What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Pop-ups and site getting redirected on google

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:45:29 PM, on 04/06/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&cli…amp;ibd=4070816
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://queensu.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2E59498D-7E44-4452-9044-0973B080B9E8} - C:\Windows\System32\winexplorer.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Ida] "C:\Program Files\Ida\IdaLaunch.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [henugamupu] Rundll32.exe "C:\ProgramData\bemetanu\bemetanu.dll",s
O4 - HKCU\..\Run: [ee74d711] rundll32.exe "C:\ProgramData\rajadeda\rajadeda.dll",b
O4 - HKCU\..\Run: [CPMed47e48d] Rundll32.exe "C:\ProgramData\senifetu\senifetu.dll",a
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/lib/queenpubpolicy/…s/ebraryRdr.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resou…NPUplden-ca.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MrHealthy (MrHealthyService) - Symantec Corporation - C:\Program Files\Norton PC Checkup\executables\mrHealthy\MrHealthy.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8982 bytes

O and this is my friend's laptop its been notgood up for a while.
Post #2
Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop. Post them back to your topic.

Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt). Note: Do not run Option #2 yet.
Post #3
here they are DDS (Ver_09-05-14.01) - NTFSx86 NETWORK Run by [removed] at 23:35:47.93 on 15/06/2009 Internet Explorer: 7.0.6000.16830 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.2.1033.18.2038.1383 [GMT -4:00] AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Users\Kathey\Desktop\dds.com C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://queensu.ca/ uWindow Title = Internet Explorer provided by Dell uDefault_Page_URL = hxxp://www.google.ca/ig/dell?hl=en&client=dell-row&channel=ca&ibd=4070816 uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.0\NppBho.dll BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll BHO: : {2e59498d-7e44-4452-9044-0973b080b9e8} - c:\windows\system32\winexplorer.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll uRun: [Ida] "c:\program files\ida\IdaLaunch.exe" uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [henugamupu] Rundll32.exe "c:\programdata\bemetanu\bemetanu.dll",s uRun: [ee74d711] rundll32.exe "c:\programdata\rajadeda\rajadeda.dll",b uRun: [CPMed47e48d] Rundll32.exe "c:\programdata\senifetu\senifetu.dll",a mRun: [SigmatelSysTrayApp] c:\program files\sigmatel\c-major audio\wdm\sttray.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [osCheck] "c:\program files\norton internet security\osCheck.exe" mRun: [ECenter] c:\dell\e-center\EULALauncher.exe mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\users\kathey\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\users\kathey\appdata\roaming\microsoft\windows\start menu\programs\startup\OneNote Table Of Contents.onetoc2 StartupFolder: c:\users\kathey\appdata\roaming\microsoft\windows\start menu\programs\startup\rncsys32.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\npjpi160.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} - hxxp://site.ebrary.com/lib/queenpubpolicy/support/plugins/ebraryRdr.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/pr02/resources/VistaMSNPUplden-ca.cab DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\puresp3.dll Notify: igfxcui - igfxdev.dll ================= FIREFOX =================== FF - ProfilePath - c:\users\kathey\appdata\roaming\mozilla\firefox\profiles\jnjnyspw.default\ FF - prefs.js: browser.startup.homepage - hxxp://facebook.com/ FF - plugin: c:\program files\java\jre1.6.0\bin\npjava11.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npjava12.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npjava13.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npjava14.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npjava32.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npjpi160.dll FF - plugin: c:\program files\java\jre1.6.0\bin\npoji610.dll ============= SERVICES / DRIVERS =============== S1 glaide32;glaide32;c:\windows\system32\drivers\glaide32.sys [2009-6-7 91326] S1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20070921.001\IDSvix86.sys [2007-9-21 180272] S2 MrHealthyService;MrHealthy;c:\program files\norton pc checkup\executables\mrhealthy\mrhealthy.exe -service –> c:\program files\norton pc checkup\executables\mrhealthy\MrHealthy.exe -service [?] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-25 101936] S3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2006-12-3 37008] =============== Created Last 30 ================ 2009-06-15 23:21 172,032 a——- c:\windows\system32\igfxres.dll 2009-06-07 05:28 91,326 a——- c:\windows\system32\drivers\glaide32.sys 2009-06-04 20:06 –d—– c:\programdata\senifetu 2009-06-04 20:06 –d—– c:\programdata\fudoneze 2009-06-04 20:06 –d—– c:\progra~2\senifetu 2009-06-04 20:06 –d—– c:\progra~2\fudoneze 2009-06-01 13:09 –d—– c:\programdata\rajadeda 2009-06-01 13:09 –d—– c:\programdata\kebivozu 2009-06-01 13:09 –d—– c:\progra~2\rajadeda 2009-06-01 13:09 –d—– c:\progra~2\kebivozu 2009-06-01 01:09 –d—– c:\programdata\modisemi 2009-06-01 01:09 –d—– c:\programdata\lugarine 2009-06-01 01:09 –d—– c:\progra~2\modisemi 2009-06-01 01:09 –d—– c:\progra~2\lugarine 2009-05-31 14:40 373,760 a——- c:\windows\system32\winexplorer.dll 2009-05-31 14:40 –d—– c:\program files\common files\Uninstall 2009-05-31 14:39 –d—– c:\program files\PAV 2009-05-31 13:09 –d—– c:\programdata\wimavogu 2009-05-31 13:09 –d—– c:\programdata\rinihuye 2009-05-31 13:09 –d—– c:\progra~2\wimavogu 2009-05-31 13:09 –d—– c:\progra~2\rinihuye 2009-05-30 17:49 –d—– c:\programdata\zidutufi 2009-05-30 17:49 –d—– c:\programdata\nilezisu 2009-05-30 17:49 –d—– c:\progra~2\zidutufi 2009-05-30 17:49 –d—– c:\progra~2\nilezisu 2009-05-30 05:49 –d—– c:\programdata\rojideze 2009-05-30 05:49 –d—– c:\programdata\lusajuwo 2009-05-30 05:49 –d—– c:\progra~2\rojideze 2009-05-30 05:49 –d—– c:\progra~2\lusajuwo 2009-05-29 17:49 –d—– c:\programdata\tutepega 2009-05-29 17:49 –d—– c:\progra~2\tutepega 2009-05-29 17:49 –d—– c:\programdata\zahuzihi 2009-05-29 17:49 –d—– c:\progra~2\zahuzihi 2009-05-28 18:51 –d—– c:\programdata\vuseyiju 2009-05-28 18:51 –d—– c:\programdata\mohohimu 2009-05-28 18:51 –d—– c:\progra~2\vuseyiju 2009-05-28 18:51 –d—– c:\progra~2\mohohimu 2009-05-27 20:23 –d—– c:\programdata\ganoseho 2009-05-27 20:23 –d—– c:\programdata\dararudi 2009-05-27 20:23 –d—– c:\progra~2\ganoseho 2009-05-27 20:23 –d—– c:\progra~2\dararudi 2009-05-26 19:07 –d—– c:\programdata\weyalomi 2009-05-26 19:07 –d—– c:\programdata\tesidaye 2009-05-26 19:07 –d—– c:\programdata\bemetanu 2009-05-26 19:07 –d—– c:\progra~2\weyalomi 2009-05-26 19:07 –d—– c:\progra~2\tesidaye 2009-05-26 19:07 –d—– c:\progra~2\bemetanu 2009-05-26 19:07 –d—– c:\programdata\mahogiwe 2009-05-26 19:07 –d—– c:\programdata\lezuyawo 2009-05-26 19:07 –d—– c:\programdata\dayugapu 2009-05-26 19:07 –d—– c:\progra~2\mahogiwe 2009-05-26 19:07 –d—– c:\progra~2\lezuyawo 2009-05-26 19:07 –d—– c:\progra~2\dayugapu 2009-05-26 07:07 –d—– c:\programdata\jezegunu 2009-05-26 07:07 –d—– c:\programdata\fupuvuyu 2009-05-26 07:07 –d—– c:\progra~2\jezegunu 2009-05-26 07:07 –d—– c:\progra~2\fupuvuyu 2009-05-25 19:07 –d—– c:\programdata\vabuwida 2009-05-25 19:07 –d—– c:\programdata\moyomego 2009-05-25 19:07 –d—– c:\progra~2\vabuwida 2009-05-25 19:07 –d—– c:\progra~2\moyomego 2009-05-24 21:53 –d—– c:\programdata\vajetezo 2009-05-24 21:53 –d—– c:\programdata\muzupera 2009-05-24 21:53 –d—– c:\progra~2\vajetezo 2009-05-24 21:53 –d—– c:\progra~2\muzupera 2009-05-22 18:29 –d—– c:\programdata\yeteyohi 2009-05-22 18:29 –d—– c:\programdata\lakopayi 2009-05-22 18:29 –d—– c:\progra~2\yeteyohi 2009-05-22 18:29 –d—– c:\progra~2\lakopayi 2009-05-21 18:09 –d—– c:\programdata\wojigovu 2009-05-21 18:09 –d—– c:\programdata\sunufajo 2009-05-21 18:09 –d—– c:\progra~2\wojigovu 2009-05-21 18:09 –d—– c:\progra~2\sunufajo 2009-05-20 18:24 –d—– c:\programdata\wupoyahi 2009-05-20 18:24 –d—– c:\programdata\hozefudu 2009-05-20 18:24 –d—– c:\progra~2\wupoyahi 2009-05-20 18:24 –d—– c:\progra~2\hozefudu 2009-05-20 06:24 –d—– c:\programdata\yilipagi 2009-05-20 06:24 –d—– c:\programdata\wupuyera 2009-05-20 06:24 –d—– c:\progra~2\yilipagi 2009-05-20 06:24 –d—– c:\progra~2\wupuyera 2009-05-19 18:23 –d—– c:\programdata\kagejade 2009-05-19 18:23 –d—– c:\progra~2\kagejade 2009-05-19 18:23 –d—– c:\programdata\vibevije 2009-05-19 18:23 –d—– c:\progra~2\vibevije 2009-05-18 15:55 –d—– c:\programdata\yadubupi 2009-05-18 15:55 –d—– c:\programdata\gosezale 2009-05-18 15:55 –d—– c:\progra~2\yadubupi 2009-05-18 15:55 –d—– c:\progra~2\gosezale 2009-05-18 03:55 –d—– c:\programdata\rahawufi 2009-05-18 03:55 –d—– c:\programdata\dunahewa 2009-05-18 03:55 –d—– c:\progra~2\rahawufi 2009-05-18 03:55 –d—– c:\progra~2\dunahewa 2009-05-17 15:55 –d—– c:\programdata\navaguke 2009-05-17 15:55 –d—– c:\programdata\lugopuko 2009-05-17 15:55 –d—– c:\progra~2\navaguke 2009-05-17 15:55 –d—– c:\progra~2\lugopuko ==================== Find3M ==================== 2009-05-03 13:17 48,128 a——- c:\users\kathey\a.exe 2009-04-18 22:55 130,895 a——- c:\windows\hpoins18.dat 2009-03-20 16:21 86,016 a——- c:\windows\inf\infstor.dat 2009-03-20 16:21 51,200 a——- c:\windows\inf\infpub.dat 2009-03-20 16:21 86,016 a——- c:\windows\inf\infstrng.dat 2009-03-15 03:05 665,600 a——- c:\windows\inf\drvindex.dat 2008-12-10 04:18 174 a–sh— c:\program files\desktop.ini 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2007-08-16 03:17 8,192 a–sh— c:\windows\users\default\NTUSER.DAT ============= FINISH: 23:36:49.57 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-05-14.01) Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume3 Install Date: 15/08/2007 7:24:44 PM System Uptime: 15/06/2009 11:05:49 PM (0 hours ago) Motherboard: Dell Inc. | | 0KU927 Processor: Intel® Core™2 Duo CPU T7300 @ 2.00GHz | Microprocessor | 1994/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 99 GiB total, 60.259 GiB free. D: is FIXED (NTFS) - 10 GiB total, 5.853 GiB free. E: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== No restore point in system. ==== Installed Programs ====================== 2007 Microsoft Office Suite Service Pack 1 (SP1) 32 Bit HP CIO Components Installer Adobe Flash Player 10 ActiveX Adobe Reader 7.0.8 Adobe Shockwave Player 11 AIO_CDA_ProductContext AIO_CDA_Software AIO_Scan AppCore Apple Mobile Device Support Apple Software Update AutoUpdate AV Bonjour BufferChm C3100 c3100_Help Canon G.726 WMP-Decoder Canon MovieEdit Task for ZoomBrowser EX Canon RAW Image Task for ZoomBrowser EX Canon Utilities CameraWindow Canon Utilities CameraWindow DC Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX Canon Utilities MyCamera Canon Utilities MyCamera DC Canon Utilities PhotoStitch Canon Utilities RemoteCapture Task for ZoomBrowser EX Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility ccCommon CleanUp! Conexant HDA D330 MDC V.92 Modem Copy CustomerResearchQFolder Dell DataSafe Online Dell Support Center Dell System Customization Wizard Dell Touchpad DellSupport Destinations DeviceManagementQFolder DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player DocProc DocProcQFolder eSupportQFolder Fax Games, Music, & Photos Launcher HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Customer Participation Program 8.0 HP Imaging Device Functions 8.0 HP OCR Software 8.0 HP Photosmart Essential HP Photosmart.All-In-One Driver Software 8.0 .A HP Solution Center 8.0 HP Update HPProductAssistant HPSSupply Ida iTunes Java™ SE Runtime Environment 6 LiveUpdate 3.2 (Symantec Corporation) LiveUpdate Notice (Symantec Corporation) MarketResearch MediaDirect Microsoft .NET Framework 3.5 SP1 Microsoft Office Excel MUI (English) 2007 Microsoft Office Home and Student 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Modem Diagnostic Tool Mozilla Firefox (3.0.10) MSRedist MSXML 4.0 SP2 (KB954430) Network Magic Norton AntiVirus Norton Confidential Browser Component Norton Confidential Web Protection Component Norton Internet Security Norton Internet Security (Symantec Corporation) Norton PC Checkup Norton Protection Center Product Documentation Launcher QuickSet QuickTime Roxio Creator Audio Roxio Creator BDAV Plugin Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Express Labeler Roxio MyDVD DE Roxio Update Manager Scan Security Update for 2007 Microsoft Office System (KB951550) Security Update for 2007 Microsoft Office System (KB951944) Security Update for 2007 Microsoft Office System (KB960003) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office Excel 2007 (KB959997) Security Update for Microsoft Office OneNote 2007 (KB950130) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Microsoft Office system 2007 (KB954326) Security Update for Microsoft Office system 2007 (KB956828) Security Update for Microsoft Office Word 2007 (KB956358) Security Update for Visio 2007 (KB947590) Skype™ 3.5 SolutionCenter Sonic Activation Module SPBBC 32bit Status Symantec Real Time Storage Protection Component SymNet Toolbox TrayApp UnloadSupport Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) WebReg Windows Live installer Windows Live Messenger Windows Live Sign-in Assistant WinZip 11.1 ==== Event Viewer Messages From Past Week ======== 15/06/2009 11:18:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 15/06/2009 11:18:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 15/06/2009 11:18:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 15/06/2009 11:18:29 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 15/06/2009 11:08:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: eeCtrl SPBBCDrv spldr SRTSPX SYMTDI Wanarpv6 15/06/2009 11:08:19 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 15/06/2009 11:06:52 PM, Error: EventLog [6008] - The previous system shutdown at 12:16:46 PM on 12/06/2009 was unexpected. 09/06/2009 8:20:17 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.2.102 for the Network Card with network address 001B779CB2F8 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message). 08/06/2009 8:21:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} ==== End Of File =========================== GooredFix v1.92 by jpshortstuff Log created at 23:37 on 15/06/2009 running Option #1 (Kathey) Firefox version 3.0.10 (en-US) =====Suspect Goored Entries===== =====Dumping Registry Values===== [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Plugins"="C:\Program Files\Mozilla Firefox\plugins" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions] "Components"="C:\Program Files\Mozilla Firefox\components" [HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions] "{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"
Post #4
Thanks for the logs. Now we'll continue :)


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.


Please continue as follows:

  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  • Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
Post #7
I ran Combofix.exe and it opened properly. But the problem is I can't disable norton Internet security, and it wont let me uninstall it because im in safe mode, but the comp won't start in the normal mode. So i tried to run combofix but a rookit box showed up saying i have to restart the comp. But when it was restarted it goes straight to normal mode and the window wont run.
Post #8
Hi,

Please see if you can find c:\ComboFix.txt file generated. If not, run ComboFix again. When it reboots, make sure safe mode option is selected.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI