG5.LNK c:\windows\system32\drivers\SKYNETkttpltuu.sys c:\windows\system32\SKYNETkacbtwyb.dat c:\windows\system32\SKYNETtutotmix.dll c:\windows\system32\SKYNETwylwnesp.dll c:\windows\system32\SKYNETyunqffer.dat F:\Desktop.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SKYNETchhhkown ((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 ))))))))))))))))))))))))))))))) . 2009-06-24 00:03 . 2009-06-24 00:03 -------- d-----w- c:\documents and settings\Chris\Application Data\Foxit 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\program files\Pure Digital Technologies 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Digital Technologies 2009-06-19 03:01 . 2009-06-21 04:48 -------- d-----w- c:\documents and settings\Princess Aly\Application Data\Orbit 2009-06-19 02:33 . 2009-06-21 04:49 -------- d-----w- c:\documents and settings\Karyn\Application Data\Orbit 2009-06-17 16:12 . 2009-06-17 17:12 -------- d-----w- c:\documents and settings\Karyn\Application Data\Skype 2009-06-17 03:09 . 2009-06-17 03:09 -------- d-----w- c:\documents and settings\Princess Aly\Local Settings\Application Data\Mozilla 2009-06-17 03:08 . 2009-06-17 19:55 -------- d-----w- c:\documents and settings\Princess Aly\Local Settings\Application Data\Google 2009-06-16 18:31 . 2009-06-17 22:55 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Google 2009-06-16 18:30 . 2009-06-16 18:30 1244648 ----a-w- c:\documents and settings\Karyn\Application Data\MSNInstaller\msnauins.exe 2009-06-16 18:30 . 2009-06-16 18:30 -------- d-----w- c:\documents and settings\Karyn\Application Data\MSNInstaller 2009-06-16 18:24 . 2009-06-16 18:24 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Identities 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Mozilla 2009-06-15 15:13 . 2009-06-15 15:13 54024 ----a-w- c:\documents and settings\Karyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Application Data\Ahead 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Ahead 2009-06-15 15:06 . 2009-06-15 15:06 -------- d-----w- c:\documents and settings\Karyn\Application Data\DigitalPersona 2009-06-15 13:11 . 2009-06-23 16:38 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Google 2009-06-08 04:06 . 2009-06-08 04:06 -------- d-----w- c:\program files\Xiph.Org 2009-06-06 21:08 . 2009-06-06 21:08 -------- d-----w- c:\program files\Free AVCHD Converter 2009-06-06 20:48 . 2009-06-06 20:48 -------- d-----w- c:\documents and settings\Chris\Application Data\4Media Software Studio 2009-06-06 20:30 . 2009-06-06 20:41 -------- d-----w- c:\documents and settings\Chris\Application Data\GetRightToGo 2009-06-06 20:14 . 2009-06-06 20:14 -------- d-----w- C:\ConverterOutput 2009-06-06 20:13 . 2008-06-15 17:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll 2009-06-06 20:13 . 2008-06-15 17:01 258352 ----a-w- c:\windows\system32\unicows.dll 2009-06-06 20:13 . 2009-06-06 20:13 -------- d-----w- c:\program files\Cucusoft 2009-06-06 19:57 . 2009-06-06 20:02 -------- d-----w- c:\program files\iSkysoft 2009-06-06 18:45 . 2009-06-06 18:45 -------- d-----w- C:\Desktop 2009-06-06 17:39 . 2009-06-06 17:39 -------- d-----w- c:\program files\Smart Projects 2009-06-04 20:45 . 2009-06-04 20:45 91136 ----a-w- C:\iexplor520.exe 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\Chris\Local Settings\Application Data\BinTube.com 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\All Users\Application Data\IsolatedStorage 2009-05-31 05:33 . 2009-05-31 05:42 -------- d-----w- c:\program files\BinTube 2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w- c:\program files\Common Files\Skype 2009-05-25 18:46 . 2009-05-25 18:46 48128 ----a-w- C:\apnet.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-24 04:56 . 2008-12-26 20:04 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs 2009-06-24 04:56 . 2008-12-26 20:04 0 ----a-w- c:\windows\system32\drivers\logiflt.iad 2009-06-24 04:45 . 2008-07-15 04:12 2951878 ----a-w- c:\windows\Internet Logs\tvDebug.Zip 2009-06-23 11:04 . 2008-01-17 01:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-21 04:55 . 2008-01-17 00:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Orbit 2009-06-20 16:46 . 2008-01-15 00:53 54024 ----a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-20 15:31 . 2009-04-27 03:32 -------- d-----w- c:\program files\Paint.NET 2009-06-16 01:06 . 2009-06-16 01:06 -------- d-----w- c:\documents and settings\Princess Aly\Application Data\DigitalPersona 2009-06-15 04:48 . 2009-04-24 05:51 -------- d-----w- c:\program files\Windows Desktop Search 2009-06-07 23:47 . 2008-01-20 00:51 52 ----a-w- c:\windows\sfshell.tmp 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\documents and settings\Chris\Application Data\SUPERAntiSpyware.com 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-06-06 21:40 . 2009-06-06 21:41 2766848 ----a-w- c:\windows\Internet Logs\xDBC4.tmp 2009-06-06 20:46 . 2008-01-16 03:57 -------- d-----w- c:\documents and settings\Chris\Application Data\GrabIt 2009-06-04 01:14 . 2008-12-29 01:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Skype 2009-06-04 00:40 . 2008-12-29 01:14 -------- d-----w- c:\documents and settings\Chris\Application Data\skypePM 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----r- c:\program files\Skype 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-05-25 07:24 . 2008-05-27 05:18 350208 ------w- c:\windows\system32\mssph.dll 2009-05-25 04:07 . 2009-05-25 04:07 -------- d-----w- c:\documents and settings\Chris\Application Data\Windows Search 2009-05-20 02:19 . 2008-12-30 17:51 -------- d-----w- c:\program files\Camfrog 2009-05-20 01:58 . 2008-12-30 17:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Camfrog 2009-05-16 13:42 . 2009-05-16 13:42 -------- d-----w- c:\documents and settings\Chris\Application Data\Webcammax 2009-05-15 04:00 . 2009-01-06 04:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-05-15 04:00 . 2009-01-06 04:49 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-05-15 04:00 . 2009-01-06 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-05-15 03:59 . 2009-01-06 04:50 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-12 22:12 . 2008-01-15 00:39 26144 ----a-w- c:\windows\system32\spupdsvc.exe 2009-05-07 15:32 . 2006-02-28 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2006-02-28 12:00 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-27 02:08 . 2009-04-27 02:05 -------- d-----w- c:\documents and settings\Chris\Application Data\gtk-2.0 2009-04-21 07:07 . 2009-04-21 07:07 57344 ----a-w- c:\windows\SSEUninstaller.exe 2009-04-21 07:07 . 2009-04-21 07:07 44544 ----a-w- c:\windows\system32\Gif89.dll 2009-04-21 07:07 . 2009-04-21 07:07 32768 ----a-w- c:\windows\system32\ShellLnkSSE.dll 2009-04-17 12:26 . 2006-02-28 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-04-13 02:54 . 2009-04-17 03:35 954368 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe 2009-04-13 02:54 . 2009-04-17 03:35 71652 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avutil-49.dll 2009-04-13 02:54 . 2009-04-17 03:35 103424 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\pixomatic.dll 2009-04-13 02:54 . 2009-04-17 03:35 4534272 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\cooliris19.dll 2009-04-13 02:54 . 2009-04-17 03:35 344064 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe 2009-04-13 02:54 . 2009-04-17 03:35 131868 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avformat-52.dll 2009-04-13 02:54 . 2009-04-17 03:35 1161626 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avcodec-51.dll 2009-04-13 02:54 . 2009-04-17 03:35 65536 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll 2009-04-08 03:30 . 2009-04-08 03:30 1878984 ----a-w- c:\documents and settings\Chris\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-03-29 06:47 . 2009-03-29 06:51 2470400 ----a-w- c:\windows\Internet Logs\xDBC3.tmp 2007-02-23 04:08 . 2009-04-25 00:50 925696 ----a-w- c:\program files\GSpot.exe 2007-02-19 23:28 . 2009-04-25 00:50 117974 ----a-r- c:\program files\GSpot27.dat 2007-01-17 06:37 . 2009-04-25 00:50 3615 ----a-r- c:\program files\license.txt 2007-01-17 06:37 . 2009-04-25 00:50 10684 ----a-r- c:\program files\ExportFormat.txt 2008-01-17 05:19 . 2008-01-17 05:18 80 --sha-r- c:\windows\system32\35A4D3DF54.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Shadow"="c:\program files\NewTech Infosystems\NTI Shadow\Shadow.exe" [2007-08-03 521464] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-17 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DPAgnt"="c:\program files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-10 807440] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-15 1947928] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ] 2006-10-10 00:27 99856 ----a-w- c:\windows\system32\DPWLEvHd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-15 04:00 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=c:\windows\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^E-mail.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\E-mail.lnk backup=c:\windows\pss\E-mail.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^Mozilla Firefox.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\Mozilla Firefox.lnk backup=c:\windows\pss\Mozilla Firefox.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/5/2009 9:49 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/5/2009 9:50 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/3/2009 5:15 PM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/3/2009 5:15 PM 298776] R2 FlipShare Service;FlipShare Service;c:\program files\Pure Digital Technologies\FlipShare\FlipShareService.exe [11/13/2008 1:17 PM 439616] R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [12/9/2008 12:37 PM 13088] R3 dpK0Bx01;Fingerprint Reader Filter Driver;c:\windows\system32\drivers\dpK0Bx01.sys [9/16/2006 5:25 PM 35584] R3 usbdpfp;Fingerprint Reader Class Driver;c:\windows\system32\drivers\usbdpfp.sys [9/16/2006 5:23 PM 47360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SFC4;SFC4;c:\windows\system32\drivers\sfc4.sys [1/14/2008 10:20 PM 41472] --- Other Services/Drivers In Memory --- *Deregistered* - uphcleanhlp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2009-06-24 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-17 05:38] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ig?source=gama&hl=en uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: turbotax.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} - hxxp://www.digimeld.com/download/digimeldOcx.CAB FF - ProfilePath - . ************************************************************************** disk not found C:\ please note that you need administrator rights to perform deep scan scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(780) c:\windows\system32\DPWLEvHd.dll - - - - - - - > 'lsass.exe'(836) c:\windows\DPPWDFLT.dll - - - - - - - > 'explorer.exe'(7432) c:\windows\TEMP\logishrd\LVPrcInj01.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\DigitalPersona\Bin\DPWinLct.exe c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\bgsvcgen.exe c:\program files\DigitalPersona\Bin\DpHost.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\IoctlSvc.exe c:\program files\UPHClean\uphclean.exe c:\windows\system32\searchindexer.exe c:\program files\DigitalPersona\Bin\DPFUSMgr.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wscntfy.exe c:\windows\system32\searchprotocolhost.exe c:\windows\system32\rundll32.exe c:\windows\system32\searchfilterhost.exe . ************************************************************************** . Completion time: 2009-06-24 22:04 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-24 05:03 Pre-Run: 95,919,509,504 bytes free Post-Run: 104,490,373,120 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 283 --- E O F --- 2009-06-15 04:48 |
|
|
|
|
06-24-2009, 02:07 PM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello pipeplug. One or more of the identified infections is a backdoor trojan.
This type of infection allows hackers to remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Please read this: How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud? ------------------------------------------------------ Please go to: VirusTotal
|
|
|
|
|
06-24-2009, 05:53 PM
|
#5 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
When I entered the C:\iexplorer520.exe my AVG software threw up a red flag that it was infected so I sent it to the vault. Tried again and now the PC says it can't find the file. Please advise. The other file follows.
File apnet.exe received on 2009.06.24 23:50:41 (UTC) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 25/41 (60.98%) Loading server information... Your file is queued in position: 2. Estimated start time is between 52 and 75 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.18 2009.06.24 BAT.Trojan.FormatCQ!IK AhnLab-V3 5.0.0.2 2009.06.24 - AntiVir 7.9.0.196 2009.06.24 TR/Generic.1568657 Antiy-AVL 2.0.3.1 2009.06.24 - Authentium 5.1.2.4 2009.06.24 W32/Backdoor2.ELUF Avast 4.8.1335.0 2009.06.24 - AVG 8.5.0.339 2009.06.24 - BitDefender 7.2 2009.06.25 Trojan.Generic.1568657 CAT-QuickHeal 10.00 2009.06.22 Trojan.Agent.IRC ClamAV 0.94.1 2009.06.25 - Comodo 1405 2009.06.24 UnclassifiedMalware DrWeb 5.0.0.12182 2009.06.24 Trojan.Hosts.82 eSafe 7.0.17.0 2009.06.24 Win32.GenericDropper eTrust-Vet 31.6.6577 2009.06.24 Win32/Droplet.JY F-Prot 4.4.4.56 2009.06.24 W32/Backdoor2.ELUF F-Secure 8.0.14470.0 2009.06.25 - Fortinet 3.117.0.0 2009.06.24 PossibleThreat GData 19 2009.06.25 Trojan.Generic.1568657 Ikarus T3.1.1.59.0 2009.06.24 BAT.Trojan.FormatCQ Jiangmin 11.0.706 2009.06.24 Trojan/Agent.cdnm K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.06.25 - McAfee 5656 2009.06.24 Generic Dropper!hv.h McAfee+Artemis 5656 2009.06.24 Generic Dropper!hv.h McAfee-GW-Edition 6.7.6 2009.06.25 Trojan.Generic.1568657 Microsoft 1.4803 2009.06.24 TrojanClicker:Win32/Napeam.A NOD32 4186 2009.06.24 - Norman 6.01.09 2009.06.24 - nProtect 2009.1.8.0 2009.06.24 Trojan/W32.Agent.48128.AS Panda 10.0.0.16 2009.06.24 - PCTools 4.4.2.0 2009.06.24 - Prevx 3.0 2009.06.25 Medium Risk Malware Rising 21.35.24.00 2009.06.24 - Sophos 4.43.0 2009.06.24 Mal/Generic-A Sunbelt 3.2.1858.2 2009.06.25 Trojan.1 Symantec 1.4.4.12 2009.06.25 Trojan Horse TheHacker 6.3.4.3.353 2009.06.24 - TrendMicro 8.950.0.1094 2009.06.24 - VBA32 3.12.10.7 2009.06.24 Trojan.Win32.Agent.bvxl ViRobot 2009.6.24.1802 2009.06.24 - VirusBuster 4.6.5.0 2009.06.24 Trojan.Generic.TR Additional information File size: 48128 bytes MD5...: 0cabd8b0ea43421347224deed29a57c8 SHA1..: f3e2763eac86e0531c5626d3caf4f75707a9e4f6 SHA256: cb0f2effb54b243c3433e22f7aca26fe14c2612b98d0a7fd7fb891d3c09e4520 ssdeep: 768:g9J8NowRheD8/3rJiUqyet8w9abyzm5E50kyoVonvzRiZljBwiwo5sW3LhaN IC48:g9wvQUreUbyzABq2mLha2O35 PEiD..: - TrID..: File type identification Win32 Executable Generic (38.4%) Win32 Dynamic Link Library (generic) (34.1%) Win16/32 Executable Delphi generic (9.3%) Generic Win/DOS Executable (9.0%) DOS Executable Generic (9.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0xa0c0 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 8 sections ) name viradd virsiz rawdsiz ntrpy md5 CODE 0x1000 0x9558 0x9600 6.36 2bd3f16ed4bcb4c37d0078769daa28c3 DATA 0xb000 0x45c 0x600 3.09 d912183338edaf40b4cf455aba92f9f5 BSS 0xc000 0x965 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .idata 0xd000 0x8ca 0xa00 4.23 2a435f04c2ff4ca8018ccdaabf9f19f1 .tls 0xe000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rdata 0xf000 0x18 0x200 0.20 994c454bc9dd923a2dd36d6f9b3a0d6b .reloc 0x10000 0xed8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x11000 0xf40 0x1000 3.94 02b6bc2f14c34a4ad9a55330a9068c93 ( 7 imports ) > kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, WideCharToMultiByte, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle > user32.dll: GetKeyboardType, LoadStringA, MessageBoxA, CharNextA > advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey > oleaut32.dll: SysFreeString > kernel32.dll: TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA > kernel32.dll: WriteFile, WaitForSingleObject, VirtualQuery, SizeofResource, SetFilePointer, SetFileAttributesA, SetEnvironmentVariableA, SetEndOfFile, ReadFile, LockResource, LoadResource, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalAlloc, GetWindowsDirectoryA, GetVersionExA, GetThreadLocale, GetTempFileNameA, GetStringTypeExA, GetStdHandle, GetShortPathNameA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetDiskFreeSpaceA, GetCommandLineA, GetCPInfo, GetACP, FreeResource, FormatMessageA, FindResourceA, EnumCalendarInfoA, DeleteFileA, CreateProcessA, CreateFileA, CloseHandle > user32.dll: MessageBoxA, LoadStringA, GetSystemMetrics, CharPrevA, CharNextA, CharToOemA ( 0 exports ) PDFiD.: - RDS...: NSRL Reference Data Set - Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=5D693BD000EFDD65BC3600B801C7FE00C121F623' target='_blank'>http://info.prevx.com/aboutprogramte...C7FE00C121F623</a> |
|
|
|
|
06-24-2009, 08:13 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello again, pipeplug.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Quote:
I wanted to collect those files for analysis. Go to AVG's vault and restore C:\iexplor520.exe to its original location. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/387326-search-choices-get-redirected.html#post2205347 Collect:: C:\iexplor520.exe C:\apnet.exe File:: c:\windows\system32\drivers\lvuvc.hs c:\windows\system32\drivers\logiflt.iad  Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ |
|
|
|
|
|
06-26-2009, 04:45 PM
|
#7 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
The "[4]-Submit_date@time.zip" file was not where you said it would be. Could not find it at all. Sorry.
ComboFix 09-06-26.02 - Chris 06/26/2009 15:17.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2769 [GMT -7:00] Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Chris\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} FILE :: "c:\windows\system32\drivers\logiflt.iad" "c:\windows\system32\drivers\lvuvc.hs" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\apnet.exe c:\docume~1\Chris\LOCALS~1\Temp\catchme.dll c:\documents and settings\Chris\Local Settings\temp\catchme.dll c:\windows\system32\drivers\logiflt.iad c:\windows\system32\drivers\lvuvc.hs c:\windows\TEMP\logishrd\LVPrcInj01.dll . ((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 ))))))))))))))))))))))))))))))) . 2009-06-24 23:21 . 2009-06-24 23:21 -------- d-----w- c:\windows\system32\Adobe 2009-06-24 05:03 . 2009-06-24 05:03 -------- dc----w- c:\windows\system32\dllcache\cache 2009-06-24 00:03 . 2009-06-24 00:03 -------- d-----w- c:\documents and settings\Chris\Application Data\Foxit 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\program files\Pure Digital Technologies 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Digital Technologies 2009-06-19 03:01 . 2009-06-21 04:48 -------- d-----w- c:\documents and settings\Princess Aly\Application Data\Orbit 2009-06-19 02:33 . 2009-06-21 04:49 -------- d-----w- c:\documents and settings\Karyn\Application Data\Orbit 2009-06-17 16:12 . 2009-06-17 17:12 -------- d-----w- c:\documents and settings\Karyn\Application Data\Skype 2009-06-17 03:09 . 2009-06-17 03:09 -------- d-----w- c:\documents and settings\Princess Aly\Local Settings\Application Data\Mozilla 2009-06-17 03:08 . 2009-06-17 19:55 -------- d-----w- c:\documents and settings\Princess Aly\Local Settings\Application Data\Google 2009-06-16 18:31 . 2009-06-17 22:55 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Google 2009-06-16 18:30 . 2009-06-16 18:30 1244648 ----a-w- c:\documents and settings\Karyn\Application Data\MSNInstaller\msnauins.exe 2009-06-16 18:30 . 2009-06-16 18:30 -------- d-----w- c:\documents and settings\Karyn\Application Data\MSNInstaller 2009-06-16 18:24 . 2009-06-16 18:24 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Identities 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Mozilla 2009-06-15 15:13 . 2009-06-15 15:13 54024 ----a-w- c:\documents and settings\Karyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Application Data\Ahead 2009-06-15 15:13 . 2009-06-15 15:13 -------- d-----w- c:\documents and settings\Karyn\Local Settings\Application Data\Ahead 2009-06-15 15:06 . 2009-06-15 15:06 -------- d-----w- c:\documents and settings\Karyn\Application Data\DigitalPersona 2009-06-08 04:06 . 2009-06-08 04:06 -------- d-----w- c:\program files\Xiph.Org 2009-06-06 21:08 . 2009-06-06 21:08 -------- d-----w- c:\program files\Free AVCHD Converter 2009-06-06 20:48 . 2009-06-06 20:48 -------- d-----w- c:\documents and settings\Chris\Application Data\4Media Software Studio 2009-06-06 20:30 . 2009-06-06 20:41 -------- d-----w- c:\documents and settings\Chris\Application Data\GetRightToGo 2009-06-06 20:14 . 2009-06-06 20:14 -------- d-----w- C:\ConverterOutput 2009-06-06 20:13 . 2008-06-15 17:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll 2009-06-06 20:13 . 2008-06-15 17:01 258352 ----a-w- c:\windows\system32\unicows.dll 2009-06-06 20:13 . 2009-06-06 20:13 -------- d-----w- c:\program files\Cucusoft 2009-06-06 19:57 . 2009-06-06 20:02 -------- d-----w- c:\program files\iSkysoft 2009-06-06 18:45 . 2009-06-06 18:45 -------- d-----w- C:\Desktop 2009-06-06 17:39 . 2009-06-06 17:39 -------- d-----w- c:\program files\Smart Projects 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\Chris\Local Settings\Application Data\BinTube.com 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\All Users\Application Data\IsolatedStorage 2009-05-31 05:33 . 2009-05-31 05:42 -------- d-----w- c:\program files\BinTube 2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w- c:\program files\Common Files\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-26 22:23 . 2008-07-15 04:12 3668476 ----a-w- c:\windows\Internet Logs\tvDebug.Zip 2009-06-26 20:54 . 2008-01-17 01:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-24 05:41 . 2008-01-16 03:57 -------- d-----w- c:\documents and settings\Chris\Application Data\GrabIt 2009-06-21 04:55 . 2008-01-17 00:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Orbit 2009-06-20 16:46 . 2008-01-15 00:53 54024 ----a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-20 15:31 . 2009-04-27 03:32 -------- d-----w- c:\program files\Paint.NET 2009-06-16 01:06 . 2009-06-16 01:06 -------- d-----w- c:\documents and settings\Princess Aly\Application Data\DigitalPersona 2009-06-15 04:48 . 2009-04-24 05:51 -------- d-----w- c:\program files\Windows Desktop Search 2009-06-07 23:47 . 2008-01-20 00:51 52 ----a-w- c:\windows\sfshell.tmp 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\documents and settings\Chris\Application Data\SUPERAntiSpyware.com 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-06-06 21:40 . 2009-06-06 21:41 2766848 ----a-w- c:\windows\Internet Logs\xDBC4.tmp 2009-06-04 01:14 . 2008-12-29 01:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Skype 2009-06-04 00:40 . 2008-12-29 01:14 -------- d-----w- c:\documents and settings\Chris\Application Data\skypePM 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----r- c:\program files\Skype 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-05-25 07:24 . 2008-05-27 05:18 350208 ------w- c:\windows\system32\mssph.dll 2009-05-25 04:07 . 2009-05-25 04:07 -------- d-----w- c:\documents and settings\Chris\Application Data\Windows Search 2009-05-20 02:19 . 2008-12-30 17:51 -------- d-----w- c:\program files\Camfrog 2009-05-20 01:58 . 2008-12-30 17:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Camfrog 2009-05-16 13:42 . 2009-05-16 13:42 -------- d-----w- c:\documents and settings\Chris\Application Data\Webcammax 2009-05-15 04:00 . 2009-01-06 04:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-05-15 04:00 . 2009-01-06 04:49 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-05-15 04:00 . 2009-01-06 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-05-15 03:59 . 2009-01-06 04:50 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-12 22:12 . 2008-01-15 00:39 26144 ----a-w- c:\windows\system32\spupdsvc.exe 2009-05-07 15:32 . 2006-02-28 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-29 04:56 . 2006-02-28 12:00 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-21 07:07 . 2009-04-21 07:07 57344 ----a-w- c:\windows\SSEUninstaller.exe 2009-04-21 07:07 . 2009-04-21 07:07 44544 ----a-w- c:\windows\system32\Gif89.dll 2009-04-21 07:07 . 2009-04-21 07:07 32768 ----a-w- c:\windows\system32\ShellLnkSSE.dll 2009-04-17 12:26 . 2006-02-28 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-04-13 02:54 . 2009-04-17 03:35 954368 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe 2009-04-13 02:54 . 2009-04-17 03:35 71652 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avutil-49.dll 2009-04-13 02:54 . 2009-04-17 03:35 103424 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\pixomatic.dll 2009-04-13 02:54 . 2009-04-17 03:35 4534272 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\cooliris19.dll 2009-04-13 02:54 . 2009-04-17 03:35 344064 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe 2009-04-13 02:54 . 2009-04-17 03:35 131868 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avformat-52.dll 2009-04-13 02:54 . 2009-04-17 03:35 1161626 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avcodec-51.dll 2009-04-13 02:54 . 2009-04-17 03:35 65536 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll 2009-04-08 03:30 . 2009-04-08 03:30 1878984 ----a-w- c:\documents and settings\Chris\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-03-29 06:47 . 2009-03-29 06:51 2470400 ----a-w- c:\windows\Internet Logs\xDBC3.tmp 2007-02-23 04:08 . 2009-04-25 00:50 925696 ----a-w- c:\program files\GSpot.exe 2007-02-19 23:28 . 2009-04-25 00:50 117974 ----a-r- c:\program files\GSpot27.dat 2007-01-17 06:37 . 2009-04-25 00:50 3615 ----a-r- c:\program files\license.txt 2007-01-17 06:37 . 2009-04-25 00:50 10684 ----a-r- c:\program files\ExportFormat.txt 2008-01-17 05:19 . 2008-01-17 05:18 80 --sha-r- c:\windows\system32\35A4D3DF54.dll . ((((((((((((((((((((((((((((( SnapShot@2009-06-24_05.01.11 ))))))))))))))))))))))))))))))))))))))))) . + 2009-06-24 05:03 . 2008-10-16 21:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe + 2009-06-24 05:03 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll + 2009-06-24 05:03 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe + 2009-06-24 05:03 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe + 2009-06-24 05:03 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe + 2009-06-24 05:03 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll + 2009-06-24 05:03 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe + 2009-06-24 05:03 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys + 2009-06-24 05:03 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys + 2009-06-24 05:03 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe + 2008-01-14 09:23 . 2009-06-25 13:06 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-01-14 09:23 . 2009-06-21 04:52 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-01-14 09:23 . 2009-06-23 16:38 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-01-14 09:23 . 2009-06-25 13:06 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-01-14 09:23 . 2009-06-25 13:06 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-01-14 09:23 . 2009-06-21 04:52 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-06-24 23:21 . 2009-06-24 23:21 78566 c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe + 2009-06-04 12:15 . 2009-06-04 12:15 94208 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll - 2009-03-19 15:43 . 2009-03-19 15:43 94208 c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll + 2009-06-04 11:45 . 2009-06-04 11:45 79488 c:\windows\system32\Adobe\Shockwave 11\gtapi.dll + 2009-06-04 12:17 . 2009-06-04 12:17 9216 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll - 2009-03-19 15:45 . 2009-03-19 15:45 9216 c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll + 2009-06-24 05:03 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe + 2009-06-24 05:03 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll + 2009-06-24 05:03 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll + 2009-06-24 05:03 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll + 2009-06-24 05:03 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys + 2009-06-24 05:03 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe + 2009-06-24 05:03 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys + 2009-06-24 05:03 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll + 2009-06-24 05:03 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll + 2009-06-24 05:03 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll + 2009-06-04 11:45 . 2009-06-04 11:45 132472 c:\windows\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL - 2009-03-19 15:43 . 2009-03-19 15:43 114688 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe + 2009-06-04 12:15 . 2009-06-04 12:15 114688 c:\windows\system32\Adobe\Shockwave 11\SwInit.exe + 2009-06-05 11:38 . 2009-06-05 11:38 468408 c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150600.exe + 2009-06-04 12:17 . 2009-06-04 12:17 446464 c:\windows\system32\Adobe\Shockwave 11\Proj.dll + 2009-06-04 12:16 . 2009-06-04 12:16 372736 c:\windows\system32\Adobe\Shockwave 11\Plugin.dll + 2009-06-05 11:34 . 2009-06-05 11:34 714752 c:\windows\system32\Adobe\Shockwave 11\gi.dll - 2009-03-19 15:45 . 2009-03-19 15:45 614400 c:\windows\system32\Adobe\Shockwave 11\Control.dll + 2009-06-04 12:15 . 2009-06-04 12:15 614400 c:\windows\system32\Adobe\Shockwave 11\Control.dll + 2009-06-05 11:38 . 2009-06-05 11:38 202168 c:\windows\system32\Adobe\Director\SwDir.dll - 2009-03-19 15:55 . 2009-03-19 15:55 202168 c:\windows\system32\Adobe\Director\SwDir.dll + 2009-06-04 12:17 . 2009-06-04 12:17 131072 c:\windows\system32\Adobe\Director\np32dsw.dll - 2009-03-19 15:45 . 2009-03-19 15:45 131072 c:\windows\system32\Adobe\Director\np32dsw.dll + 2009-06-24 05:03 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll + 2009-06-24 05:03 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe + 2009-06-24 05:03 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe + 2009-06-24 05:03 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe - 2009-03-19 15:20 . 2009-03-19 15:20 1011712 c:\windows\system32\Adobe\Shockwave 11\iml32.dll + 2009-06-04 11:51 . 2009-06-04 11:51 1011712 c:\windows\system32\Adobe\Shockwave 11\iml32.dll + 2009-06-04 11:45 . 2009-06-04 11:45 1886320 c:\windows\system32\Adobe\Shockwave 11\gt.exe + 2009-06-04 11:55 . 2009-06-04 11:55 1798144 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll - 2009-03-19 15:24 . 2009-03-19 15:24 1798144 c:\windows\system32\Adobe\Shockwave 11\dirapi.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Shadow"="c:\program files\NewTech Infosystems\NTI Shadow\Shadow.exe" [2007-08-03 521464] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-17 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DPAgnt"="c:\program files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-10 807440] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-15 1947928] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ] 2006-10-10 00:27 99856 ----a-w- c:\windows\system32\DPWLEvHd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-15 04:00 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=c:\windows\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^E-mail.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\E-mail.lnk backup=c:\windows\pss\E-mail.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^Mozilla Firefox.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\Mozilla Firefox.lnk backup=c:\windows\pss\Mozilla Firefox.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/5/2009 9:49 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/5/2009 9:50 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/3/2009 5:15 PM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/3/2009 5:15 PM 298776] R2 FlipShare Service;FlipShare Service;c:\program files\Pure Digital Technologies\FlipShare\FlipShareService.exe [11/13/2008 1:17 PM 439616] R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [12/9/2008 12:37 PM 13088] R3 dpK0Bx01;Fingerprint Reader Filter Driver;c:\windows\system32\drivers\dpK0Bx01.sys [9/16/2006 5:25 PM 35584] R3 usbdpfp;Fingerprint Reader Class Driver;c:\windows\system32\drivers\usbdpfp.sys [9/16/2006 5:23 PM 47360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SFC4;SFC4;c:\windows\system32\drivers\sfc4.sys [1/14/2008 10:20 PM 41472] --- Other Services/Drivers In Memory --- *Deregistered* - uphcleanhlp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2009-06-26 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-17 05:38] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ig?source=gama&hl=en uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: turbotax.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} - hxxp://www.digimeld.com/download/digimeldOcx.CAB FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?gl=all FF - component: c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll . ************************************************************************** disk not found C:\ please note that you need administrator rights to perform deep scan scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(744) c:\windows\system32\DPWLEvHd.dll - - - - - - - > 'lsass.exe'(800) c:\windows\DPPWDFLT.dll - - - - - - - > 'explorer.exe'(7588) c:\windows\TEMP\logishrd\LVPrcInj01.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\DigitalPersona\Bin\DPWinLct.exe c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\bgsvcgen.exe c:\program files\DigitalPersona\Bin\DpHost.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\IoctlSvc.exe c:\program files\UPHClean\uphclean.exe c:\windows\system32\searchindexer.exe c:\program files\DigitalPersona\Bin\DPFUSMgr.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wscntfy.exe c:\windows\system32\searchprotocolhost.exe c:\windows\system32\rundll32.exe c:\windows\system32\searchfilterhost.exe . ************************************************************************** . Completion time: 2009-06-26 15:29 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-26 22:29 ComboFix2.txt 2009-06-24 05:04 Pre-Run: 95,470,424,064 bytes free Post-Run: 95,567,077,376 bytes free 327 --- E O F --- 2009-06-15 04:48 |
|
|
|
|
06-26-2009, 05:07 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello again, pipeplug. It also appears you didn't restore the C:\iexplor520.exe from AVG's vault. Is it still there?
Go to Start > Run and copy/paste the following into the Run box and click OK: C:\QooBox\ComboFix-quarantined-files.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ |
|
|
|
|
06-26-2009, 08:59 PM
|
#9 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
2009-06-26 22:26:59 . 2009-06-26 22:26:59 53,248 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Chris\LOCALS~1\temp\catchme.dll.vir
2009-06-26 22:22:51 . 2009-06-26 22:22:51 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\lvuvc.hs.vir 2009-06-26 22:17:28 . 2009-06-26 22:17:30 192 ----a-w- C:\Qoobox\Quarantine\catchme.txt 2009-06-24 23:17:39 . 2008-02-06 01:20:30 109,080 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\LVPrcInj01.dll.vir 2009-06-24 04:52:24 . 2009-06-26 22:20:36 7,027 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-06-24 04:45:41 . 2008-02-06 01:20:30 109,080 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Temp\logishrd\LVPrcInj02.dll.vir 2009-06-24 04:39:14 . 2009-06-24 04:39:14 69,118 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\SKYNETkttpltuu.sys.vir_backup_by_findstr 2009-06-24 04:39:12 . 2009-06-24 04:39:31 1,305 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Service_SKYNETchhhkown.reg.dat 2009-06-24 04:33:32 . 2009-06-26 22:27:18 423 ----a-w- C:\Qoobox\Quarantine\catchme.log 2009-06-24 02:35:58 . 2009-06-24 04:36:06 93 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETkacbtwyb.dat.vir 2009-06-15 12:59:35 . 2009-06-15 12:59:35 64,784 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\11309534\11309534.glu.vir 2009-06-15 12:59:35 . 2009-06-15 12:59:35 368,684 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\11309534\11309534.exe.vir 2009-06-15 12:59:35 . 2009-06-15 12:59:35 47,660 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\91319526\91319526.exe.vir 2009-06-06 21:05:24 . 2009-06-24 04:36:06 20,992 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETwylwnesp.dll.vir 2009-06-06 21:05:05 . 2009-06-24 04:36:06 333,818 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETyunqffer.dat.vir 2009-06-06 21:05:05 . 2009-06-06 21:05:05 44,544 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETtutotmix.dll.vir 2009-05-25 18:46:19 . 2009-05-25 18:46:19 48,128 ----a-w- C:\Qoobox\Quarantine\C\apnet.exe.vir 2008-12-26 20:04:01 . 2009-06-24 23:17:12 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\logiflt.iad.vir 2008-01-16 01  33 . 2003-09-24 01:23:11 532 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\desktop\CKMAG5.LNK.vir
|
|
|
|
|
06-27-2009, 01:32 PM
|
#13 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello again, pipeplug. I need you to restore that file so I can submit it for analysis. Open AVG's virus vault, select C:\iexplor520.exe, and click 'Restore'. If you cannot complete this step, stop here and let me know.
------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ |
|
|
|
|
|
06-28-2009, 09:42 AM
|
#14 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
Finally! Here it is.
ComboFix 09-06-26.02 - Chris 06/28/2009 8:34.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2792 [GMT -7:00] Running from: c:\documents and settings\Chris\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Chris\Desktop\CFScript.txt AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . - REDUCED FUNCTIONALITY MODE - FILE :: "C:\iexplor520.exe" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\iexplor520.exe c:\windows\TEMP\logishrd\LVPrcInj01.dll . ((((((((((((((((((((((((( Files Created from 2009-05-28 to 2009-06-28 ))))))))))))))))))))))))))))))) . 2009-06-24 23:21 . 2009-06-24 23:21 -------- d-----w- c:\windows\system32\Adobe 2009-06-24 05:03 . 2009-06-24 05:03 -------- dc----w- c:\windows\system32\dllcache\cache 2009-06-24 00:03 . 2009-06-24 00:03 -------- d-----w- c:\documents and settings\Chris\Application Data\Foxit 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\program files\Pure Digital Technologies 2009-06-21 00:04 . 2009-06-21 00:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Digital Technologies 2009-06-08 04:06 . 2009-06-08 04:06 -------- d-----w- c:\program files\Xiph.Org 2009-06-06 21:08 . 2009-06-06 21:08 -------- d-----w- c:\program files\Free AVCHD Converter 2009-06-06 20:48 . 2009-06-06 20:48 -------- d-----w- c:\documents and settings\Chris\Application Data\4Media Software Studio 2009-06-06 20:30 . 2009-06-06 20:41 -------- d-----w- c:\documents and settings\Chris\Application Data\GetRightToGo 2009-06-06 20:14 . 2009-06-06 20:14 -------- d-----w- C:\ConverterOutput 2009-06-06 20:13 . 2008-06-15 17:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll 2009-06-06 20:13 . 2008-06-15 17:01 258352 ----a-w- c:\windows\system32\unicows.dll 2009-06-06 20:13 . 2009-06-06 20:13 -------- d-----w- c:\program files\Cucusoft 2009-06-06 19:57 . 2009-06-06 20:02 -------- d-----w- c:\program files\iSkysoft 2009-06-06 18:45 . 2009-06-06 18:45 -------- d-----w- C:\Desktop 2009-06-06 17:39 . 2009-06-06 17:39 -------- d-----w- c:\program files\Smart Projects 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\Chris\Local Settings\Application Data\BinTube.com 2009-05-31 05:34 . 2009-05-31 05:34 -------- d-----w- c:\documents and settings\All Users\Application Data\IsolatedStorage 2009-05-31 05:33 . 2009-05-31 05:42 -------- d-----w- c:\program files\BinTube . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-28 15:36 . 2009-06-27 13:58 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs 2009-06-28 14:20 . 2008-01-17 01:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-26 22:23 . 2008-07-15 04:12 3668476 ----a-w- c:\windows\Internet Logs\tvDebug.Zip 2009-06-24 05:41 . 2008-01-16 03:57 -------- d-----w- c:\documents and settings\Chris\Application Data\GrabIt 2009-06-21 04:55 . 2008-01-17 00:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Orbit 2009-06-20 16:46 . 2008-01-15 00:53 54024 ----a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-20 15:31 . 2009-04-27 03:32 -------- d-----w- c:\program files\Paint.NET 2009-06-15 04:48 . 2009-04-24 05:51 -------- d-----w- c:\program files\Windows Desktop Search 2009-06-07 23:47 . 2008-01-20 00:51 52 ----a-w- c:\windows\sfshell.tmp 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\documents and settings\Chris\Application Data\SUPERAntiSpyware.com 2009-06-07 04:36 . 2008-01-17 01:39 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-06-06 21:40 . 2009-06-06 21:41 2766848 ----a-w- c:\windows\Internet Logs\xDBC4.tmp 2009-06-04 01:14 . 2008-12-29 01:13 -------- d-----w- c:\documents and settings\Chris\Application Data\Skype 2009-06-04 00:40 . 2008-12-29 01:14 -------- d-----w- c:\documents and settings\Chris\Application Data\skypePM 2009-05-28 01:31 . 2009-05-28 01:31 -------- d-----w- c:\program files\Common Files\Skype 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----r- c:\program files\Skype 2009-05-28 01:31 . 2008-12-29 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-05-25 07:24 . 2008-05-27 05:18 350208 ------w- c:\windows\system32\mssph.dll 2009-05-25 04:07 . 2009-05-25 04:07 -------- d-----w- c:\documents and settings\Chris\Application Data\Windows Search 2009-05-20 02:19 . 2008-12-30 17:51 -------- d-----w- c:\program files\Camfrog 2009-05-20 01:58 . 2008-12-30 17:51 -------- d-----w- c:\documents and settings\Chris\Application Data\Camfrog 2009-05-19 04:00 . 2009-06-28 15:38 1439488 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgupd.dll 2009-05-19 04:00 . 2009-06-28 15:38 755992 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avginet.dll 2009-05-16 13:42 . 2009-05-16 13:42 -------- d-----w- c:\documents and settings\Chris\Application Data\Webcammax 2009-05-15 04:00 . 2009-01-06 04:50 11952 ----a-w- c:\windows\system32\avgrsstx.dll 2009-05-15 04:00 . 2009-01-06 04:49 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2009-05-15 04:00 . 2009-01-06 04:49 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2009-05-15 03:59 . 2009-01-06 04:50 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2009-05-12 22:12 . 2008-01-15 00:39 26144 ----a-w- c:\windows\system32\spupdsvc.exe 2009-05-07 15:32 . 2006-02-28 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-02 01:12 . 2009-06-28 15:38 1085208 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgupd.exe 2009-05-02 01:12 . 2009-06-28 15:38 587032 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgiproxy.exe 2009-04-29 04:56 . 2006-02-28 12:00 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-21 07:07 . 2009-04-21 07:07 57344 ----a-w- c:\windows\SSEUninstaller.exe 2009-04-21 07:07 . 2009-04-21 07:07 44544 ----a-w- c:\windows\system32\Gif89.dll 2009-04-21 07:07 . 2009-04-21 07:07 32768 ----a-w- c:\windows\system32\ShellLnkSSE.dll 2009-04-17 12:26 . 2006-02-28 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-04-13 02:54 . 2009-04-17 03:35 954368 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\PicLensHelper.exe 2009-04-13 02:54 . 2009-04-17 03:35 71652 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avutil-49.dll 2009-04-13 02:54 . 2009-04-17 03:35 103424 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\pixomatic.dll 2009-04-13 02:54 . 2009-04-17 03:35 4534272 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\cooliris19.dll 2009-04-13 02:54 . 2009-04-17 03:35 344064 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\LaunchCooliris.exe 2009-04-13 02:54 . 2009-04-17 03:35 131868 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avformat-52.dll 2009-04-13 02:54 . 2009-04-17 03:35 1161626 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\libs\avcodec-51.dll 2009-04-13 02:54 . 2009-04-17 03:35 65536 ----a-w- c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll 2009-04-08 03:30 . 2009-04-08 03:30 1878984 ----a-w- c:\documents and settings\Chris\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2007-02-23 04:08 . 2009-04-25 00:50 925696 ----a-w- c:\program files\GSpot.exe 2007-02-19 23:28 . 2009-04-25 00:50 117974 ----a-r- c:\program files\GSpot27.dat 2007-01-17 06:37 . 2009-04-25 00:50 3615 ----a-r- c:\program files\license.txt 2007-01-17 06:37 . 2009-04-25 00:50 10684 ----a-r- c:\program files\ExportFormat.txt 2008-01-17 05:19 . 2008-01-17 05:18 80 --sha-r- c:\windows\system32\35A4D3DF54.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Shadow"="c:\program files\NewTech Infosystems\NTI Shadow\Shadow.exe" [2007-08-03 521464] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-17 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DPAgnt"="c:\program files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-10 807440] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-15 1947928] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-18 13574144] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-18 86016] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ] 2006-10-10 00:27 99856 ----a-w- c:\windows\system32\DPWLEvHd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-05-15 04:00 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli DPPWDFLT [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=c:\windows\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^E-mail.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\E-mail.lnk backup=c:\windows\pss\E-mail.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Chris^Start Menu^Programs^Startup^Mozilla Firefox.lnk] path=c:\documents and settings\Chris\Start Menu\Programs\Startup\Mozilla Firefox.lnk backup=c:\windows\pss\Mozilla Firefox.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= "c:\\Program Files\\Common Files\\Ahead\\Nero Web\\SetupX.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443 "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674 "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674 "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675 "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443 R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/5/2009 9:49 PM 325896] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/5/2009 9:50 PM 108552] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2/3/2009 5:15 PM 908568] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/3/2009 5:15 PM 298776] R2 FlipShare Service;FlipShare Service;c:\program files\Pure Digital Technologies\FlipShare\FlipShareService.exe [11/13/2008 1:17 PM 439616] R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [12/9/2008 12:37 PM 13088] R3 dpK0Bx01;Fingerprint Reader Filter Driver;c:\windows\system32\drivers\dpK0Bx01.sys [9/16/2006 5:25 PM 35584] R3 usbdpfp;Fingerprint Reader Class Driver;c:\windows\system32\drivers\usbdpfp.sys [9/16/2006 5:23 PM 47360] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 SFC4;SFC4;c:\windows\system32\drivers\sfc4.sys [1/14/2008 10:20 PM 41472] --- Other Services/Drivers In Memory --- *Deregistered* - uphcleanhlp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2009-06-28 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-01-17 05:38] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ig?source=gama&hl=en uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 Trusted Zone: turbotax.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} - hxxp://www.digimeld.com/download/digimeldOcx.CAB FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?gl=all FF - component: c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\piclens@cooliris.com\components\coolirisstub.dll FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\1aimw0n6.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll . ************************************************************************** disk not found C:\ please note that you need administrator rights to perform deep scan scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(784) c:\windows\system32\DPWLEvHd.dll - - - - - - - > 'lsass.exe'(840) c:\windows\DPPWDFLT.dll - - - - - - - > 'explorer.exe'(6228) c:\windows\TEMP\logishrd\LVPrcInj01.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ZoneLabs\vsmon.exe c:\program files\DigitalPersona\Bin\DPWinLct.exe c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\bgsvcgen.exe c:\program files\DigitalPersona\Bin\DpHost.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\AVG\AVG8\avgnsx.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\IoctlSvc.exe c:\program files\UPHClean\uphclean.exe c:\windows\system32\searchindexer.exe c:\program files\DigitalPersona\Bin\DPFUSMgr.exe c:\program files\AVG\AVG8\avgcsrvx.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\system32\wscntfy.exe c:\windows\system32\rundll32.exe c:\windows\system32\searchprotocolhost.exe c:\program files\AVG\AVG8\avgupd.exe c:\windows\system32\searchfilterhost.exe . ************************************************************************** . Completion time: 2009-06-28 8:40 - machine was rebooted ComboFix-quarantined-files.txt 2009-06-28 15:40 ComboFix2.txt 2009-06-27 14:06 ComboFix3.txt 2009-06-26 22:29 ComboFix4.txt 2009-06-24 05:04 Pre-Run: 96,006,684,672 bytes free Post-Run: 95,927,898,112 bytes free 258 --- E O F --- 2009-06-15 04:48 |
|
|
|
|
06-28-2009, 01:41 PM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello again, pipeplug.
Open Notepad and copy/paste the entire contents of the codebox below, into Notepad: Code:
@echo off for %%g in ( "C:\Qoobox\Quarantine\C\iexplor520.exe.vir" "C:\Qoobox\Quarantine\C\apnet.exe.vir" ) do zip Files_for_submission %%g del %0 It should look like this:  Double-click on submit.bat to run it. This batchfile will create a Files_for_submission.zip file in the same location where the batchfile was saved. Please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 and include this link in the message: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/387326-search-choices-get-redirected.html#post2209975 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ |
|
|
|
|
06-28-2009, 04:13 PM
|
#17 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Hello again, pipeplug. Thanks for submitting the file. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
06-29-2009, 06:36 AM
|
#18 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, June 29, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, June 29, 2009 02 58Records in database: 2400131 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 90240 Threat name: 4 Infected objects: 4 Suspicious objects: 0 Duration of the scan: 07:45:01 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\11309534\11309534.exe.vir Infected: Trojan-Downloader.Win32.FraudLoad.erl 1 C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\91319526\91319526.exe.vir Infected: Trojan-Downloader.Win32.FraudLoad.wbzw 1 C:\Qoobox\Quarantine\C\iexplor520.exe.vir Infected: Trojan.Win32.TDSS.ahna 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETwylwnesp.dll.vir Infected: Trojan.Win32.Small.bzc 1 The selected area was scanned. |
|
|
|
|
06-29-2009, 12:29 PM
|
#19 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,493
OS: XP SP3
|
Re: Search Choices get Redirected
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable AVG before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
06-29-2009, 08:31 PM
|
#20 (permalink) |
|
I helped the forums.
Join Date: Jun 2009
Posts: 11
OS: xp
|
Re: Search Choices get Redirected
Thank you so very much for all your help and your patience Chemist.
Can you answer one last question before this thread is done? Can SpywareBlaster and AVG run at the same time? Live long and Prosper |
|
|
|
| Thread Tools | |
|
|
