cap
Topic Starter
My computer is slow and popups keep coming up. I noticed when I search for particular keywords on mozilla, like hijackthis for example, it will close out of it. That's about the jist of my problems.
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 21:30:43.65 on Mon 08/24/2009
Internet Explorer: 6.0.2900.2180
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar4.dll
uRun: [PhotoShow Deluxe Media Manager] c:\progra~1\ahead\neroph~1\data\xtras\mssysmgr.exe
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [] c:\windows\temp\g5l057.exe
uRun: [hsf7husjnfg98gi498aejhiugjkdg4] c:\windows\temp\g5l057.exe
uRun: [Windows System Recover!] c:\docume~1\colby\locals~1\temp\csrss.exe
uRun: [braviax] c:\windows\system32\braviax.exe
uRun: [AntiSpyware Service] c:\docume~1\colby\locals~1\temp\rqu35k6.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\mcupdate.exe
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ALServ] "c:\program files\altec lansing\ams\ALServ.exe"
mRun: [SunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe
mRun: [WinampAgent] c:\program files\winamp\winampa.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [PC Antispyware 2010] "c:\program files\pc_antispyware2010\PC_Antispyware2010.exe" /hide
mRun: [braviax] braviax.exe
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photo2.walgreens.com/WalgreensActivia.cab
DPF: {41564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: bccecdbdfb - c:\windows\system32\bccecdbdfb.dll
Notify: fdcceddbbbe - c:\windows\system32\fdcceddbbbe.dll
AppInit_DLLs: cru629.dat
STS: c:\windows\system32\gsf83iujid.dll: {b2c7b2a1-00f3-42bd-f434-00aaba2c8952} - c:\windows\system32\gsf83iujid.dll
STS: c:\windows\system32\tajf83ikdmf.dll: {bf56a325-23f2-42ad-f4e4-00aac39caa53} - c:\windows\system32\tajf83ikdmf.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\colby\applic~1\mozilla\firefox\profiles\2iznnypq.default\
FF - plugin: c:\documents and settings\colby\application data\mozilla\firefox\profiles\2iznnypq.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPOJI610.dll
—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
=============== Created Last 30 ================
2009-08-23 09:51 16,794 a——- c:\docume~1\alluse~1\applic~1\vutivyn.dat
2009-08-20 15:29 15,000 a——- c:\windows\system32\tajf83ikdmf.dll
2009-08-19 09:10 –d—– c:\documents and settings\colby\LocalLow
2009-08-19 09:10 –d—– c:\docume~1\alluse~1\applic~1\TVU Networks
2009-08-18 10:42 19,145 a——- c:\program files\common files\uripokociq.dll
2009-08-18 10:42 18,091 a——- c:\windows\jyriwoseqa.scr
2009-08-18 10:42 17,797 a——- c:\windows\aquma.scr
2009-08-18 10:42 17,487 a——- c:\windows\alahyk.dl
2009-08-18 10:42 16,781 a——- c:\docume~1\alluse~1\applic~1\etesymaduv.dll
2009-08-18 10:42 14,275 a——- c:\windows\ojeryd._dl
2009-08-18 10:42 13,260 a——- c:\windows\uxeduroki.db
2009-08-18 10:42 12,667 a——- c:\docume~1\colby\applic~1\yqoky.reg
2009-08-18 10:42 12,094 a——- c:\windows\tijufej.db
2009-08-18 10:42 11,673 a——- c:\windows\zymas.reg
2009-08-18 10:42 11,601 a——- c:\docume~1\alluse~1\applic~1\ydykux.bin
2009-08-18 10:42 11,145 a——- c:\program files\common files\opipeb.dat
2009-08-18 10:42 10,750 a——- c:\windows\lucoxyqaxu.vbs
2009-08-18 10:42 10,745 a——- c:\windows\icola.scr
2009-08-18 10:42 347,741 a——- c:\windows\system32\_scui.cpl
2009-08-18 10:42 –d—– c:\program files\PC_Antispyware2010
2009-08-18 10:36 11,264 a——- c:\windows\braviax.exe
2009-08-18 10:36 6,144 a——- c:\windows\system32\cru629.dat
2009-08-18 10:36 6,144 a——- c:\windows\cru629.dat
2009-08-18 10:34 190,157 a——- c:\windows\system32\wisdstr.exe
2009-08-18 10:34 11,264 a——- c:\windows\system32\braviax.exe
2009-08-12 01:44 –d—– c:\windows\ServicePackFiles
2009-08-08 10:37 150,544 a——- c:\windows\system32\8cd3622e9eccb3a66b1d6babb8c0d96f.exe
2009-08-08 10:37 124,448 a——- c:\windows\system32\4d46fc928d7cf583a3f2b0127e04ace8.exe
2009-08-08 10:37 244,752 a——- c:\windows\system32\840b7737de16d27435105dd116bb5541.exe
2009-08-06 08:58 192,529 a——- c:\windows\system32\kdpini.dll
2009-08-05 08:58 150,544 a——- c:\windows\system32\dcc9e00f18fa13f3f715eb37aae32d0b.exe
2009-08-05 08:58 124,448 a——- c:\windows\system32\e76d0594a148ecfad424835b3aa7ec65.exe
2009-08-05 08:58 244,752 a——- c:\windows\system32\22d6fce7c2438ae8134cf6f9c2962650.exe
2009-08-01 16:24 150,544 a——- c:\windows\system32\d68a6b66bd72932970a94d415229b821.exe
2009-08-01 16:24 124,448 a——- c:\windows\system32\060fb5624b8c0bda040b568a8eba1cc4.exe
2009-08-01 16:24 244,752 a——- c:\windows\system32\4a5b4dbedcb0fcab49ec7bd50b05f7fa.exe
2009-07-29 23:11 –d—– c:\windows\scratch_recording
2009-07-28 00:17 116,224 ——– c:\windows\system32\fdcceddbbbe.dll
==================== Find3M ====================
2009-08-18 10:34 29,184 a——- c:\windows\system32\drivers\beep.sys
2009-08-13 16:51 2,516 a–sh— c:\windows\system32\KGyGaAvL.sys
2009-08-05 04:11 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-07-17 13:55 58,880 a——- c:\windows\system32\atl.dll
2009-07-13 02:18 233,472 a——- c:\windows\system32\wmpdxm.dll
2009-06-26 11:18 659,456 a——- c:\windows\system32\wininet.dll
2009-06-26 11:18 81,920 a——- c:\windows\system32\ieencode.dll
2009-06-18 19:55 0 a——- C:\jswohrrf.exe
2009-06-18 19:55 8,704 a——- C:\ngamcx.exe
2009-06-18 19:54 184,848 a——- C:\dtnln.exe
2009-06-16 09:55 119,808 a——- c:\windows\system32\t2embed.dll
2009-06-16 09:55 82,432 a——- c:\windows\system32\fontsub.dll
2009-06-12 06:50 76,288 a——- c:\windows\system32\telnet.exe
2009-06-10 09:21 84,992 a——- c:\windows\system32\avifil32.dll
2009-06-10 01:32 132,096 a——- c:\windows\system32\wkssvc.dll
2009-06-08 16:30 629,760 a——- c:\windows\ElectricSheep_2_7b17.scr
2009-06-05 02:42 655,872 a——- c:\windows\system32\mstscax.dll
2009-06-05 02:01 9,214,464 a——- c:\windows\avcodec-52.dll
2009-06-05 02:01 745,984 a——- c:\windows\avformat-52.dll
2009-06-05 02:01 218,624 a——- c:\windows\swscale-0.dll
2009-06-05 02:01 70,144 a——- c:\windows\avutil-50.dll
2009-06-03 14:27 1,290,752 a——- c:\windows\system32\quartz.dll
============= FINISH: 21:32:40.56 ===============
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/24 21:38
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================
Drivers
——————-
Name: d687ef078237ccde711cf10ae711031f.sys
Image Path: d687ef078237ccde711cf10ae711031f.sys
Address: 0xF8546000 Size: 57344 File Visible: No Signed: -
Status: -
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF66C6000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8AAC000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF4B9E000 Size: 49152 File Visible: No Signed: -
Status: -
Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0xF88F6000 Size: 20480 File Visible: No Signed: -
Status: -
Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xF395A000 Size: 53248 File Visible: No Signed: -
Status: -
Processes
——————-
Path: C:\WINDOWS\system32\braviax.exe
PID: 1828 Status: Hidden from the Windows API!
SSDT
——————-
#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\System32\Drivers\Beep.SYS" at address 0xf86781a0
Hidden Services
——————-
Service Name: d687ef078237ccde711cf10ae711031f
Image Path: system32\d687ef078237ccde711cf10ae711031f.sys
==EOF==
Thanks for responding so soon!