|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-22-2009, 11:29 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 26
OS: XP
|
Help needed: slower internet access with popups, Malwarebytes won't open
Hi, thanks for the help. I think I have a adware/malware program that my virus scanners can't find. My internet is very slow and I'm getting an increased number of popups. Also, I can't open Malwarebyte's, the program I usually use to clean up situations like this. I've run Vundofix and nothing came up. I also ran Trend Micro's downloadable program and nothing came up. I tried opening Malwarebyte's in safe mode and got the same error message, tried reinstalling it 3 times and still got the same message, if that helps at all.
I read the to do sheet and have attached the scans. Below is the DDS.txt, attached are attach.txt and ark.txt. Thanks for helping me!! I appreciate it! DDS (Ver_09-10-13.01) - NTFSx86 Run by Family at 17:53:17.01 on 2009-10-22 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2279 [GMT -4:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Norton Ghost\Agent\VProSvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Documents and Settings\Family\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Family\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Family\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Family\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Family\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll TB: McAfee SiteAdvisor: {0bf43445-2f28-4351-9252-17fe6e806aa0} - c:\program files\siteadvisor\SiteAdv.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: Easy-WebPrint: {03c1c47f-0538-4645-8372-d3109b9fc636} - c:\program files\canon\easy-webprint\Toolband.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent mRun: [IAAnotif] "c:\program files\intel\intel application accelerator\iaanotif.exe" mRun: [P17Helper] Rundll32 P17.dll,P17Helper mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [AtiPTA] atiptaxx.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [hpppta] c:\program files\hewlett-packard\hp precisionscan\precisionscan pro\hpppta.exe /ICON mRun: [dapileger] Rundll32.exe "c:\windows\system32\dosoyahe.dll",a StartupFolder: c:\docume~1\family\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\family\startm~1\programs\startup\outloo~1.lnk - c:\program files\outlook express\MSIMN.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {38E51477-DDB4-4aed-9D61-D0C193E10749} - {38E51477-DDB4-4aed-9D61-D0C193E10749} {38E51477-DDB4-4aed-9D61-D0C193E10749} - {38e51477-ddb4-4aed-9d61-d0c193e10749}\inprocserver32 does not exist! IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll Trusted Zone: internet Trusted Zone: mcafee.com DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409 DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab DPF: {205FF73B-CA67-11D5-99DD-444553540002} - hxxp://www.wildtangent.com/webdrivers/webinstall/shockwave/Install.cab DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - hxxp://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://media.grab.com/media/35f4a8/games/files/1147/axhost.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} - hxxp://simcity.ea.com/play/classic/SimCityX.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {DD3641E5-A9CF-11D1-9AA1-444553540000} - hxxp://www.sunterra.com/downloads/svh/svideo3.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} - hxxp://apps.corel.com/nos_dl_manager/plugin/IENetOpPlugin.ocx DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - hxxp://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: nnnlmmn - nnnlmmn.dll AppInit_DLLs: yezumoyu.dll c:\windows\system32\dosoyahe.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SSODL: laripojip - {942df49a-43fd-45d6-b585-e9ae006171d9} - c:\windows\system32\dosoyahe.dll STS: tokatiluy: {942df49a-43fd-45d6-b585-e9ae006171d9} - c:\windows\system32\dosoyahe.dll LSA: Notification Packages = scecli veseyusi.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\family\applic~1\mozilla\firefox\profiles\amsmajis.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\family\application data\move networks\plugins\npqmp071505000010.dll FF - plugin: c:\documents and settings\family\local settings\application data\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service ============= SERVICES / DRIVERS =============== R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-9-8 206112] R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2004-8-12 5120] R3 MovRVDrv32;MovRVDrv32;c:\windows\system32\drivers\MovRVDrv32.sys [2008-9-8 3768] R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1553896] S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?] S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\family\locals~1\temp\jnv4_mib.sys --> c:\docume~1\family\locals~1\temp\jnv4_mib.sys [?] S3 SoundMovieServer;SoundMovieServer;c:\windows\system32\snmvtsvc.exe [2008-9-8 200704] =============== Created Last 30 ================ 2009-10-20 19:19 664 a------- c:\windows\system32\d3d9caps.dat 2009-10-20 18:58 <DIR> --d----- C:\VundoFix Backups 2009-10-20 18:53 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-10-20 18:42 <DIR> --d----- c:\program files\spyware remover 2009-10-20 18:38 <DIR> --d----- c:\program files\Malwarebytes 2009-10-20 18:37 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-20 18:37 19,160 a------- c:\windows\system32\drivers\mbam.sys 2009-10-15 02:46 20 a------- c:\windows\HP PrecisionScan Pro.INI 2009-10-13 19:59 2,146,304 a------- c:\windows\system32\GPhotos.scr 2009-10-12 23:42 116 a------- c:\windows\NeroDigital.ini 2009-10-10 23:51 68,608 ac------ c:\windows\system32\dllcache\hpgt53tk.dll 2009-10-10 23:51 32,768 ac------ c:\windows\system32\dllcache\hpgtmcro.dll 2009-10-10 23:51 68,608 a------- c:\windows\system32\hpgt53tk.dll 2009-10-10 23:51 32,768 a------- c:\windows\system32\hpgtmcro.dll 2009-10-10 23:51 165,888 ac------ c:\windows\system32\dllcache\hpgt53.dll 2009-10-10 23:51 165,888 a------- c:\windows\system32\hpgt53.dll 2009-10-10 22:06 <DIR> --d----- C:\sj666 2009-10-05 14:08 32,592 a------- c:\windows\system32\msonpmon.dll 2009-10-05 14:04 <DIR> --d----- c:\windows\SHELLNEW 2009-10-05 12:58 <DIR> --d----- c:\docume~1\family\applic~1\GetRightToGo 2009-09-28 22:37 <DIR> --d----- c:\program files\xsgfyp ==================== Find3M ==================== 2009-10-17 14:47 1,880 a------- c:\windows\AUTOLNCH.REG 2009-10-08 17:29 38,728 a---h--- c:\windows\system32\mlfcache.dat 2009-09-16 10:22 214,664 a------- c:\windows\system32\drivers\mfehidk.sys 2009-09-16 10:22 79,816 a------- c:\windows\system32\drivers\mfeavfk.sys 2009-09-16 10:22 40,552 a------- c:\windows\system32\drivers\mfesmfk.sys 2009-09-16 10:22 35,272 a------- c:\windows\system32\drivers\mfebopk.sys 2009-09-16 10:22 34,248 a------- c:\windows\system32\drivers\mferkdk.sys 2009-09-11 10:18 136,192 a------- c:\windows\system32\msv1_0.dll 2009-09-04 17:03 58,880 a------- c:\windows\system32\msasn1.dll 2009-09-01 20:30 411,368 a------- c:\windows\system32\deploytk.dll 2009-08-29 04:08 916,480 a------- c:\windows\system32\wininet.dll 2009-08-26 04:00 247,326 a------- c:\windows\system32\strmdll.dll 2009-08-24 02:04 472,576 a------- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe 2009-08-23 17:00 922,112 -------- c:\windows\system32\imapi2fs.dll 2009-08-23 17:00 426,496 -------- c:\windows\system32\imapi2.dll 2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll 2009-08-04 20:44 2,189,184 a------- c:\windows\system32\ntoskrnl.exe 2009-08-04 10:20 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe 2006-07-23 01:39 88 a--shr-- c:\windows\system32\283962B5F1.sys 2009-07-21 12:03 51,712 a--sh--- c:\windows\system32\dezudesu.dll 2009-07-22 12:03 90,112 a--sh--- c:\windows\system32\dosoyahe.dll 2009-07-22 12:03 37,888 a--sh--- c:\windows\system32\fenufebo.dll 2009-07-22 00:03 89,088 a--sh--- c:\windows\system32\galazere.dll 2009-07-21 12:02 38,400 a--sh--- c:\windows\system32\gigijomo.dll 2009-07-20 12:02 38,400 a--sh--- c:\windows\system32\jerugame.dll 2006-07-23 01:40 4,184 a--sh--- c:\windows\system32\KGyGaAvL.sys 2009-07-21 12:02 51,712 a--sh--- c:\windows\system32\lenoruta.dll 2009-07-22 00:03 38,400 a--sh--- c:\windows\system32\piraguyu.dll 2009-07-21 00:02 51,712 a--sh--- c:\windows\system32\tibugizu.dll 2009-07-21 00:02 38,400 a--sh--- c:\windows\system32\valopawi.dll 2009-07-21 12:03 51,712 a--sh--- c:\windows\system32\veseyusi.dll 2009-07-21 12:03 51,712 a--sh--- c:\windows\system32\yezumoyu.dll 2009-07-11 06:38 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009071120090712\index.dat ============= FINISH: 17:54:18.48 =============== I read in the forum about ESET scanner, so I did it. I didn't mess with anything, I unchecked "fix" and scanned only. I thought the results may help. Here they are: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\V585CI0N\index[1].htm JS/TrojanDownloader.FraudLoad.NAB trojan C:\Documents and Settings\Family\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_0019db JS/TrojanDownloader.FraudLoad.NAB trojan C:\Documents and Settings\Family\My Documents\Elizabeth\CruiseLinesTycoon.exe a variant of Win32/Adware.Trymedia application C:\Documents and Settings\Family\My Documents\Elizabeth\TradewindsLegendsSetup-dm.exe Win32/Adware.Trymedia application C:\Downloads\SkiResortTycoon_Setup-dm.exe Win32/Adware.Trymedia application C:\Downloads\TradewindsLegendsSetup-dm[1].exe Win32/Adware.Trymedia application C:\WINDOWS\SYSTEM32\dezudesu.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\fenufebo.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\galazere.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\jemakoyo.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\lenoruta.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\nevahoti.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\piraguyu.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\rupefido.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\veseyusi.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\vibabugo.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\SYSTEM32\yezumoyu.dll a variant of Win32/Kryptik.AWS trojan C:\WINDOWS\Temp\D06.tmp a variant of Win32/Kryptik.AQO trojan D:\~ Software Tools\Nero\Nero-6.6.1.15a.exe Win32/Toolbar.AskSBar application Operating memory a variant of Win32/Kryptik.AWS trojan Last edited by amateur; 10-25-2009 at 01:49 AM. Reason: to retain 0-reply status |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-26-2009, 03:49 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,550
OS: XP SP3
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: My Way Search Assistant<<Please read this ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Please see this >> http://img.photobucket.com/albums/v6...ee_disable.gif Please post the C:\ComboFix.txt in your next reply for further review. Please re-enable your antivirus before posting the ComboFix.txt log. ------------------------------------------------------ |
|
|
|
|
10-27-2009, 09:58 AM
|
#3 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 26
OS: XP
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello, Thanks for helping.
I looked for "My Way Search Assistant" in add/remove programs and found nothing, there were also no programs with Search Assistant in it. ... Also, I disabled McAfee, let ComboFix run; it ran through, then reloaded Windows-now my computer is in very low resolution and when I try to change it it says "The currently selected graphics display driver cannot be used". I've attached a screenshot of the full message if you need ti read it. --And, while typing this up, Mcafee found the trojan Artemis! in Combofix.exe. Not sure about this, so I attached the info in another screenshot. Here is my ComboFix Log: Thanks again. ComboFix 09-10-26.03 - Family 2009-10-27 0:57.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2009 [GMT -4:00] Running from: c:\documents and settings\Family\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AUTOLNCH.REG c:\windows\system32\fenufebo.dll c:\windows\system32\fifegibo.dll c:\windows\system32\fikinula.dll c:\windows\system32\fodajobu.dll c:\windows\system32\galazere.dll c:\windows\system32\gaparija.dll c:\windows\system32\hiwofudi.dll c:\windows\system32\nevahoti.dll c:\windows\system32\nogumufo.dll c:\windows\system32\piraguyu.dll c:\windows\system32\sowipota.dll c:\windows\system32\vugitopi.dll c:\windows\system32\yumeyubi.dll . ((((((((((((((((((((((((( Files Created from 2009-09-27 to 2009-10-27 ))))))))))))))))))))))))))))))) . 2009-10-25 04:05 . 2009-10-25 05:55 -------- d-----w- c:\documents and settings\All Users\Application Data\47612727 2009-10-24 18:47 . 2009-10-24 18:47 -------- d-----w- c:\program files\ESET 2009-10-20 23:19 . 2009-10-20 23:20 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-10-20 22:58 . 2009-10-20 22:58 -------- d-----w- C:\VundoFix Backups 2009-10-20 22:53 . 2009-10-20 22:53 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-10-20 22:42 . 2009-10-20 22:42 -------- d-----w- c:\program files\spyware remover 2009-10-20 22:38 . 2009-10-20 22:38 -------- d-----w- c:\program files\Malwarebytes 2009-10-20 22:37 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-20 22:37 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-17 19:17 . 2009-10-17 19:17 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google 2009-10-13 23:59 . 2009-10-13 23:59 2146304 ----a-w- c:\windows\system32\GPhotos.scr 2009-10-11 03:51 . 2001-08-18 02:36 68608 -c--a-w- c:\windows\system32\dllcache\hpgt53tk.dll 2009-10-11 03:51 . 2001-08-18 02:36 68608 ----a-w- c:\windows\system32\hpgt53tk.dll 2009-10-11 03:51 . 2001-08-18 02:36 32768 -c--a-w- c:\windows\system32\dllcache\hpgtmcro.dll 2009-10-11 03:51 . 2001-08-18 02:36 32768 ----a-w- c:\windows\system32\hpgtmcro.dll 2009-10-11 03:51 . 2001-08-18 02:36 165888 -c--a-w- c:\windows\system32\dllcache\hpgt53.dll 2009-10-11 03:51 . 2001-08-18 02:36 165888 ----a-w- c:\windows\system32\hpgt53.dll 2009-10-11 02:06 . 2009-10-11 02:06 -------- d-----w- C:\sj666 2009-10-05 18:08 . 2006-10-26 23:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2009-10-05 18:07 . 2009-10-05 18:07 -------- d-----w- c:\program files\Microsoft Works 2009-10-05 18:06 . 2009-10-05 18:06 -------- d-----w- c:\program files\Microsoft.NET 2009-10-05 18:04 . 2009-10-05 18:05 -------- d-----w- c:\windows\SHELLNEW 2009-10-05 18:04 . 2009-10-05 18:04 -------- d-----w- c:\documents and settings\Family\Local Settings\Application Data\Microsoft Help 2009-10-05 18:04 . 2009-10-05 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-10-05 18:03 . 2009-10-05 18:03 -------- d-----r- C:\MSOCache 2009-10-05 16:58 . 2009-10-05 18:06 -------- d-----w- c:\documents and settings\Family\Application Data\GetRightToGo 2009-09-29 02:37 . 2009-09-29 05:35 -------- d-----w- c:\program files\xsgfyp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-22 04:23 . 2005-01-16 00:06 -------- d-----w- c:\program files\McAfee 2009-10-20 22:37 . 2009-09-22 07:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-20 22:37 . 2009-09-22 07:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-10-20 22:31 . 2009-09-22 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-10-20 22:31 . 2009-09-22 20:06 -------- d-----w- c:\documents and settings\Family\Application Data\Malwarebytes 2009-10-15 08:05 . 2005-01-16 00:06 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-10-11 04:11 . 2006-07-01 23:20 -------- d-----w- c:\program files\Google 2009-10-11 02:11 . 2009-10-11 02:11 -------- d-----w- c:\program files\Hewlett-Packard 2009-10-08 21:29 . 2009-07-11 15:28 38728 -c-ha-w- c:\windows\system32\mlfcache.dat 2009-10-08 21:26 . 2005-01-09 23:13 41416 -c--a-w- c:\documents and settings\Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-05 16:54 . 2004-12-30 05:36 -------- d-----w- c:\program files\Common Files\Corel 2009-09-26 06:07 . 2009-09-25 19:19 -------- d-----w- c:\documents and settings\Family\Application Data\Move Networks 2009-09-23 03:41 . 2009-09-22 07:26 -------- d-----w- c:\program files\ocglqb 2009-09-22 05:22 . 2009-09-22 05:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue 2009-09-16 14:22 . 2007-08-16 17:47 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys 2009-09-16 14:22 . 2007-08-16 17:47 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys 2009-09-16 14:22 . 2007-08-16 17:47 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys 2009-09-16 14:22 . 2007-08-16 17:47 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys 2009-09-16 14:22 . 2007-08-16 17:47 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys 2009-09-11 14:18 . 2004-08-12 14:01 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-10 22:47 . 2005-01-21 04:23 -------- d-----w- c:\documents and settings\Family\Application Data\Apple Computer 2009-09-10 22:29 . 2009-09-10 22:27 -------- d-----w- c:\program files\iTunes 2009-09-10 22:29 . 2009-09-10 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-10 22:27 . 2005-01-21 03:16 -------- d-----w- c:\program files\iPod 2009-09-10 22:27 . 2008-09-08 22:07 -------- d-----w- c:\program files\Common Files\Apple 2009-09-10 22:25 . 2009-09-10 22:24 -------- d-----w- c:\program files\QuickTime 2009-09-04 21:03 . 2004-08-12 14:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-02 00:30 . 2009-09-02 00:31 411368 -c--a-w- c:\windows\system32\deploytk.dll 2009-09-02 00:30 . 2004-12-30 05:32 -------- d-----w- c:\program files\Java 2009-08-29 08:08 . 2004-08-12 14:09 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-26 08:00 . 2004-08-12 14:06 247326 -c--a-w- c:\windows\system32\strmdll.dll 2009-08-24 06:04 . 2009-08-24 06:04 472576 -c--a-w- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe 2009-08-23 21:00 . 2009-08-23 21:00 922112 ------w- c:\windows\system32\imapi2fs.dll 2009-08-23 21:00 . 2009-08-23 21:00 426496 ------w- c:\windows\system32\imapi2.dll 2009-08-05 09:01 . 2004-08-12 14:01 204800 -c--a-w- c:\windows\system32\mswebdvd.dll 2009-08-05 00:44 . 2004-08-12 14:02 2189184 -c--a-w- c:\windows\system32\ntoskrnl.exe 2009-08-04 14:20 . 2004-08-03 22:59 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe 2006-07-23 05:39 . 2006-05-27 18:39 88 -csha-r- c:\windows\SYSTEM32\283962B5F1.sys 2006-07-23 05:40 . 2006-02-23 03:47 4184 -csha-w- c:\windows\SYSTEM32\KGyGaAvL.sys 2009-07-21 16:02 . 2009-07-21 16:02 51712 -csha-w- c:\windows\SYSTEM32\lenoruta.dll 2009-07-26 16:06 . 2009-07-26 16:06 51712 --sha-w- c:\windows\SYSTEM32\lidegiwe.dll 2009-07-26 16:05 . 2009-07-26 16:05 51712 --sha-w- c:\windows\SYSTEM32\vejuyabe.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ba2a3be-fa98-4a65-a865-5bd5d442a27b}] 2009-07-26 16:06 51712 --sha-w- c:\windows\SYSTEM32\lidegiwe.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 135168] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328] "hpppta"="c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hpppta.exe" [2001-12-13 98304] "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2009-07-09 5134864] "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928] "AtiPTA"="atiptaxx.exe" - c:\windows\SYSTEM32\atiptaxx.exe [2006-02-22 344064] c:\documents and settings\Family\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] Outlook Express.lnk - c:\program files\Outlook Express\MSIMN.EXE [2004-8-4 60416] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"= "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Family\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-09-08 5:20 PM 206112] R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\SYSTEM32\dllhost.exe [2004-08-12 9:56 AM 5120] R3 MovRVDrv32;MovRVDrv32;c:\windows\SYSTEM32\DRIVERS\MovRVDrv32.sys [2008-09-08 7:06 PM 3768] R3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2007-12-20 5:13 PM 1553896] S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?] S3 jnv4_mib;jnv4_mib;\??\c:\docume~1\Family\LOCALS~1\Temp\jnv4_mib.sys --> c:\docume~1\Family\LOCALS~1\Temp\jnv4_mib.sys [?] S3 SoundMovieServer;SoundMovieServer;c:\windows\SYSTEM32\snmvtsvc.exe [2008-09-08 7:06 PM 200704] --- Other Services/Drivers In Memory --- *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] 2009-10-26 c:\windows\Tasks\Cleanup.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-10-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2350648319-3392060685-3698023044-1006Core.job - c:\documents and settings\Family\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-26 23:50] 2009-10-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2350648319-3392060685-3698023044-1006UA.job - c:\documents and settings\Family\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-26 23:50] 2009-10-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-10-26 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-09-22 c:\windows\Tasks\Uniblue SpyEraser.job - c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2007-08-20 15:00] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html Trusted Zone: internet Trusted Zone: mcafee.com DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://media.grab.com/media/35f4a8/games/files/1147/axhost.cab FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\amsmajis.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Family\Application Data\Move Networks\plugins\npqmp071505000010.dll FF - plugin: c:\documents and settings\Family\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service . - - - - ORPHANS REMOVED - - - - HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe HKLM-Run-dapileger - c:\windows\system32\hiwofudi.dll HKLM-Run-piyurabuze - vugitopi.dll SharedTaskScheduler-{62f79771-1109-4df3-964b-0b7b462c167a} - c:\windows\system32\hiwofudi.dll SSODL-fukiwugoj-{62f79771-1109-4df3-964b-0b7b462c167a} - c:\windows\system32\hiwofudi.dll Notify-nnnlmmn - nnnlmmn.dll Notify-ssqpq - (no file) AddRemove-Easy Hi-Q Recorder_is1 - c:\program files\Easy Hi-Q Recorder\unins000.exe AddRemove-2kv4.8.442 - c:\windows\Radeon Omega Drivers v4.8.442 AddRemove-Uniblue DriverScanner - c:\documents and settings\All Users\Application Data\{E9405398-E712-430B-B9AA-DD1F9505008B}\DriverScanner_Setup.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-27 01:07 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2350648319-3392060685-3698023044-1006\Software\SecuROM\License information*] "datasecu"=hex:47,ff,15,93,31,f7,8a,6c,38,c0,3c,e0,69,39,e2,6e,8b,c7,29,39,42, 69,09,e3,4e,72,89,4d,ff,e1,9c,47,3f,3b,a4,df,87,96,ec,4f,6d,46,01,9b,7e,df,\ "rkeysecu"=hex:1c,2a,73,ec,79,1a,cd,a2,48,10,fc,1d,fe,c1,b6,ce . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3672) c:\windows\system32\WININET.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\CTsvcCDA.EXE c:\program files\Intel\Intel Application Accelerator\iaantmon.exe c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\combofix\CF23198.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\program files\McAfee\MPF\MPFSrv.exe c:\program files\McAfee\MSK\MskSrver.exe c:\program files\Norton Ghost\Agent\VProSvc.exe c:\windows\system32\Rundll32.exe c:\windows\system32\MsPMSPSv.exe c:\windows\system32\wscntfy.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\msdtc.exe c:\progra~1\McAfee\VIRUSS~1\mcods.exe c:\progra~1\mcafee\VIRUSS~1\mcvsshld.exe c:\combofix\PEV.cfxxe . ************************************************************************** . Completion time: 2009-10-27 1:12 - machine was rebooted ComboFix-quarantined-files.txt 2009-10-27 05:12 Pre-Run: 117,032,460,288 bytes free Post-Run: 117,311,143,936 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect - - End Of File - - 6E8A993C6D5D9AF817139AFE0C739A67 Last edited by mehlev; 10-27-2009 at 10:10 AM. |
|
|
|
|
10-27-2009, 11:33 AM
|
#4 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,550
OS: XP SP3
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello mehlev. Gonna take me a while to research the resolution problem. Never seen that before. Did you try updating your driver?
Please tell McAfee to ignore ComboFix.exe. Parts of ComboFix 'look' like malware to some scanners. It's a false positive. Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
dir /a /s "c:\documents and settings\All Users\Application Data\47612727" > log.txt dir /a /s "C:\sj666" >> log.txt dir /a /s "c:\program files\xsgfyp" >> log.txt dir /a /s "c:\program files\ocglqb" >> log.txt notepad log.txt It should look like this:  Double-click on peek.bat and allow it to run. A Notepad file will open. Post the contents of that file in your next reply. ------------------------------------------------------ |
|
|
|
|
10-27-2009, 02:27 PM
|
#5 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 26
OS: XP
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello chemist,
Here is the peek.bat Data: Should I delete the peek.bat file from my desktop yet? Volume in drive C has no label. Volume Serial Number is BC19-57BB Directory of c:\documents and settings\All Users\Application Data\47612727 2009-10-25 01:55 AM <DIR> . 2009-10-25 01:55 AM <DIR> .. 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 2 Dir(s) 117,332,836,352 bytes free Volume in drive C has no label. Volume Serial Number is BC19-57BB Directory of C:\sj666 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2001-12-13 03:19 AM 57 AUTORUN.INF 2009-10-10 10:06 PM <DIR> Diagnostics 2009-10-10 10:06 PM <DIR> ENGLISH 2001-12-13 03:26 AM 506 HP5300CP.INF 2001-12-13 03:26 AM 104,573 HP5300CP.VXD 2001-12-13 03:26 AM 952 HP53CP95.INF 2001-12-13 03:26 AM 96,300 HP53PW2K.SYS 2001-12-13 03:26 AM 12,729 HP53STI.CAT 2001-12-13 03:26 AM 18,000 HP53STI.INF 2001-12-13 03:55 AM 102,400 HPG53USD.DLL 2001-12-13 04:18 AM 36,864 HPGWIAMD.DLL 2001-12-13 03:26 AM 53,248 HPMD32.DLL 2001-12-13 03:26 AM 90,112 HPMD32P.DLL 2001-12-13 03:26 AM 106,496 HPMD32U.DLL 2001-03-14 02:50 PM 19,716 HPSJ95CI.DLL 2001-12-13 03:54 AM 102,400 HPSJVSET.DLL 2002-02-08 02:14 PM 32,768 hpupdate.exe 2009-10-10 10:06 PM <DIR> I386 2009-10-10 10:06 PM <DIR> MEDIA 2001-12-13 03:54 AM 151,552 PRNTFIX.EXE 2002-02-08 02:14 PM 20,480 setup.exe 2002-01-31 03:49 PM 186 setup.ini 2000-07-06 06:38 AM 28,672 updatloc.dll 2001-12-13 03:21 AM 8,944 USBSCAN.SYS 20 File(s) 986,955 bytes Directory of C:\sj666\Diagnostics 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2001-12-12 10:52 AM 8,034 appdata.src 2001-12-18 06:41 AM 94,208 DeviceInfo.dll 2001-12-18 06:41 AM 90,112 HpAppEgn.dll 2001-05-01 05:11 AM 49,152 HPSdRes.dll 2001-12-18 06:41 AM 57,344 HpSdUi.dll 2001-12-18 06:41 AM 307,200 HPSysDig.exe 2001-12-18 06:53 AM 20,480 HPSysDigv12.doc 2001-12-18 06:41 AM 86,016 logging.dll 2001-12-18 06:41 AM 20,480 rdevice.exe 2001-12-18 06:41 AM 90,112 systeminfo.dll 10 File(s) 823,138 bytes Directory of C:\sj666\ENGLISH 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2001-12-13 05:44 AM 113 DATA.TAG 2001-12-13 05:44 AM 44,916,423 data1.cab 2001-12-13 05:44 AM 63,923 data1.hdr 2001-12-13 03:28 AM 1,603 Hpscanjt.cnt 2001-12-13 03:28 AM 98,532 Hpscanjt.hlp 2009-10-10 10:06 PM <DIR> Intel 32 2000-12-07 02:40 AM 24,223 LANG.DAT 2001-12-13 05:44 AM 619 layout.bin 1998-07-27 10:41 AM 450 os.dat 2001-12-12 06:00 PM 56,314 Readme.doc 2009-10-10 10:11 PM <DIR> ScanToWeb 2000-12-11 03:30 AM 73,987 Setup.exe 2001-12-13 05:44 AM 109 SETUP.INI 2001-12-13 05:44 AM 113,508 setup.ins 2001-12-13 05:44 AM 49 setup.lid 1999-02-23 04:45 AM 296,674 _inst32i.ex_ 2000-12-11 03:30 AM 30,979 _ISDel.exe 2001-12-13 03:21 AM 34,816 _Setup.dll 2001-12-13 05:44 AM 174,897 _sys1.cab 2001-12-13 05:44 AM 5,939 _sys1.hdr 2001-12-13 05:44 AM 1,345,043 _user1.cab 2001-12-13 05:44 AM 7,156 _user1.hdr 20 File(s) 47,245,357 bytes Directory of C:\sj666\ENGLISH\Intel 32 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 1998-09-29 09:34 PM 34,816 _Setup.dll 1 File(s) 34,816 bytes Directory of C:\sj666\ENGLISH\ScanToWeb 2009-10-10 10:11 PM <DIR> . 2009-10-10 10:11 PM <DIR> .. 2000-05-24 01:35 AM 130 DATA.TAG 2000-05-24 01:35 AM 846,737 data1.cab 2000-05-24 01:35 AM 4,879 data1.hdr 1999-01-12 04:34 AM 23,541 lang.dat 2000-05-24 01:35 AM 590 layout.bin 1998-07-27 10:41 AM 450 os.dat 1999-01-12 05:42 AM 73,728 Setup.exe 2000-05-24 01:35 AM 109 SETUP.INI 2000-05-24 01:35 AM 68,975 setup.ins 2000-03-03 10:02 AM 1,093 setup.iss 2000-05-24 01:35 AM 49 setup.lid 2009-10-10 10:11 PM 332 setup.log 1999-02-23 04:45 AM 296,674 _inst32i.ex_ 1998-10-27 06:06 AM 27,648 _ISDel.exe 1998-09-29 09:34 AM 34,816 _Setup.dll 2000-05-24 01:35 AM 175,466 _sys1.cab 2000-05-24 01:35 AM 3,905 _sys1.hdr 2000-05-24 01:35 AM 18,541 _user1.cab 2000-05-24 01:35 AM 4,675 _user1.hdr 19 File(s) 1,582,338 bytes Directory of C:\sj666\I386 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2001-08-17 06:53 AM 13,824 usbscan.sys 1 File(s) 13,824 bytes Directory of C:\sj666\MEDIA 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2009-10-10 10:06 PM <DIR> Xtras 0 File(s) 0 bytes Directory of C:\sj666\MEDIA\Xtras 2009-10-10 10:06 PM <DIR> . 2009-10-10 10:06 PM <DIR> .. 2001-12-12 06:00 PM 57,344 checkhw.exe 2001-12-12 06:00 PM 36,864 parainst.exe 2 File(s) 94,208 bytes Total Files Listed: 73 File(s) 50,780,636 bytes 23 Dir(s) 117,332,828,160 bytes free Volume in drive C has no label. Volume Serial Number is BC19-57BB Directory of c:\program files\xsgfyp 2009-09-29 01:35 AM <DIR> . 2009-09-29 01:35 AM <DIR> .. 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 2 Dir(s) 117,332,828,160 bytes free Volume in drive C has no label. Volume Serial Number is BC19-57BB Directory of c:\program files\ocglqb 2009-09-22 11:41 PM <DIR> . 2009-09-22 11:41 PM <DIR> .. 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 2 Dir(s) 117,332,828,160 bytes free |
|
|
|
|
10-27-2009, 03:36 PM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,550
OS: XP SP3
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello again, mehlev. Good job on the driver. Yes, you can delete the peek.bat file.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ You are using an outdated version of HijackThis. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Manager<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. To open Notepad, go Start > Run and type Notepad then click 'OK'. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/424895-help-needed-slower-internet-access-popups-malwarebytes-wont-open.html#post2412736 Collect:: C:\WINDOWS\SYSTEM32\dezudesu.dll C:\WINDOWS\SYSTEM32\jemakoyo.dll C:\WINDOWS\SYSTEM32\lenoruta.dll C:\WINDOWS\SYSTEM32\rupefido.dll C:\WINDOWS\SYSTEM32\veseyusi.dll C:\WINDOWS\SYSTEM32\vibabugo.dll C:\WINDOWS\SYSTEM32\yezumoyu.dll c:\windows\SYSTEM32\lidegiwe.dll c:\windows\SYSTEM32\vejuyabe.dll Folder:: c:\documents and settings\All Users\Application Data\47612727 C:\VundoFix Backups c:\docume~1\family\applic~1\GetRightToGo c:\program files\xsgfyp c:\program files\ocglqb DDS:: uInternet Connection Wizard,ShellNext = iexplore DirLook:: c:\program files\spyware remover Driver:: jnv4_mib  Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Please re-enable your antivirus before posting the ComboFix.txt log. ------------------------------------------------------ **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ |
|
|
|
|
10-28-2009, 12:57 AM
|
#8 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 26
OS: XP
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello chemist--
-I didn't have any files of HijackThis (I looked in Add/Remove, C:, and searched my C drive) -No Viewpoint Manager in Add/Remove Programs -I ran the Notepad info through ComboFix, here is the data: -No popup came up, I tried to submit the file to bleepingcomputer & it says page not found. ComboFix 09-10-27.04 - Family 2009-10-28 2:40.3.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2551 [GMT -4:00] Running from: c:\documents and settings\Family\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Family\Desktop\CFScript.txt AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} file zipped: c:\windows\SYSTEM32\lenoruta.dll file zipped: c:\windows\SYSTEM32\lidegiwe.dll file zipped: c:\windows\SYSTEM32\vejuyabe.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\family\applic~1\GetRightToGo c:\docume~1\family\applic~1\GetRightToGo\X12-30107-DLM.data c:\documents and settings\All Users\Application Data\47612727 c:\program files\ocglqb c:\program files\xsgfyp C:\VundoFix Backups c:\windows\system32\hapurunu.dll c:\windows\system32\jorujedi.dll c:\windows\SYSTEM32\lenoruta.dll c:\windows\SYSTEM32\lidegiwe.dll c:\windows\system32\mubotova.dll c:\windows\system32\tufamovo.dll c:\windows\system32\vejuyabe.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_JNV4_MIB -------\Service_jnv4_mib ((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-28 ))))))))))))))))))))))))))))))) . 2009-10-24 18:47 . 2009-10-24 18:47 -------- d-----w- c:\program files\ESET 2009-10-20 23:19 . 2009-10-20 23:20 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-10-20 22:53 . 2009-10-20 22:53 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6} 2009-10-20 22:42 . 2009-10-20 22:42 -------- d-----w- c:\program files\spyware remover 2009-10-20 22:38 . 2009-10-20 22:38 -------- d-----w- c:\program files\Malwarebytes 2009-10-20 22:37 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-20 22:37 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-17 19:17 . 2009-10-17 19:17 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google 2009-10-13 23:59 . 2009-10-13 23:59 2146304 ----a-w- c:\windows\system32\GPhotos.scr 2009-10-11 03:51 . 2001-08-18 02:36 68608 -c--a-w- c:\windows\system32\dllcache\hpgt53tk.dll 2009-10-11 03:51 . 2001-08-18 02:36 68608 ----a-w- c:\windows\system32\hpgt53tk.dll 2009-10-11 03:51 . 2001-08-18 02:36 32768 -c--a-w- c:\windows\system32\dllcache\hpgtmcro.dll 2009-10-11 03:51 . 2001-08-18 02:36 32768 ----a-w- c:\windows\system32\hpgtmcro.dll 2009-10-11 03:51 . 2001-08-18 02:36 165888 -c--a-w- c:\windows\system32\dllcache\hpgt53.dll 2009-10-11 03:51 . 2001-08-18 02:36 165888 ----a-w- c:\windows\system32\hpgt53.dll 2009-10-11 02:06 . 2009-10-11 02:06 -------- d-----w- C:\sj666 2009-10-05 18:08 . 2006-10-26 23:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2009-10-05 18:07 . 2009-10-05 18:07 -------- d-----w- c:\program files\Microsoft Works 2009-10-05 18:06 . 2009-10-05 18:06 -------- d-----w- c:\program files\Microsoft.NET 2009-10-05 18:04 . 2009-10-05 18:05 -------- d-----w- c:\windows\SHELLNEW 2009-10-05 18:04 . 2009-10-05 18:04 -------- d-----w- c:\documents and settings\Family\Local Settings\Application Data\Microsoft Help 2009-10-05 18:04 . 2009-10-05 18:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-10-05 18:03 . 2009-10-05 18:03 -------- d-----r- C:\MSOCache . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-22 04:23 . 2005-01-16 00:06 -------- d-----w- c:\program files\McAfee 2009-10-20 22:37 . 2009-09-22 07:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-20 22:37 . 2009-09-22 07:39 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-10-20 22:31 . 2009-09-22 07:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-10-20 22:31 . 2009-09-22 20:06 -------- d-----w- c:\documents and settings\Family\Application Data\Malwarebytes 2009-10-15 08:05 . 2005-01-16 00:06 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2009-10-11 04:11 . 2006-07-01 23:20 -------- d-----w- c:\program files\Google 2009-10-11 02:11 . 2009-10-11 02:11 -------- d-----w- c:\program files\Hewlett-Packard 2009-10-08 21:29 . 2009-07-11 15:28 38728 -c-ha-w- c:\windows\system32\mlfcache.dat 2009-10-08 21:26 . 2005-01-09 23:13 41416 -c--a-w- c:\documents and settings\Family\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-05 16:54 . 2004-12-30 05:36 -------- d-----w- c:\program files\Common Files\Corel 2009-09-26 06:07 . 2009-09-25 19:19 -------- d-----w- c:\documents and settings\Family\Application Data\Move Networks 2009-09-22 05:22 . 2009-09-22 05:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue 2009-09-16 14:22 . 2007-08-16 17:47 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys 2009-09-16 14:22 . 2007-08-16 17:47 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys 2009-09-16 14:22 . 2007-08-16 17:47 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys 2009-09-16 14:22 . 2007-08-16 17:47 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys 2009-09-16 14:22 . 2007-08-16 17:47 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys 2009-09-11 14:18 . 2004-08-12 14:01 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-10 22:47 . 2005-01-21 04:23 -------- d-----w- c:\documents and settings\Family\Application Data\Apple Computer 2009-09-10 22:29 . 2009-09-10 22:27 -------- d-----w- c:\program files\iTunes 2009-09-10 22:29 . 2009-09-10 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2009-09-10 22:27 . 2005-01-21 03:16 -------- d-----w- c:\program files\iPod 2009-09-10 22:27 . 2008-09-08 22:07 -------- d-----w- c:\program files\Common Files\Apple 2009-09-10 22:25 . 2009-09-10 22:24 -------- d-----w- c:\program files\QuickTime 2009-09-04 21:03 . 2004-08-12 14:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-09-02 00:30 . 2009-09-02 00:31 411368 -c--a-w- c:\windows\system32\deploytk.dll 2009-09-02 00:30 . 2004-12-30 05:32 -------- d-----w- c:\program files\Java 2009-08-29 08:08 . 2004-08-12 14:09 916480 ------w- c:\windows\system32\wininet.dll 2009-08-26 08:00 . 2004-08-12 14:06 247326 -c--a-w- c:\windows\system32\strmdll.dll 2009-08-24 06:04 . 2009-08-24 06:04 472576 -c--a-w- c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe 2009-08-23 21:00 . 2009-08-23 21:00 922112 ------w- c:\windows\system32\imapi2fs.dll 2009-08-23 21:00 . 2009-08-23 21:00 426496 ------w- c:\windows\system32\imapi2.dll 2009-08-05 09:01 . 2004-08-12 14:01 204800 -c--a-w- c:\windows\system32\mswebdvd.dll 2009-08-05 00:44 . 2004-08-12 14:02 2189184 -c----w- c:\windows\system32\ntoskrnl.exe 2009-08-04 14:20 . 2004-08-03 22:59 2066048 ------w- c:\windows\system32\ntkrnlpa.exe 2006-07-23 05:39 . 2006-05-27 18:39 88 -csha-r- c:\windows\SYSTEM32\283962B5F1.sys 2006-07-23 05:40 . 2006-02-23 03:47 4184 -csha-w- c:\windows\SYSTEM32\KGyGaAvL.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\program files\spyware remover ---- 2009-10-20 22:42 . 2009-10-20 22:42 10498 ----a-w- c:\program files\spyware remover\unins000.msg 2009-10-20 22:42 . 2009-09-10 18:54 269648 ----a-w- c:\program files\spyware remover\mbamservice.exe 2009-10-20 22:42 . 2009-09-10 18:54 420176 ----a-w- c:\program files\spyware remover\mbamgui.exe 2009-10-20 22:42 . 2009-09-10 18:54 46416 ----a-w- c:\program files\spyware remover\ssubtmr6.dll 2009-10-20 22:42 . 2009-09-10 18:54 496976 ----a-w- c:\program files\spyware remover\vbalsgrid6.ocx 2009-10-20 22:42 . 2009-09-10 18:53 70992 ----a-w- c:\program files\spyware remover\mbamext.dll 2009-10-20 22:42 . 2009-09-10 18:54 79696 ----a-w- c:\program files\spyware remover\zlib.dll 2009-10-20 22:42 . 2008-10-31 21:54 13097 ----a-w- c:\program files\spyware remover\Languages\ukrainian.lng 2009-10-20 22:42 . 2009-09-09 03:46 12962 ----a-w- c:\program files\spyware remover\Languages\spanish.lng 2009-10-20 22:42 . 2009-09-07 05:51 12265 ----a-w- c:\program files\spyware remover\Languages\swedish.lng 2009-10-20 22:42 . 2009-04-15 09:00 13808 ----a-w- c:\program files\spyware remover\Languages\turkish.lng 2009-10-20 22:42 . 2009-09-06 13:23 12198 ----a-w- c:\program files\spyware remover\Languages\serbian.lng 2009-10-20 22:42 . 2008-07-26 13:58 11599 ----a-w- c:\program files\spyware remover\Languages\slovak.lng 2009-10-20 22:42 . 2008-03-04 03:28 11205 ----a-w- c:\program files\spyware remover\Languages\slovenian.lng 2009-10-20 22:42 . 2008-03-04 23:56 12245 ----a-w- c:\program files\spyware remover\Languages\portugueseBR.lng 2009-10-20 22:42 . 2008-06-15 17:04 12345 ----a-w- c:\program files\spyware remover\Languages\portuguesePT.lng 2009-10-20 22:42 . 2008-03-13 23:09 12672 ----a-w- c:\program files\spyware remover\Languages\romanian.lng 2009-10-20 22:42 . 2008-07-04 04:58 11779 ----a-w- c:\program files\spyware remover\Languages\russian.lng 2009-10-20 22:42 . 2008-09-11 02:29 13314 ----a-w- c:\program files\spyware remover\Languages\macedonian.lng 2009-10-20 22:42 . 2009-06-10 17:39 11593 ----a-w- c:\program files\spyware remover\Languages\norwegian.lng 2009-10-20 22:42 . 2009-01-11 04:56 11623 ----a-w- c:\program files\spyware remover\Languages\polish.lng 2009-10-20 22:42 . 2008-03-03 21:39 12048 ----a-w- c:\program files\spyware remover\Languages\hungarian.lng 2009-10-20 22:42 . 2008-03-05 00:03 13019 ----a-w- c:\program files\spyware remover\Languages\italian.lng 2009-10-20 22:42 . 2009-07-23 23:46 9269 ----a-w- c:\program files\spyware remover\Languages\korean.lng 2009-10-20 22:42 . 2008-12-19 20:30 11457 ----a-w- c:\program files\spyware remover\Languages\latvian.lng 2009-10-20 22:42 . 2009-09-09 03:45 13442 ----a-w- c:\program files\spyware remover\Languages\french.lng 2009-10-20 22:42 . 2009-09-10 18:12 13642 ----a-w- c:\program files\spyware remover\Languages\german.lng 2009-10-20 22:42 . 2008-10-07 19:15 13234 ----a-w- c:\program files\spyware remover\Languages\greek.lng 2009-10-20 22:42 . 2009-08-20 00:38 9278 ----a-w- c:\program files\spyware remover\Languages\hebrew.lng 2009-10-20 22:42 . 2009-09-03 14:22 11314 ----a-w- c:\program files\spyware remover\Languages\english.lng 2009-10-20 22:42 . 2009-07-31 13:20 11213 ----a-w- c:\program files\spyware remover\Languages\estonian.lng 2009-10-20 22:42 . 2008-05-17 14:09 11624 ----a-w- c:\program files\spyware remover\Languages\finnish.lng 2009-10-20 22:42 . 2008-12-27 20:41 11977 ----a-w- c:\program files\spyware remover\Languages\croatian.lng 2009-10-20 22:42 . 2009-09-07 23:42 12199 ----a-w- c:\program files\spyware remover\Languages\czech.lng 2009-10-20 22:42 . 2009-02-18 00:27 11893 ----a-w- c:\program files\spyware remover\Languages\danish.lng 2009-10-20 22:42 . 2008-03-04 23:56 12255 ----a-w- c:\program files\spyware remover\Languages\dutch.lng 2009-10-20 22:42 . 2008-03-05 00:05 12595 ----a-w- c:\program files\spyware remover\Languages\catalan.lng 2009-10-20 22:42 . 2008-08-01 13:03 8045 ----a-w- c:\program files\spyware remover\Languages\chineseSI.lng 2009-10-20 22:42 . 2008-08-04 16:58 8141 ----a-w- c:\program files\spyware remover\Languages\chineseTR.lng 2009-10-20 22:42 . 2008-07-03 14:10 13924 ----a-w- c:\program files\spyware remover\Languages\albanian.lng 2009-10-20 22:42 . 2009-04-10 04:53 10331 ----a-w- c:\program files\spyware remover\Languages\arabic.lng 2009-10-20 22:42 . 2009-08-01 20:14 12636 ----a-w- c:\program files\spyware remover\Languages\bosnian.lng 2009-10-20 22:42 . 2009-09-09 03:46 12610 ----a-w- c:\program files\spyware remover\Languages\bulgarian.lng 2009-10-20 22:42 . 2009-09-10 18:37 16400 ----a-w- c:\program files\spyware remover\changes.rtf 2009-10-20 22:42 . 2009-01-04 23:31 4124 ----a-w- c:\program files\spyware remover\license.txt 2009-10-20 22:42 . 2009-09-10 18:53 163664 ----a-w- c:\program files\spyware remover\mbam.dll 2009-10-20 22:42 . 2009-07-30 19:27 59015 ----a-w- c:\program files\spyware remover\mbam.chm 2009-10-20 22:42 . 2009-10-20 22:42 9495 ----a-w- c:\program files\spyware remover\unins000.dat 2009-10-20 22:42 . 2009-10-20 22:42 699216 ----a-w- c:\program files\spyware remover\unins000.exe ((((((((((((((((((((((((((((( SnapShot@2009-10-27_05.07.27 ))))))))))))))))))))))))))))))))))))))))) . + 2009-10-28 06:49 . 2009-10-28 06:49 16384 c:\windows\Temp\Perflib_Perfdata_c04.dat + 2009-10-28 06:47 . 2009-10-28 06:47 16384 c:\windows\Temp\Perflib_Perfdata_8c4.dat + 2009-10-27 21:07 . 2009-10-27 21:07 16384 c:\windows\Temp\Perflib_Perfdata_574.dat + 2009-10-28 06:47 . 2009-10-28 06:47 16384 c:\windows\Temp\Perflib_Perfdata_524.dat + 2009-10-27 21:03 . 2001-11-09 16:01 24064 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ativcoxx.dll + 2009-10-27 21:03 . 2007-12-05 02:17 17408 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atitvo32.dll + 2009-10-27 21:03 . 2006-02-22 01:05 61440 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiphexx.exe + 2009-10-27 21:03 . 2006-02-22 01:05 36864 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\Atiiprxx.exe + 2009-10-27 21:03 . 2006-02-14 01:29 43008 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiicdxx.msi + 2009-10-27 21:03 . 2007-12-05 02:53 53248 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ATIDDC.DLL + 2009-10-27 21:03 . 2007-12-05 02:55 26112 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\Ati2mdxx.exe + 2009-10-27 21:03 . 2007-12-05 02:16 49152 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2erec.dll + 2009-10-27 21:03 . 2007-12-05 02:55 43520 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2edxx.dll + 2009-10-27 09:30 . 2009-10-28 02:53 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2005-01-09 23:07 . 2009-10-27 05:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2005-01-09 23:07 . 2009-10-27 05:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat + 2005-01-09 23:07 . 2009-10-28 02:53 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat + 2009-10-27 09:30 . 2009-10-28 02:53 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat - 2005-01-09 23:07 . 2009-10-27 05:03 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat - 2004-08-25 19:12 . 2007-12-05 02:17 17408 c:\windows\SYSTEM32\atitvo32.dll + 2004-08-25 19:12 . 2004-08-25 19:12 17408 c:\windows\SYSTEM32\atitvo32.dll + 2004-08-25 19:26 . 2004-08-25 19:26 81920 c:\windows\SYSTEM32\ATIDDC.DLL + 2004-08-25 19:27 . 2004-08-25 19:27 65536 c:\windows\SYSTEM32\Ati2mdxx.exe + 1980-01-01 06:00 . 2004-08-25 19:27 86016 c:\windows\SYSTEM32\ati2evxx.dll + 2004-08-25 19:27 . 2004-08-25 19:27 30720 c:\windows\SYSTEM32\ati2edxx.dll + 2009-10-27 21:03 . 2006-02-22 08:13 6144 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiicdxx.sys + 2009-10-27 21:03 . 2007-12-05 02:55 122880 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\Oemdspif.dll + 2009-10-27 21:03 . 2007-12-05 02:33 887724 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ativva6x.dat + 2009-10-27 21:03 . 2006-02-22 01:05 344064 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiptaxx.exe + 2009-10-27 21:03 . 2006-02-22 01:05 139264 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiprbxx.exe + 2009-10-27 21:03 . 2006-02-22 01:05 114688 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atippaxx.dll + 2009-10-27 21:03 . 2006-02-22 01:05 274432 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atipdsxx.dll + 2009-10-27 21:03 . 2007-12-05 02:56 147456 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atipdlxx.dll + 2009-10-27 21:03 . 2007-12-05 02:14 180224 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiok3x2.dll + 2009-10-27 21:03 . 2007-12-05 02:19 385024 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atikvmag.dll + 2009-10-27 21:03 . 2007-09-29 02:49 307200 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiiiexx.dll + 2009-10-27 21:03 . 2006-02-22 08:14 380928 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiicdxx.dll + 2009-10-27 21:03 . 2007-11-06 14:19 158080 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiicdxx.dat + 2009-10-27 21:03 . 2007-12-05 03:05 368640 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ATIDEMGX.dll + 2009-10-27 21:03 . 2006-02-22 08:13 348160 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\aticds10.dll + 2009-10-27 21:03 . 2004-08-25 19:28 787456 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2mtag.sys + 2009-10-27 21:03 . 2007-12-05 02:53 495616 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2evxx.exe + 2009-10-27 21:03 . 2007-12-05 02:55 122880 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2evxx.dll + 2009-10-27 21:03 . 2007-12-05 03:04 269312 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2dvag.dll + 2009-10-27 21:03 . 2007-12-05 02:11 499712 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati2cqag.dll + 2004-08-25 19:27 . 2004-08-25 19:27 102400 c:\windows\SYSTEM32\Oemdspif.dll + 1980-01-01 06:00 . 2004-08-25 19:15 476928 c:\windows\SYSTEM32\DLLCACHE\ativvaxx.dll + 1980-01-01 06:00 . 2004-08-25 19:29 209408 c:\windows\SYSTEM32\DLLCACHE\ati2dvag.dll + 1980-01-01 06:00 . 2004-08-25 19:10 237568 c:\windows\SYSTEM32\DLLCACHE\ati2cqag.dll + 1980-01-01 06:00 . 2004-08-25 19:15 476928 c:\windows\SYSTEM32\ativvaxx.dll + 2004-08-25 19:27 . 2004-08-25 19:27 126976 c:\windows\SYSTEM32\atipdlxx.dll + 2004-08-25 20:40 . 2004-08-25 20:40 294912 c:\windows\SYSTEM32\atiiiexx.dll + 2004-08-25 19:26 . 2004-08-25 19:26 389120 c:\windows\SYSTEM32\ati2evxx.exe + 1980-01-01 06:00 . 2004-08-25 19:29 209408 c:\windows\SYSTEM32\ati2dvag.dll + 1980-01-01 06:00 . 2004-08-25 19:10 237568 c:\windows\SYSTEM32\ati2cqag.dll + 2009-10-27 21:03 . 2007-12-05 02:33 1640192 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ativvaxx.dll + 2009-10-27 21:03 . 2007-12-05 02:33 3107788 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ativvaxx.dat + 2009-10-27 21:03 . 2007-12-05 02:33 3107788 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ativva5x.dat + 2009-10-27 21:03 . 2006-02-22 01:05 2060288 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atipuixx.dll + 2009-10-27 21:03 . 2007-12-05 02:19 5435392 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atioglxx.dll + 2009-10-27 21:03 . 2007-12-05 02:48 9535488 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atioglx2.dll + 2009-10-27 21:03 . 2006-02-22 01:05 1830912 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\atiadaxx.exe + 2009-10-27 21:03 . 2007-06-27 01:41 2940992 c:\windows\SYSTEM32\ReinstallBackups\0019\DriverFiles\ati3duag.dll + 1980-01-01 06:00 . 2004-08-25 19:25 2239328 c:\windows\SYSTEM32\DLLCACHE\ati3duag.dll + 2004-08-25 19:48 . 2004-08-25 19:48 6508544 c:\windows\SYSTEM32\atioglxx.dll + 1980-01-01 06:00 . 2004-08-25 19:25 2239328 c:\windows\SYSTEM32\ati3duag.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856] "EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-09-03 3342336] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 135168] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-11-16 127035] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328] "hpppta"="c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hpppta.exe" [2001-12-13 98304] "McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [2009-07-09 5134864] "dapileger"="c:\windows\system32\tufamovo.dll" [BU] "P17Helper"="P17.dll" - c:\windows\SYSTEM32\P17.dll [2004-06-10 60928] "AtiPTA"="atiptaxx.exe" - c:\windows\SYSTEM32\atiptaxx.exe [2006-02-22 344064] "piyurabuze"="vugitopi.dll" [BU] c:\documents and settings\Family\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] Outlook Express.lnk - c:\program files\Outlook Express\MSIMN.EXE [2004-8-4 60416] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"= "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Documents and Settings\\Family\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-09-08 5:20 PM 206112] R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\SYSTEM32\dllhost.exe [2004-08-12 9:56 AM 5120] R3 MovRVDrv32;MovRVDrv32;c:\windows\SYSTEM32\DRIVERS\MovRVDrv32.sys [2008-09-08 7:06 PM 3768] R3 SymSnapService;SymSnapService;c:\program files\Norton Ghost\Shared\Drivers\SymSnapService.exe [2007-12-20 5:13 PM 1553896] S2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?] S3 SoundMovieServer;SoundMovieServer;c:\windows\SYSTEM32\snmvtsvc.exe [2008-09-08 7:06 PM 200704] --- Other Services/Drivers In Memory --- *Deregistered* - mbr . Contents of the 'Scheduled Tasks' folder 2009-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34] 2009-10-26 c:\windows\Tasks\Cleanup.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-10-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2350648319-3392060685-3698023044-1006Core.job - c:\documents and settings\Family\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-26 23:50] 2009-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2350648319-3392060685-3698023044-1006UA.job - c:\documents and settings\Family\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-26 23:50] 2009-10-15 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-10-27 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-03-29 16:22] 2009-09-22 c:\windows\Tasks\Uniblue SpyEraser.job - c:\program files\Uniblue\SpyEraser\SpyEraser.exe [2007-08-20 15:00] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html Trusted Zone: internet Trusted Zone: mcafee.com DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://media.grab.com/media/35f4a8/games/files/1147/axhost.cab FF - ProfilePath - c:\documents and settings\Family\Application Data\Mozilla\Firefox\Profiles\amsmajis.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Family\Application Data\Move Networks\plugins\npqmp071505000010.dll FF - plugin: c:\documents and settings\Family\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service . - - - - ORPHANS REMOVED - - - - BHO-{5ba2a3be-fa98-4a65-a865-5bd5d442a27b} - lidegiwe.dll SharedTaskScheduler-{d14a26e6-0ead-4b2f-adb2-8654b61c5292} - c:\windows\system32\tufamovo.dll SSODL-zinenurek-{d14a26e6-0ead-4b2f-adb2-8654b61c5292} - c:\windows\system32\tufamovo.dll ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-28 02:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2350648319-3392060685-3698023044-1006\Software\SecuROM\License information*] "datasecu"=hex:47,ff,15,93,31,f7,8a,6c,38,c0,3c,e0,69,39,e2,6e,8b,c7,29,39,42, 69,09,e3,4e,72,89,4d,ff,e1,9c,47,3f,3b,a4,df,87,96,ec,4f,6d,46,01,9b,7e,df,\ "rkeysecu"=hex:1c,2a,73,ec,79,1a,cd,a2,48,10,fc,1d,fe,c1,b6,ce . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2344) c:\windows\system32\WININET.dll c:\program files\McAfee\SiteAdvisor\saHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\program files\WinZip\wzshlstb.dll c:\program files\WinZip\wzshlex1.dll c:\program files\WinZip\WZCAB3.DLL c:\program files\WinRAR\rarext.dll c:\program files\Norton Ghost\Browser\VProShellExt.dll c:\program files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\FotomatShellExt.dll c:\program files\spyware remover\mbamext.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\combofix\CF22033.exe c:\program files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\CTsvcCDA.EXE c:\program files\Intel\Intel Application Accelerator\iaantmon.exe c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\windows\system32\Rundll32.exe c:\program files\McAfee\MPF\MPFSrv.exe c:\program files\McAfee\MSK\MskSrver.exe c:\program files\Norton Ghost\Agent\VProSvc.exe c:\windows\system32\MsPMSPSv.exe c:\windows\system32\wscntfy.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\msdtc.exe c:\combofix\PEV.cfxxe . ************************************************************************** . Completion time: 2009-10-28 2:53 - machine was rebooted ComboFix-quarantined-files.txt 2009-10-28 06:53 Pre-Run: 117,189,259,264 bytes free Post-Run: 117,156,446,208 bytes free - - End Of File - - 9737B0132BA8E7ED80029C64E237E5EF |
|
|
|
|
10-28-2009, 05:50 AM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,550
OS: XP SP3
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello again, mehlev. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I'm not having any trouble accessing the bleepingcomputer site. Please try submitting the file again. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad (don't forget to copy and paste REGEDIT4): Code:
REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "dapileger"=- "piyurabuze"=- It should look like this:  Double-click on fix.reg and choose Yes to merge/add it to the registry. Please delete the file afterwards. ------------------------------------------------------ Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs): Java 2 Runtime Environment, SE v1.4.2_03 These are all outdated, and security risks by having them installed still. Leave this one as it has the latest definitions: Java(TM) 6 Update 16 Going forward, Java will overwrite existing installs, so removing older versions should not be required after this. When updating in the future, make sure you untick the box next to whatever free program they prompt you to install, unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Ensure your external and/or USB drives are inserted during the scan. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Click Accept, when prompted to download and install the program files and database of malware definitions.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
10-28-2009, 02:50 PM
|
#10 (permalink) |
|
Registered User
Join Date: Jul 2006
Posts: 26
OS: XP
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
It feels normal--I haven't had one popup and the internet is loading faster. I think you solved it. Thanks so much, the slowness was killing me.
-I submitted the file to bleepingcomputer, ran fixreg, uninstalled java 2, ran atf cleaner, and scanned with kaspersky. Here is the scan: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, October 28, 2009 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Wednesday, October 28, 2009 16:15:16 Records in database: 3094989 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ H:\ Scan statistics: Objects scanned: 209987 Threats found: 5 Infected objects found: 7 Suspicious objects found: 0 Scan duration: 04:27:15 File name / Threat / Threats count C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\fenufebo.dll.vir Infected: Trojan.Win32.Monder.cumu 1 C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\piraguyu.dll.vir Infected: Trojan.Win32.Monder.cumv 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP143\A0025995.dll Infected: Trojan.Win32.Monder.cuoh 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP143\A0025998.dll Infected: Trojan.Win32.Monder.cuog 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP145\A0026146.dll Infected: Trojan.Win32.Monder.cumu 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP145\A0026149.dll Infected: Trojan.Win32.Monder.cuok 1 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP145\A0026154.dll Infected: Trojan.Win32.Monder.cumv 1 Selected area has been scanned. |
|
|
|
|
10-28-2009, 03:38 PM
|
#11 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,550
OS: XP SP3
|
Re: Help needed: slower internet access with popups, Malwarebytes won't open
Hello again, mehlev. Thanks for submitting the file.
------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable VirusScan before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /uninstall This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
