|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
07-11-2009, 02:18 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Webpage Hijacked - Please help
Hi, this is my first time posting so I hope I posted everything that is needed.
My problem is that my webpages are getting hijacked. After I do a search on Yahoo/Google, and click on one of the links from my search result, I get sent to some random website. I do notice at the bottom left of the Modzilla screen, it shows data transfering to www.counter.fastclick.net. I get the same result if I use Modzilla or IE. I've purchased PC Tools Spyware Doctor and still can not get rid of the problem. I do use VUZE to download videos, I don't know if that's a problem or not. Below is the DDS file that was requested and I've attached the other two files that was requested from the "new instructions" thread. Let me know if more information is needed. Thanks in advance for your help. DDS (Ver_09-06-26.01) - NTFSx86 Run by byue at 23:42:21.45 on Fri 07/10/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1177 [GMT -7:00] AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\AskBarDis\bar\bin\AskService.exe C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Spyware Doctor\TFEngine\TFService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\s3graphics\chrome3\Chrome3.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\PROGRA~1\samsung\SAMSUN~3\SUPNOT~1.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\byue\Desktop\tech support\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = about:blank uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [<NO NAME>] mRun: [EDS] c:\program files\samsung\samsung eds\EDSAgent.exe mRun: [VTTimer] VTTimer.exe mRun: [Chrome3] c:\program files\s3graphics\chrome3\Chrome3.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [SUPBackGround] c:\program files\samsung\samsung update plus\SUPBackGround.exe mRun: [BatteryManager] c:\program files\samsung\samsung battery manager\BatteryManager.exe mRun: [DMHotKey] c:\program files\samsung\easy display manager\DMLoader.exe mRun: [MagicKeyboard] c:\program files\samsung\magickbd\PreMKBD.exe mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\byue\applic~1\mozilla\firefox\profiles\07zv4oxm.default\ FF - plugin: c:\program files\google\google updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-13 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-27 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-6-28 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-6-28 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-6-27 159600] R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-4-10 464264] R2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-4-10 234888] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2009-1-8 4300] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-27 348752] R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-6-27 1095560] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [2008-1-14 30208] R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-6-27 64392] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2009-1-8 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-6-28 33056] R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [2009-1-8 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [2009-1-8 238464] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?] =============== Created Last 30 ================ 2009-07-10 23:04 <DIR> --d----- c:\program files\Trend Micro 2009-07-09 18:54 <DIR> --d----- c:\program files\iPod 2009-07-09 18:53 <DIR> --d----- c:\program files\iTunes 2009-06-29 17:54 <DIR> --dsh--- c:\documents and settings\byue\PrivacIE 2009-06-28 13:52 51,488 a------- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 13:52 39,200 a------- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 13:52 33,056 a------- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 13:52 12,576 a------- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 03:06 <DIR> --dsh--- c:\documents and settings\byue\IETldCache 2009-06-27 23:28 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll 2009-06-27 23:28 <DIR> --d----- c:\windows\ie8updates 2009-06-27 23:28 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll 2009-06-27 23:28 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll 2009-06-27 23:25 <DIR> -cd-h--- c:\windows\ie8 2009-06-27 18:13 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys 2009-06-27 18:12 130,936 a------- c:\windows\system32\drivers\PCTCore.sys 2009-06-27 18:12 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-27 18:12 64,392 a------- c:\windows\system32\drivers\pctplsg.sys 2009-06-27 18:12 <DIR> --d----- c:\program files\common files\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\program files\Spyware Doctor 2009-06-27 18:12 <DIR> --d----- c:\docume~1\byue\applic~1\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools 2009-06-27 18:09 9,200 -------- c:\windows\system32\drivers\cdralw2k.sys 2009-06-27 18:09 9,072 -------- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-27 18:09 <DIR> --d----- c:\windows\system32\IOSUBSYS 2009-06-15 19:19 <DIR> --d----- c:\program files\REFN 2009-06-15 19:18 <DIR> --d----- c:\windows\Downloaded Installations 2009-06-13 20:08 14 a------- c:\windows\ASSE.dat 2009-06-13 19:21 64,160 a------- c:\windows\system32\drivers\Lbd.sys 2009-06-13 19:21 <DIR> --d----- c:\program files\Lavasoft 2009-06-13 14:19 <DIR> --d----- c:\program files\Spybot - Search & Destroy 2009-06-13 14:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy ==================== Find3M ==================== 2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll 2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll 2009-04-17 05:26 1,847,168 a------- c:\windows\system32\win32k.sys 2009-04-16 00:56 1,060,864 a------- c:\windows\system32\MFC71.dll 2009-04-16 00:56 499,712 a------- c:\windows\system32\msvcp71.dll 2009-04-16 00:56 348,160 a------- c:\windows\system32\msvcr71.dll 2009-04-15 23:25 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2009-04-15 07:51 585,216 a------- c:\windows\system32\rpcrt4.dll ============= FINISH: 23:42:49.26 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
07-13-2009, 05:36 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. ========= Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop. Link 1 Link 2 Link 3   * IMPORTANT !!! Place combofix.exe on your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Double click on combofix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement. ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Click on Yes, to continue scanning for malware. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. |
|
|
|
|
07-13-2009, 10:01 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
Thanks for your help. I've attached the log. ComboFix 09-07-13.01 - byue 07/13/2009 20:47.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1495 [GMT -7:00] Running from: c:\documents and settings\byue\Desktop\tech support\Combo-Fix.exe AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-1220945662-1425521274-1417001333-1003 c:\windows\msetup c:\windows\msetup\MSetup.exe c:\windows\system32\drivers\gxvxcdkvjndqeocwrsafkelkdalwrsmyswtag.sys c:\windows\system32\drivers\gxvxcdwupxmjlrcttiturypijwilrgwugujov.sys c:\windows\system32\drivers\gxvxcdxodskmpxjsaoyltubndeuevvmfrmogm.sys c:\windows\system32\drivers\gxvxcjcdlmlhbgrrpxmcoedjbobutfaqiomvm.sys c:\windows\system32\drivers\gxvxcsrnvpujhioyktevxowkbgkcirqobltfm.sys c:\windows\system32\drivers\gxvxcudotewcirrnopqfvkilxymnqjtarwwrq.sys c:\windows\system32\drivers\gxvxcwswespqyprtlilrmobxvhoexnqwfkdpx.sys c:\windows\system32\gxvxccounter c:\windows\system32\gxvxchreeybwumllothqpxudpgkostjlpkfnc.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_GXVXCSERV.SYS ((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 ))))))))))))))))))))))))))))))) . 2009-07-11 06:04 . 2009-07-11 06:04 -------- d-----w- c:\program files\Trend Micro 2009-07-10 01:54 . 2009-07-10 01:54 -------- d-----w- c:\program files\iPod 2009-07-10 01:53 . 2009-07-10 01:54 -------- d-----w- c:\program files\iTunes 2009-07-10 01:52 . 2009-07-10 01:53 -------- d-----w- c:\program files\QuickTime 2009-07-10 01:49 . 2009-07-10 01:49 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-30 00:54 . 2009-06-30 00:54 -------- d-sh--w- c:\documents and settings\byue\PrivacIE 2009-06-28 20:52 . 2009-03-31 18:23 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\byue\IETldCache 2009-06-28 06:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-28 06:28 . 2009-06-28 06:28 -------- d-----w- c:\windows\ie8updates 2009-06-28 06:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-28 06:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-28 06:25 . 2009-06-28 06:28 -------- dc-h--w- c:\windows\ie8 2009-06-28 01:13 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-06-28 01:12 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-06-28 01:12 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-28 01:12 . 2009-06-28 01:13 -------- d-----w- c:\program files\Common Files\PC Tools 2009-06-28 01:12 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2009-06-28 01:12 . 2009-07-14 03:32 -------- d-----w- c:\program files\Spyware Doctor 2009-06-28 01:12 . 2009-06-28 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2009-06-28 01:12 . 2009-06-28 01:12 -------- d-----w- c:\documents and settings\byue\Application Data\PC Tools 2009-06-28 01:09 . 2008-11-20 19:19 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-06-28 01:09 . 2008-11-20 19:19 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-28 01:09 . 2009-06-28 01:09 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-06-28 01:08 . 2009-06-28 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-16 02:19 . 2009-06-16 02:19 -------- d-----w- c:\program files\REFN 2009-06-16 02:18 . 2009-06-16 02:18 -------- d-----w- c:\windows\Downloaded Installations . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-14 03:32 . 2009-04-11 11:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp 2009-07-10 01:54 . 2009-04-13 00:13 -------- d-----w- c:\program files\Common Files\Apple 2009-06-28 01:09 . 2009-05-16 01:08 -------- d-----w- c:\program files\Google 2009-06-28 00:22 . 2009-01-09 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-06-21 02:53 . 2009-04-10 22:04 -------- d-----w- c:\documents and settings\byue\Application Data\Azureus 2009-06-14 06:29 . 2009-06-13 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-14 06:29 . 2009-06-14 02:21 -------- d-----w- c:\program files\Lavasoft 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-14 03:08 . 2009-06-14 03:08 14 ----a-w- c:\windows\ASSE.dat 2009-06-13 23:27 . 2009-05-16 01:08 -------- d-----w- c:\program files\DivX 2009-06-13 21:56 . 2009-04-11 00:50 -------- d-----w- c:\program files\ArtisanDVDPlayer 2009-06-13 20:04 . 2009-06-13 20:04 -------- d-----w- c:\program files\Microsoft Silverlight 2009-06-11 06:56 . 2009-01-09 02:49 -------- d-----w- c:\program files\Java 2009-06-11 06:55 . 2009-06-11 06:55 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-05-30 13:44 . 2009-04-11 12:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-05-21 18:33 . 2009-05-16 07:17 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\AVS4YOU 2009-05-16 07:16 . 2009-05-16 07:16 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-16 01:14 . 2009-05-16 01:14 -------- d-----w- c:\documents and settings\byue\Application Data\DivX 2009-05-16 00:51 . 2009-05-16 00:51 -------- d-----w- c:\documents and settings\byue\Application Data\AVS4YOU 2009-05-16 00:51 . 2009-05-16 00:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU 2009-05-16 00:50 . 2009-05-16 00:49 -------- d-----w- c:\program files\Common Files\Remote Control Software Common 2009-05-16 00:49 . 2009-05-16 00:49 -------- d-----w- c:\program files\Logitech 2009-05-16 00:49 . 2009-01-09 02:51 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-16 00:49 . 2009-05-16 00:49 -------- d-----w- c:\program files\Common Files\Remote Control USB Driver 2009-05-16 00:36 . 2009-05-16 00:36 -------- d-----w- c:\documents and settings\byue\Application Data\Xilisoft Corporation 2009-05-13 05:15 . 2009-01-09 01:18 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-09 08:09 . 2009-04-10 22:05 68904 ----a-w- c:\documents and settings\byue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-07 15:32 . 2009-01-09 01:18 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-23 04:28 . 2009-04-23 04:28 386048 ----a-w- c:\documents and settings\byue\Application Data\Free-backup.info\JustZIPit\JustZIPit.exe 2009-04-17 12:26 . 2009-01-09 01:18 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-16 07:56 . 2009-04-16 07:56 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-04-16 07:56 . 2009-04-16 07:56 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-04-16 07:56 . 2009-04-16 07:56 1060864 ----a-w- c:\windows\system32\MFC71.dll 2009-04-16 06:25 . 2009-01-09 02:45 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-15 14:51 . 2009-01-09 01:18 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-06-03 03:00 . 2009-06-14 05:46 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-12-10 01:40 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-10 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-10 333192] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456] "Chrome3"="c:\program files\s3graphics\chrome3\Chrome3.exe" [2008-12-09 712704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480] "SUPBackGround"="c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe" [2008-12-04 298664] "BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-11-27 2768896] "DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944] "MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2008-05-16 94208] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-17 580200] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Spyware Doctor\\pctsGui.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/13/2009 7:21 PM 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/27/2009 6:12 PM 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/28/2009 1:52 PM 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/28/2009 1:52 PM 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [6/27/2009 6:13 PM 159600] R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [4/10/2009 3:04 PM 464264] R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [4/10/2009 3:04 PM 234888] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [1/8/2009 7:50 PM 4300] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [1/14/2008 8:01 PM 30208] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [1/8/2009 6:21 PM 534528] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [1/8/2009 6:21 PM 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [1/8/2009 7:54 PM 238464] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [6/27/2009 6:12 PM 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 6:12 PM 348752] S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/28/2009 1:52 PM 33056] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-07-14 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 01:07] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\byue\Application Data\Mozilla\Firefox\Profiles\07zv4oxm.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-13 20:53 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(800) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-07-14 20:54 ComboFix-quarantined-files.txt 2009-07-14 03:54 Pre-Run: 127,867,289,600 bytes free Post-Run: 127,995,392,000 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 215 --- E O F --- 2009-06-28 10:00 Last edited by TheBruce1; 07-14-2009 at 03:50 AM. |
|
|
|
|
07-14-2009, 04:07 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
Please do not attach your logs, simply copy/paste them into your replies. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear. ======== P2P P2P - I see you have P2P software (Vuze and Vuze Toolbar) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections. References for the risk of these programs are Here, Here and Here. ========= Click > Start > Control Panel > Add or Remove Programs and uninstall the following programs: J2SE Runtime Environment 5.0 Leave Java(TM) 6 Update 14 installed ========== Open notepad and copy/paste the text in the quotebox below into it: Code:
Folder::
c:\documents and settings\All Users\Application Data\McAfee
File::
c:\windows\ASSE.dat
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
DDS::
uInternet Settings,ProxyOverride = *.local
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
This animation will guide you through the process:  To optimize scanning time and produce a more sensible report for review:
========= Logs Required C:\Combofix.txt Kaspersky Scan Report An update on how your system is running. |
|
|
|
|
07-15-2009, 07:02 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi, below are the 2 requested logs.
combofix.txt log ComboFix 09-07-14.07 - byue 07/14/2009 23:20.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1303 [GMT -7:00] Running from: c:\documents and settings\byue\Desktop\tech support\Combo-Fix.exe Command switches used :: c:\documents and settings\byue\Desktop\tech support\cfscript.txt AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} FILE :: "c:\windows\ASSE.dat" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\McAfee c:\documents and settings\All Users\Application Data\McAfee\MSC\Cache\McSubDB.Bak c:\documents and settings\All Users\Application Data\McAfee\MSC\mcifolog.log c:\documents and settings\All Users\Application Data\McAfee\MSC\mcini.ini c:\documents and settings\All Users\Application Data\McAfee\MSC\McSubDB.Dat c:\windows\ASSE.dat . ((((((((((((((((((((((((( Files Created from 2009-06-15 to 2009-07-15 ))))))))))))))))))))))))))))))) . 2009-07-15 06:07 . 2009-07-15 06:07 -------- d-----w- c:\windows\LastGood 2009-07-11 06:04 . 2009-07-11 06:04 -------- d-----w- c:\program files\Trend Micro 2009-07-10 01:54 . 2009-07-10 01:54 -------- d-----w- c:\program files\iPod 2009-07-10 01:53 . 2009-07-10 01:54 -------- d-----w- c:\program files\iTunes 2009-07-10 01:52 . 2009-07-10 01:53 -------- d-----w- c:\program files\QuickTime 2009-07-10 01:49 . 2009-07-10 01:49 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-30 00:54 . 2009-06-30 00:54 -------- d-sh--w- c:\documents and settings\byue\PrivacIE 2009-06-28 20:52 . 2009-03-31 18:23 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\byue\IETldCache 2009-06-28 06:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-28 06:28 . 2009-06-28 06:28 -------- d-----w- c:\windows\ie8updates 2009-06-28 06:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-28 06:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-28 06:25 . 2009-06-28 06:28 -------- dc-h--w- c:\windows\ie8 2009-06-28 01:13 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-06-28 01:12 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-06-28 01:12 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-28 01:12 . 2009-06-28 01:13 -------- d-----w- c:\program files\Common Files\PC Tools 2009-06-28 01:12 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2009-06-28 01:12 . 2009-07-15 06:17 -------- d-----w- c:\program files\Spyware Doctor 2009-06-28 01:12 . 2009-06-28 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2009-06-28 01:12 . 2009-06-28 01:12 -------- d-----w- c:\documents and settings\byue\Application Data\PC Tools 2009-06-28 01:09 . 2008-11-20 19:19 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-06-28 01:09 . 2008-11-20 19:19 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-28 01:09 . 2009-06-28 01:09 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-06-28 01:08 . 2009-06-28 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-06-16 02:19 . 2009-06-16 02:19 -------- d-----w- c:\program files\REFN 2009-06-16 02:18 . 2009-06-16 02:18 -------- d-----w- c:\windows\Downloaded Installations . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-15 06:17 . 2009-04-11 11:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp 2009-07-15 06:15 . 2009-01-09 02:49 -------- d-----w- c:\program files\Java 2009-07-10 01:54 . 2009-04-13 00:13 -------- d-----w- c:\program files\Common Files\Apple 2009-06-28 01:09 . 2009-05-16 01:08 -------- d-----w- c:\program files\Google 2009-06-21 02:53 . 2009-04-10 22:04 -------- d-----w- c:\documents and settings\byue\Application Data\Azureus 2009-06-14 06:29 . 2009-06-13 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-14 06:29 . 2009-06-14 02:21 -------- d-----w- c:\program files\Lavasoft 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-13 23:27 . 2009-05-16 01:08 -------- d-----w- c:\program files\DivX 2009-06-13 21:56 . 2009-04-11 00:50 -------- d-----w- c:\program files\ArtisanDVDPlayer 2009-06-13 20:04 . 2009-06-13 20:04 -------- d-----w- c:\program files\Microsoft Silverlight 2009-06-11 06:55 . 2009-06-11 06:55 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-05-30 13:44 . 2009-04-11 12:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-05-21 18:33 . 2009-05-16 07:17 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\AVS4YOU 2009-05-16 07:16 . 2009-05-16 07:16 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-13 05:15 . 2009-01-09 01:18 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-09 08:09 . 2009-04-10 22:05 68904 ----a-w- c:\documents and settings\byue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-07 15:32 . 2009-01-09 01:18 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-23 04:28 . 2009-04-23 04:28 386048 ----a-w- c:\documents and settings\byue\Application Data\Free-backup.info\JustZIPit\JustZIPit.exe 2009-04-17 12:26 . 2009-01-09 01:18 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-16 07:56 . 2009-04-16 07:56 499712 ----a-w- c:\windows\system32\msvcp71.dll 2009-04-16 07:56 . 2009-04-16 07:56 348160 ----a-w- c:\windows\system32\msvcr71.dll 2009-04-16 07:56 . 2009-04-16 07:56 1060864 ----a-w- c:\windows\system32\MFC71.dll 2009-04-16 06:25 . 2009-01-09 02:45 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-06-03 03:00 . 2009-06-14 05:46 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456] "Chrome3"="c:\program files\s3graphics\chrome3\Chrome3.exe" [2008-12-09 712704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480] "SUPBackGround"="c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe" [2008-12-04 298664] "BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-11-27 2768896] "DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944] "MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2008-05-16 94208] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-17 580200] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Spyware Doctor\\pctsGui.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/13/2009 7:21 PM 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/27/2009 6:12 PM 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/28/2009 1:52 PM 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/28/2009 1:52 PM 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [6/27/2009 6:13 PM 159600] R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [4/10/2009 3:04 PM 464264] R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [4/10/2009 3:04 PM 234888] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [1/8/2009 7:50 PM 4300] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [1/14/2008 8:01 PM 30208] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [1/8/2009 6:21 PM 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/28/2009 1:52 PM 33056] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [1/8/2009 6:21 PM 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [1/8/2009 7:54 PM 238464] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [6/27/2009 6:12 PM 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 6:12 PM 348752] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-07-15 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 01:07] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\byue\Application Data\Mozilla\Firefox\Profiles\07zv4oxm.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-14 23:24 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(796) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-07-15 23:26 ComboFix-quarantined-files.txt 2009-07-15 06:26 ComboFix2.txt 2009-07-14 03:54 Pre-Run: 128,008,368,128 bytes free Post-Run: 127,977,684,992 bytes free 182 --- E O F --- 2009-06-28 10:00 Kaspersky online scan -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, July 15, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, July 15, 2009 08:38:34 Records in database: 2470542 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ Scan statistics: Files scanned: 47249 Threat name: 4 Infected objects: 17 Suspicious objects: 0 Duration of the scan: 01:42:15 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcdkvjndqeocwrsafkelkdalwrsmyswtag.sys.vir Infected: Trojan.Win32.Tdss.aetr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcdwupxmjlrcttiturypijwilrgwugujov.sys.vir Infected: Trojan.Win32.Tdss.aetr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcdxodskmpxjsaoyltubndeuevvmfrmogm.sys.vir Infected: Trojan.Win32.Tdss.aetr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcjcdlmlhbgrrpxmcoedjbobutfaqiomvm.sys.vir Infected: Rootkit.Win32.Agent.kvr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcsrnvpujhioyktevxowkbgkcirqobltfm.sys.vir Infected: Trojan.Win32.Tdss.aetr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcudotewcirrnopqfvkilxymnqjtarwwrq.sys.vir Infected: Trojan.Win32.Tdss.aetr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\gxvxcwswespqyprtlilrmobxvhoexnqwfkdpx.sys.vir Infected: Rootkit.Win32.Agent.kvr 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\gxvxchreeybwumllothqpxudpgkostjlpkfnc.dll.vir Infected: Trojan.Win32.Tdss.acdc 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007787.sys Infected: Trojan.Win32.Tdss.aetr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007788.sys Infected: Trojan.Win32.Tdss.aetr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007789.sys Infected: Trojan.Win32.Tdss.aetr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007790.sys Infected: Rootkit.Win32.Agent.kvr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007791.sys Infected: Trojan.Win32.Tdss.aetr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007792.sys Infected: Trojan.Win32.Tdss.aetr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007793.sys Infected: Rootkit.Win32.Agent.kvr 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007794.dll Infected: Trojan.Win32.Tdss.acdc 1 C:\System Volume Information\_restore{8D6B4944-8CD3-4D60-8EA1-5E084EC34B44}\RP41\A0007818.com Infected: Trojan.Win32.Tdss.admj 1 The selected area was scanned. |
|
|
|
|
07-15-2009, 12:32 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall An update on how your system is running. |
|
|
|
|
|
07-15-2009, 10:14 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
Here is the log. ComboFix 09-07-14.08 - byue 07/15/2009 21:09.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1285 [GMT -7:00] Running from: c:\documents and settings\byue\Desktop\tech support\Combo-Fix.exe Command switches used :: c:\documents and settings\byue\Desktop\tech support\cfscript.txt AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\AskBarDis c:\program files\AskBarDis\bar\bin\askBar.dll c:\program files\AskBarDis\bar\bin\askPopStp.dll c:\program files\AskBarDis\bar\bin\AskService.exe c:\program files\AskBarDis\bar\bin\AskSplash.exe c:\program files\AskBarDis\bar\bin\AskTBApp.exe c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe c:\program files\AskBarDis\bar\bin\psvince.dll c:\program files\AskBarDis\bar\Cache\0303BCA2 c:\program files\AskBarDis\bar\Cache\0303C211.bin c:\program files\AskBarDis\bar\Cache\0303C3B7.bin c:\program files\AskBarDis\bar\Cache\0303C4A1.bin c:\program files\AskBarDis\bar\Cache\0303C58C.bin c:\program files\AskBarDis\bar\Cache\0303C695.bin c:\program files\AskBarDis\bar\Cache\0303C78F.bin c:\program files\AskBarDis\bar\Cache\0303C8F7.bin c:\program files\AskBarDis\bar\Cache\files.ini c:\program files\AskBarDis\bar\History\search c:\program files\AskBarDis\bar\Settings\AskLogo.ico c:\program files\AskBarDis\bar\Settings\config.dat c:\program files\AskBarDis\bar\Settings\config.dat.bak c:\program files\AskBarDis\bar\Settings\prevcfg.htm c:\program files\AskBarDis\bar\Settings\prevCfg2.htm c:\program files\AskBarDis\unins000.dat c:\program files\AskBarDis\unins000.exe . ((((((((((((((((((((((((( Files Created from 2009-06-16 to 2009-07-16 ))))))))))))))))))))))))))))))) . 2009-07-11 06:04 . 2009-07-11 06:04 -------- d-----w- c:\program files\Trend Micro 2009-07-10 01:54 . 2009-07-10 01:54 -------- d-----w- c:\program files\iPod 2009-07-10 01:53 . 2009-07-10 01:54 -------- d-----w- c:\program files\iTunes 2009-07-10 01:52 . 2009-07-10 01:53 -------- d-----w- c:\program files\QuickTime 2009-07-10 01:49 . 2009-07-10 01:49 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-30 00:54 . 2009-06-30 00:54 -------- d-sh--w- c:\documents and settings\byue\PrivacIE 2009-06-28 20:52 . 2009-03-31 18:23 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\byue\IETldCache 2009-06-28 06:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-28 06:28 . 2009-06-28 06:28 -------- d-----w- c:\windows\ie8updates 2009-06-28 06:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-28 06:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-28 06:25 . 2009-06-28 06:28 -------- dc-h--w- c:\windows\ie8 2009-06-28 01:13 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-06-28 01:12 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-06-28 01:12 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-28 01:12 . 2009-06-28 01:13 -------- d-----w- c:\program files\Common Files\PC Tools 2009-06-28 01:12 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2009-06-28 01:12 . 2009-07-16 04:06 -------- d-----w- c:\program files\Spyware Doctor 2009-06-28 01:12 . 2009-06-28 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2009-06-28 01:12 . 2009-06-28 01:12 -------- d-----w- c:\documents and settings\byue\Application Data\PC Tools 2009-06-28 01:09 . 2008-11-20 19:19 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-06-28 01:09 . 2008-11-20 19:19 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-28 01:09 . 2009-06-28 01:09 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-06-28 01:08 . 2009-06-28 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-16 04:06 . 2009-04-11 11:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp 2009-07-15 06:15 . 2009-01-09 02:49 -------- d-----w- c:\program files\Java 2009-07-10 01:54 . 2009-04-13 00:13 -------- d-----w- c:\program files\Common Files\Apple 2009-06-28 01:09 . 2009-05-16 01:08 -------- d-----w- c:\program files\Google 2009-06-21 02:53 . 2009-04-10 22:04 -------- d-----w- c:\documents and settings\byue\Application Data\Azureus 2009-06-16 14:36 . 2009-01-09 01:18 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2009-01-09 01:18 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 02:19 . 2009-06-16 02:19 -------- d-----w- c:\program files\REFN 2009-06-14 06:29 . 2009-06-13 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-14 06:29 . 2009-06-14 02:21 -------- d-----w- c:\program files\Lavasoft 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-13 23:27 . 2009-05-16 01:08 -------- d-----w- c:\program files\DivX 2009-06-13 21:56 . 2009-04-11 00:50 -------- d-----w- c:\program files\ArtisanDVDPlayer 2009-06-13 20:04 . 2009-06-13 20:04 -------- d-----w- c:\program files\Microsoft Silverlight 2009-06-11 06:55 . 2009-06-11 06:55 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-06-03 19:09 . 2009-01-09 01:18 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-30 13:44 . 2009-04-11 12:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-05-21 18:33 . 2009-05-16 07:17 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\Common Files\AVSMedia 2009-05-17 21:24 . 2009-05-16 00:48 -------- d-----w- c:\program files\AVS4YOU 2009-05-16 07:16 . 2009-05-16 07:16 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-13 05:15 . 2009-01-09 01:18 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-09 08:09 . 2009-04-10 22:05 68904 ----a-w- c:\documents and settings\byue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-07 15:32 . 2009-01-09 01:18 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-23 04:28 . 2009-04-23 04:28 386048 ----a-w- c:\documents and settings\byue\Application Data\Free-backup.info\JustZIPit\JustZIPit.exe 2009-04-17 12:26 . 2009-01-09 01:18 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-06-03 03:00 . 2009-06-14 05:46 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456] "Chrome3"="c:\program files\s3graphics\chrome3\Chrome3.exe" [2008-12-09 712704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480] "SUPBackGround"="c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe" [2008-12-04 298664] "BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-11-27 2768896] "DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944] "MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2008-05-16 94208] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-17 580200] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Spyware Doctor\\pctsGui.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/13/2009 7:21 PM 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/27/2009 6:12 PM 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/28/2009 1:52 PM 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/28/2009 1:52 PM 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [6/27/2009 6:13 PM 159600] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [1/8/2009 7:50 PM 4300] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [1/14/2008 8:01 PM 30208] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [1/8/2009 6:21 PM 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/28/2009 1:52 PM 33056] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [1/8/2009 6:21 PM 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [1/8/2009 7:54 PM 238464] S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?] S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [6/27/2009 6:12 PM 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 6:12 PM 348752] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-07-16 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 01:07] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\byue\Application Data\Mozilla\Firefox\Profiles\07zv4oxm.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-15 21:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(796) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-07-16 21:12 ComboFix-quarantined-files.txt 2009-07-16 04:12 ComboFix2.txt 2009-07-15 06:26 ComboFix3.txt 2009-07-14 03:54 Pre-Run: 128,635,752,448 bytes free Post-Run: 128,674,516,992 bytes free 199 --- E O F --- 2009-07-15 10:01 |
|
|
|
|
07-16-2009, 04:17 AM
|
#8 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
Did you install the firewall? Quote:
http://forum.vuze.com/thread.jspa?messageID=183161& First remove Vuze and then Ask. |
|
|
|
|
|
07-16-2009, 10:14 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
I did install the firewall. I removed VUZE and the VUZE toolbar, there was no ASK software. Everything seems to be back to normal now. When I run Spyware Doctor, I still get 1 notice. It's called Application.NirCmd. Spyware Doctor says this might be a legitimate application. What do you think? Thanks for all your help. How do I make a donation and do I need to reference anything? Thanks Again |
|
|
|
|
07-17-2009, 04:38 AM
|
#10 (permalink) | ||
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello
Quote:
I just want to be sure those Ask entries are gone, we`ll run Combofix one more to be sure. ====== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
||
|
|
|
|
07-17-2009, 07:47 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
ComboFix 09-07-14.08 - byue 07/17/2009 17:36.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1380 [GMT -7:00] Running from: c:\documents and settings\byue\Desktop\tech support\Combo-Fix.exe Command switches used :: c:\documents and settings\byue\Desktop\tech support\CFscript.txt AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52} . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 ))))))))))))))))))))))))))))))) . 2009-07-16 04:17 . 2009-07-16 04:17 -------- d-----w- c:\documents and settings\byue\Application Data\PCToolsFirewallPlus 2009-07-16 04:15 . 2008-09-22 18:29 97408 ----a-w- c:\windows\system32\drivers\pctfw.sys 2009-07-16 04:15 . 2009-01-21 16:38 95640 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2009-07-16 04:15 . 2009-07-16 04:17 -------- d-----w- c:\program files\PC Tools Firewall Plus 2009-07-11 06:04 . 2009-07-11 06:04 -------- d-----w- c:\program files\Trend Micro 2009-07-10 01:54 . 2009-07-10 01:54 -------- d-----w- c:\program files\iPod 2009-07-10 01:53 . 2009-07-10 01:54 -------- d-----w- c:\program files\iTunes 2009-07-10 01:52 . 2009-07-10 01:53 -------- d-----w- c:\program files\QuickTime 2009-07-10 01:49 . 2009-07-10 01:49 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-30 00:54 . 2009-06-30 00:54 -------- d-sh--w- c:\documents and settings\byue\PrivacIE 2009-06-28 20:52 . 2009-03-31 18:23 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\byue\IETldCache 2009-06-28 06:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-28 06:28 . 2009-06-28 06:28 -------- d-----w- c:\windows\ie8updates 2009-06-28 06:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-28 06:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-28 06:25 . 2009-06-28 06:28 -------- dc-h--w- c:\windows\ie8 2009-06-28 01:13 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-06-28 01:12 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-06-28 01:12 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-28 01:12 . 2009-06-28 01:13 -------- d-----w- c:\program files\Common Files\PC Tools 2009-06-28 01:12 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2009-06-28 01:12 . 2009-07-18 00:34 -------- d-----w- c:\program files\Spyware Doctor 2009-06-28 01:12 . 2009-06-28 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2009-06-28 01:12 . 2009-06-28 01:12 -------- d-----w- c:\documents and settings\byue\Application Data\PC Tools 2009-06-28 01:09 . 2008-11-20 19:19 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-06-28 01:09 . 2008-11-20 19:19 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-28 01:09 . 2009-06-28 01:09 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-06-28 01:08 . 2009-06-28 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-18 00:35 . 2009-04-11 11:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp 2009-07-17 01:12 . 2009-04-10 22:03 -------- d-----w- c:\program files\Vuze 2009-07-15 06:15 . 2009-01-09 02:49 -------- d-----w- c:\program files\Java 2009-07-10 01:54 . 2009-04-13 00:13 -------- d-----w- c:\program files\Common Files\Apple 2009-06-28 01:09 . 2009-05-16 01:08 -------- d-----w- c:\program files\Google 2009-06-21 02:53 . 2009-04-10 22:04 -------- d-----w- c:\documents and settings\byue\Application Data\Azureus 2009-06-16 14:36 . 2009-01-09 01:18 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2009-01-09 01:18 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 02:19 . 2009-06-16 02:19 -------- d-----w- c:\program files\REFN 2009-06-14 06:29 . 2009-06-13 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-14 06:29 . 2009-06-14 02:21 -------- d-----w- c:\program files\Lavasoft 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-13 23:27 . 2009-05-16 01:08 -------- d-----w- c:\program files\DivX 2009-06-13 21:56 . 2009-04-11 00:50 -------- d-----w- c:\program files\ArtisanDVDPlayer 2009-06-13 20:04 . 2009-06-13 20:04 -------- d-----w- c:\program files\Microsoft Silverlight 2009-06-11 06:55 . 2009-06-11 06:55 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-06-03 19:09 . 2009-01-09 01:18 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-30 13:44 . 2009-04-11 12:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-05-21 18:33 . 2009-05-16 07:17 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-16 07:16 . 2009-05-16 07:16 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-13 05:15 . 2009-01-09 01:18 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-09 08:09 . 2009-04-10 22:05 68904 ----a-w- c:\documents and settings\byue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-07 15:32 . 2009-01-09 01:18 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-23 04:28 . 2009-04-23 04:28 386048 ----a-w- c:\documents and settings\byue\Application Data\Free-backup.info\JustZIPit\JustZIPit.exe 2009-06-03 03:00 . 2009-06-14 05:46 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456] "Chrome3"="c:\program files\s3graphics\chrome3\Chrome3.exe" [2008-12-09 712704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480] "SUPBackGround"="c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe" [2008-12-04 298664] "BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-11-27 2768896] "DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944] "MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888] "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2008-05-16 94208] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-17 580200] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Spyware Doctor\\pctsGui.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/13/2009 7:21 PM 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/27/2009 6:12 PM 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/28/2009 1:52 PM 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/28/2009 1:52 PM 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [6/27/2009 6:13 PM 159600] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [1/8/2009 7:50 PM 4300] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [6/27/2009 6:12 PM 73840] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [1/14/2008 8:01 PM 30208] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [1/8/2009 6:21 PM 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/28/2009 1:52 PM 33056] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [1/8/2009 6:21 PM 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [1/8/2009 7:54 PM 238464] S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?] S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [7/15/2009 9:15 PM 95640] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [6/27/2009 6:12 PM 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 6:12 PM 348752] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-07-17 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 01:07] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\byue\Application Data\Mozilla\Firefox\Profiles\07zv4oxm.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-17 17:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(1188) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll - - - - - - - > 'explorer.exe'(2908) c:\windows\system32\WININET.dll c:\windows\system32\btmmhook.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-18 17:39 ComboFix-quarantined-files.txt 2009-07-18 00:38 ComboFix2.txt 2009-07-16 04:12 ComboFix3.txt 2009-07-15 06:26 ComboFix4.txt 2009-07-14 03:54 Pre-Run: 129,286,307,840 bytes free Post-Run: 129,249,894,400 bytes free 188 --- E O F --- 2009-07-15 10:01 |
|
|
|
|
07-19-2009, 04:36 AM
|
#12 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
Those Ask entries are still present, make sure nothing interferes with Combofix, if ThreatFire is active, disable it and then Combofix again. Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall |
|
|
|
|
|
07-20-2009, 02:07 AM
|
#13 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
Here is the log. ComboFix 09-07-14.08 - byue 07/20/2009 0:59.1.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1217 [GMT -7:00] Running from: c:\documents and settings\byue\Desktop\tech support\Combo-Fix.exe Command switches used :: c:\documents and settings\byue\Desktop\tech support\CFscript.txt AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52} . - REDUCED FUNCTIONALITY MODE - FILE :: "c:\program files\AskBarDis" . ((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-16 04:17 . 2009-07-16 04:17 -------- d-----w- c:\documents and settings\byue\Application Data\PCToolsFirewallPlus 2009-07-16 04:15 . 2008-09-22 18:29 97408 ----a-w- c:\windows\system32\drivers\pctfw.sys 2009-07-16 04:15 . 2009-01-21 16:38 95640 ----a-w- c:\windows\system32\drivers\pctplfw.sys 2009-07-16 04:15 . 2009-07-16 04:17 -------- d-----w- c:\program files\PC Tools Firewall Plus 2009-07-11 06:04 . 2009-07-11 06:04 -------- d-----w- c:\program files\Trend Micro 2009-07-10 01:54 . 2009-07-10 01:54 -------- d-----w- c:\program files\iPod 2009-07-10 01:53 . 2009-07-10 01:54 -------- d-----w- c:\program files\iTunes 2009-07-10 01:52 . 2009-07-10 01:53 -------- d-----w- c:\program files\QuickTime 2009-07-10 01:49 . 2009-07-10 01:49 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe 2009-06-30 00:54 . 2009-06-30 00:54 -------- d-sh--w- c:\documents and settings\byue\PrivacIE 2009-06-28 20:52 . 2009-03-31 18:23 39200 ----a-w- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 33056 ----a-w- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 12576 ----a-w- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 20:52 . 2009-03-31 18:23 51488 ----a-w- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-06-28 10:06 . 2009-06-28 10:06 -------- d-sh--w- c:\documents and settings\byue\IETldCache 2009-06-28 06:28 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-06-28 06:28 . 2009-06-28 06:28 -------- d-----w- c:\windows\ie8updates 2009-06-28 06:28 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-06-28 06:28 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-28 06:25 . 2009-06-28 06:28 -------- dc-h--w- c:\windows\ie8 2009-06-28 01:13 . 2008-12-11 15:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys 2009-06-28 01:12 . 2009-04-03 18:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys 2009-06-28 01:12 . 2008-12-18 19:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-28 01:12 . 2009-06-28 01:13 -------- d-----w- c:\program files\Common Files\PC Tools 2009-06-28 01:12 . 2008-12-10 18:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys 2009-06-28 01:12 . 2009-07-20 07:47 -------- d-----w- c:\program files\Spyware Doctor 2009-06-28 01:12 . 2009-06-28 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools 2009-06-28 01:12 . 2009-06-28 01:12 -------- d-----w- c:\documents and settings\byue\Application Data\PC Tools 2009-06-28 01:09 . 2008-11-20 19:19 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys 2009-06-28 01:09 . 2008-11-20 19:19 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-28 01:09 . 2009-06-28 01:09 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-06-28 01:08 . 2009-06-28 02:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 07:47 . 2009-04-11 11:36 -------- d---a-w- c:\documents and settings\All Users\Application Data\Temp 2009-07-17 01:12 . 2009-04-10 22:03 -------- d-----w- c:\program files\Vuze 2009-07-15 06:15 . 2009-01-09 02:49 -------- d-----w- c:\program files\Java 2009-07-10 01:54 . 2009-04-13 00:13 -------- d-----w- c:\program files\Common Files\Apple 2009-06-28 01:09 . 2009-05-16 01:08 -------- d-----w- c:\program files\Google 2009-06-21 02:53 . 2009-04-10 22:04 -------- d-----w- c:\documents and settings\byue\Application Data\Azureus 2009-06-16 14:36 . 2009-01-09 01:18 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2009-01-09 01:18 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 02:19 . 2009-06-16 02:19 -------- d-----w- c:\program files\REFN 2009-06-14 06:29 . 2009-06-13 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-06-14 06:29 . 2009-06-14 02:21 -------- d-----w- c:\program files\Lavasoft 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-06-14 06:25 . 2009-06-13 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-06-13 23:27 . 2009-05-16 01:08 -------- d-----w- c:\program files\DivX 2009-06-13 21:56 . 2009-04-11 00:50 -------- d-----w- c:\program files\ArtisanDVDPlayer 2009-06-13 20:04 . 2009-06-13 20:04 -------- d-----w- c:\program files\Microsoft Silverlight 2009-06-11 06:55 . 2009-06-11 06:55 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-06-03 19:09 . 2009-01-09 01:18 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-30 13:44 . 2009-04-11 12:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2009-05-21 18:33 . 2009-05-16 07:17 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-05-16 07:16 . 2009-05-16 07:16 152576 ----a-w- c:\documents and settings\byue\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-13 05:15 . 2009-01-09 01:18 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-09 08:09 . 2009-04-10 22:05 68904 ----a-w- c:\documents and settings\byue\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-07 15:32 . 2009-01-09 01:18 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-23 04:28 . 2009-04-23 04:28 386048 ----a-w- c:\documents and settings\byue\Application Data\Free-backup.info\JustZIPit\JustZIPit.exe 2009-06-03 03:00 . 2009-06-14 05:46 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-28 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2007-12-21 659456] "Chrome3"="c:\program files\s3graphics\chrome3\Chrome3.exe" [2008-12-09 712704] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-28 1044480] "SUPBackGround"="c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe" [2008-12-04 298664] "BatteryManager"="c:\program files\Samsung\Samsung Battery Manager\BatteryManager.exe" [2008-11-27 2768896] "DMHotKey"="c:\program files\Samsung\Easy Display Manager\DMLoader.exe" [2006-12-27 466944] "MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-15 151552] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-04 218408] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888] "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-11-17 17676288] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2008-05-16 94208] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-17 580200] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Spyware Doctor\\pctsGui.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/13/2009 7:21 PM 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/27/2009 6:12 PM 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [6/28/2009 1:52 PM 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [6/28/2009 1:52 PM 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [6/27/2009 6:13 PM 159600] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [1/8/2009 7:50 PM 4300] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [6/27/2009 6:12 PM 73840] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [1/14/2008 8:01 PM 30208] R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [7/15/2009 9:15 PM 95640] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [1/8/2009 6:21 PM 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [6/28/2009 1:52 PM 33056] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [1/8/2009 6:21 PM 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [1/8/2009 7:54 PM 238464] S2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?] S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [6/27/2009 6:12 PM 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/27/2009 6:12 PM 348752] S3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service --> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?] --- Other Services/Drivers In Memory --- *Deregistered* - mchInjDrv [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2009-07-20 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-28 01:07] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\byue\Application Data\Mozilla\Firefox\Profiles\07zv4oxm.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-20 00:59 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(1188) c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll - - - - - - - > 'explorer.exe'(3924) c:\windows\system32\WININET.dll c:\windows\system32\btmmhook.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-20 1:01 ComboFix-quarantined-files.txt 2009-07-20 08:01 ComboFix2.txt 2009-07-18 00:39 ComboFix3.txt 2009-07-16 04:12 ComboFix4.txt 2009-07-15 06:26 ComboFix5.txt 2009-07-20 07:48 Pre-Run: 129,421,549,568 bytes free Post-Run: 129,394,794,496 bytes free 191 --- E O F --- 2009-07-15 10:01 |
|
|
|
|
07-20-2009, 04:10 AM
|
#14 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
Those entries are still there, been doing some more research on these entries and they can be quite a handful to remove. The best way would be to re-install Vuze also allow Ask to be installed, once installed, uninstall Vuze and that should remove those Ask entries as well. Make sure no security applications interfere with the installation and removal of Vuze/Ask. Then run DDS again and post a fresh DDS.txt in your reply. |
|
|
|
|
07-22-2009, 12:59 AM
|
#15 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
Hi,
Below are the logs. DDS DDS (Ver_09-06-26.01) - NTFSx86 Run by byue at 23:54:11.34 on Tue 07/21/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1122 [GMT -7:00] AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch C:\WINDOWS\system32\svchost -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\svchost.exe -k LocalService C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Spyware Doctor\TFEngine\TFService.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\s3graphics\chrome3\Chrome3.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Spyware Doctor\sdloader.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\byue\Desktop\tech support\dds.scr C:\WINDOWS\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [EDS] c:\program files\samsung\samsung eds\EDSAgent.exe mRun: [VTTimer] VTTimer.exe mRun: [Chrome3] c:\program files\s3graphics\chrome3\Chrome3.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [SUPBackGround] c:\program files\samsung\samsung update plus\SUPBackGround.exe mRun: [BatteryManager] c:\program files\samsung\samsung battery manager\BatteryManager.exe mRun: [DMHotKey] c:\program files\samsung\easy display manager\DMLoader.exe mRun: [MagicKeyboard] c:\program files\samsung\magickbd\PreMKBD.exe mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe mRun: [00PCTFW] "c:\program files\pc tools firewall plus\FirewallGUI.exe" -s StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_14.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\byue\applic~1\mozilla\firefox\profiles\07zv4oxm.default\ FF - plugin: c:\program files\google\google updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-13 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-27 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-6-28 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-6-28 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-6-27 159600] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2009-1-8 4300] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-6-27 73840] R2 PCToolsFirewallPlus;PC Tools Firewall Plus;c:\program files\pc tools firewall plus\FWService.exe [2009-7-15 146800] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-27 348752] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [2008-1-14 30208] R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-7-15 95640] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2009-1-8 534528] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-6-28 33056] R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [2009-1-8 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [2009-1-8 238464] S?3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-6-27 1095560] S2 ASKService;ASKService;c:\program files\askbardis\bar\bin\askservice.exe --> c:\program files\askbardis\bar\bin\AskService.exe [?] S2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\askupgrade.exe --> c:\program files\askbardis\bar\bin\ASKUpgrade.exe [?] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-6-27 64392] =============== Created Last 30 ================ 2009-07-20 00:48 <DIR> --ds---- C:\Combo-Fix 2009-07-15 21:17 <DIR> --d----- c:\docume~1\byue\applic~1\PCToolsFirewallPlus 2009-07-15 21:15 97,408 a------- c:\windows\system32\drivers\pctfw.sys 2009-07-15 21:15 95,640 a------- c:\windows\system32\drivers\pctplfw.sys 2009-07-15 21:15 <DIR> --d----- c:\program files\PC Tools Firewall Plus 2009-07-13 20:53 <DIR> -cd----- c:\windows\system32\dllcache\cache 2009-07-13 20:35 <DIR> a-dshr-- C:\cmdcons 2009-07-13 20:33 219,648 a------- c:\windows\PEV.exe 2009-07-13 20:33 161,792 a------- c:\windows\SWREG.exe 2009-07-13 20:33 98,816 a------- c:\windows\sed.exe 2009-07-10 23:04 <DIR> --d----- c:\program files\Trend Micro 2009-07-09 18:54 <DIR> --d----- c:\program files\iPod 2009-07-09 18:53 <DIR> --d----- c:\program files\iTunes 2009-06-29 17:54 <DIR> --dsh--- c:\documents and settings\byue\PrivacIE 2009-06-28 13:52 51,488 a------- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 13:52 39,200 a------- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 13:52 33,056 a------- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 13:52 12,576 a------- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 03:06 <DIR> --dsh--- c:\documents and settings\byue\IETldCache 2009-06-27 23:28 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll 2009-06-27 23:28 <DIR> --d----- c:\windows\ie8updates 2009-06-27 23:28 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll 2009-06-27 23:28 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll 2009-06-27 23:25 <DIR> -cd-h--- c:\windows\ie8 2009-06-27 18:13 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys 2009-06-27 18:12 130,936 a------- c:\windows\system32\drivers\PCTCore.sys 2009-06-27 18:12 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-27 18:12 64,392 a------- c:\windows\system32\drivers\pctplsg.sys 2009-06-27 18:12 <DIR> --d----- c:\program files\common files\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\program files\Spyware Doctor 2009-06-27 18:12 <DIR> --d----- c:\docume~1\byue\applic~1\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools 2009-06-27 18:09 9,200 -------- c:\windows\system32\drivers\cdralw2k.sys 2009-06-27 18:09 9,072 -------- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-27 18:09 <DIR> --d----- c:\windows\system32\IOSUBSYS ==================== Find3M ==================== 2009-06-16 07:36 119,808 a------- c:\windows\system32\t2embed.dll 2009-06-16 07:36 81,920 a------- c:\windows\system32\fontsub.dll 2009-06-03 12:09 1,291,264 a------- c:\windows\system32\quartz.dll 2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll 2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll ============= FINISH: 23:55:21.00 =============== Attach UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 4/11/2009 4:33:41 AM System Uptime: 7/21/2009 10:46:58 PM (1 hours ago) Motherboard: SAMSUNG ELECTRONICS CO., LTD. | | NC20/NB20 Processor: VIA Nano processor U2250@1300+MHz | mPGA 479m | 1595/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 143 GiB total, 120.499 GiB free. ==== Disabled Device Manager Items ============= Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Atheros AR5007EG Wireless Network Adapter Device ID: PCI\VEN_168C&DEV_001C&SUBSYS_7130144F&REV_01\4&3B3D4D14&0&0018 Manufacturer: Atheros Name: Atheros AR5007EG Wireless Network Adapter PNP Device ID: PCI\VEN_168C&DEV_001C&SUBSYS_7130144F&REV_01\4&3B3D4D14&0&0018 Service: AR5416 ==== System Restore Points =================== RP16: 4/21/2009 9:42:20 PM - System Checkpoint RP17: 4/22/2009 10:46:27 PM - System Checkpoint RP18: 4/24/2009 6:47:42 AM - System Checkpoint RP19: 4/25/2009 6:24:22 PM - System Checkpoint RP20: 4/26/2009 7:01:43 PM - System Checkpoint RP21: 4/27/2009 6:26:38 PM - Installed Microsoft Office Professional Plus 2007 RP22: 4/29/2009 9:13:33 PM - System Checkpoint RP23: 5/1/2009 12:40:48 AM - System Checkpoint RP24: 5/2/2009 8:40:35 AM - System Checkpoint RP25: 5/3/2009 12:10:26 PM - System Checkpoint RP26: 5/4/2009 7:21:37 PM - System Checkpoint RP27: 5/5/2009 7:27:08 PM - System Checkpoint RP28: 5/6/2009 8:11:15 PM - System Checkpoint RP29: 5/7/2009 8:20:21 PM - System Checkpoint RP30: 5/8/2009 9:19:12 PM - System Checkpoint RP31: 5/10/2009 2:40:09 PM - System Checkpoint RP32: 5/12/2009 7:22:20 AM - System Checkpoint RP33: 5/13/2009 9:18:27 AM - System Checkpoint RP34: 5/14/2009 12:31:52 AM - Software Distribution Service 3.0 RP35: 5/15/2009 12:38:10 AM - System Checkpoint RP36: 5/15/2009 5:49:05 PM - Installed Remote Control USB Driver RP37: 5/15/2009 5:49:24 PM - Installed Logitech Harmony Remote Software 7 RP38: 5/16/2009 12:17:32 AM - Installed Java(TM) 6 Update 13 RP39: 6/15/2009 7:18:57 PM - System Checkpoint RP40: 6/28/2009 3:21:37 AM - System Checkpoint RP41: 6/28/2009 10:23:42 AM - Spyware Doctor: Cleaning Threats RP42: 7/14/2009 11:14:42 PM - Removed J2SE Runtime Environment 5.0 RP43: 7/15/2009 3:00:15 AM - Software Distribution Service 3.0 RP44: 7/16/2009 8:07:43 PM - System Checkpoint RP45: 7/18/2009 11:34:57 PM - System Checkpoint ==== Installed Programs ====================== 2007 Microsoft Office Suite Service Pack 1 (SP1) Adobe Flash Player 10 Plugin Adobe Flash Player ActiveX Adobe Reader 9.1.2 Apple Mobile Device Support Apple Software Update Atheros WLAN Client Bonjour Critical Update for Windows Media Player 11 (KB959772) CyberLink YouCam Easy Display Manager Easy Network Manager FormViewer Google Updater HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) imagine digital freedom - Samsung iTunes Java(TM) 6 Update 14 Logitech Harmony Remote Software 7 Magic Keyboard Marvell Miniport Driver Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 Microsoft National Language Support Downlevel APIs Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Professional Plus 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C Runtime Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.0.11) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 Parser and SDK Namuga 1.3M Webcam PC Tools Firewall Plus 5.0 Picasa 3 Platform QuickTime Realtek High Definition Audio Driver Remote Control USB Driver Samsung Battery Manager Samsung EDS Samsung Magic Doctor Samsung Recovery Solution III Samsung Update Plus Samsung Wallpaper Security Update for Windows Internet Explorer 8 (KB969897) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB973346) Spyware Doctor 6.0 Synaptics Pointing Device Driver Update for Windows Internet Explorer 8 (KB971930) Update for Windows XP (KB898461) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) User Guide VIA Chrome9 HC3 IGP 6.14.10.0173 VIA Platform Device Manager Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 VLC media player 0.9.9 WebFldrs XP WIDCOMM Bluetooth Software Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Player 11 ==== Event Viewer Messages From Past Week ======== 7/21/2009 11:54:30 PM, error: Service Control Manager [7034] - The PC Tools Security Service service terminated unexpectedly. It has done this 1 time(s). 7/15/2009 9:17:28 PM, error: Service Control Manager [7023] - The Automatic Updates service terminated with the following error: The specified module could not be found. 7/15/2009 9:11:16 PM, error: Service Control Manager [7000] - The ASKUpgrade service failed to start due to the following error: The system cannot find the file specified. 7/15/2009 9:11:16 PM, error: Service Control Manager [7000] - The ASKService service failed to start due to the following error: The system cannot find the file specified. 7/15/2009 9:10:16 PM, error: Service Control Manager [7031] - The ASKUpgrade service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 7/15/2009 9:10:16 PM, error: Service Control Manager [7031] - The ASKService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 7/14/2009 11:24:06 PM, error: Service Control Manager [7034] - The Marvell Yukon Service service terminated unexpectedly. It has done this 1 time(s). 7/14/2009 11:19:39 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect. 7/14/2009 11:15:17 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found. 7/14/2009 11:05:42 PM, error: Service Control Manager [7000] - The Lavasoft Ad-Aware Service service failed to start due to the following error: The system cannot find the file specified. ==== End Of File =========================== |
|
|
|
|
07-22-2009, 04:36 AM
|
#17 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hi
If you have not installed/uninstalled Vuze yet, do this first. Do not install Vuze just yet. Please copy and paste the following text in the quote to Notepad. Code:
@echo off sc stop ASKService sc delete ASKService sc stop ASKUpgrade sc delete ASKUpgrade exit It should look like this:  Double click FixServices.bat. A window will open and close. This is normal. (Reboot is still required for it to take effect) Post the DDS.txt in your reply. |
|
|
|
|
07-24-2009, 12:47 PM
|
#18 (permalink) |
|
Registered User
Join Date: Jul 2009
Posts: 11
OS: xp
|
Re: Webpage Hijacked - Please help
HI,
Here is the dds.txt DDS (Ver_09-06-26.01) - NTFSx86 Run by byue at 20:02:29.37 on Wed 07/22/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_14 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1790.1403 [GMT -7:00] AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6} FW: PC Tools Firewall Plus *disabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\s3graphics\chrome3\Chrome3.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\MagicKBD\MagicKBD.exe C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\PROGRA~1\samsung\SAMSUN~3\SUPNOT~1.EXE C:\Documents and Settings\byue\Desktop\tech support\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [EDS] c:\program files\samsung\samsung eds\EDSAgent.exe mRun: [VTTimer] VTTimer.exe mRun: [Chrome3] c:\program files\s3graphics\chrome3\Chrome3.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [SUPBackGround] c:\program files\samsung\samsung update plus\SUPBackGround.exe mRun: [BatteryManager] c:\program files\samsung\samsung battery manager\BatteryManager.exe mRun: [DMHotKey] c:\program files\samsung\easy display manager\DMLoader.exe mRun: [MagicKeyboard] c:\program files\samsung\magickbd\PreMKBD.exe mRun: [UCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe mRun: [00PCTFW] "c:\program files\pc tools firewall plus\FirewallGUI.exe" -s StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\npjpi160_14.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\byue\applic~1\mozilla\firefox\profiles\07zv4oxm.default\ FF - plugin: c:\program files\google\google updater\2.4.1601.7122\npCIDetect13.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-13 64160] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-27 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-6-28 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-6-28 39200] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-6-27 159600] R2 DOSMEMIO;MEMIO;c:\windows\system32\MEMIO.SYS [2009-1-8 4300] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-6-27 73840] R2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32mpcoinst,serviceStartProc --> RUNDLL32.EXE ykx32mpcoinst,serviceStartProc [?] R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.SYS [2008-1-14 30208] R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2009-1-8 534528] R3 vcrdrx32;VIA MSP Cardreader Host Controller;c:\windows\system32\drivers\vcrdrx32.sys [2009-1-8 90752] R3 VMC326;Vimicro Camera Service VMC326;c:\windows\system32\drivers\VMC326.sys [2009-1-8 238464] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?] S2 PCToolsFirewallPlus;PC Tools Firewall Plus;c:\program files\pc tools firewall plus\FWService.exe [2009-7-15 146800] S3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-7-15 95640] S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-6-27 64392] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-27 348752] S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-6-27 1095560] S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-6-28 33056] S3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?] =============== Created Last 30 ================ 2009-07-20 00:48 <DIR> --ds---- C:\Combo-Fix 2009-07-15 21:17 <DIR> --d----- c:\docume~1\byue\applic~1\PCToolsFirewallPlus 2009-07-15 21:15 97,408 a------- c:\windows\system32\drivers\pctfw.sys 2009-07-15 21:15 95,640 a------- c:\windows\system32\drivers\pctplfw.sys 2009-07-15 21:15 <DIR> --d----- c:\program files\PC Tools Firewall Plus 2009-07-13 20:53 <DIR> -cd----- c:\windows\system32\dllcache\cache 2009-07-13 20:35 <DIR> a-dshr-- C:\cmdcons 2009-07-13 20:33 219,648 a------- c:\windows\PEV.exe 2009-07-13 20:33 161,792 a------- c:\windows\SWREG.exe 2009-07-13 20:33 98,816 a------- c:\windows\sed.exe 2009-07-10 23:04 <DIR> --d----- c:\program files\Trend Micro 2009-07-09 18:54 <DIR> --d----- c:\program files\iPod 2009-07-09 18:53 <DIR> --d----- c:\program files\iTunes 2009-06-29 17:54 <DIR> --dsh--- c:\documents and settings\byue\PrivacIE 2009-06-28 13:52 51,488 a------- c:\windows\system32\drivers\TfFsMon.sys 2009-06-28 13:52 39,200 a------- c:\windows\system32\drivers\TfSysMon.sys 2009-06-28 13:52 33,056 a------- c:\windows\system32\drivers\TfNetMon.sys 2009-06-28 13:52 12,576 a------- c:\windows\system32\drivers\TfKbMon.sys 2009-06-28 03:06 <DIR> --dsh--- c:\documents and settings\byue\IETldCache 2009-06-27 23:28 102,912 -c------ c:\windows\system32\dllcache\iecompat.dll 2009-06-27 23:28 <DIR> --d----- c:\windows\ie8updates 2009-06-27 23:28 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll 2009-06-27 23:28 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll 2009-06-27 23:25 <DIR> -cd-h--- c:\windows\ie8 2009-06-27 18:13 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys 2009-06-27 18:12 130,936 a------- c:\windows\system32\drivers\PCTCore.sys 2009-06-27 18:12 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys 2009-06-27 18:12 64,392 a------- c:\windows\system32\drivers\pctplsg.sys 2009-06-27 18:12 <DIR> --d----- c:\program files\common files\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\program files\Spyware Doctor 2009-06-27 18:12 <DIR> --d----- c:\docume~1\byue\applic~1\PC Tools 2009-06-27 18:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools 2009-06-27 18:09 9,200 -------- c:\windows\system32\drivers\cdralw2k.sys 2009-06-27 18:09 9,072 -------- c:\windows\system32\drivers\cdr4_xp.sys 2009-06-27 18:09 <DIR> --d----- c:\windows\system32\IOSUBSYS ==================== Find3M ==================== 2009-06-16 07:36 119,808 a------- c:\windows\system32\t2embed.dll 2009-06-16 07:36 81,920 a------- c:\windows\system32\fontsub.dll 2009-06-03 12:09 1,291,264 a------- c:\windows\system32\quartz.dll 2009-05-21 11:33 410,984 a------- c:\windows\system32\deploytk.dll 2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll 2009-05-07 08:32 345,600 a------- c:\windows\system32\localspl.dll ============= FINISH: 20:02:59.93 =============== |
|
|
|
|
07-24-2009, 01:00 PM
|
#19 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Webpage Hijacked - Please help
Hello again
That got rid of those Ask entries. If there are no further issues, continue below. ====== Delete DDS from your desktop, you can keep ATF-Cleaner if you wish...otherwise delete from desktop. ====== Well done, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ======== Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. For Internet Explorer users: WOT for IE -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Malwarebytes ' Anti-Malware SpywareBlaster to help prevent spyware from installing in the first place.
------------------------------------------------------------------ The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more. It can also alert you if you have not installed the latest patches from Microsoft. ============================================== Also, please take a look at this well written article: PC Safety and Security--What Do I Need? **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
| Thread Tools | |
|
|
