Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads

User Tag List

Repeated Win32.SuperJuan and Win32.Monder attacks

This is a discussion on Repeated Win32.SuperJuan and Win32.Monder attacks within the Resolved HJT Threads forums, part of the Tech Support Forum category. Hello, I am currently running Windows XP and my Kaspersky AV program has been detecting an increasing amount of attacks


 
 
Thread Tools Search this Thread
Old 10-30-2008, 10:53 AM   #1
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, I am currently running Windows XP and my Kaspersky AV program has been detecting an increasing amount of attacks lately from several different trojans/viruses. The two that appear to be happening the most are Adware.Win32.SuperJuan and Trojan.Win32.Monder. Of course, Kaspersky reports that the threats have all been "successfully neutralized", however problems keep persisting. These problems include EXREMELY reduced internet speed, increased spam, web browser often freezes and crashes, as well as reduced performance speed of my OS. I have tried to disinfect these threats everytime, yet the problems keep persisting. Here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 1:51:25 PM, on 10/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mouse\Amoumain.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Owner.MIKE\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sympatico.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] -SOUNDMAN.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [dwStart] C:\Program Files\PCSecurityShield\The Shield Firewall\FireWall.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [30d72e6c] rundll32.exe "C:\WINDOWS\system32\nmipylfy.dll",b
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute 2008\vrie.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - https://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - https://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - https://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\progra~1\kasper~1\kasper~1.0\adialhk.dll ikmvoe.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CSIScanner - Unknown owner - C:\Program Files\PrevxCSI\prevxcsi.exe" /service (file missing)
O23 - Service: Onlineeye Firewall Service (gmxfwsvc) - Unknown owner - C:\Program Files\Onlineeye\gmxffcsrv.exe" -service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
mfinnigan1 is offline  
Sponsored Links
Advertisement
 
Old 11-03-2008, 04:11 AM   #2
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Hi

Please visit this webpage for download links, and instructions for running ComboFix tool:

https://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.


A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
Blade81 is offline  
Old 11-04-2008, 01:12 PM   #3
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, here are the two reports you asked for, thank you in advance for your time and help :D

ComboFix 08-11-04.02 - Owner 2008-11-04 15:53:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1511 [GMT -5:00]
Running from: c:\documents and settings\Owner.MIKE\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.MIKE\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\BM33e41df0.txt
c:\windows\BM33e41df0.xml
c:\windows\IA
c:\windows\pskt.ini
c:\windows\system32\~.exe
c:\windows\system32\adxgsjjk.dll
c:\windows\system32\arsguvgg.ini
c:\windows\system32\arxptaoy.dll
c:\windows\system32\atbqhmgj.ini
c:\windows\system32\ccqkugbo.dll
c:\windows\system32\cirgbwlc.ini
c:\windows\system32\crxjhtqk.dll
c:\windows\system32\csakvphi.dll
c:\windows\system32\ddhgikqn.dll
c:\windows\system32\dgpjtsel.ini
c:\windows\system32\dlqwwbsb.dll
c:\windows\system32\dxjoyfxv.dll
c:\windows\system32\dymytg.dll
c:\windows\system32\ecgykjwh.dll
c:\windows\system32\ehoeugpo.ini
c:\windows\system32\eneggohj.dll
c:\windows\system32\eniiqqop.ini
c:\windows\system32\eqtoctsw.ini
c:\windows\system32\frvvwims.dll
c:\windows\system32\fvhbthsb.ini
c:\windows\system32\gcncirbw.dll
c:\windows\system32\gdieouku.dll
c:\windows\system32\hlgijwcy.ini
c:\windows\system32\ibokvvgd.dll
c:\windows\system32\ifyuku.dll
c:\windows\system32\jceoqnwf.dll
c:\windows\system32\jmdkyciq.ini
c:\windows\system32\jojktoou.dll
c:\windows\system32\kaaxoqix.dll
c:\windows\system32\klcnqnbs.dll
c:\windows\system32\kpahurcr.dll
c:\windows\system32\kpussrxv.ini
c:\windows\system32\lmevcsgb.ini
c:\windows\system32\mbcynrra.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\mditarjn.ini
c:\windows\system32\mesuyayu.ini
c:\windows\system32\mhqdausj.dll
c:\windows\system32\mnpjsr.dll
c:\windows\system32\msbivrhq.ini
c:\windows\system32\nfdvsdfj.ini
c:\windows\system32\nhtuwfoj.ini
c:\windows\system32\nmipylfy.dll
c:\windows\system32\nufrbnaa.dll
c:\windows\system32\nxdfusci.dll
c:\windows\system32\odsybdgc.ini
c:\windows\system32\ouawdyxm.dll
c:\windows\system32\pasmeb.dll
c:\windows\system32\pkxwinhv.dll
c:\windows\system32\ppdghehg.ini
c:\windows\system32\pybhhbtl.ini
c:\windows\system32\pzrvzg.dll
c:\windows\system32\qbvtexix.ini
c:\windows\system32\qcljulmd.ini
c:\windows\system32\qcndfrhn.ini
c:\windows\system32\qecvxkev.dll
c:\windows\system32\retfctqn.dll
c:\windows\system32\rmibbqfv.dll
c:\windows\system32\rmynedvq.ini
c:\windows\system32\rvsexfoa.dll
c:\windows\system32\senmbfyq.dll
c:\windows\system32\ssqNDvvV.dll
c:\windows\system32\sxnptw.dll
c:\windows\system32\syiekt.dll
c:\windows\system32\thnsswod.dll
c:\windows\system32\tjeylamy.ini
c:\windows\system32\tohemswt.dll
c:\windows\system32\tsptjeyg.dll
c:\windows\system32\tugpjski.dll
c:\windows\system32\tuiadmdl.ini
c:\windows\system32\twsmehot.ini
c:\windows\system32\txcxtasj.dll
c:\windows\system32\uesllk.dll
c:\windows\system32\ukxrrdqt.dll
c:\windows\system32\uyfhynuu.ini
c:\windows\system32\vbbwivky.ini
c:\windows\system32\vriqpnlc.dll
c:\windows\system32\vrupotfk.ini
c:\windows\system32\VvvDNqss.ini
c:\windows\system32\VvvDNqss.ini2
c:\windows\system32\wbuaasxs.ini
c:\windows\system32\weiojbld.ini
c:\windows\system32\wybsqjxc.ini
c:\windows\system32\xbrrusww.dll
c:\windows\system32\xgjxvpie.dll
c:\windows\system32\xryoopgg.ini
c:\windows\system32\yflypimn.ini
c:\windows\system32\ykmyesxq.ini
c:\windows\system32\yniqxfde.ini
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-10-04 to 2008-11-04 )))))))))))))))))))))))))))))))
.

2008-11-04 00:51 . 2008-11-04 00:52 <DIR> d-------- c:\program files\Realtek AC97
2008-11-04 00:51 . 2006-07-31 11:19 315,392 --a------ c:\windows\alcupd.exe
2008-11-04 00:51 . 2006-07-31 11:27 217,088 --a------ c:\windows\Alcrmv.exe
2008-10-30 15:51 . 2004-07-22 23:51 704,512 --a------ c:\windows\FixFace.dll
2008-10-30 11:56 . 2008-10-30 17:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2008-10-21 04:33 . 2008-10-21 04:33 552 --a------ c:\windows\system32\d3d8caps.dat
2008-10-08 19:47 . 2008-10-08 19:47 42,320 --a------ c:\windows\system32\xfcodec.dll
2008-10-05 16:16 . 2008-10-05 16:16 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-10-05 15:58 . 2008-10-05 15:58 <DIR> d-------- C:\ProgramData
2008-10-05 15:57 . 2008-10-05 15:57 4,374 --a------ c:\windows\system32\ealregsnapshot1.reg

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-04 21:00 551,200 --sha-w c:\windows\system32\drivers\fidbox2.dat
2008-11-04 21:00 27,564,576 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-11-04 20:59 52,628 --sha-w c:\windows\system32\drivers\fidbox2.idx
2008-11-04 20:59 370,148 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-11-04 20:40 --------- d-----w c:\documents and settings\Owner.MIKE\Application Data\Xfire
2008-11-04 05:58 137,480 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-04 05:56 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-10-30 20:52 --------- d-----w c:\program files\Steam
2008-10-30 18:11 --------- d-----w c:\program files\GameSpy Arcade
2008-10-30 17:25 --------- d-----w c:\program files\mIRC
2008-10-30 16:14 --------- d-s---w c:\program files\Xfire
2008-10-30 01:50 --------- d-----w c:\program files\VisualRoute 2008
2008-10-29 16:54 22,328 ----a-w c:\documents and settings\Owner.MIKE\Application Data\PnkBstrK.sys
2008-10-29 16:54 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-29 16:52 --------- d-----w c:\program files\Activision
2008-10-29 02:25 --------- d-----w c:\program files\XAC
2008-10-06 21:16 --------- d-----w c:\program files\Incomplete
2008-10-06 21:15 --------- d-----w c:\program files\LimeWire
2008-10-05 20:58 --------- d-----w c:\program files\Electronic Arts
2008-09-29 21:30 --------- d-----w c:\program files\Lavasoft
2008-09-29 21:30 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-09-29 21:29 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-09-24 15:40 4,122,368 ----a-r c:\windows\system32\drivers\alcxwdm.sys
2008-09-21 05:01 --------- d-----w c:\program files\Google
2008-09-20 18:24 --------- d-----w c:\program files\Yahoo!
2008-09-20 08:03 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-09-20 07:43 --------- d-----w c:\program files\Java
2008-09-14 19:21 --------- d-----w c:\documents and settings\Owner.MIKE\Application Data\AdobeUM
2008-09-12 20:26 --------- d-----w c:\program files\iTunes
2008-09-12 20:26 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-12 20:25 --------- d-----w c:\program files\iPod
2008-09-12 20:24 --------- d-----w c:\program files\QuickTime
2008-09-12 20:24 --------- d-----w c:\program files\Bonjour
2008-09-12 20:23 --------- d-----w c:\program files\Common Files\Apple
2008-09-11 01:00 --------- d-----w c:\program files\FixTunes
2008-09-10 20:45 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys
2006-07-24 18:56 0 ----a-w c:\documents and settings\Owner.MIKE\Application Data\wklnhst.dat
2006-08-07 04:03 56 --sh--r c:\windows\system32\5A190918CC.sys
2008-02-11 19:54 1,682 --sha-w c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2008-04-13 19:12 14336 27c6d03bcdb8cfeb96b716f3d8be3e18 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\svchost.exe
2004-08-10 14:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\svchost.exe

2008-04-13 19:12 82432 2ccc474eb85ceaa3e1fa1726580a3e5a c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ws2_32.dll
2004-08-10 14:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\ws2_32.dll

2008-04-13 19:12 507904 ed0ef0a136dec83df69f04118870003e c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
2004-08-10 14:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\winlogon.exe

2008-04-13 14:20 182656 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ndis.sys
2004-08-10 14:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys

2008-04-13 13:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ip6fw.sys
2004-08-10 14:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys

2008-04-13 19:12 108544 0e776ed5f7cc9f94299e70461b7b8185 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\services.exe
2004-08-10 14:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\services.exe

2008-04-13 19:12 13312 bf2466b3e18e970d8a976fb95fc1ca85 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\lsass.exe
2004-08-10 14:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\lsass.exe

2008-04-13 19:12 15360 5f1d5f88303d4a4dbc8e5f97ba967cc3 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ctfmon.exe
2004-08-10 14:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\ctfmon.exe

2008-04-13 19:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
2004-08-10 14:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"WheelMouse"="c:\program files\Mouse\Amoumain.exe" [2006-05-09 163840]
"RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 2650112]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 227856]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= c:\windows\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= c:\windows\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= L3codecp.acm
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"VIDC.HFYU"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"msacm.lameacm"= LameACM.dll
"vidc.xvid"= xvid.dll
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe]
--a------ 2007-06-29 15:03 36864 c:\program files\GameSpy\Comrade\Comrade.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dwStart]
--a------ 2004-08-04 20:13 405504 c:\program files\PCSecurityShield\The Shield Firewall\FireWall.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
--a------ 2007-03-05 16:57 1103480 c:\program files\Download Manager\DLM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-09-10 16:40 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 12:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-10-07 17:36 1410296 c:\program files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-09-21 17:39 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra------ 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 01:41 1626112 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R3 Amps2prt;Compatible PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
S0 NVStrap;NVStrap;c:\windows\system32\drivers\NVStrap.sys [2007-10-30 4224]
S2 gmxfwsvc;Onlineeye Firewall Service;c:\program files\Onlineeye\gmxffcsrv.exe [ ]
S3 FarStoneFireWallDrive;FarStoneFireWallDrive;c:\windows\system32\Drivers\FarDrive.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2008-10-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2006-07-24 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-10 14:00]
.
- - - - ORPHANS REMOVED - - - -

BHO-{07DB3140-F0F2-465B-BEFA-F2470200120A} - c:\windows\system32\ssqNDvvV.dll
BHO-{5ebad19d-bb7c-40f7-932e-f351980522f7} - c:\windows\system32\pzrvzg.dll
BHO-{6e3a6274-2aff-4786-a687-241a0206d186} - c:\windows\system32\pasmeb.dll
BHO-{715948b3-9490-47bf-97b0-8fa581b9ff92} - c:\windows\system32\ifyuku.dll
BHO-{8068d17d-e0de-430d-8ff3-04abea0e5955} - c:\windows\system32\syiekt.dll
BHO-{aa7eca46-b730-4b46-b1ec-ebdc89143963} - (no file)
BHO-{c354d993-2ab2-4700-9753-28cf36a7988d} - (no file)
BHO-{d2d68fd3-07f5-45c8-901f-1c054e333bad} - c:\windows\system32\uesllk.dll
BHO-{fa9b4f03-71df-467c-b76c-e38d810fa75d} - c:\windows\system32\dymytg.dll
HKLM-Run-30d72e6c - c:\windows\system32\tohemswt.dll
Notify-tuvSjGWO - (no file)
MSConfigStartUp-30d72e6c - c:\windows\system32\nmipylfy.dll
MSConfigStartUp-SoundMan - -SOUNDMAN.EXE


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.sympatico.ca/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 -: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 -: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 -: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
.
.
------- File Associations -------
.
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2008-11-04 16:00:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MDM]
"ImagePath"="-\"c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE\""

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ose]
"ImagePath"="-\"c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\msiexec.exe
c:\windows\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-11-04 16:08:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-04 21:08:10

Pre-Run: 67,130,880,000 bytes free
Post-Run: 67,890,049,024 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

337 --- E O F --- 2008-11-04 21:07:09

Logfile of HijackThis v1.99.1
Scan saved at 4:12:12 PM, on 11/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner.MIKE\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sympatico.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - https://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - https://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - https://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Onlineeye Firewall Service (gmxfwsvc) - Unknown owner - C:\Program Files\Onlineeye\gmxffcsrv.exe" -service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
mfinnigan1 is offline  
Sponsored Links
Advertisement
 
Old 11-04-2008, 10:00 PM   #4
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Hi

Upload following file to https://www.virustotal.com and post back the results:
c:\windows\FixFace.dll


Uninstall old Adobe Reader versions and get the latest one here or get Foxit Reader here.


Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


Post back its report & a fresh hjt log.
Blade81 is offline  
Old 11-10-2008, 05:51 AM   #5
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, here are the three logs/reports you asked for. Sorry for the delay, my building has been experiencing power outages for the last couple days now.

File FixFace.dll received on 11.10.2008 07:36:22 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/36 (0%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 43 and 62 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.11.7.1 2008.11.10 -
AntiVir 7.9.0.26 2008.11.07 -
Authentium 5.1.0.4 2008.11.09 -
Avast 4.8.1248.0 2008.11.10 -
AVG 8.0.0.161 2008.11.09 -
BitDefender 7.2 2008.11.10 -
CAT-QuickHeal 9.50 2008.11.10 -
ClamAV 0.94.1 2008.11.10 -
DrWeb 4.44.0.09170 2008.11.10 -
eSafe 7.0.17.0 2008.11.09 -
eTrust-Vet 31.6.6200 2008.11.09 -
Ewido 4.0 2008.11.09 -
F-Prot 4.4.4.56 2008.11.09 -
F-Secure 8.0.14332.0 2008.11.10 -
Fortinet 3.117.0.0 2008.11.09 -
GData 19 2008.11.10 -
Ikarus T3.1.1.45.0 2008.11.10 -
K7AntiVirus 7.10.520 2008.11.08 -
Kaspersky 7.0.0.125 2008.11.10 -
McAfee 5429 2008.11.10 -
Microsoft 1.4104 2008.11.10 -
NOD32 3598 2008.11.10 -
Norman 5.80.02 2008.11.07 -
Panda 9.0.0.4 2008.11.09 -
PCTools 4.4.2.0 2008.11.09 -
Prevx1 V2 2008.11.10 -
Rising 21.03.00.00 2008.11.10 -
SecureWeb-Gateway 6.7.6 2008.11.10 -
Sophos 4.35.0 2008.11.10 -
Sunbelt 3.1.1785.2 2008.11.08 -
Symantec 10 2008.11.10 -
TheHacker 6.3.1.1.147 2008.11.10 -
TrendMicro 8.700.0.1004 2008.11.10 -
VBA32 3.12.8.9 2008.11.10 -
ViRobot 2008.11.7.1457 2008.11.07 -
VirusBuster 4.5.11.0 2008.11.09 -
Additional information
File size: 704512 bytes
MD5...: 92954f881f06cfd4469ad5b6906c7158
SHA1..: c54665f8a37f0d61cc8d59c8e1553d701ca49add
SHA256: c3e5bd48bc64183429ea078039607933331f32f88a7b8a0c95456fbb21b10ceb
SHA512: 2005379a4e8b6cf02e128494d59b0964b5cf5cd54cfddfe7ce629068e3a00f80
3e35b0d1107846dae4144e0c18d8bfbb3f1c3facbc17c40bfd04e170f2ad9a74
PEiD..: Armadillo v1.xx - v2.xx
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x60003ea1
timedatestamp.....: 0x4100b55b (Fri Jul 23 06:51:07 2004)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9216 0xa000 6.32 020147d56ea349ec3f3f3e4f2a28f8af
.rdata 0xb000 0x1510 0x2000 4.08 f4dcc8b23288acf29686219f8fe1d17d
.data 0xd000 0x48f0 0x3000 1.02 10776c41c50c417ef64b10df15684448
.rsrc 0x12000 0x999c0 0x9a000 4.01 dc1aecd85319fab3ded392a66bf77b53
.reloc 0xac000 0x17e2 0x2000 2.78 8e2f1cadb47d0903b9f173035b91cd6a

( 3 imports )
> KERNEL32.dll: GlobalUnlock, GlobalAlloc, GlobalLock, GetCurrentProcess, GlobalReAlloc, IsBadReadPtr, GetModuleFileNameA, FlushInstructionCache, GetCurrentThreadId, GetLastError, GetPrivateProfileIntA, GetPrivateProfileStringA, SetLastError, HeapSize, HeapAlloc, ReadFile, SetEndOfFile, LoadLibraryA, GetProcAddress, IsBadCodePtr, SetUnhandledExceptionFilter, CreateFileA, FlushFileBuffers, SetStdHandle, LCMapStringW, LCMapStringA, GetStringTypeW, GetStringTypeA, MultiByteToWideChar, IsBadWritePtr, VirtualAlloc, InterlockedIncrement, InterlockedDecrement, SetFilePointer, WriteFile, VirtualFree, HeapCreate, HeapDestroy, OutputDebugStringA, TlsSetValue, RtlUnwind, GetCommandLineA, GetVersion, HeapFree, GetCPInfo, GetACP, GetOEMCP, EnterCriticalSection, LeaveCriticalSection, CloseHandle, InitializeCriticalSection, ExitProcess, TerminateProcess, HeapReAlloc, GetVersionExA, GetStartupInfoA, GetFileType, TlsAlloc, TlsFree, TlsGetValue, SetHandleCount, GetStdHandle, GetModuleHandleA, GetEnvironmentVariableA, DeleteCriticalSection, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW
> USER32.dll: wsprintfA, SetWindowLongA, GetWindowLongA, DrawTextA, DrawFocusRect, InflateRect, CopyRect, GetWindowTextA, GetClientRect, PtInRect, GetWindowRect, GetCursorPos, InvalidateRect, SetTimer, KillTimer, GetCapture, SendMessageA, GetDlgCtrlID, GetDC, ReleaseDC, CallWindowProcA, PostMessageA, ScreenToClient, OffsetRect, SetWindowRgn, GetDlgItem, SetRect, GetTopWindow, GetClassNameA, GetWindow, CallNextHookEx, UnhookWindowsHookEx, SetWindowsHookExA, LoadBitmapA, LoadImageA, GetSysColor, GetParent
> GDI32.dll: GetBkMode, CreateDIBSection, DeleteDC, ExtCreateRegion, BitBlt, SetTextColor, DeleteObject, SelectObject, CreateCompatibleBitmap, SetBkMode, CreateFontIndirectA, CreateSolidBrush, CreateCompatibleDC, GetObjectA, GetTextColor, SetBkColor, GetStockObject, CombineRgn, StretchBlt

( 6 exports )
Install, Uninstall, XGUIDecorateWindow, XGUIInstall, XGUISetBitmapRgn, XGUIUninstall

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, November 10, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, November 10, 2008 05:11:17
Records in database: 1377781
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 92990
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:20:08

No malware has been detected. The scan area is clean.

The selected area was scanned.

Logfile of HijackThis v1.99.1
Scan saved at 8:49:09 AM, on 11/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Mouse\Amoumain.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner.MIKE\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.sympatico.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - https://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - https://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - https://gamedownload.ijjimax.com/game...Plugin9USA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Onlineeye Firewall Service (gmxfwsvc) - Unknown owner - C:\Program Files\Onlineeye\gmxffcsrv.exe" -service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - -"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
mfinnigan1 is offline  
Old 11-10-2008, 08:39 AM   #6
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Hi

Looks quite nice now :) Before final steps I'd like to know how's your system running?
Blade81 is offline  
Old 11-10-2008, 09:18 AM   #7
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, I'm glad that the system is looking good :) The system is running alot smoother and I have stopped recieving Monder and Superjuan attacks. However, recently I have been recieving a number of Trojan.32.Pakes attacks, but I do not believe anything has been infected. Thank you for your continued help :)
mfinnigan1 is offline  
Old 11-10-2008, 09:59 AM   #8
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Quote:
recently I have been recieving a number of Trojan.32.Pakes attacks
Hi

Which program has alerted about those? Do you have any log of the alerts?
Blade81 is offline  
Old 11-11-2008, 06:21 PM   #9
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello,

My Kaspersky Internet 7.0 Antivirus keeps picking up these repeated "Pakes" attacks. It says that it comes up under c:\system volume information\_restore . If there is a way of posting a log on of this that you know of, let me know, thanks.
mfinnigan1 is offline  
Old 11-11-2008, 10:25 PM   #10
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Hi


Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis


Does Kaspersky still report anything?
Blade81 is offline  
Old 11-12-2008, 09:46 AM   #11
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, I followed your instructions and so far Kaspersky is not detecting anything. However, before, it was detecting attacks, yet saying that they were neutralized. So I will have to wait and see. I am noticing thought that under Kaspersky's "Reports and Data Files" Tab that there are a whole lot of INFECTED files under Backup, and I have the option to delete or restore these objects. Unfortunately I do not know where Kaspersky keeps these logs, so if you have any idea please let me know, and I will post.
mfinnigan1 is offline  
Old 11-12-2008, 09:47 AM   #12
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello, I followed your instructions and so far Kaspersky is not detecting anything. However, before, it was detecting attacks, yet saying that they were neutralized. So I will have to wait and see. I am noticing thought that under Kaspersky's "Reports and Data Files" Tab that there are a whole lot of INFECTED files under Backup, and I have the option to delete or restore these objects. Unfortunately I do not know where Kaspersky keeps these logs, so if you have any idea please let me know, and I will post.

But here is an example of one of the infected objects under the Backup tab:

Infected: Trojan program Trojan.Win32.Pakes.lko C:\System Volume Information\_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP880\A0183706.dll 152 KB
mfinnigan1 is offline  
Old 11-12-2008, 10:13 PM   #13
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



Hi

You may clean those backups :)


Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.



Now lets uninstall ComboFix:
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
  • Download Spybot
    Spybot is a scanner like adaware. It scans for spyware and other malicious programs. It is important to have both Adaware and Spybot on your computer because each program provides unique detection and pretection measures. Spybot has preventitive tools that stop programs from even installing on your computer.
    To see how to set this up as well as more spybot features, see here
    Spybot can be downloaded at this location
  • Download SpywareBlaster
    Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
    kill bits
    in the registry, so that certain activex controls can't install.
    If you don't know what activex controls are, see here
    You can download SpywareBlaster here here
    SpywareBlaster tutorial
  • hosts file:
    • Every version of windows has a hosts file as part of them.
    • In a very basic sense, they are used to locate webpages.
    • We can customize a hosts file so that it blocks certain webpages.
    • However, it can slow down certain computers.
    • This is why using a hosts file is optional!!
    Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
    If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
    1. Click the start button (at the lower left hand corner of your screen)
    2. Click run
    3. In the dialog box, type services.msc
    4. hit enter, then locate dns client
    5. Highlight it, then double-click it.
    6. On the dropdown box, change the setting from automatic to manual.
    7. Click ok


Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit https://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade
Blade81 is offline  
Old 11-13-2008, 10:25 AM   #14
Guest
 
Join Date: Oct 2008
Posts: 8
OS:



Hello,

I have fixed my Internet Explorer Settings, updated from the Windows website, and I have downloaded and installed Spyware Blaster and Spybot S&D. Everything appears to be working as it should be. This may seem like a stupid questoin, but should these two programs be running constantly or should I just use them to scan my system once or twice a week? In any case, thank you VERY much for all your help and time :) It is greatly appreciated.

Mike
mfinnigan1 is offline  
Old 11-13-2008, 10:35 AM   #15
Security Team
Analyst
 
Join Date: Jun 2008
Location: Finland
Posts: 1,454
OS: Win7 64-bit, Win8.1 64-bit



You're welcome :)

Yes, both can be running at the same time. SpywareBlaster will bring its protection without separate runs. Spybot should be run once or twice in two weeks.
Blade81 is offline  
 

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2
Powered by vBadvanced CMPS v3.2.3


All times are GMT -7. The time now is 03:59 PM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging v3.1.0 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
Copyright 2001 - 2018, Tech Support Forum

Windows 10 - Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts