What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] pop up problem

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
gotufife (11168 ) Found nothing file429_277.exe (37376 ) Found UnclassifiedMalware virus (8%) 2.7.rar (204289 ) Found Heur.W32 virus (5%) setup.exe (192512 ) Found Trojan.Win32.Redosdru!IK virus (10%) 蔷薇蝶舞.exe (124758 ) Found Trojan-Downloader.Win32.VB!I… virus (8%) QQ农场挂机.exe (1497600 ) Found Trojan.Win32.Hider!IK virus (45%) jgbwg1.434.rar (1177581 ) Found Virus.Win32.Neptunia!IK virus (32%) keygen.exe (238080 ) Found Virus.Win32.Crypt.VT!IK virus (51%) wupdmgr.exe (8704 ) Found Packer.Win32.Agent.aq [Suspi… virus (2%) 520dnf.cn-kldnf2.7.rar (208413 ) Found Heur.W32 virus (5%) Account Lockout Status.msi (305664 ) Found nothing file429_268.exe (1220096 ) Found nothing setup.exe (192512 ) Found Trojan.Win32.Redosdru!IK virus (13%) meca.rar (1013001 ) Found nothing services.exe (110592 ) Found nothing muma.exe (430963 ) Found Packed.Win32.PolyCrypt.b!IK virus (35%) file429_128.exe (282624 ) Found nothing 桌面.rar (1136028 ) Found TR/Hijacker.Gen virus (24%) Windows 7 build 7264 Activator.exe (2193471 ) Found Backdoor.Win32.Iroffer!IK virus (8%) file429_124.exe (2274816 ) Found nothing QC Script.txt (1393 ) Found VBS/Generic@MM virus (5%) 111dnf-leleweshanghai.rar (2002532 ) Found Gen.Trojan!IK virus (21%) TPTB.exe (4231168 ) Found Variant:Trojan.Spy.Keylogger… virus (21%) 冥云通用智能和宝宝挂V3.0.exe (750050 ) Found Trojan-Spy.Win32.Sincom!IK virus (51%) 高三各科复习材料.exe (735744 ) Found Trojan.Win32.Hider!IK virus (48%) file429_072.exe (1106432 ) Found nothing 1.html (4037 ) Found UnclassifiedMalware virus (5%) 2.7.exe (275566 ) Found Trojan-PWS.Win32.LdPinch!IK virus (48%) Prototype_V1.001_Plus_6_Trainer_By_… (70656 ) Found nothing Super.txt (3762 ) Found nothing QQ农场挂机.exe (1457152 ) Found Trojan.Win32.Hider!IK virus (48%) ZNZ.vmp.exe (417792 ) Found Trojan-Clicker.Win32.VB!IK virus (13%) 360Safe.lnk (876 ) Found nothing BaiAi.exe (57344 ) Found Trojan-Clicker.Win32.VB.GG!I… virus (8%) 通用进程隐藏工具.rar (709725 ) Found TR/Dropper.Gen virus (18%) test.html (5061 ) Found nothing ep10.exe (936521 ) Found Virus.Win32.Small!IK virus (29%) grab00000.jpg (14050 ) Found nothing Gta san.JPG (43448 ) Found nothing top_2009_1280_f.23147.jpg (417156 ) Found nothing p9pj21.exe (1298676 ) Found Virus.Win32.Neptunia!IK virus (81%) AVSredirect.dll (27648 ) Found Suspicious virus (5%) serveR.rar (69270 ) Found Proxy.AHCC virus (10%) dnfqq0729.exe (515072 ) Found nothing Keygen.exe (71680 ) Found Riskware.Keygen.Nero!IK virus (18%) daemon406-x86.exe (1530776 ) Found Riskware.WebToolbar!IK virus (5%) 斗鱼VIP_v2.0版.rar (207034 ) Found DR/generic.696171 virus (35%) sadamzinho s2.jpg (57918 ) Found nothing DNF千千0722测试版.exe (3177719 ) Found Virus.Win32.Agent.COH!IK virus (35%) TIK.伤害复活版.rar (1947678 ) Found TR/Crypt.ZPACK.Gen virus (8%)
Post #17
Hi electriccrayon

That's a rather strange results log, as it list multiple files. gotufife showed in the log as an extentionless file. How did you obtain the results?

Thanks
Post #18
after i clicked add to clipboard, this is the only log i found. i guess i didnt look in the right place for the log report. if you know where it gets stored, id be more than happy to fetch it!
Post #19
i checked it again, and i found this under the scan results tab. i thought i was supposed to find the clipboard or something.. Scanner results : All Scanners reported not find malware! Time : 2009/07/28 21:48:02 (EDT)
Post #20
Hi electriccrayon,

That looks better. We'll remove the ESET detection and submit that file.

Let's use a new copy of combofix. Locate combofix.exe on your desktop, right click it and select delete.

Down load a new copy from one of the links below. Save it to your desktop but don't run it. We will use a CFScript again.

Link 1
Link 2

Please follow all previous instructions regarding security programs.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/pop_up_problem_t105550.html

Suspect::[4]
C:\WINDOWS\System32\gotufife 

File::
C:\Documents and Settings\Tony Gymetric\My Documents\My Music\go for a soda.wma 

Registry::

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  • Click save
Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.

Are you having any problems with your computer?

Please post back with the combofix log.

Thanks
Post #21
i havent had any popups all evening, and it does seem to be running smoother. hard to say until i start surfing as much as i normaly do.


ComboFix 09-07-28.01 - Tony Gymetric 07/28/2009 22:36.9.2 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Tony Gymetric\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\Tony Gymetric\My Documents\My Music\go for a soda.wma"

file zipped: c:\windows\system32\gotufife
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Tony Gymetric\My Documents\My Music\go for a soda.wma

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-29 )))))))))))))))))))))))))))))))
.

2009-07-28 06:41 . 2009-07-28 23:04 ——– d—–w- c:\windows\LastGood
2009-07-28 06:41 . 2009-07-28 06:41 ——– d—–w- c:\program files\ESET
2009-07-28 03:33 . 2009-07-28 03:33 ——– d—–w- c:\program files\Java
2009-07-28 03:32 . 2009-07-28 03:32 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\McAfee
2009-07-27 23:39 . 2009-07-27 23:39 ——– d—–w- C:\_OTL
2009-07-18 13:04 . 2009-06-29 04:13 353048 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgxch32.dll
2009-07-18 13:04 . 2009-06-29 04:13 2301208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avguiadv.dll
2009-07-07 22:18 . 2009-07-07 22:18 ——– d—–w- c:\documents and settings\Tony Gymetric\Local Settings\Application Data\AVG Security Toolbar
2009-07-07 22:18 . 2009-07-07 22:18 ——– d—–w- c:\documents and settings\Tony Gymetric\Local Settings\Application Data\Mozilla
2009-07-04 21:05 . 2009-06-29 04:13 327688 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgldx86.sys
2009-07-04 21:05 . 2009-07-04 21:04 2054424 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcorex.dll
2009-07-04 21:05 . 2009-07-04 21:04 2167576 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgresf.dll
2009-07-04 21:05 . 2009-06-29 04:13 906520 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgemc.exe
2009-07-04 21:05 . 2009-07-04 21:04 3403032 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgui.exe
2009-07-04 21:05 . 2009-06-29 04:13 1204504 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgabout.dll
2009-07-04 21:05 . 2009-06-29 04:12 337176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avglogx.dll
2009-07-04 21:05 . 2009-06-29 04:12 829208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgcfgx.dll
2009-07-04 21:05 . 2009-06-29 04:12 3298072 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\setup.exe
2009-07-04 21:03 . 2009-06-29 04:11 1085208 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.exe
2009-07-04 21:03 . 2009-06-29 04:11 1454360 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\avg8\update\backup\avgupd.dll
2009-06-29 09:35 . 2009-06-29 09:35 ——– d—–w- c:\documents and settings\Tony Gymetric\Application Data\com.imeem.DesktopUploader.6C3F108F466C0F04F30B58747CAA4DF34281133B.1
2009-06-29 09:35 . 2009-06-29 09:35 ——– d—–w- c:\program files\imeem Uploader
2009-06-29 09:33 . 2009-06-29 09:32 38208 —-a-w- c:\documents and settings\Tony Gymetric\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-06-29 09:33 . 2009-06-29 09:33 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-06-29 04:14 . 2009-06-29 04:14 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG Security Toolbar
2009-06-29 04:14 . 2009-06-29 04:14 ——– d—–w- c:\documents and settings\LocalService\Application Data\AVGTOOLBAR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-29 02:28 . 2008-08-04 13:36 ——– d—a-w- c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
2009-07-28 03:33 . 2008-12-19 18:39 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-28 03:32 . 2009-06-14 20:21 152576 —-a-w- c:\documents and settings\Tony Gymetric\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-07-27 07:03 . 2008-08-04 13:01 ——– d—–w- c:\program files\BearShare
2009-07-22 07:23 . 2008-12-16 03:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-22 07:23 . 2009-01-05 18:33 3775176 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-13 17:36 . 2008-12-16 03:33 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2008-12-16 03:33 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-04 21:04 . 2008-10-15 03:17 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-29 04:13 . 2008-10-15 03:17 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-29 04:13 . 2008-10-15 03:17 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-26 01:09 . 2008-08-04 12:55 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!
2009-06-16 14:36 . 2004-08-04 07:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 07:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:09 . 2004-08-04 07:00 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-26 23:50 . 2009-06-26 01:09 607472 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-08 18:48 . 2008-10-15 03:17 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 15:32 . 2004-08-04 07:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-07-23 03:38 . 2009-07-07 22:03 137208 —-a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2004-08-04 07:00 . 2008-08-03 22:39 73728 –sha-w- c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-07-26_22.41.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-28 03:38 . 2009-07-28 03:38 16384 c:\windows\temp\Perflib_Perfdata_d4.dat
- 2009-06-14 21:37 . 2009-05-21 15:34 148888 c:\windows\system32\javaws.exe
+ 2009-07-28 03:33 . 2009-07-28 03:33 148888 c:\windows\system32\javaws.exe
+ 2009-07-28 03:33 . 2009-07-28 03:33 144792 c:\windows\system32\javaw.exe
- 2009-06-14 21:37 . 2009-05-21 15:34 144792 c:\windows\system32\javaw.exe
+ 2009-07-28 03:33 . 2009-07-28 03:33 144792 c:\windows\system32\java.exe
- 2009-06-14 21:37 . 2009-05-21 15:34 144792 c:\windows\system32\java.exe
+ 2009-07-28 03:33 . 2009-07-28 03:33 536576 c:\windows\Installer\4bb86.msi
+ 2009-07-27 07:21 . 2009-07-27 07:21 176128 c:\windows\ERDNT\AutoBackup\7-27-2009\Users\00000002\UsrClass.dat
+ 2009-07-27 07:21 . 2005-10-20 17:02 163328 c:\windows\ERDNT\AutoBackup\7-27-2009\ERDNT.EXE
+ 2009-07-27 07:21 . 2009-07-27 07:21 4878336 c:\windows\ERDNT\AutoBackup\7-27-2009\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-25 7569408]
"hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
"lxdvmon.exe"="c:\program files\Lexmark X5400 Series\lxdvmon.exe" [2007-11-02 455336]
"lxdvamon"="c:\program files\Lexmark X5400 Series\lxdvamon.exe" [2007-11-02 25256]
"Lexmark X5400 Series Fax Server"="c:\program files\Lexmark X5400 Series\fm3032.exe" [2007-11-02 307880]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-29 1948440]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-28 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\Tony Gymetric\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-8-4 113664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-29 04:13 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\lxdvcoms.exe"=
"c:\\Program Files\\Lexmark X5400 Series\\lxdvmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdvjswx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundRouterRequest"= 1 (0x1)

R2 lxdvCATSCustConnectService;lxdvCATSCustConnectService;c:\windows\System32\spool\DRIVERS\W32X86\3\\lxdvserv.exe [2007-10-18 98984]
R3 Flash1;Flash1;c:\swsetup\SP36119\winphlash\Flash1.sys [2006-03-01 3456]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-07-04 335752]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-08 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-07-04 907032]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-06-29 298776]
S2 lxdv_device;lxdv_device;c:\windows\system32\lxdvcoms.exe [2007-10-18 594600]

.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.myspace.com
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\Tony Gymetric\Application Data\Mozilla\Firefox\Profiles\r6htrlaj.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.myspace.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avgb&type=yahoo_avg_hs2-tb-web_us&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-28 22:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-29 22:40
ComboFix-quarantined-files.txt 2009-07-29 02:40
ComboFix2.txt 2009-07-27 07:24
ComboFix3.txt 2009-07-26 22:45

Pre-Run: 86,162,198,528 bytes free
Post-Run: 86,171,086,848 bytes free

214 — E O F — 2009-07-16 07:02
Upload was successful
Post #22 last edited
Hi electriccrayon,

This looks ok. I need you to post a log of sorts.

Open windows explorer (right click the Start button and click Explore)

  • Navigate to this folder

    C:\Qoobox
  • In the right hand panel, locate this file ComboFix-quarantined-files.txt
  • Open it with notepad and copy and paste it's contents into your next reply

Browse around a bit and see how it is.

Thanks
Post #23
no popups. running smooth, everything is loading good. no problems as far as i can tell. 2009-07-29 02:36:15 . 2009-07-29 02:36:15 9,568 —-a-w- C:\Qoobox\Quarantine\[4]-Submit_2009-07-28_22.36.11.zip 2009-07-26 22:30:36 . 2009-07-29 02:38:15 8,101 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2009-07-26 22:27:33 . 2009-07-29 02:35:05 255 —-a-w- C:\Qoobox\Quarantine\catchme.log 2009-07-22 05:51:41 . 2009-07-22 05:51:41 10 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\run.log.vir 2009-05-05 10:47:33 . 2009-06-29 07:39:15 14,700 —-a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Tony Gymetric\My Documents\My Music\go for a soda.wma.vir 2009-04-26 11:13:55 . 2009-07-27 07:15:45 85,504 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\reguligu.dll.vir 2009-04-26 11:13:55 . 2009-07-27 07:15:47 50,688 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\tupabezu.dll.vir 2009-04-25 23:13:28 . 2009-07-27 07:15:47 86,016 —-a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\yapiniti.dll.vir
Post #24
Hi electriccrayon,

Thanks. That sounds like good news.

Let's see if we can get a close look at that file.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield
  • Do not copy the word CODE , please note the script starts with the :
    :file
C:\WINDOWS\System32\gotufife
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Thanks
Post #25
SystemLook v1.0 by jpshortstuff (22.05.09) Log created at 01:39 on 29/07/2009 by Tony Gymetric (Administrator - Elevation successful) ========== file ========== C:\WINDOWS\System32\gotufife - File found and opened. MD5: DBD18207E3564DC9AB43662206D6DAAB Created at 23:08 on 25/04/2009 Modified at 07:14 on 27/07/2009 Size: 11168 bytes Attributes: –ah– No version information available. -=End Of File=-
Post #26
Hi Electriccrayon,

I'm very uncomfortable wit that file even if it tested clean. You would appear to have the only copy of it according to google. I would like to try renaming it and see what we get.

Open windows explorer (right click the Start button and click Explore)

At the top of windows explorer, click tools, folder options, click the
view tab
  • check Display the contents of system folders
  • check Show hidden files and folders
  • uncheck "Hide extensions for known file types" box
  • uncheck "Hide protecting operating system files" box
Click apply, click ok

Navigate to this folder

C:\windows\system32
  • In the right hand panel, locate this file gotufife
  • If found, right click the file and select rename
  • add the number 1 to the end of the file so it reads gotufife1
  • left click near the filename to ensure the rename took place.

Everything still OK?

Thanks
Post #28
Hi Electriccrayon,

my laptop didnt start smoking and explode, so i think its fine!

:rofl:

That's good. Tell you what, it's past my bedtime, try the computer out do your usual things. I'll post some cleanup instructions as soon I get up in about 6 hours.

If there doesn't seem to be any averse effects from renaming that file, we'll remove it.

Ok?
Post #30
Hi Electriccrayon,

If all programs seem to be functioning normally, you can delete the file we renamed.

If no other problems, we can clean up our tools.

From your desktop, please delete
  • any notepads/logs that we created
  • SystemLook.exe
  • DDS.scr
Eset online can be removed via add/remove programs if you wish.


Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /u

Next
Open OTM then click the Clean Up button. You may get prompted by your firewall that OTM wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


Don't forget to re-enable SpywareGuard and WinPatrol when you are done.


Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.0.1 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Just add a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


-Check this site out to check for out of date programs
Secunia Personal Software Inspector (PSI) 1.0


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879


We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care :adios:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI