Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

Possible Malware? Firefox won't open, slow computer

This is a discussion on Possible Malware? Firefox won't open, slow computer within the Resolved HJT Threads forums, part of the Tech Support Forum category. Hello, My boyfriend's computer has been getting REALLY slow. It seems that the problems started when he began visiting MySpace


 
 
Thread Tools Search this Thread
Old 10-22-2008, 05:28 PM   #1
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Hello,

My boyfriend's computer has been getting REALLY slow. It seems that the problems started when he began visiting MySpace and some of the profiles. Last night, I tried opening FireFox from the quick launch menu and i got an error (attached screenshot).

I ran HJT and the panda active scan.

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:52 PM, on 10/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\fxssvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\WINNT\System32\msiexec.exe
\?\C:\WINNT\system32\WBEM\WMIADAP.EXE
C:\USBStorage\USBDetector.exe
C:\Program Files\CRW\shwicon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
\?\C:\WINNT\system32\WBEM\WMIADAP.EXE
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mikey-temporary\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_CRW Series Driver v1.17r023] "C:\Program Files\CRW\shwicon.exe" -t"The Company\CRW Series Driver v1.17r023"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Boingo Wireless Software] "C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe" -Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [application] C:\Program Files\ACSPMonitor\ASMonitor.exe hs
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - ?p=ZCxdm869YYUS
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - https://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - https://www.update.microsoft.com/wind...?1203188016036
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boingo Wireless Engine - Unknown owner - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
O23 - Service: Boingo WMonitor - Boingo Wireless, Inc. - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5156 bytes
Attached Thumbnails
Click image for larger version

Name:	firefox.bmp
Views:	44
Size:	721.6 KB
ID:	35204  
Attached Files
File Type: txt ActiveScan.txt (53.1 KB, 19 views)
khorsed1018 is offline  
Sponsored Links
Advertisement
 
Old 10-25-2008, 03:01 PM   #2
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

If you're not receiving help elsewhere and still require assistance for this issue, please do the following:

------------------------------------------------------

Please explain why this computer has no antivirus program installed and running. This is an open invitation for infection.

It can take as little as eight seconds to infect an unprotected computer.

Please keep this computer offline except when downloading tools and posting in the forum until we get one installed.

------------------------------------------------------

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Download RSIT by random/random and Save it to your Desktop.

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

1. Double-click gmer.exe to run it.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst.


If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click Yes
  • Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK
  • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your Desktop.
  • You will be attaching the gmer.txt log to your next reply.

If you do not receive notice about possible rootkit activity, remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked
  • Click the Scan button and let the program do its work. GMER will produce a log.
  • Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your Desktop.
  • You will be attaching the gmer.txt log to your next reply.


2. Double-click RSIT.exe to start the tool and click Continue at the disclaimer.
  • When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
  • Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt in your next reply.
  • You will be attaching the info.txt log to your next reply.
  • It can be found at C:\rsit\info.txt
------------------------------------------------------

Please post log.txt in your next reply.

Please attach gmer.txt and info.txt to your next reply.

To attach a file to a post, simply click the Manage Attachments button under Additional Options > Attach Files on the post composition page, and use the Browse button in the Upload File from your Computer box: to navigate to the file and click Upload

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 10-25-2008, 05:52 PM   #3
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Hi there, I'm away from this computer until Monday. The reason it doesn't have antivirus is because I tried installing Zone Alarm and AVG, and neither would install. It said the system doesn't have the minimum requirements. Is there something else I can install?

Thanks,
Kristin
khorsed1018 is offline  
Sponsored Links
Advertisement
 
Old 10-25-2008, 06:23 PM   #4
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



I'll have to see your logs first.
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 10-26-2008, 09:16 PM   #5
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Hello, just got back from the beach, what a beautiful weekend up here in Washington! Here are the logs. Sorry for the delay on getting these to you. Thanks for your help! --Kristin

-----------

Logfile of random's system information tool 1.04 (written by random/random)
Run by mikey-temporary at 2008-10-26 21:10:10
Microsoft Windows XP Professional Service Pack 2
System drive C: has 8 GB (46%) free of 17 GB
Total RAM: 383 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:10:24 PM, on 10/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\fxssvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\wscntfy.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\CRW\shwicon.exe
C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\notepad.exe
C:\Documents and Settings\mikey-temporary\Desktop\RSIT.exe
C:\Documents and Settings\mikey-temporary\Desktop\mikey-temporary.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_CRW Series Driver v1.17r023] "C:\Program Files\CRW\shwicon.exe" -t"The Company\CRW Series Driver v1.17r023"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Boingo Wireless Software] "C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe" -Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [application] C:\Program Files\ACSPMonitor\ASMonitor.exe hs
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - ?p=ZCxdm869YYUS
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - https://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - https://www.update.microsoft.com/wind...?1203188016036
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boingo Wireless Engine - Unknown owner - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
O23 - Service: Boingo WMonitor - Boingo Wireless, Inc. - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5038 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-05-08 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-16 652784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=mobsync.exe /logon []
"SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2000-02-22 86016]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2000-02-22 217088]
"USBDetector"=C:\USBStorage\USBDetector.exe [2002-11-25 53248]
"ShowIcon_The Company_CRW Series Driver v1.17r023"=C:\Program Files\CRW\shwicon.exe [2003-01-27 73728]
"NWEReboot"= []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-05-08 185896]
"Boingo Wireless Software"=C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe [2006-09-18 1144400]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"application"=C:\Program Files\ACSPMonitor\ASMonitor.exe hs []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-08-04 1667584]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-06-08 68856]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
C:\WINNT\system32\wzcdlg.dll [2004-08-04 378368]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NBF]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nbf.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProtectedStorage]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sglfb.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\tga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - C:\WINNT\NOTEPAD.EXE "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 3 months======

2008-10-26 21:04:36 ----A---- C:\WINNT\gmer.ini
2008-10-26 21:04:33 ----A---- C:\WINNT\gmer_uninstall.cmd
2008-10-26 21:04:33 ----A---- C:\WINNT\gmer.exe
2008-10-26 21:04:33 ----A---- C:\WINNT\gmer.dll
2008-10-26 21:02:58 ----D---- C:\rsit
2008-10-22 17:14:42 ----D---- C:\WINNT\Prefetch
2008-10-22 16:41:21 ----A---- C:\WINNT\setuplog.txt
2008-10-22 16:36:24 ----D---- C:\WINNT\peernet
2008-10-22 16:36:19 ----D---- C:\WINNT\provisioning
2008-10-22 16:03:08 ----HDC---- C:\WINNT\$NtServicePackUninstall$
2008-10-22 16:02:58 ----D---- C:\WINNT\EHome
2008-10-22 15:46:56 ----N---- C:\WINNT\system32\spnpinst.exe
2008-10-22 15:24:38 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-10-22 15:19:26 ----D---- C:\Program Files\SpywareBlaster
2008-10-22 10:59:43 ----D---- C:\Program Files\Panda Security
2008-09-13 19:18:36 ----A---- C:\WINNT\PrimoPDF Uninstall Log.txt
2008-09-13 16:50:32 ----A---- C:\WINNT\system32\Primomonnt.dll
2008-09-13 16:50:07 ----D---- C:\WINNT\PrimoPDF4
2008-09-13 16:25:31 ----A---- C:\WINNT\PrimoPDF Setup Log.txt

======List of files/folders modified in the last 3 months======

2008-10-26 21:04:36 ----AD---- C:\WINNT
2008-10-26 21:04:33 ----AD---- C:\WINNT\system32\drivers
2008-10-26 09:26:28 ----AD---- C:\WINNT\security
2008-10-25 21:23:10 ----SHD---- C:\WINNT\Installer
2008-10-25 03:28:51 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-22 17:24:35 ----AD---- C:\WINNT\system32
2008-10-22 17:24:35 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2008-10-22 17:24:32 ----AD---- C:\WINNT\Temp
2008-10-22 17:23:31 ----SD---- C:\Documents and Settings\mikey-temporary\Application Data\Microsoft
2008-10-22 17:19:03 ----AD---- C:\WINNT\Debug
2008-10-22 17:18:27 ----A---- C:\WINNT\OEWABLog.txt
2008-10-22 17:16:08 ----A---- C:\WINNT\ModemLog_SENS LT56PTW Modem (SFM-1400LW).txt
2008-10-22 17:15:35 ----D---- C:\WINNT\system32\CatRoot2
2008-10-22 17:15:17 ----D---- C:\WINNT\system32\NtmsData
2008-10-22 17:15:16 ----AD---- C:\WINNT\system32\wbem
2008-10-22 17:15:13 ----HD---- C:\WINNT\inf
2008-10-22 17:13:50 ----SHD---- C:\System Volume Information
2008-10-22 17:13:41 ----D---- C:\Program Files\Messenger
2008-10-22 17:13:40 ----D---- C:\Program Files\Internet Explorer
2008-10-22 17:13:39 ----AD---- C:\WINNT\AppPatch
2008-10-22 17:13:32 ----RSD---- C:\WINNT\Fonts
2008-10-22 17:11:19 ----A---- C:\WINNT\SchedLgU.Txt
2008-10-22 16:52:13 ----A---- C:\WINNT\imsins.BAK
2008-10-22 16:51:10 ----AD---- C:\WINNT\system32\CatRoot
2008-10-22 16:41:25 ----RASH---- C:\boot.ini
2008-10-22 16:38:26 ----D---- C:\WINNT\WinSxS
2008-10-22 16:37:43 ----AD---- C:\WINNT\system32\Setup
2008-10-22 16:37:41 ----AD---- C:\WINNT\Help
2008-10-22 16:37:37 ----D---- C:\WINNT\system32\inetsrv
2008-10-22 16:37:35 ----D---- C:\WINNT\ime
2008-10-22 16:36:31 ----D---- C:\WINNT\system32\oobe
2008-10-22 16:36:31 ----D---- C:\Program Files\Windows Media Player
2008-10-22 16:36:28 ----D---- C:\Program Files\Movie Maker
2008-10-22 16:36:19 ----AD---- C:\WINNT\Media
2008-10-22 16:25:37 ----D---- C:\WINNT\system32\Restore
2008-10-22 16:25:35 ----AD---- C:\WINNT\system32\npp
2008-10-22 16:25:34 ----D---- C:\WINNT\mui
2008-10-22 16:25:33 ----AD---- C:\WINNT\msagent
2008-10-22 16:25:15 ----D---- C:\WINNT\srchasst
2008-10-22 16:25:01 ----D---- C:\Program Files\NetMeeting
2008-10-22 16:24:42 ----D---- C:\WINNT\system32\Com
2008-10-22 16:24:20 ----D---- C:\Program Files\Windows NT
2008-10-22 16:24:18 ----D---- C:\Program Files\Outlook Express
2008-10-22 16:24:02 ----D---- C:\Program Files\Common Files\System
2008-10-22 16:24:00 ----RASHDC---- C:\WINNT\system32\dllcache
2008-10-22 16:22:50 ----D---- C:\WINNT\system32\usmt
2008-10-22 16:22:36 ----AD---- C:\WINNT\system
2008-10-22 16:16:37 ----RD---- C:\WINNT\Web
2008-10-22 16:15:34 ----RASH---- C:\NTDETECT.COM
2008-10-22 15:19:26 ----RAD---- C:\Program Files
2008-10-22 15:14:36 ----AD---- C:\Program Files\Common Files
2008-10-22 15:14:28 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-22 10:59:13 ----SD---- C:\WINNT\Downloaded Program Files
2008-10-08 23:07:52 ----D---- C:\Program Files\Mozilla Firefox
2008-10-06 00:16:07 ----D---- C:\WINNT\system32\FxsTmp
2008-10-05 17:23:55 ----AD---- C:\Program Files\Common Files\Microsoft Shared
2008-10-05 17:23:27 ----D---- C:\Program Files\Ahead
2008-10-05 17:22:20 ----HD---- C:\Program Files\InstallShield Installation Information
2008-10-05 17:21:45 ----D---- C:\Program Files\MovieStar
2008-10-05 17:18:57 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-10-05 17:13:28 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-13 17:33:46 ----RSD---- C:\WINNT\assembly
2008-09-13 17:33:46 ----D---- C:\WINNT\Microsoft.NET
2008-09-13 16:41:47 ----D---- C:\WINNT\Registration
2008-09-13 16:32:40 ----D---- C:\WINNT\PCHealth
2008-08-30 13:45:07 ----D---- C:\Documents and Settings\mikey-temporary\Application Data\U3
2008-08-02 00:27:50 ----D---- C:\Program Files\Google

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-12-09 58000]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-12-09 23420]
R1 NEOFLTR_530_10741;Juniper Networks TDI Filter Driver (NEOFLTR_530_10741); \??\C:\WINNT\System32\Drivers\NEOFLTR_530_10741.SYS []
R1 P3;Intel PentiumIII Processor Driver; C:\WINNT\System32\DRIVERS\p3.sys [2004-08-03 42496]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINNT\System32\drivers\ws2ifsl.sys [2003-03-31 12032]
R3 atimpab;atimpab; C:\WINNT\System32\DRIVERS\atimpab.sys [2001-08-17 289664]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINNT\System32\DRIVERS\CmBatt.sys [2004-08-03 14080]
R3 LSWPCv4;Wireless-B Notebook Adapter Driver; C:\WINNT\System32\DRIVERS\rtl8180.sys [2003-10-01 184832]
R3 ltmodem5;LT Modem Driver; C:\WINNT\System32\DRIVERS\ltmdmnt.sys [2004-08-03 606684]
R3 Maestro;ESS Maestro2E Audio Driver (WDM); C:\WINNT\system32\drivers\essm2e.sys [2002-08-28 137088]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINNT\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINNT\system32\drivers\msmpu401.sys [2001-08-17 2944]
R3 PCASp50;PCASp50 NDIS Protocol Driver; C:\WINNT\System32\Drivers\PCASp50.sys [2005-11-21 20096]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINNT\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S1 tga;tga; C:\WINNT\system32\drivers\tga.sys []
S2 Ca536av;FashionCam Video Camera Device; C:\WINNT\System32\Drivers\Ca536av.sys [2003-09-05 514859]
S3 atirage3;atirage3; C:\WINNT\System32\DRIVERS\atimpab.sys [2001-08-17 289664]
S3 BWNDIS5;BWNDIS5 NDIS Protocol Driver; \??\C:\WINNT\System32\BWNDIS5.SYS []
S3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver; C:\WINNT\System32\DRIVERS\cben5.sys [2001-08-17 46108]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 DzlUsb;Dazzle DVC USB Device; C:\WINNT\System32\DRIVERS\DzlUsb.sys [2001-10-11 61469]
S3 gmer;gmer; C:\WINNT\System32\DRIVERS\gmer.sys [2008-10-26 85969]
S3 HidUsb;Microsoft HID Class Driver; C:\WINNT\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 HPUATA;HP CD Writer Plus Controller Driver; C:\WINNT\System32\DRIVERS\HPUATA.sys [2001-09-24 75776]
S3 mouhid;Mouse HID Driver; C:\WINNT\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MPE;BDA MPE Filter; C:\WINNT\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\System32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 SynTP;Synaptics TouchPad Driver; C:\WINNT\System32\DRIVERS\SynTP.sys [2000-02-22 192976]
S3 USBCamera;FashionCam Digital Still Camera Device; C:\WINNT\System32\Drivers\Bulk536.sys [2003-05-14 11048]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINNT\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 aic116x;aic116x; C:\WINNT\system32\drivers\aic116x.sys []
S4 ami0nt;ami0nt; C:\WINNT\system32\drivers\ami0nt.sys []
S4 BusLogic;BusLogic; C:\WINNT\system32\drivers\BusLogic.sys []
S4 cpqarry2;cpqarry2; C:\WINNT\system32\drivers\cpqarry2.sys []
S4 cpqfcalm;cpqfcalm; C:\WINNT\system32\drivers\cpqfcalm.sys []
S4 cpqfws2e;cpqfws2e; C:\WINNT\system32\drivers\cpqfws2e.sys []
S4 deckzpsx;deckzpsx; C:\WINNT\system32\drivers\deckzpsx.sys []
S4 EFS;EFS; C:\WINNT\system32\drivers\EFS.sys []
S4 Fd16_700;Fd16_700; C:\WINNT\system32\drivers\Fd16_700.sys []
S4 fireport;fireport; C:\WINNT\system32\drivers\fireport.sys []
S4 flashpnt;flashpnt; C:\WINNT\system32\drivers\flashpnt.sys []
S4 ipsraidn;ipsraidn; C:\WINNT\system32\drivers\ipsraidn.sys []
S4 lp6nds35;lp6nds35; C:\WINNT\system32\drivers\lp6nds35.sys []
S4 Ncrc710;Ncrc710; C:\WINNT\system32\drivers\Ncrc710.sys []
S4 Parallel;Parallel class driver; C:\WINNT\System32\DRIVERS\parallel.sys []
S4 ql2100;ql2100; C:\WINNT\system32\drivers\ql2100.sys []
S4 ultra66;ultra66; C:\WINNT\system32\drivers\ultra66.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINNT\System32\atievxx.exe [2001-08-17 37376]
R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-16 168432]
R3 Boingo Wireless Engine;Boingo Wireless Engine; C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe [2006-09-06 853576]
R3 Boingo WMonitor;Boingo WMonitor; C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe [2006-09-06 79432]
S2 Fax;Fax; C:\WINNT\system32\fxssvc.exe [2004-08-04 267776]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-02-09 68096]
S3 aspnet_state;ASP.NET State Service; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 UtilMan;Utility Manager; C:\WINNT\System32\UtilMan.exe [2004-08-04 50176]

-----------------EOF-----------------
Attached Files
File Type: txt info.txt (4.4 KB, 20 views)
File Type: txt GMER.txt (570 Bytes, 16 views)
khorsed1018 is offline  
Old 10-27-2008, 04:14 AM   #6
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello Kristin.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.


------------------------------------------------------

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with our tools.
  • Double-click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

Please close HijackThis now.

------------------------------------------------------

Please post the following in your next reply:

ComboFix.txt
new HijackThis log


If you have any questions along the way...STOP and ask them before proceeding.
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 10-27-2008, 11:20 AM   #7
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Hello, thanks for your reply! Here are the logs. I also attached some screenshots for you to look at. When ComboFix was preparing the log, I got a popup message about the Boingo wireless engine being unable to start. I opened it and manually connected to the wireless connection, as my wireless connection kept saying it was acquiring IP address. Once I did that, ComboFix finally finished.

Also, when it finished and I got the combofix log, and I got another popup about a someone attempting to change my Google search. I attached a screenshot of the Google message also.

Also, when I first started ComboFix, I got a message about rootkit items and that the computer needed to restart. I clicked ok and let it reboot, and ComboFix went on as normal.

Thanks,
Kristin

--------------------------------------

ComboFix 08-10-26.01 - mikey-temporary 2008-10-27 10:53:12.1 - NTFSx86
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\mikey-temporary\Application Data\SpamBlockerUtility_Icons
C:\Documents and Settings\mikey-temporary\Application Data\SpamBlockerUtility_Icons\Software_Online_8.ico
C:\Documents and Settings\mikey-temporary\Application Data\SSTEM~1
C:\Program Files\QdrDrive
C:\Program Files\QdrPack
C:\Program Files\QdrPack\QdrPack13.exe
C:\WINNT\17PHolmes72.exe
C:\WINNT\mrofinu72.exe
C:\WINNT\mrofinu72.exe.tmp
C:\WINNT\scurit~1
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_IAS


((((((((((((((((((((((((( Files Created from 2008-09-27 to 2008-10-27 )))))))))))))))))))))))))))))))
.

2008-10-26 21:04 . 2008-10-26 21:08 250 --a------ C:\WINNT\gmer.ini
2008-10-26 21:02 . 2008-10-26 21:03 <DIR> d-------- C:\rsit
2008-10-22 16:36 . 2008-10-22 16:36 <DIR> d-------- C:\WINNT\provisioning
2008-10-22 16:36 . 2008-10-22 16:36 <DIR> d-------- C:\WINNT\peernet
2008-10-22 16:02 . 2008-10-22 16:02 <DIR> d-------- C:\WINNT\EHome
2008-10-22 15:46 . 2002-04-15 21:11 67,866 --------- C:\WINNT\system32\drivers\netwlan5.img
2008-10-22 15:46 . 2004-08-04 00:56 11,776 --------- C:\WINNT\system32\spnpinst.exe
2008-10-22 15:46 . 2004-08-02 14:20 7,208 --------- C:\WINNT\system32\secupd.sig
2008-10-22 15:46 . 2004-08-02 14:20 4,569 --------- C:\WINNT\system32\secupd.dat
2008-10-22 15:19 . 2008-10-22 15:19 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-10-22 10:59 . 2008-10-22 10:59 <DIR> d-------- C:\Program Files\Panda Security
2008-10-22 10:59 . 2008-06-19 17:24 28,544 --a------ C:\WINNT\system32\drivers\pavboot.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-27 12:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-22 22:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-06 00:23 --------- d-----w C:\Program Files\Ahead
2008-10-06 00:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-06 00:21 --------- d-----w C:\Program Files\MovieStar
2008-10-06 00:18 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-06 00:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-14 02:21 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Juniper Networks
2008-08-30 20:45 --------- d-----w C:\Documents and Settings\mikey-temporary\Application Data\U3
2004-12-09 17:32 271 --sh--w C:\Program Files\desktop.ini
2004-12-09 17:32 21,952 -c-h--w C:\Program Files\folder.htt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-08 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2000-02-22 86016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2000-02-22 217088]
"USBDetector"="C:\USBStorage\USBDetector.exe" [2002-11-25 53248]
"ShowIcon_The Company_CRW Series Driver v1.17r023"="C:\Program Files\CRW\shwicon.exe" [2003-01-27 73728]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-08 185896]
"Boingo Wireless Software"="C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe" [2006-09-18 1144400]
"Synchronization Manager"="mobsync.exe" [2004-08-04 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-08-06 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"VIDC.NSVI"= NSVIDEO.DLL
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 pavboot;pavboot;C:\WINNT\system32\drivers\pavboot.sys [2008-06-19 28544]
R1 NEOFLTR_530_10741;Juniper Networks TDI Filter Driver (NEOFLTR_530_10741);C:\WINNT\System32\Drivers\NEOFLTR_530_10741.SYS [2006-05-25 57063]
R3 Boingo Wireless Engine;Boingo Wireless Engine;C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe [2006-09-06 853576]
R3 Boingo WMonitor;Boingo WMonitor;C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe [2006-09-06 79432]
R3 LSWPCv4;Wireless-B Notebook Adapter Driver;C:\WINNT\system32\DRIVERS\rtl8180.sys [2003-10-01 184832]
R3 Maestro;ESS Maestro2E Audio Driver (WDM);C:\WINNT\system32\drivers\essm2e.sys [2002-08-28 137088]
R3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINNT\system32\Drivers\PCASp50.sys [2005-11-21 20096]
S2 Ca536av;FashionCam Video Camera Device;C:\WINNT\system32\Drivers\Ca536av.sys [2003-09-05 514859]
S3 BWNDIS5;BWNDIS5 NDIS Protocol Driver;C:\WINNT\System32\BWNDIS5.SYS [ ]
S3 CBEN5;Xircom CardBus Ethernet 10/100 Adapter family Driver;C:\WINNT\system32\DRIVERS\cben5.sys [2001-08-17 46108]
S3 DzlUsb;Dazzle DVC USB Device;C:\WINNT\system32\DRIVERS\DzlUsb.sys [2001-10-11 61469]
S3 HPUATA;HP CD Writer Plus Controller Driver;C:\WINNT\system32\DRIVERS\HPUATA.sys [2001-09-24 75776]
S3 USBCamera;FashionCam Digital Still Camera Device;C:\WINNT\system32\Drivers\Bulk536.sys [2003-05-14 11048]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)
HKLM-Explorer_Run-application - C:\Program Files\ACSPMonitor\ASMonitor.exe
SafeBoot-sglfb.sys
SafeBoot-tga.sys


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\mikey-temporary\Application Data\Mozilla\Firefox\Profiles\anpdnuuk.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2008-10-27 11:03:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINNT\system32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
.
**************************************************************************
.
Completion time: 2008-10-27 11:14:21 - machine was rebooted [mikey-temporary]
ComboFix-quarantined-files.txt 2008-10-27 18:14:15

Pre-Run: 8,266,330,112 bytes free
Post-Run: 9,414,557,696 bytes free

130 --- E O F --- 2008-02-18 02:56:06



==============================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:24 AM, on 10/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wscntfy.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\CRW\shwicon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mikey-temporary\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_CRW Series Driver v1.17r023] "C:\Program Files\CRW\shwicon.exe" -t"The Company\CRW Series Driver v1.17r023"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Boingo Wireless Software] "C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe" -Minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - ?p=ZCxdm869YYUS
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - https://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - https://www.update.microsoft.com/wind...?1203188016036
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boingo Wireless Engine - Unknown owner - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
O23 - Service: Boingo WMonitor - Boingo Wireless, Inc. - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 5213 bytes
Attached Thumbnails
Click image for larger version

Name:	printscreen_boingofailed.bmp
Views:	54
Size:	1.06 MB
ID:	35441   Click image for larger version

Name:	printscreen_google.bmp
Views:	45
Size:	576.1 KB
ID:	35442   Click image for larger version

Name:	printscreen_rootkitmessage.bmp
Views:	44
Size:	780.1 KB
ID:	35443  

khorsed1018 is offline  
Old 10-27-2008, 12:03 PM   #8
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Kristin. Please tell us how your system is behaving. Also, please respond to your other thread.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

We need to install Java on your machine. We need it in order to run an online can with Kaspersky.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 10 and Save it to your Desktop.
  • Scroll down to where it says Java Runtime Environment (JRE) 6 Update 10 The Java SE Runtime Environment (JRE) allows end-users to run Java applications.
  • Click the Download button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: I agree to the Java SE Runtime Environment 6 License Agreement.
  • Click Continue
  • Click on the link to download Windows Offline Installation and Save the file to your Desktop.
  • Close any programs you may have running - especially your web browser.
  • Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version.
  • After the install is complete, go back to your Control Panel and click the Java icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button.
    • There are two options in the window to clear the cache - Leave BOTH Checked
      • Applications and Applets
      • Trace and Log Files
    • Click OK on Delete Temporary Files Window.
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE
    • Click OK to leave the Temporary Files Window.
    • Click OK to leave the Java Control Panel.
    • Delete jre-6u10-windows-i586-p.exe from your desktop.
------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.
  • Click Run at any Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

Please close HijackThis now.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
new HijackThis log
report on system behavior
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 10-28-2008, 04:03 PM   #9
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Hello,

System Report - seems to run a bit faster, however, the Windows xp welcome music that plays when it typically loads the desktop, loads while it's loading my personal settings...it has done this for a while. I haven't really noticed anything else, but my boyfriend said that when he was on myspace.com, an error came up and kicked him off the site several times. He doesn't remember what the error said, but it asked him if he wanted to report it to Microsoft.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:00:39 PM, on 10/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wscntfy.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\CRW\shwicon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\notepad.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\mikey-temporary\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_CRW Series Driver v1.17r023] "C:\Program Files\CRW\shwicon.exe" -t"The Company\CRW Series Driver v1.17r023"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Boingo Wireless Software] "C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe" -Minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - ?p=ZCxdm869YYUS
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - https://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - https://www.update.microsoft.com/wind...?1203188016036
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Boingo Wireless Engine - Unknown owner - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
O23 - Service: Boingo WMonitor - Boingo Wireless, Inc. - C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 5830 bytes



KASPERSKY

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"https://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd">

<html>
<head>
<title>KASPERSKY ONLINE SCANNER 7 REPORT</title>
<meta http-equiv='Content-Type' content='text/html; charset=utf-8'>
<style type='text/css'>
.pagetitle { font-size:20px; color:#FFFFFF; font-family: Arial, Geneva, sans-serif; }
.text { font-size:11px; font-family: Arial, Geneva, sans-serif; }
TD { font-size:11px; font-family: Arial, Geneva, sans-serif; }
</style>

</head>

<body>
<table width='100%' border='0'>
<tr align='center' bgcolor='#005447'>
<td colspan='2' height='30px' class='pagetitle'>
<b>KASPERSKY ONLINE SCANNER 7 REPORT</b>
</td>
</tr>
<tr>
<td colspan='2' height='70px'>
Tuesday, October 28, 2008<br>
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)<br>
Kaspersky Online Scanner 7 version: 7.0.25.0<br>
Program database last update: Tuesday, October 28, 2008 04:58:16<br>
Records in database: 1352855<br>
</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
</table>
<table width='100%' border='0'>
<tr bgcolor='#EFEBDE'>
<td colspan='2' height='20px'><b>Scan settings</b></td>
</tr>
<tr>
<td height='15px' width='250px'>Scan using the following database</td>
<td>extended</td>
</tr>
<tr>
<td height='15px'>Scan archives</td>
<td>yes</td>
</tr>
<tr>
<td height='15px'>Scan mail databases</td>
<td>yes</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
<tr bgcolor='#EFEBDE'>
<td height='20px'><b>Scan area</b></td>
<td>My Computer</td>
</tr>
<tr>
<td colspan='2' height='20px'>
A:\<br>
C:\<br>
D:\
</td>
</tr>
<tr>
<td colspan='2' height='10px'>
</td>
</tr>
<tr bgcolor='#EFEBDE'>
<td colspan='2' height='20px'><b>Scan statistics</b></td>
</tr>
<tr>
<td height='15px'>Files scanned</td>
<td>36372</td>
</tr>
<tr>
<td height='15px'>Threat name</td>
<td>6</td>
</tr>
<tr>
<td height='15px'>Infected objects</td>
<td>21</td>
</tr>
<tr>
<td height='15px'>Suspicious objects</td>
<td>0</td>
</tr>
<tr>
<td height='15px'>Duration of the scan</td>
<td>01:51:29</td>
</tr>
</table>
<br>
<table width='100%%' border="0">

<tr bgcolor='#EFEBDE'><td height='20px'><b>File name</b></td>
<td width='200px'><b>Threat name</b></td>
<td width='100px'><b>Threats count</b></td>
</tr>
<tr><td height='20px'>C:\Qoobox\Quarantine\C\Program Files\QdrPack\QdrPack13.exe.vir</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ahs</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Qoobox\Quarantine\C\WINNT\17PHolmes72.exe.vir</td><td>Infected: Trojan-Downloader.Win32.Homles.e</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Qoobox\Quarantine\C\WINNT\mrofinu72.exe.tmp.vir</td><td>Infected: Trojan-Downloader.Win32.Homles.e</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\Qoobox\Quarantine\C\WINNT\mrofinu72.exe.vir</td><td>Infected: Trojan-Downloader.Win32.Homles.e</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L3DFD.tmp</td><td>Infected: not-a-virus:AdWare.Win32.AdBand.m</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L3DFD.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ajr</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L3DFD.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ahs</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L5BDB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.AdBand.m</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L5BDB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ajr</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L5BDB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ahs</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L7C93.tmp</td><td>Infected: Trojan.Win32.Scapur.k</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L8863.tmp</td><td>Infected: Trojan.Win32.Scapur.k</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\L8AD.tmp</td><td>Infected: Trojan-Downloader.Win32.Small.imu</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LB687.tmp</td><td>Infected: Trojan.Win32.Scapur.k</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LBF35.tmp</td><td>Infected: Trojan.Win32.Scapur.k</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCC5B.tmp</td><td>Infected: not-a-virus:AdWare.Win32.AdBand.m</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCC5B.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ajr</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCC5B.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ahs</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCEEB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.AdBand.m</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCEEB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ajr</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td height='20px'>C:\WINNT\system32\LCEEB.tmp</td><td>Infected: not-a-virus:AdWare.Win32.Agent.ahs</td><td>1</td><td></tr>
<tr><td colspan='3' height='1' bgcolor='#EFEBDE'></td></tr>
<tr><td colspan='3' height='20px'><b>
The selected area was scanned.</td></tr></table>
</body>
</html>
khorsed1018 is offline  
Old 10-28-2008, 04:05 PM   #10
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



Ooops, I'm sorry, I just realized that I accidentally saved the kaspersky log as a html file. Sorry! If you need me to re-run it, please let me know.

Thanks,
Kristin
khorsed1018 is offline  
Old 10-28-2008, 04:29 PM   #11
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Hello again, Kristin.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\WINNT\system32\L3DFD.tmp"
"C:\WINNT\system32\L5BDB.tmp"
"C:\WINNT\system32\L7C93.tmp"
"C:\WINNT\system32\L8863.tmp"
"C:\WINNT\system32\L8AD.tmp"
"C:\WINNT\system32\LB687.tmp"
"C:\WINNT\system32\LBF35.tmp"
"C:\WINNT\system32\LCC5B.tmp"
"C:\WINNT\system32\LCEEB.tmp"

) do (
del /a/f %%g >nul 2>and1
if exist %%g echo.%%g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0
Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Tell me what it says in your next reply. Press any key to continue.

------------------------------------------------------

Quote:
It said the system doesn't have the minimum requirements. Is there something else I can install?
Even though you have a small hard drive, AVG should install. I don't know of anything smaller, but you can try avast! or Avira.

Do you still have the installer for AVG? Try installing it again. Let me know.

Quote:
however, the Windows xp welcome music that plays when it typically loads the desktop, loads while it's loading my personal settings...it has done this for a while. I haven't really noticed anything else, but my boyfriend said that when he was on myspace.com, an error came up and kicked him off the site several times. He doesn't remember what the error said, but it asked him if he wanted to report it to Microsoft.
I've never heard of that before. If it still does it when we are done, you can seek expert help in our XP forum. As far as the error messages, unless you give me the exact message, I can't really do anything. Again, if it still happens when we are done, folks in the XP forum know what those error messages mean.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

Please close HijackThis now.

------------------------------------------------------
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
Old 10-28-2008, 08:21 PM   #12
Registered Member
 
Join Date: Mar 2008
Posts: 31
OS: XP



a. fix.bat - it says Deleted Successfully! Press any key to continue......
b. I was able to install AVG antivirus and it's active now.
c. I'll post to the xp forum about the logon process taking so long.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:18 PM, on 10/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\atievxx.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wscntfy.exe
C:\USBStorage\USBDetector.exe
C:\Program Files\CRW\shwicon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\WMonitor.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWEngine.exe
C:\Program Files\Boingo\Boingo Wireless Software\Boingo.exe
C:\Program Files\Boingo\Boingo Wireless Software\WENGINE2\BWExtUserMode.exe
C:\WINNT\explorer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\notepad.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Documents and Settings\mikey-temporary\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

https://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer -

{3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program

Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [USBDetector] C:\USBStorage\USBDetector.exe
O4 - HKLM\..\Run: [ShowIcon_The Company_CRW Series Driver v1.17r023] "C:\Program

Files\CRW\shwicon.exe" -t"The Company\CRW Series Driver v1.17r023"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader

8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"

-osboot
O4 - HKLM\..\Run: [Boingo Wireless Software] "C:\Program Files\Boingo\Boingo Wireless

Software\Boingo.exe" -Minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program

Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet

Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User

'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet

Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet

Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet

Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - ?p=ZCxdm869YYUS
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -

https://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

https://www.update.microsoft.com/wind...b_site.cab?120

3188016036
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program

Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe

Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. -

C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. -

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boingo Wireless Engine - Unknown owner - C:\Program Files\Boingo\Boingo

Wireless Software\WENGINE2\BWEngine.exe
O23 - Service: Boingo WMonitor - Boingo Wireless, Inc. - C:\Program Files\Boingo\Boingo

Wireless Software\WENGINE2\WMonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program

Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. -

C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 6531 bytes
khorsed1018 is offline  
Old 10-29-2008, 04:30 AM   #13
Security Team
Moderator, Analyst
Rangemaster, TSF Academy
 
chemist's Avatar
 
Join Date: Oct 2007
Location: Georgia
Posts: 29,790
OS: XP/Win7/Win10



Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Delete RSIT.exe from your desktop.

Delete the following Folder if it still exists:

C:\rsit

Empty your Recycle Bin if it is not emptied automatically.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK
combofix /u
This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
  • SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
  • IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here
  • MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
  • Spybot - Search & Destroy is an excellent spyware remover and also offers real-time protection against critical registry changes. Don't use the Immunize feature in Spybot if you use SpywareBlaster. See tutorial here
Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Our services are free, but you may contribute to the author of ComboFix via PayPal

Proud member of UNITE

Microsoft MVP - Consumer Security 2014, 2015
chemist is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 09:17 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts