What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] #2 Google redirect , kills spybot, Malwarebytes, HJT

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
God i have the worst memeory, cant remeber things for 10 minutes, anyway, I followed the romove sbsd and macfee av disable instructions as best i could, i think the instructions are a bit outdated, sbsd didnt have the tetimer in the system startup list, but i made sure the teatimmer wasnt in taskmanager befor i ran combofix, also macfee instructions are wrong there is no exit option when right clicked anymore, you have to disable all of it through the menus now… this search is taking insanely long, its in /windows now and still no combofix.txt
Post #17
I think there is somthing wrong with the expoler search function, i redifined the search to just "combo" and it start listing everything multiable times example the combo-fix.exe was list 6 times with the same path and still going when i shut it down..this may have to do with an other error that keeps popping up on reboots "Proquota" keeps saying somthing about profile space exceeded before crashing..i suspect it has somthing do with java from web searches so i havnt been to worried about it.
Post #18
alright small problem, i think i missed turning off script scanning in macffe befor running combofix, should i rerun it?
Post #19
Note: We recommend that you save these instructions to your desktop, or print them out, as we will be going into Safe Mode during part of this fix. Select all of the text, copy (Ctrl+C) and paste (Ctrl+V) to a Notepad (Start->Programs->Accessories) document, then save (Ctrl+S) to your desktop

How to disable McAfee:

  • Please open McAfee Security Centre
  • Under Common Tasks click on Home
  • Click Computer Files
  • Click Configure
  • Make sure the following are disabled by ticking the "Off" button.

    Virus protection
    Spyware protection
    System Guards Protection
    Script Scanning Protection (you may have to scroll down to see it)

  • Next, select never for "When to re-enable real time scanning"
  • and click OK.
Further info on disabling and re-enabling McAfee: http://help.aol.com/help/microsites/micros…ternalID=222820


Disable the TeaTimer, leave it disabled, do not turn it back on until we're done or it will prevent fixes from taking
  • Run Spybot-S&D in Advanced Mode.
  • If it is not already set to do this Go to the Mode menu select "Advanced Mode"
  • On the left hand side, Click on Tools
  • Then click on the Resident Icon in the List
  • Uncheck "Resident TeaTimer" and OK any prompts.
  • Restart your computer.<–You need to do this for it to take effect
Please do not proceed until the TeaTimer is disabled

Make sure both of these are disabled before you do anything else.

============================================

Please reboot your computer in Safe Mode by doing the following:
  • Restart your computer.
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually.
  • Instead of Windows loading as normal, a menu with options should appear.
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.

============================================

Once in Safe Mode, run Combo-Fix.exe.
If ComboFix reboots the machine, make absolutely sure you boot back into Safe Mode by using the above instructions, until a log is produced. This means you will have to babysit the machine whilst it scans.
Post #20
Alright, heres the log :)


ComboFix 09-07-27.02 - Owner 07/27/2009 22:09.3.2 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1776 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_OULTRAF
——-\Legacy_SFX
——-\Legacy_SFXDRV
——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}
——-\Legacy_OULTRAF
——-\Legacy_SFX
——-\Legacy_SFXDRV
——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
——-\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
.

2009-07-27 01:38 . 2009-07-27 01:40 ——– d—–w- c:\program files\TRM
2009-07-27 01:35 . 2009-07-27 01:38 ——– d—–w- c:\program files\TM
2009-07-26 22:57 . 2008-04-14 00:12 50176 -c–a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-26 22:57 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2009-07-26 22:37 . 2009-07-26 22:37 ——– d—–w- c:\windows\Sun
2009-07-26 21:41 . 2009-07-26 22:35 ——– d—–w- c:\documents and settings\Owner\.housecall6.6
2009-07-26 21:41 . 2009-07-26 21:41 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2009-07-26 21:40 . 2009-07-26 21:40 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-26 19:54 . 2009-07-26 19:54 19456 —-a-w- C:\cmngfi.exe
2009-07-25 20:06 . 2009-07-25 20:06 ——– d—–w- c:\program files\Combined Community Codec Pack
2009-07-22 22:32 . 2009-07-22 22:52 ——– d—–w- c:\program files\daeykg
2009-07-18 15:53 . 2009-07-18 15:53 ——– d—–w- c:\program files\Haysoft
2009-07-17 16:18 . 2009-07-17 16:19 ——– d—–w- c:\program files\Error Repair Professional
2009-07-14 15:02 . 2009-07-14 15:02 ——– d—–w- c:\program files\THQ
2009-07-13 20:03 . 2009-07-13 20:03 ——– d—–w- c:\program files\The Lost Watch II 3D Screensaver
2009-07-13 20:03 . 2009-06-04 21:24 920576 —-a-w- c:\windows\system32\The_Lost_Watch_II_3D_Screensaver.scr
2009-07-13 20:00 . 2009-07-13 20:00 ——– d—–w- c:\program files\Deep Space 3D Screensaver
2009-07-13 20:00 . 2009-04-07 23:28 914432 —-a-w- c:\windows\system32\Deep_Space_3D_Screensaver.scr
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-27 01:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-05 20:24 . 2009-07-05 20:24 ——– d—–w- c:\windows\system32\wbem\Repository
2009-07-05 20:23 . 2009-07-05 20:23 ——– d—–w- c:\program files\Common Files\Apple
2009-07-05 20:21 . 2009-07-05 20:21 ——– d—–w- c:\program files\Apple Software Update
2009-07-04 19:43 . 2000-03-21 07:55 118784 —-a-w- c:\windows\system32\vbalNCSM6.dll
2009-07-04 19:43 . 2009-07-05 00:25 ——– d—–w- c:\program files\eGames
2009-07-04 18:20 . 2008-09-05 00:22 447752 —-a-r- c:\windows\system32\vp6vfw.dll
2009-07-04 18:20 . 2009-07-04 18:20 10134 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-07-04 18:20 . 2009-07-04 18:20 ——– d—–w- c:\program files\Microsoft WSE
2009-07-03 23:14 . 2009-07-03 23:14 ——– d—–w- c:\program files\Hasbro
2009-07-03 22:59 . 2009-07-03 22:59 ——– d—–w- c:\documents and settings\Owner\Application Data\SpinTop
2009-07-03 19:26 . 2009-07-03 19:26 ——– d-sh–w- c:\documents and settings\Administrator.BRYAN-2L2U6K2N1\IETldCache
2009-07-03 19:11 . 2009-07-03 19:11 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2009-07-03 19:11 . 2009-07-03 19:14 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2009-07-03 19:11 . 2009-07-03 19:14 ——– d-s—w- c:\documents and settings\Administrator
2009-07-03 18:59 . 2009-07-03 19:14 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-07-03 18:59 . 2009-07-27 06:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-07-03 18:59 . 2009-07-03 18:59 ——– d—–w- c:\program files\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-28 05:21 . 2003-03-31 12:00 407040 —-a-w- c:\windows\system32\netlogon.dll
2009-07-28 00:24 . 2007-11-17 21:42 189480 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-07-28 00:24 . 2007-11-17 21:42 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-07-27 06:58 . 2009-07-27 06:58 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-27 06:51 . 2009-07-27 06:36 ——– d—–w- c:\program files\Trend Micro
2009-07-26 22:16 . 2008-12-12 01:33 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-25 07:27 . 2008-03-02 18:03 ——– d—–w- c:\documents and settings\Owner\Application Data\uTorrent
2009-07-25 00:43 . 2007-08-31 07:40 ——– d—–w- c:\program files\Steam
2009-07-24 20:50 . 2008-03-09 17:20 ——– d—–w- c:\program files\Bethesda Softworks
2009-07-19 19:17 . 2008-09-05 23:29 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE
2009-07-19 19:17 . 2008-06-19 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE Creature Creator
2009-07-19 17:53 . 2009-05-12 02:27 ——– d—–w- c:\program files\ImageConverter Plus
2009-07-19 17:53 . 2007-12-31 17:07 ——– d—–w- c:\program files\Advanced GIF Animator
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:57 . 2007-11-17 21:42 794408 —-a-w- c:\windows\system32\pbsvc.exe
2009-07-15 23:57 . 2007-11-17 21:42 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-07-14 14:57 . 2007-11-15 02:52 ——– d—–w- c:\program files\Electronic Arts
2009-07-10 22:25 . 2008-06-15 20:46 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-10 22:18 . 2008-06-15 20:52 ——– d—–w- c:\program files\McAfee
2009-07-08 17:28 . 2009-07-27 06:58 2920112 -c–a-w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
2009-07-06 00:06 . 2009-03-01 03:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-05 17:31 . 2007-08-31 02:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-04 17:52 . 2009-06-17 03:31 ——– d—–w- c:\program files\EA SPORTS
2009-07-03 23:00 . 2008-05-18 19:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-03 14:49 . 2009-07-27 06:58 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-29 03:28 . 2007-09-09 22:08 ——– d—–w- c:\program files\SystemRequirementsLab
2009-06-29 01:34 . 2008-07-29 22:03 ——– d—–w- c:\program files\PokerStars.NET
2009-06-27 17:10 . 2009-06-27 17:10 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-06-27 05:07 . 2009-04-10 22:48 ——– d–h–w- c:\program files\Zero G Registry
2009-06-27 05:05 . 2008-05-17 00:52 ——– d—–w- c:\program files\Free Easy Burner
2009-06-27 05:03 . 2008-05-17 01:38 ——– d—–w- c:\program files\Avi2Dvd
2009-06-19 22:25 . 2009-06-19 22:25 41472 —-a-w- c:\windows\system32\dgd32.dll
2009-06-17 03:45 . 2009-06-17 03:45 ——– d—–w- c:\program files\Lionhead Studios Ltd
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2003-03-31 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-14 07:25 . 2009-06-07 02:21 ——– d—–w- c:\documents and settings\Owner\Application Data\Any Video Converter
2009-06-14 02:52 . 2009-02-23 02:56 ——– d—–w- c:\program files\GtkRadiant-1.4
2009-06-11 20:51 . 2007-10-25 23:15 ——– d—–w- c:\program files\Quake III Arena
2009-06-07 02:21 . 2009-06-07 02:21 ——– d—–w- c:\program files\Any Video Converter
2009-06-04 00:24 . 2009-06-04 00:24 ——– d—–w- c:\program files\K-Lite Codec Pack
2009-06-03 19:09 . 2005-08-30 16:14 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-16 04:05 . 2008-12-12 01:38 593920 ——w- c:\windows\system32\ati2sgag.exe
2009-05-16 03:58 . 2007-07-28 03:30 4069888 —-a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-05-16 03:39 . 2008-12-01 20:52 442368 —-a-w- c:\windows\system32\ATIDEMGX.dll
2009-05-16 03:38 . 2007-05-18 01:57 335872 —-a-w- c:\windows\system32\ati2dvag.dll
2009-05-16 03:18 . 2008-12-01 20:41 204800 —-a-w- c:\windows\system32\atipdlxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2009-05-16 03:17 . 2008-12-01 20:40 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2009-05-16 03:17 . 2008-12-01 20:40 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\ati2evxx.dll
2009-05-16 03:15 . 2008-12-01 20:38 602112 —-a-w- c:\windows\system32\ati2evxx.exe
2009-05-16 03:14 . 2008-12-01 20:37 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2009-05-16 03:07 . 2007-05-18 01:41 2987136 —-a-w- c:\windows\system32\ati3duag.dll
2009-05-16 02:55 . 2008-12-01 20:46 11423744 —-a-w- c:\windows\system32\atioglxx.dll
2009-05-16 02:54 . 2007-05-18 01:30 2122624 —-a-w- c:\windows\system32\ativvaxx.dll
2009-05-16 02:54 . 2008-12-01 20:11 887724 —-a-w- c:\windows\system32\ativva6x.dat
2009-05-16 02:54 . 2008-12-01 20:11 3 —-a-w- c:\windows\system32\ativva5x.dat
2009-05-16 02:51 . 2008-12-01 20:19 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2009-05-16 02:38 . 2009-05-16 02:38 49664 —-a-w- c:\windows\system32\atimpc32.dll
2009-05-16 02:38 . 2008-12-01 19:57 49664 —-a-w- c:\windows\system32\amdpcom32.dll
2009-05-16 02:33 . 2008-12-01 19:53 479232 —-a-w- c:\windows\system32\atikvmag.dll
2009-05-16 02:31 . 2008-12-01 19:52 139264 —-a-w- c:\windows\system32\atiadlxx.dll
2009-05-16 02:31 . 2008-12-01 19:52 17408 —-a-w- c:\windows\system32\atitvo32.dll
2009-05-16 02:30 . 2008-12-01 19:51 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2009-05-16 02:26 . 2008-12-01 19:50 376832 —-a-w- c:\windows\system32\atiok3x2.dll
2009-05-16 02:24 . 2007-05-18 01:10 651264 —-a-w- c:\windows\system32\ati2cqag.dll
2009-05-16 01:35 . 2009-05-16 01:35 45056 —-a-w- c:\windows\system32\aticalrt.dll
2009-05-16 01:34 . 2009-05-16 01:34 45056 —-a-w- c:\windows\system32\aticalcl.dll
2009-05-16 01:33 . 2009-05-16 01:33 3158016 —-a-w- c:\windows\system32\aticaldd.dll
2009-05-13 05:15 . 2006-06-23 18:33 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-12 04:11 . 2007-08-31 02:24 13640 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-12 04:07 . 2009-05-12 04:07 112640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1033\ResourceCache.dll
2009-05-12 04:07 . 2009-05-12 04:07 416 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-05-07 15:32 . 2003-03-31 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-05 19:33 . 2009-05-05 19:33 118784 —-a-w- c:\windows\system32\atibtmon.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-03 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusStartupHelp"="c:\program files\ASUS\AASP\1.00.24\AsRunHelp.exe" [2006-12-29 363008]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-05-08 159744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MacroMaker.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\MacroMaker.lnk
backup=c:\windows\pss\MacroMaker.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\america's army 3\\Binaries\\AA3Game.exe"=
"c:\\Program Files\\Sony\\EverQuest II\\EQ2VoiceService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:sfx

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/26/2009 11:58 PM 64160]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2/9/2008 1:28 PM 10880]
R3 kbdcap;kbdcap;c:\windows\system32\drivers\KbdCap.sys [11/16/2008 10:46 AM 109440]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [7/20/2007 6:40 PM 84992]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

2009-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]

2009-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-27 22:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{02753D26-01B1-F783-A4A7-5358450913EE}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nakopcfcogegljlnhefplobbjggh"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,
6e,67,65,67,61,65,69,69,00,00
"maapbbdkibpmkodhjfkfkpdepj"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,6e,
67,65,67,61,65,69,69,00,00

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:67,c9,6f,6f,ae,19,bc,8a,6a,04,9c,1b,2a,47,3e,20,42,c6,ff,e4,4e,63,78,
ca,d8,af,50,05,99,fd,4e,b3,1c,80,74,80,1f,ed,69,eb,c2,92,d8,1c,cd,b1,e4,06,\
"??"=hex:25,a4,a2,6c,2e,35,2c,50,39,35,0c,52,91,50,8b,a1

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:3d,b8,65,e4,4a,34,23,c8,93,91,0e,72,22,bd,33,b0,e7,7d,b6,52,0e,
4f,09,3e,84,86,5f,22,c5,f4,a2,a4,83,37,a4,56,0e,00,9e,ed,6e,75,6b,d1,7d,67,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(236)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1416)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
.
———————— Other Running Processes ————————
.
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
.
**************************************************************************
.
Completion time: 2009-07-28 22:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-28 05:37

Pre-Run: 23,338,782,720 bytes free
Post-Run: 23,226,327,040 bytes free

274 — E O F — 2009-07-27 08:52
Post #21
Make sure McAfee and TeaTimer are still disabled before proceeding.

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    DDS::
uInternet Settings,ProxyServer = http=localhost:7171
uInternet Settings,ProxyOverride = *.local;

DirLook::
c:\program files\daeykg

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"=-
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

====================

Go to My Computer-> Tools-> Folder Options-> View tab:
  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)

====================

Please go to one of the below sites to scan the following file:
Jotti
Virus Total

Click on Browse, and upload the following file for analysis:
C:\cmngfi.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
Post #22
File cmngfi.exe received on 2009.07.28 13:51:12 (UTC) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 16/41 (39.03%) Loading server information… Your file is queued in position: 2. Estimated start time is between 50 and 71 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.24 2009.07.28 Trojan-Downloader.Win32.Votwup!IK AhnLab-V3 5.0.0.2 2009.07.28 - AntiVir 7.9.0.234 2009.07.28 TR/CryptRedol.19456.3.1 Antiy-AVL 2.0.3.7 2009.07.28 - Authentium 5.1.2.4 2009.07.28 - Avast 4.8.1335.0 2009.07.27 - AVG 8.5.0.387 2009.07.28 SHeur2.ASXE BitDefender 7.2 2009.07.28 Trojan.CryptRedol.Gen.3 CAT-QuickHeal 10.00 2009.07.28 (Suspicious) - DNAScan ClamAV 0.94.1 2009.07.28 - Comodo 1793 2009.07.28 - DrWeb 5.0.0.12182 2009.07.28 - eSafe 7.0.17.0 2009.07.27 - eTrust-Vet 31.6.6643 2009.07.28 - F-Prot 4.4.4.56 2009.07.28 - F-Secure 8.0.14470.0 2009.07.28 - Fortinet 3.120.0.0 2009.07.28 PossibleThreat GData 19 2009.07.28 Trojan.CryptRedol.Gen.3 Ikarus T3.1.1.64.0 2009.07.28 Trojan-Downloader.Win32.Votwup Jiangmin 11.0.800 2009.07.28 - K7AntiVirus 7.10.803 2009.07.27 - Kaspersky 7.0.0.125 2009.07.28 - McAfee 5690 2009.07.27 - McAfee+Artemis 5690 2009.07.27 Artemis!6819E489DB10 McAfee-GW-Edition 6.8.5 2009.07.28 Heuristic.LooksLike.Trojan.CryptRedol.H Microsoft 1.4903 2009.07.28 TrojanDownloader:Win32/Votwup.gen!A NOD32 4285 2009.07.28 - Norman 6.01.09 2009.07.28 - nProtect 2009.1.8.0 2009.07.28 - Panda 10.0.0.14 2009.07.28 Generic Trojan PCTools 4.4.2.0 2009.07.28 - Prevx 3.0 2009.07.28 - Rising 21.40.14.00 2009.07.28 - Sophos 4.44.0 2009.07.28 Mal/EncPk-IF Sunbelt 3.2.1858.2 2009.07.28 Trojan.Win32.Unidentified.VS Symantec 1.4.4.12 2009.07.28 Packed.Generic.233 TheHacker 6.3.4.3.375 2009.07.28 - TrendMicro 8.950.0.1094 2009.07.28 - VBA32 3.12.10.9 2009.07.28 - ViRobot 2009.7.28.1857 2009.07.28 - VirusBuster 4.6.5.0 2009.07.27 Trojan.CryptRedol.E Additional information File size: 19456 bytes MD5…: 6819e489db1092c424cecfca114f3a5f SHA1..: eef256545d7c15f7433358516eb99a54e3ac3bc7 SHA256: 50f2ed5d1c9de665c3e52f944df5b5595b06ee881e812b144879273f133fbda5 ssdeep: 384:UJ7HsxtM67bLoIgsL2rrRGPDQBsGhhgV:i7MrM6756wUBlhh6 PEiD..: - TrID..: File type identification Generic Win/DOS Executable (49.9%) DOS Executable Generic (49.8%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x10e4 timedatestamp…..: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype…….: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x11e1 0x1400 7.33 10e03cd0c4ceb77a1f5cd64c6034cccb .rdata 0x3000 0x496 0x800 3.35 3f217a00b2980d345a529c997413ffc5 .data 0x4000 0xae25 0x2c00 7.65 b5032a1be4bfed6c0b71cb35cc577372 ( 5 imports ) > KERNEL32.DLL: UnhandledExceptionFilter, DuplicateHandle, FreeLibrary, SetStdHandle, LocalFileTimeToFileTime, GetVersionExA, HeapCreate, GetACP, lstrcmpA, GetTimeZoneInformation, GetModuleHandleA, GetStringTypeA, SetConsoleCP, ExitProcess, Sleep, SetLastError, GetTempFileNameW, VirtualProtect, GetCurrentThreadId, GetStartupInfoA, HeapAlloc, GetOEMCP, GetModuleHandleW, InterlockedIncrement > USER32.DLL: ReleaseDC, GetFocus, SetFocus, CopyRect, IsWindowEnabled, MsgWaitForMultipleObjects, AdjustWindowRectEx, EnableWindow, DialogBoxParamW > MSVCRT.DLL: _initterm, __p__commode > ADVAPI32.DLL: RegCreateKeyW, RegEnumKeyExW > GDI32.DLL: IntersectClipRect ( 0 exports ) PDFiD.: - RDS…: NSRL Reference Data Set -
Post #23
Not sure if you missed it or you're still working on it, but I need the Combofix log produced after you run that script with it. :)

C:\Combofix.txt
Post #24
ya sorry bout that, forgot all about posting that :)

ComboFix 09-07-27.02 - Owner 07/28/2009 6:29.4.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1622 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
.

2009-07-27 01:38 . 2009-07-27 01:40 ——– d—–w- c:\program files\TRM
2009-07-27 01:35 . 2009-07-27 01:38 ——– d—–w- c:\program files\TM
2009-07-26 22:57 . 2008-04-14 00:12 50176 -c–a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-26 22:57 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2009-07-26 22:37 . 2009-07-26 22:37 ——– d—–w- c:\windows\Sun
2009-07-26 21:41 . 2009-07-26 22:35 ——– d—–w- c:\documents and settings\Owner\.housecall6.6
2009-07-26 21:41 . 2009-07-26 21:41 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2009-07-26 21:40 . 2009-07-26 21:40 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-26 19:54 . 2009-07-26 19:54 19456 —-a-w- C:\cmngfi.exe
2009-07-25 20:06 . 2009-07-25 20:06 ——– d—–w- c:\program files\Combined Community Codec Pack
2009-07-22 22:32 . 2009-07-22 22:52 ——– d—–w- c:\program files\daeykg
2009-07-18 15:53 . 2009-07-18 15:53 ——– d—–w- c:\program files\Haysoft
2009-07-17 16:18 . 2009-07-17 16:19 ——– d—–w- c:\program files\Error Repair Professional
2009-07-14 15:02 . 2009-07-14 15:02 ——– d—–w- c:\program files\THQ
2009-07-13 20:03 . 2009-07-13 20:03 ——– d—–w- c:\program files\The Lost Watch II 3D Screensaver
2009-07-13 20:03 . 2009-06-04 21:24 920576 —-a-w- c:\windows\system32\The_Lost_Watch_II_3D_Screensaver.scr
2009-07-13 20:00 . 2009-07-13 20:00 ——– d—–w- c:\program files\Deep Space 3D Screensaver
2009-07-13 20:00 . 2009-04-07 23:28 914432 —-a-w- c:\windows\system32\Deep_Space_3D_Screensaver.scr
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-27 01:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-05 20:24 . 2009-07-05 20:24 ——– d—–w- c:\windows\system32\wbem\Repository
2009-07-05 20:23 . 2009-07-05 20:23 ——– d—–w- c:\program files\Common Files\Apple
2009-07-05 20:21 . 2009-07-05 20:21 ——– d—–w- c:\program files\Apple Software Update
2009-07-04 19:43 . 2000-03-21 07:55 118784 —-a-w- c:\windows\system32\vbalNCSM6.dll
2009-07-04 19:43 . 2009-07-05 00:25 ——– d—–w- c:\program files\eGames
2009-07-04 18:20 . 2008-09-05 00:22 447752 —-a-r- c:\windows\system32\vp6vfw.dll
2009-07-04 18:20 . 2009-07-04 18:20 10134 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-07-04 18:20 . 2009-07-04 18:20 ——– d—–w- c:\program files\Microsoft WSE
2009-07-03 23:14 . 2009-07-03 23:14 ——– d—–w- c:\program files\Hasbro
2009-07-03 22:59 . 2009-07-03 22:59 ——– d—–w- c:\documents and settings\Owner\Application Data\SpinTop
2009-07-03 19:26 . 2009-07-03 19:26 ——– d-sh–w- c:\documents and settings\Administrator.BRYAN-2L2U6K2N1\IETldCache
2009-07-03 19:11 . 2009-07-03 19:11 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2009-07-03 19:11 . 2009-07-03 19:14 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2009-07-03 19:11 . 2009-07-03 19:14 ——– d-s—w- c:\documents and settings\Administrator
2009-07-03 18:59 . 2009-07-03 19:14 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-07-03 18:59 . 2009-07-27 06:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-07-03 18:59 . 2009-07-03 18:59 ——– d—–w- c:\program files\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-28 05:21 . 2003-03-31 12:00 407040 —-a-w- c:\windows\system32\netlogon.dll
2009-07-28 00:24 . 2007-11-17 21:42 189480 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-07-28 00:24 . 2007-11-17 21:42 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-07-27 06:58 . 2009-07-27 06:58 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-27 06:51 . 2009-07-27 06:36 ——– d—–w- c:\program files\Trend Micro
2009-07-26 22:16 . 2008-12-12 01:33 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-25 07:27 . 2008-03-02 18:03 ——– d—–w- c:\documents and settings\Owner\Application Data\uTorrent
2009-07-25 00:43 . 2007-08-31 07:40 ——– d—–w- c:\program files\Steam
2009-07-24 20:50 . 2008-03-09 17:20 ——– d—–w- c:\program files\Bethesda Softworks
2009-07-19 19:17 . 2008-09-05 23:29 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE
2009-07-19 19:17 . 2008-06-19 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE Creature Creator
2009-07-19 17:53 . 2009-05-12 02:27 ——– d—–w- c:\program files\ImageConverter Plus
2009-07-19 17:53 . 2007-12-31 17:07 ——– d—–w- c:\program files\Advanced GIF Animator
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:57 . 2007-11-17 21:42 794408 —-a-w- c:\windows\system32\pbsvc.exe
2009-07-15 23:57 . 2007-11-17 21:42 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-07-14 14:57 . 2007-11-15 02:52 ——– d—–w- c:\program files\Electronic Arts
2009-07-10 22:25 . 2008-06-15 20:46 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-10 22:18 . 2008-06-15 20:52 ——– d—–w- c:\program files\McAfee
2009-07-08 17:28 . 2009-07-27 06:58 2920112 -c–a-w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
2009-07-06 00:06 . 2009-03-01 03:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-05 17:31 . 2007-08-31 02:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-04 17:52 . 2009-06-17 03:31 ——– d—–w- c:\program files\EA SPORTS
2009-07-03 23:00 . 2008-05-18 19:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-03 14:49 . 2009-07-27 06:58 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-29 03:28 . 2007-09-09 22:08 ——– d—–w- c:\program files\SystemRequirementsLab
2009-06-29 01:34 . 2008-07-29 22:03 ——– d—–w- c:\program files\PokerStars.NET
2009-06-27 17:10 . 2009-06-27 17:10 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-06-27 05:07 . 2009-04-10 22:48 ——– d–h–w- c:\program files\Zero G Registry
2009-06-27 05:05 . 2008-05-17 00:52 ——– d—–w- c:\program files\Free Easy Burner
2009-06-27 05:03 . 2008-05-17 01:38 ——– d—–w- c:\program files\Avi2Dvd
2009-06-19 22:25 . 2009-06-19 22:25 41472 —-a-w- c:\windows\system32\dgd32.dll
2009-06-17 03:45 . 2009-06-17 03:45 ——– d—–w- c:\program files\Lionhead Studios Ltd
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2003-03-31 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-14 07:25 . 2009-06-07 02:21 ——– d—–w- c:\documents and settings\Owner\Application Data\Any Video Converter
2009-06-14 02:52 . 2009-02-23 02:56 ——– d—–w- c:\program files\GtkRadiant-1.4
2009-06-11 20:51 . 2007-10-25 23:15 ——– d—–w- c:\program files\Quake III Arena
2009-06-07 02:21 . 2009-06-07 02:21 ——– d—–w- c:\program files\Any Video Converter
2009-06-04 00:24 . 2009-06-04 00:24 ——– d—–w- c:\program files\K-Lite Codec Pack
2009-06-03 19:09 . 2005-08-30 16:14 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-16 04:05 . 2008-12-12 01:38 593920 ——w- c:\windows\system32\ati2sgag.exe
2009-05-16 03:58 . 2007-07-28 03:30 4069888 —-a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-05-16 03:39 . 2008-12-01 20:52 442368 —-a-w- c:\windows\system32\ATIDEMGX.dll
2009-05-16 03:38 . 2007-05-18 01:57 335872 —-a-w- c:\windows\system32\ati2dvag.dll
2009-05-16 03:18 . 2008-12-01 20:41 204800 —-a-w- c:\windows\system32\atipdlxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2009-05-16 03:17 . 2008-12-01 20:40 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2009-05-16 03:17 . 2008-12-01 20:40 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\ati2evxx.dll
2009-05-16 03:15 . 2008-12-01 20:38 602112 —-a-w- c:\windows\system32\ati2evxx.exe
2009-05-16 03:14 . 2008-12-01 20:37 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2009-05-16 03:07 . 2007-05-18 01:41 2987136 —-a-w- c:\windows\system32\ati3duag.dll
2009-05-16 02:55 . 2008-12-01 20:46 11423744 —-a-w- c:\windows\system32\atioglxx.dll
2009-05-16 02:54 . 2007-05-18 01:30 2122624 —-a-w- c:\windows\system32\ativvaxx.dll
2009-05-16 02:54 . 2008-12-01 20:11 887724 —-a-w- c:\windows\system32\ativva6x.dat
2009-05-16 02:54 . 2008-12-01 20:11 3 —-a-w- c:\windows\system32\ativva5x.dat
2009-05-16 02:51 . 2008-12-01 20:19 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2009-05-16 02:38 . 2009-05-16 02:38 49664 —-a-w- c:\windows\system32\atimpc32.dll
2009-05-16 02:38 . 2008-12-01 19:57 49664 —-a-w- c:\windows\system32\amdpcom32.dll
2009-05-16 02:33 . 2008-12-01 19:53 479232 —-a-w- c:\windows\system32\atikvmag.dll
2009-05-16 02:31 . 2008-12-01 19:52 139264 —-a-w- c:\windows\system32\atiadlxx.dll
2009-05-16 02:31 . 2008-12-01 19:52 17408 —-a-w- c:\windows\system32\atitvo32.dll
2009-05-16 02:30 . 2008-12-01 19:51 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2009-05-16 02:26 . 2008-12-01 19:50 376832 —-a-w- c:\windows\system32\atiok3x2.dll
2009-05-16 02:24 . 2007-05-18 01:10 651264 —-a-w- c:\windows\system32\ati2cqag.dll
2009-05-16 01:35 . 2009-05-16 01:35 45056 —-a-w- c:\windows\system32\aticalrt.dll
2009-05-16 01:34 . 2009-05-16 01:34 45056 —-a-w- c:\windows\system32\aticalcl.dll
2009-05-16 01:33 . 2009-05-16 01:33 3158016 —-a-w- c:\windows\system32\aticaldd.dll
2009-05-13 05:15 . 2006-06-23 18:33 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-12 04:11 . 2007-08-31 02:24 13640 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-12 04:07 . 2009-05-12 04:07 112640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1033\ResourceCache.dll
2009-05-12 04:07 . 2009-05-12 04:07 416 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-05-07 15:32 . 2003-03-31 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-05 19:33 . 2009-05-05 19:33 118784 —-a-w- c:\windows\system32\atibtmon.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—- Directory of c:\program files\daeykg —-



((((((((((((((((((((((((((((( SnapShot@2009-07-28_05.29.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-08-31 01:55 . 2009-07-28 13:24 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-08-31 01:55 . 2009-07-28 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-08-31 01:55 . 2009-07-28 13:24 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-08-31 01:55 . 2009-07-28 01:49 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-06-20 06:33 . 2009-07-28 13:24 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-06-20 06:33 . 2009-07-28 01:49 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-03 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusStartupHelp"="c:\program files\ASUS\AASP\1.00.24\AsRunHelp.exe" [2006-12-29 363008]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-05-08 159744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MacroMaker.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\MacroMaker.lnk
backup=c:\windows\pss\MacroMaker.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\america's army 3\\Binaries\\AA3Game.exe"=
"c:\\Program Files\\Sony\\EverQuest II\\EQ2VoiceService.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/26/2009 11:58 PM 64160]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [7/20/2007 6:40 PM 84992]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2/9/2008 1:28 PM 10880]
R3 kbdcap;kbdcap;c:\windows\system32\drivers\KbdCap.sys [11/16/2008 10:46 AM 109440]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

2009-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]

2009-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-28 06:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{02753D26-01B1-F783-A4A7-5358450913EE}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nakopcfcogegljlnhefplobbjggh"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,
6e,67,65,67,61,65,69,69,00,00
"maapbbdkibpmkodhjfkfkpdepj"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,6e,
67,65,67,61,65,69,69,00,00

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:67,c9,6f,6f,ae,19,bc,8a,6a,04,9c,1b,2a,47,3e,20,42,c6,ff,e4,4e,63,78,
ca,d8,af,50,05,99,fd,4e,b3,1c,80,74,80,1f,ed,69,eb,c2,92,d8,1c,cd,b1,e4,06,\
"??"=hex:25,a4,a2,6c,2e,35,2c,50,39,35,0c,52,91,50,8b,a1

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:3d,b8,65,e4,4a,34,23,c8,93,91,0e,72,22,bd,33,b0,e7,7d,b6,52,0e,
4f,09,3e,84,86,5f,22,c5,f4,a2,a4,83,37,a4,56,0e,00,9e,ed,6e,75,6b,d1,7d,67,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1356)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-07-28 6:35
ComboFix-quarantined-files.txt 2009-07-28 13:35
ComboFix2.txt 2009-07-28 05:37

Pre-Run: 23,240,888,320 bytes free
Post-Run: 23,192,961,024 bytes free

264 — E O F — 2009-07-27 08:52
Post #25
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    http://forums.whatthetech.com/2_Google_redirect_kills_spybot_Malwarebytes_HJT_t105568.html

Collect::
C:\cmngfi.exe

Folder::
c:\program files\daeykg
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

====================

Please do a scan with the Kaspersky Online Scanner

  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition
    files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a long time, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report

To obtain the report:
  • Click on Save Report As
  • In the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar
  • In Save as type, click the drop arrow and select Text file [*.txt]
  • Click Save

(Note for Internet Explorer users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75%. Once the license has been accepted, reset to 100%.)

In your next reply post:
Kaspersky log
Post #26
Sorry for the delay, been working all day heres those logs…


ComboFix 09-07-27.02 - Owner 07/28/2009 16:46.5.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1618 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

file zipped: C:\cmngfi.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\cmngfi.exe
c:\program files\daeykg

.
((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
.

2009-07-27 01:38 . 2009-07-27 01:40 ——– d—–w- c:\program files\TRM
2009-07-27 01:35 . 2009-07-27 01:38 ——– d—–w- c:\program files\TM
2009-07-26 22:57 . 2008-04-14 00:12 50176 -c–a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-26 22:57 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2009-07-26 22:37 . 2009-07-26 22:37 ——– d—–w- c:\windows\Sun
2009-07-26 21:41 . 2009-07-26 22:35 ——– d—–w- c:\documents and settings\Owner\.housecall6.6
2009-07-26 21:41 . 2009-07-26 21:41 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2009-07-26 21:40 . 2009-07-26 21:40 410984 —-a-w- c:\windows\system32\deploytk.dll
2009-07-25 20:06 . 2009-07-25 20:06 ——– d—–w- c:\program files\Combined Community Codec Pack
2009-07-18 15:53 . 2009-07-18 15:53 ——– d—–w- c:\program files\Haysoft
2009-07-17 16:18 . 2009-07-17 16:19 ——– d—–w- c:\program files\Error Repair Professional
2009-07-14 15:02 . 2009-07-14 15:02 ——– d—–w- c:\program files\THQ
2009-07-13 20:03 . 2009-07-13 20:03 ——– d—–w- c:\program files\The Lost Watch II 3D Screensaver
2009-07-13 20:03 . 2009-06-04 21:24 920576 —-a-w- c:\windows\system32\The_Lost_Watch_II_3D_Screensaver.scr
2009-07-13 20:00 . 2009-07-13 20:00 ——– d—–w- c:\program files\Deep Space 3D Screensaver
2009-07-13 20:00 . 2009-04-07 23:28 914432 —-a-w- c:\windows\system32\Deep_Space_3D_Screensaver.scr
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-06 00:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-06 00:31 . 2009-07-27 01:58 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-05 20:24 . 2009-07-05 20:24 ——– d—–w- c:\windows\system32\wbem\Repository
2009-07-05 20:23 . 2009-07-05 20:23 ——– d—–w- c:\program files\Common Files\Apple
2009-07-05 20:21 . 2009-07-05 20:21 ——– d—–w- c:\program files\Apple Software Update
2009-07-04 19:43 . 2000-03-21 07:55 118784 —-a-w- c:\windows\system32\vbalNCSM6.dll
2009-07-04 19:43 . 2009-07-05 00:25 ——– d—–w- c:\program files\eGames
2009-07-04 18:20 . 2008-09-05 00:22 447752 —-a-r- c:\windows\system32\vp6vfw.dll
2009-07-04 18:20 . 2009-07-04 18:20 10134 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-07-04 18:20 . 2009-07-04 18:20 ——– d—–w- c:\program files\Microsoft WSE
2009-07-03 23:14 . 2009-07-03 23:14 ——– d—–w- c:\program files\Hasbro
2009-07-03 22:59 . 2009-07-03 22:59 ——– d—–w- c:\documents and settings\Owner\Application Data\SpinTop
2009-07-03 19:26 . 2009-07-03 19:26 ——– d-sh–w- c:\documents and settings\Administrator.BRYAN-2L2U6K2N1\IETldCache
2009-07-03 19:11 . 2009-07-03 19:11 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2009-07-03 19:11 . 2009-07-03 19:14 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2009-07-03 19:11 . 2009-07-03 19:14 ——– d-s—w- c:\documents and settings\Administrator
2009-07-03 18:59 . 2009-07-03 19:14 ——– dc—-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-07-03 18:59 . 2009-07-27 06:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-07-03 18:59 . 2009-07-03 18:59 ——– d—–w- c:\program files\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-28 05:21 . 2003-03-31 12:00 407040 —-a-w- c:\windows\system32\netlogon.dll
2009-07-28 00:24 . 2007-11-17 21:42 189480 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-07-28 00:24 . 2007-11-17 21:42 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-07-27 06:58 . 2009-07-27 06:58 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-27 06:51 . 2009-07-27 06:36 ——– d—–w- c:\program files\Trend Micro
2009-07-26 22:16 . 2008-12-12 01:33 664 —-a-w- c:\windows\system32\d3d9caps.dat
2009-07-25 07:27 . 2008-03-02 18:03 ——– d—–w- c:\documents and settings\Owner\Application Data\uTorrent
2009-07-25 00:43 . 2007-08-31 07:40 ——– d—–w- c:\program files\Steam
2009-07-24 20:50 . 2008-03-09 17:20 ——– d—–w- c:\program files\Bethesda Softworks
2009-07-19 19:17 . 2008-09-05 23:29 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE
2009-07-19 19:17 . 2008-06-19 00:31 ——– d—–w- c:\documents and settings\Owner\Application Data\SPORE Creature Creator
2009-07-19 17:53 . 2009-05-12 02:27 ——– d—–w- c:\program files\ImageConverter Plus
2009-07-19 17:53 . 2007-12-31 17:07 ——– d—–w- c:\program files\Advanced GIF Animator
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:58 . 2007-11-17 21:42 139152 —-a-w- c:\documents and settings\Owner\Application Data\PnkBstrK.sys
2009-07-15 23:57 . 2007-11-17 21:42 794408 —-a-w- c:\windows\system32\pbsvc.exe
2009-07-15 23:57 . 2007-11-17 21:42 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-07-14 14:57 . 2007-11-15 02:52 ——– d—–w- c:\program files\Electronic Arts
2009-07-10 22:25 . 2008-06-15 20:46 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2009-07-10 22:18 . 2008-06-15 20:52 ——– d—–w- c:\program files\McAfee
2009-07-08 17:28 . 2009-07-27 06:58 2920112 -c–a-w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
2009-07-06 00:06 . 2009-03-01 03:16 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-07-05 17:31 . 2007-08-31 02:15 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-04 17:52 . 2009-06-17 03:31 ——– d—–w- c:\program files\EA SPORTS
2009-07-03 23:00 . 2008-05-18 19:55 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-03 14:49 . 2009-07-27 06:58 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-29 03:28 . 2007-09-09 22:08 ——– d—–w- c:\program files\SystemRequirementsLab
2009-06-29 01:34 . 2008-07-29 22:03 ——– d—–w- c:\program files\PokerStars.NET
2009-06-27 17:10 . 2009-06-27 17:10 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-06-27 05:07 . 2009-04-10 22:48 ——– d–h–w- c:\program files\Zero G Registry
2009-06-27 05:05 . 2008-05-17 00:52 ——– d—–w- c:\program files\Free Easy Burner
2009-06-27 05:03 . 2008-05-17 01:38 ——– d—–w- c:\program files\Avi2Dvd
2009-06-19 22:25 . 2009-06-19 22:25 41472 —-a-w- c:\windows\system32\dgd32.dll
2009-06-17 03:45 . 2009-06-17 03:45 ——– d—–w- c:\program files\Lionhead Studios Ltd
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2003-03-31 12:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-14 07:25 . 2009-06-07 02:21 ——– d—–w- c:\documents and settings\Owner\Application Data\Any Video Converter
2009-06-14 02:52 . 2009-02-23 02:56 ——– d—–w- c:\program files\GtkRadiant-1.4
2009-06-11 20:51 . 2007-10-25 23:15 ——– d—–w- c:\program files\Quake III Arena
2009-06-07 02:21 . 2009-06-07 02:21 ——– d—–w- c:\program files\Any Video Converter
2009-06-04 00:24 . 2009-06-04 00:24 ——– d—–w- c:\program files\K-Lite Codec Pack
2009-06-03 19:09 . 2005-08-30 16:14 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-16 04:05 . 2008-12-12 01:38 593920 ——w- c:\windows\system32\ati2sgag.exe
2009-05-16 03:58 . 2007-07-28 03:30 4069888 —-a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-05-16 03:39 . 2008-12-01 20:52 442368 —-a-w- c:\windows\system32\ATIDEMGX.dll
2009-05-16 03:38 . 2007-05-18 01:57 335872 —-a-w- c:\windows\system32\ati2dvag.dll
2009-05-16 03:18 . 2008-12-01 20:41 204800 —-a-w- c:\windows\system32\atipdlxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\Oemdspif.dll
2009-05-16 03:17 . 2008-12-01 20:40 26112 —-a-w- c:\windows\system32\Ati2mdxx.exe
2009-05-16 03:17 . 2008-12-01 20:40 43520 —-a-w- c:\windows\system32\ati2edxx.dll
2009-05-16 03:17 . 2008-12-01 20:40 155648 —-a-w- c:\windows\system32\ati2evxx.dll
2009-05-16 03:15 . 2008-12-01 20:38 602112 —-a-w- c:\windows\system32\ati2evxx.exe
2009-05-16 03:14 . 2008-12-01 20:37 53248 —-a-w- c:\windows\system32\ATIDDC.DLL
2009-05-16 03:07 . 2007-05-18 01:41 2987136 —-a-w- c:\windows\system32\ati3duag.dll
2009-05-16 02:55 . 2008-12-01 20:46 11423744 —-a-w- c:\windows\system32\atioglxx.dll
2009-05-16 02:54 . 2007-05-18 01:30 2122624 —-a-w- c:\windows\system32\ativvaxx.dll
2009-05-16 02:54 . 2008-12-01 20:11 887724 —-a-w- c:\windows\system32\ativva6x.dat
2009-05-16 02:54 . 2008-12-01 20:11 3 —-a-w- c:\windows\system32\ativva5x.dat
2009-05-16 02:51 . 2008-12-01 20:19 311296 —-a-w- c:\windows\system32\atiiiexx.dll
2009-05-16 02:38 . 2009-05-16 02:38 49664 —-a-w- c:\windows\system32\atimpc32.dll
2009-05-16 02:38 . 2008-12-01 19:57 49664 —-a-w- c:\windows\system32\amdpcom32.dll
2009-05-16 02:33 . 2008-12-01 19:53 479232 —-a-w- c:\windows\system32\atikvmag.dll
2009-05-16 02:31 . 2008-12-01 19:52 139264 —-a-w- c:\windows\system32\atiadlxx.dll
2009-05-16 02:31 . 2008-12-01 19:52 17408 —-a-w- c:\windows\system32\atitvo32.dll
2009-05-16 02:30 . 2008-12-01 19:51 53248 —-a-w- c:\windows\system32\drivers\ati2erec.dll
2009-05-16 02:26 . 2008-12-01 19:50 376832 —-a-w- c:\windows\system32\atiok3x2.dll
2009-05-16 02:24 . 2007-05-18 01:10 651264 —-a-w- c:\windows\system32\ati2cqag.dll
2009-05-16 01:35 . 2009-05-16 01:35 45056 —-a-w- c:\windows\system32\aticalrt.dll
2009-05-16 01:34 . 2009-05-16 01:34 45056 —-a-w- c:\windows\system32\aticalcl.dll
2009-05-16 01:33 . 2009-05-16 01:33 3158016 —-a-w- c:\windows\system32\aticaldd.dll
2009-05-13 05:15 . 2006-06-23 18:33 915456 —-a-w- c:\windows\system32\wininet.dll
2009-05-12 04:11 . 2007-08-31 02:24 13640 —-a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-12 04:07 . 2009-05-12 04:07 112640 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1033\ResourceCache.dll
2009-05-12 04:07 . 2009-05-12 04:07 416 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-05-07 15:32 . 2003-03-31 12:00 345600 —-a-w- c:\windows\system32\localspl.dll
2009-05-05 19:33 . 2009-05-05 19:33 118784 —-a-w- c:\windows\system32\atibtmon.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-07-28_05.29.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-08-31 01:55 . 2009-07-28 23:43 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-08-31 01:55 . 2009-07-28 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-08-31 01:55 . 2009-07-28 23:43 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-08-31 01:55 . 2009-07-28 01:49 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-06-20 06:33 . 2009-07-28 23:43 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-06-20 06:33 . 2009-07-28 01:49 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-07 3885408]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-03 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusStartupHelp"="c:\program files\ASUS\AASP\1.00.24\AsRunHelp.exe" [2006-12-29 363008]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-05-08 159744]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MacroMaker.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\MacroMaker.lnk
backup=c:\windows\pss\MacroMaker.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\america's army 3\\Binaries\\AA3Game.exe"=
"c:\\Program Files\\Sony\\EverQuest II\\EQ2VoiceService.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/26/2009 11:58 PM 64160]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [7/20/2007 6:40 PM 84992]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2/9/2008 1:28 PM 10880]
R3 kbdcap;kbdcap;c:\windows\system32\drivers\KbdCap.sys [11/16/2008 10:46 AM 109440]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49]

2009-07-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]

2009-07-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-15 17:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-28 16:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{02753D26-01B1-F783-A4A7-5358450913EE}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"nakopcfcogegljlnhefplobbjggh"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,
6e,67,65,67,61,65,69,69,00,00
"maapbbdkibpmkodhjfkfkpdepj"=hex:6b,61,6c,62,67,70,66,6f,61,6d,6d,6e,62,69,6e,
67,65,67,61,65,69,69,00,00

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:67,c9,6f,6f,ae,19,bc,8a,6a,04,9c,1b,2a,47,3e,20,42,c6,ff,e4,4e,63,78,
ca,d8,af,50,05,99,fd,4e,b3,1c,80,74,80,1f,ed,69,eb,c2,92,d8,1c,cd,b1,e4,06,\
"??"=hex:25,a4,a2,6c,2e,35,2c,50,39,35,0c,52,91,50,8b,a1

[HKEY_USERS\S-1-5-21-73586283-920026266-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:3d,b8,65,e4,4a,34,23,c8,93,91,0e,72,22,bd,33,b0,e7,7d,b6,52,0e,
4f,09,3e,84,86,5f,22,c5,f4,a2,a4,83,37,a4,56,0e,00,9e,ed,6e,75,6b,d1,7d,67,\
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(888)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-07-28 16:53
ComboFix-quarantined-files.txt 2009-07-28 23:53
ComboFix2.txt 2009-07-28 13:36
ComboFix3.txt 2009-07-28 05:37

Pre-Run: 23,222,894,592 bytes free
Post-Run: 23,173,222,400 bytes free

259 — E O F — 2009-07-27 08:52
Upload was successful
Post #27
——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Tuesday, July 28, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, July 29, 2009 01:36:25 Records in database: 2559136 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 90687 Threat name: 6 Infected objects: 10 Suspicious objects: 0 Duration of the scan: 01:29:19 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\06E846C5.exe Infected: Hoax.Win32.Renos.kh 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2B855370.htm Infected: Trojan-Downloader.VBS.Psyme.gf 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3B1E1301.exe Infected: Hoax.Win32.Renos.kh 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\53D062C7.htm Infected: Trojan-Downloader.JS.Psyme.qn 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D08298F.htm Infected: Trojan-Downloader.VBS.Psyme.gf 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D0B538B.htm Infected: Trojan-Clicker.JS.Agent.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D0F7D87.htm Infected: Trojan-Clicker.JS.Agent.h 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6CE07294.htm Infected: Trojan-Clicker.HTML.IFrame.ob 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\netlogon.dll.vir Infected: Trojan.Win32.Crot.a 1 C:\System Volume Information\_restore{1AE56DBC-CDC0-4FF4-8DBE-EC77ABEDB578}\RP3\A0001425.dll Infected: Trojan.Win32.Crot.a 1 The selected area was scanned.
Post #28
i just remebered somthing that i was going to bring to your attention but forgot, go figure….Combofix poped up a message about a new version available, and asked if i wanted to download it, since it wasnt in the instuctions, i selected "No" and proceded with the scan and made a mental note to tell you about it….maybe i should invest in a pen and note book, huh?
Post #29
Congratulations, everything looks all clean. :)

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • [external image: Posted Image]
The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.

============================================

Combofix is a powerful tool and should not be used without supervision. Especially using switch commands that delete logs and quarantines that could have helped with diagnosis.
DDS is a diagnostic tool, you can delete this.
GMER is a diagnostic tool, you can delete this.

============================================

Your current version of Adobe Reader is out of date, and may contain security issues. Please uninstall the version you have now from Add/Remove programs, and then download and install the latest Adobe Reader.

============================================

You may now re-enable McAfee and TeaTimer.

============================================

P2P - I see you have P2P software (uTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

============================================

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

7. Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here.

8. Finally, I strongly recommend that you read Miekiemoses' good advice - How to prevent Malware

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.
Post #30
Thank you very much raktor, the time and effort you put into helping me out here is greatly appreciated. my system is booting and running programs atleast twice as fast normally. you and everyone at WhattheTech have just made a new freind, hope one day i can return the favor. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI