What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] browser hijack 64.15.72.104.

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi there I keep getting redirected, using mozilla and keep getting redirected to carp** sites, particuarly bad when trying to find solutions, eg cannot get lava soft home page to load etc ran HiJack log as follows: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:18:44, on 10/03/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\AVG\AVG9\avgtray.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\abce9aad3dbe2b7775faf585c070cc03\update\update.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{4765DD29-E64B-4D44-8523-07042C8C6299}: NameServer = 212.139.132.6 212.139.132.7 O17 - HKLM\System\CS1\Services\Tcpip\..\{4765DD29-E64B-4D44-8523-07042C8C6299}: NameServer = 212.139.132.6 212.139.132.7 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O22 - SharedTaskScheduler: CmsemitaPsb - {EAA64D1E-7DF1-489A-86CE-0D5E601C0EC3} - (no file) O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe – End of file - 4898 bytes Has anyone got advice??
Post #2
Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3 last edited
Hi there many thanks for reply here are requested logs

dds:


DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] on 10/03/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.511.34 [GMT 0:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Desktop\MALWARE\dds.com

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoDFSTab = 0 (0x0)
uPolicies-explorer: NoFileAssociate = 0 (0x0)
uPolicies-explorer: NoChangeAnimation = 0 (0x0)
uPolicies-explorer: =
uPolicies-explorer: NoInstrumentation = 1 (0x1)
mPolicies-explorer: NoCommonGroups = 0 (0x0)
mPolicies-explorer: NoSimpleStartMenu = 0 (0x0)
mPolicies-explorer: HideClock = 0 (0x0)
mPolicies-explorer: NoSMMyPictures = 0 (0x0)
mPolicies-explorer: NoStartMenuMyMusic = 0 (0x0)
IE: &Search;
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
TCP: {4765DD29-E64B-4D44-8523-07042C8C6299} = 212.139.132.6 212.139.132.7
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
STS: CmsemitaPsb: {eaa64d1e-7df1-489a-86ce-0d5e601c0ec3} - CmsemitaPsb.Cmsemita
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
LSA: Authentication Packages = msv1_0 nwprovau
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\rikki\applic~1\mozilla\firefox\profiles\gjddc4oy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://eu.ixquick.com/do/metasearch.pl|http://www.startpage.com/|http://www.inbox.com/
FF - plugin: c:\windows\system32\c2mp\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-3-6 64288]
R1 lstone;Pinnacle Systems DV500 Overlay;c:\windows\system32\drivers\LStone2k.sys [2010-1-26 256113]
R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [2010-1-26 5543]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-3-9 19160]
S3 echo1394;Onyx 400F service;c:\windows\system32\drivers\echo1394.sys [2007-5-16 59264]
S3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [2008-4-4 568320]

=============== Created Last 30 ================

2010-03-10 18:09:48 0 d—–w- c:\program files\Trend Micro
2010-03-10 16:38:13 1418 —-a-w- c:\windows\system32\tmp.reg
2010-03-10 14:49:20 0 d—–w- c:\program files\Spyware Doctor
2010-03-10 14:45:23 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-03-09 12:35:18 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-09 12:35:15 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-09 12:35:15 0 d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-09 12:27:14 0 d—–w- c:\docume~1\rikki\applic~1\Malwarebytes
2010-03-09 12:27:00 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-06 18:15:08 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-03-06 18:14:58 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-06 18:11:48 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-05 15:40:08 0 d—–w- c:\windows\system32\wbem\Repository
2010-02-24 10:08:28 306688 —-a-w- c:\windows\IsUninst.exe
2010-02-24 10:07:13 0 d—–w- c:\program files\Sonic Foundry Plug-Ins
2010-02-23 20:47:23 0 d—–w- c:\program files\YAMAHA
2010-02-19 20:16:15 0 d—–w- c:\docume~1\rikki\applic~1\Antares
2010-02-19 20:12:30 1181022 —-a-w- c:\windows\system32\TmpA5962671
2010-02-19 20:11:54 1764177 —-a-w- c:\windows\system32\TmpA5926968
2010-02-19 17:44:39 0 d—–w- c:\program files\Sony Setup

==================== Find3M ====================

2010-03-07 11:05:56 2608 —-a-w- c:\windows\system32\d3d9caps.dat
2010-02-05 12:13:29 7296 —-a-w- c:\windows\system32\drivers\osaio.sys
2010-02-05 11:22:47 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-30 13:12:39 6475776 —-a-w- c:\windows\system32\PSP VintageWarmer2.dll
2009-07-19 14:40:11 728384 —-a-w- c:\program files\ST2InstrCache.dat
2001-03-30 12:00:56 32768 –sha-r- c:\windows\system32\hanlinne.dll

============= FINISH: 20:04:28.21 ===============


GMER


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-11 04:12:18
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Rikki\LOCALS~1\Temp\pxtdipow.sys


—- System - GMER 1.0.15 —-

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF85A587E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF85A5BFE]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort0 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort1 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort2 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort3 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-1b [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-13 [F84819F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-

Attach file states
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
Howd i upload it??



Thanx again
Post #4
Hi,

Please do the following:


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.



(you can post the extras.txt log if you cannot attach it.)
Post #5
Hi there just ran combo fix and browsing seems to have returned to normal, here are the logs:

ComboFx

ComboFix 10-03-10.07 - Rikki 11/03/2010 11:26:59.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.511.110 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Rikki\Application Data\Desktopicon
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\msvcsv60.dll
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((( Files Created from 2010-02-11 to 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-10 18:09 . 2010-03-10 18:09 ——– d—–w- c:\program files\Trend Micro
2010-03-10 14:49 . 2010-03-10 17:20 ——– d—–w- c:\program files\Spyware Doctor
2010-03-10 14:45 . 2010-02-24 09:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-03-09 12:35 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-09 12:35 . 2010-03-09 12:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-09 12:35 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-09 12:27 . 2010-03-09 12:27 ——– d—–w- c:\documents and settings\Rikki\Application Data\Malwarebytes
2010-03-09 12:27 . 2010-03-09 12:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-06 18:15 . 2010-02-04 15:53 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-03-06 18:14 . 2010-03-06 18:14 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-03-06 18:11 . 2010-03-06 18:11 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-05 15:40 . 2010-03-05 15:40 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-24 10:08 . 1998-10-29 18:45 306688 —-a-w- c:\windows\IsUninst.exe
2010-02-24 10:07 . 2010-02-24 10:09 ——– d—–w- c:\program files\Sonic Foundry Plug-Ins
2010-02-23 20:47 . 2010-02-23 20:47 ——– d—–w- c:\program files\YAMAHA
2010-02-19 20:16 . 2010-02-19 20:16 ——– d—–w- c:\documents and settings\Rikki\Application Data\Antares
2010-02-19 17:51 . 2010-03-10 17:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-19 17:44 . 2010-02-19 18:22 ——– d—–w- c:\program files\Sony Setup

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 11:38 . 2010-01-25 21:41 24 —-a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000005-00001102-00000002-80611102}.dat
2010-03-11 11:38 . 2010-01-25 21:41 24 —-a-w- c:\windows\system32\DVCState-{00000002-00000000-00000005-00001102-00000002-80611102}.dat
2010-03-10 16:33 . 2009-10-18 14:43 ——– d—–w- c:\program files\uTorrent
2010-03-10 14:47 . 2009-10-13 12:55 ——– d—–w- c:\documents and settings\Rikki\Application Data\uTorrent
2010-03-07 11:05 . 2009-09-12 14:49 2608 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-06 23:02 . 2010-02-04 20:48 ——– d—–w- c:\documents and settings\Rikki\Application Data\vlc
2010-03-06 18:12 . 2007-12-22 17:35 ——– d—–w- c:\program files\Lavasoft
2010-02-24 11:08 . 2008-05-01 18:53 ——– d—–w- c:\program files\iZotope
2010-02-24 10:45 . 2008-11-10 16:58 96 —-a-w- c:\windows\msocreg32.dat
2010-02-24 10:11 . 2007-12-22 19:31 ——– d—–w- c:\program files\Sony
2010-02-23 20:47 . 2007-12-22 16:50 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-23 20:47 . 2007-12-22 18:13 ——– d—–w- c:\program files\VstPlugins
2010-02-19 20:16 . 2008-03-06 01:15 ——– d—–w- c:\program files\Antares Audio Technologies
2010-02-19 17:51 . 2007-12-22 19:32 ——– d—–w- c:\documents and settings\Rikki\Application Data\Sony
2010-02-19 13:48 . 2008-04-26 15:09 ——– d—–w- c:\documents and settings\Rikki\Application Data\DivX
2010-02-11 15:21 . 2009-07-30 11:41 ——– d—–w- c:\documents and settings\Rikki\Application Data\Onyx F Series Console
2010-02-07 01:19 . 2008-05-09 19:04 ——– d—–w- c:\program files\Java
2010-02-05 12:13 . 2010-02-05 12:14 7296 —-a-w- c:\windows\system32\drivers\osaio.sys
2010-02-05 12:03 . 2010-02-05 12:03 ——– d—–w- c:\program files\ATI Technologies
2010-02-05 11:22 . 2008-01-10 00:24 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-02-04 20:41 . 2009-10-19 07:42 ——– d—–w- c:\program files\Essentials Codec Pack
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\program files\Common Files\Webroot Shared
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\documents and settings\Rikki\Application Data\Webroot
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\program files\Webroot
2010-02-03 16:59 . 2010-01-21 13:39 ——– d—–w- c:\documents and settings\All Users\Application Data\LightScribe
2010-02-01 13:25 . 2010-02-01 13:25 ——– d—–w- c:\program files\Mackie Onyx F Series
2010-01-31 11:45 . 2009-10-13 13:22 ——– d—–w- c:\program files\Ableton
2010-01-30 13:13 . 2010-01-30 13:13 ——– d—–w- c:\program files\PSPaudioware
2010-01-30 13:12 . 2010-01-30 13:12 6475776 —-a-w- c:\windows\system32\PSP VintageWarmer2.dll
2010-01-26 02:55 . 2009-09-12 14:25 ——– d—–w- c:\program files\Spotmau
2010-01-26 00:32 . 2010-01-21 13:30 ——– d—–w- c:\documents and settings\All Users\Application Data\boost_interprocess
2010-01-26 00:29 . 2007-12-22 19:32 97936 —-a-w- c:\documents and settings\Rikki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-26 00:05 . 2010-01-26 00:00 ——– d—–w- c:\program files\Pinnacle
2010-01-25 23:55 . 2008-01-09 22:15 ——– d—–w- c:\program files\Cleaner 5 EZ
2010-01-25 23:54 . 2010-01-25 23:54 ——– d—–w- c:\program files\Windows Media Components
2010-01-25 23:31 . 2010-01-25 23:31 ——– d—–w- c:\program files\XP Codec Pack
2010-01-25 21:16 . 2009-07-29 21:57 ——– d—–w- c:\program files\Creative
2010-01-25 19:35 . 2010-01-25 19:35 ——– d—–w- c:\program files\kX Audio Driver
2010-01-25 16:08 . 2010-01-25 16:08 ——– d—–w- c:\program files\Realtek AC97
2010-01-25 15:19 . 2010-01-25 15:19 ——– d—–w- c:\documents and settings\Rikki\Application Data\WinBatch
2010-01-25 15:18 . 2010-01-25 15:18 ——– d—–w- c:\program files\Intel
2010-01-25 15:17 . 2010-01-25 15:17 ——– d—–w- c:\program files\Common Files\Logitech
2010-01-25 15:17 . 2010-01-25 15:17 ——– d—–w- c:\program files\MouseWare
2010-01-25 14:25 . 2010-01-25 14:25 ——– d—–w- c:\documents and settings\Rikki\Application Data\Blitware
2010-01-25 14:25 . 2010-01-25 14:25 ——– d—–w- c:\program files\Driver Robot
2010-01-24 14:05 . 2010-01-24 14:03 ——– d—–w- c:\program files\MIDIOX
2010-01-21 13:39 . 2007-12-28 18:12 ——– d—–w- c:\program files\Common Files\LightScribe
2010-01-21 13:31 . 2010-01-21 13:30 ——– d—–w- c:\documents and settings\Rikki\Application Data\Multi File Downloader
2010-01-21 12:27 . 2010-01-17 00:11 ——– d—–w- c:\documents and settings\Rikki\Application Data\Dropbox
2010-01-21 00:49 . 2008-02-15 22:06 ——– d—–w- c:\program files\NCH Swift Sound
2010-01-17 16:33 . 2008-06-23 21:07 ——– d—–w- c:\program files\DivX
2010-01-16 20:31 . 2010-01-16 20:01 ——– d—–w- c:\documents and settings\Rikki\Application Data\YouSendIt
2010-01-16 20:01 . 2010-01-16 20:01 ——– d—–w- c:\program files\YouSendIt
2010-01-16 14:23 . 2010-01-16 14:23 ——– d—–w- c:\program files\TC Electronic
2010-01-15 21:59 . 2008-08-04 00:21 ——– d—–w- c:\program files\AVG
2009-07-19 14:40 . 2009-04-01 17:57 728384 —-a-w- c:\program files\ST2InstrCache.dat
2001-03-30 12:00 . 2001-03-30 12:00 32768 –sha-r- c:\windows\system32\hanlinne.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-05-06 17:11 1145736 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-06 1145736]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCommonGroups"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDFSTab"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Rikki^Start Menu^Programs^Startup^OneNote Table Of Contents.onetoc2]
path=c:\documents and settings\Rikki\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2
backup=c:\windows\pss\OneNote Table Of Contents.onetoc2Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 01:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\basicsmssmenu]
2007-10-09 16:21 169328 —-a-w- c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EM_EXEC]
2002-05-01 09:50 28672 —-a-w- c:\progra~1\MOUSEW~1\system\EM_EXEC.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 00:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
2005-05-11 02:46 200069 —-a-w- c:\program files\Syncrosoft\POS\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-09-11 03:40 86960 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 01:00 28672 —-a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kX Mixer]
2008-04-04 23:10 500224 —-a-w- c:\windows\system32\kxmixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2009-11-20 14:30 2363392 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-01-07 16:07 429392 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Matrox Powerdesk]
2004-09-14 09:13 684032 ——w- c:\windows\system32\PDesk\pdesk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NewsUpd]
2000-08-04 02:50 44032 —-a-w- c:\program files\Creative\News\NewsUpd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 16:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 15:28 577536 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
2004-01-26 11:38 866816 —-a-w- c:\program files\Thomson\SpeedTouch USB\dragdiag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 04:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 01:00 90112 ——w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
2005-03-08 10:02 910336 —-a-w- c:\program files\Webroot\Washer\wwDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
2002-07-02 17:56 24576 —-a-w- c:\windows\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YouSendIt.exe]
2009-10-02 14:32 82432 —-a-w- c:\program files\YouSendIt\Express\YouSendIt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Rikki\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/03/2010 18:15 64288]
R1 lstone;Pinnacle Systems DV500 Overlay;c:\windows\system32\drivers\LStone2k.sys [26/01/2010 00:00 256113]
R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [26/01/2010 00:00 5543]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 15:52 1229232]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [09/03/2010 12:35 236368]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [09/03/2010 12:35 19160]
S3 echo1394;Onyx 400F service;c:\windows\system32\drivers\echo1394.sys [16/05/2007 18:34 59264]
S3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [04/04/2008 23:10 568320]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-11-20 14:28 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-03-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 18:14]

2010-02-21 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.2.0.5\DriverRobot.exe [2010-01-25 08:53]

2010-03-11 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-05-06 17:11]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Rikki\Application Data\Mozilla\Firefox\Profiles\gjddc4oy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://eu.ixquick.com/do/metasearch.pl|http://www.startpage.com/|http://www.inbox.com/
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

SharedTaskScheduler-{EAA64D1E-7DF1-489A-86CE-0D5E601C0EC3} - (no file)
Notify-WgaLogon - (no file)
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-My Web Search Bar - c:\progra~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL
MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-FileZilla Client - g:\programs\FileZilla FTP Client\uninstall.exe
AddRemove-IL Autogun - c:\program files\Image-Line\uninstall.exe
AddRemove-Windows Drivers - c:\program files\Creative\SBLive2k\Program\Upddrv2k.EXE
AddRemove-Windows Essentials Media Codec Pack - c:\program files\Essentials Codec Pack\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 11:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ôw*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2580)
c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\MsPMSPSv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-03-11 11:59:07 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-11 11:59

Pre-Run: 19,324,190,720 bytes free
Post-Run: 19,402,661,888 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 74E32FB9735E17CD0508854E7F9ED38E


Hopefully this is the end of this problem for all help many many thanx, very poor at the moment but will donate wen funds improve:0)
Post #6
Hi,

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/browser_hijack_64_15_72_104_t110825.html

Collect::
c:\windows\system32\hanlinne.dll

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • Combofix Log
  • MBAM Log
  • Kaspersky report
Post #7
Hi there here are my recent scans:

Combo

ComboFix 10-03-10.07 - Rikki 11/03/2010 14:28:31.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.511.199 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Rikki\Desktop\CFScript.txt

file zipped: c:\windows\system32\hanlinne.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\hanlinne.dll

.
((((((((((((((((((((((((( Files Created from 2010-02-11 to 2010-03-11 )))))))))))))))))))))))))))))))
.

2010-03-10 18:09 . 2010-03-10 18:09 ——– d—–w- c:\program files\Trend Micro
2010-03-10 14:49 . 2010-03-10 17:20 ——– d—–w- c:\program files\Spyware Doctor
2010-03-10 14:45 . 2010-02-24 09:16 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-03-09 12:35 . 2010-01-07 16:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-09 12:35 . 2010-03-09 12:35 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-09 12:35 . 2010-01-07 16:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-09 12:27 . 2010-03-09 12:27 ——– d—–w- c:\documents and settings\Rikki\Application Data\Malwarebytes
2010-03-09 12:27 . 2010-03-09 12:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-06 18:15 . 2010-02-04 15:53 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-03-06 18:11 . 2010-03-06 18:11 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-03-06 18:11 . 2010-02-04 15:53 2954656 -c–a-w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe
2010-03-05 15:40 . 2010-03-05 15:40 ——– d—–w- c:\windows\system32\wbem\Repository
2010-02-24 10:08 . 1998-10-29 18:45 306688 —-a-w- c:\windows\IsUninst.exe
2010-02-24 10:07 . 2010-02-24 10:09 ——– d—–w- c:\program files\Sonic Foundry Plug-Ins
2010-02-23 20:47 . 2010-02-23 20:47 ——– d—–w- c:\program files\YAMAHA
2010-02-19 20:16 . 2010-02-19 20:16 ——– d—–w- c:\documents and settings\Rikki\Application Data\Antares
2010-02-19 17:51 . 2010-03-10 17:19 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-19 17:44 . 2010-02-19 18:22 ——– d—–w- c:\program files\Sony Setup

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-11 13:21 . 2010-01-25 21:41 24 —-a-w- c:\windows\system32\DVCStateBkp-{00000002-00000000-00000005-00001102-00000002-80611102}.dat
2010-03-11 13:21 . 2010-01-25 21:41 24 —-a-w- c:\windows\system32\DVCState-{00000002-00000000-00000005-00001102-00000002-80611102}.dat
2010-03-10 16:33 . 2009-10-18 14:43 ——– d—–w- c:\program files\uTorrent
2010-03-10 14:47 . 2009-10-13 12:55 ——– d—–w- c:\documents and settings\Rikki\Application Data\uTorrent
2010-03-07 11:05 . 2009-09-12 14:49 2608 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-06 23:02 . 2010-02-04 20:48 ——– d—–w- c:\documents and settings\Rikki\Application Data\vlc
2010-03-06 18:12 . 2007-12-22 17:35 ——– d—–w- c:\program files\Lavasoft
2010-02-24 11:08 . 2008-05-01 18:53 ——– d—–w- c:\program files\iZotope
2010-02-24 10:45 . 2008-11-10 16:58 96 —-a-w- c:\windows\msocreg32.dat
2010-02-24 10:11 . 2007-12-22 19:31 ——– d—–w- c:\program files\Sony
2010-02-23 20:47 . 2007-12-22 16:50 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-23 20:47 . 2007-12-22 18:13 ——– d—–w- c:\program files\VstPlugins
2010-02-19 20:16 . 2008-03-06 01:15 ——– d—–w- c:\program files\Antares Audio Technologies
2010-02-19 17:51 . 2007-12-22 19:32 ——– d—–w- c:\documents and settings\Rikki\Application Data\Sony
2010-02-19 13:48 . 2008-04-26 15:09 ——– d—–w- c:\documents and settings\Rikki\Application Data\DivX
2010-02-11 15:21 . 2009-07-30 11:41 ——– d—–w- c:\documents and settings\Rikki\Application Data\Onyx F Series Console
2010-02-07 01:19 . 2008-05-09 19:04 ——– d—–w- c:\program files\Java
2010-02-07 01:16 . 2010-02-07 01:16 152576 —-a-w- c:\documents and settings\Rikki\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-02-07 01:16 . 2010-02-07 01:16 79488 —-a-w- c:\documents and settings\Rikki\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-05 12:13 . 2010-02-05 12:14 7296 —-a-w- c:\windows\system32\drivers\osaio.sys
2010-02-05 12:03 . 2010-02-05 12:03 ——– d—–w- c:\program files\ATI Technologies
2010-02-05 11:22 . 2008-01-10 00:24 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-02-04 20:41 . 2009-10-19 07:42 ——– d—–w- c:\program files\Essentials Codec Pack
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\program files\Common Files\Webroot Shared
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\documents and settings\Rikki\Application Data\Webroot
2010-02-04 16:43 . 2010-02-04 16:43 ——– d—–w- c:\program files\Webroot
2010-02-03 16:59 . 2010-01-21 13:39 ——– d—–w- c:\documents and settings\All Users\Application Data\LightScribe
2010-02-01 13:25 . 2010-02-01 13:25 ——– d—–w- c:\program files\Mackie Onyx F Series
2010-01-31 11:45 . 2009-10-13 13:22 ——– d—–w- c:\program files\Ableton
2010-01-30 13:13 . 2010-01-30 13:13 ——– d—–w- c:\program files\PSPaudioware
2010-01-30 13:12 . 2010-01-30 13:12 6475776 —-a-w- c:\windows\system32\PSP VintageWarmer2.dll
2010-01-29 13:20 . 2010-01-29 12:39 93302066 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\07aaee1818a1e78c170d49b4a3319141\IDU_2.1.9.66.exe
2010-01-29 12:51 . 2010-01-29 12:39 40161344 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\35796217088d2a088438f747d5c3caf2\SBAXVSD_PCDRV_LB_2_12_0002.exe
2010-01-29 12:49 . 2010-01-29 12:39 23993760 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\7ff3c171c8c633e4affd84881589d277\gfiz11us.exe
2010-01-29 12:45 . 2010-01-29 12:39 2824728 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\a8eb6d8660ff14ee87b66b195a17b361\INF_allOS_9[1].1.0.1012_PV.exe
2010-01-29 12:41 . 2010-01-29 12:39 2638675 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\9076a43a7252a5aeec3c83c2044ad2a6\qi3z05us.exe
2010-01-29 12:41 . 2010-01-29 12:39 3016336 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\2012541bae27a71568b0d102981b2b7a\7jgc08ww.exe
2010-01-29 12:40 . 2010-01-29 12:39 469235 —-a-w- c:\documents and settings\Rikki\Application Data\Blitware\DriverRobot\downloads\84021c284b39003970732cd428056f10\sp27449.exe
2010-01-26 02:55 . 2009-09-12 14:25 ——– d—–w- c:\program files\Spotmau
2010-01-26 00:32 . 2010-01-21 13:30 ——– d—–w- c:\documents and settings\All Users\Application Data\boost_interprocess
2010-01-26 00:29 . 2007-12-22 19:32 97936 —-a-w- c:\documents and settings\Rikki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-26 00:05 . 2010-01-26 00:00 ——– d—–w- c:\program files\Pinnacle
2010-01-25 23:55 . 2008-01-09 22:15 ——– d—–w- c:\program files\Cleaner 5 EZ
2010-01-25 23:54 . 2010-01-25 23:54 ——– d—–w- c:\program files\Windows Media Components
2010-01-25 23:31 . 2010-01-25 23:31 ——– d—–w- c:\program files\XP Codec Pack
2010-01-25 21:16 . 2009-07-29 21:57 ——– d—–w- c:\program files\Creative
2010-01-25 19:35 . 2010-01-25 19:35 ——– d—–w- c:\program files\kX Audio Driver
2010-01-25 16:08 . 2010-01-25 16:08 ——– d—–w- c:\program files\Realtek AC97
2010-01-25 15:19 . 2010-01-25 15:19 ——– d—–w- c:\documents and settings\Rikki\Application Data\WinBatch
2010-01-25 15:18 . 2010-01-25 15:18 ——– d—–w- c:\program files\Intel
2010-01-25 15:17 . 2010-01-25 15:17 ——– d—–w- c:\program files\Common Files\Logitech
2010-01-25 15:17 . 2010-01-25 15:17 ——– d—–w- c:\program files\MouseWare
2010-01-25 14:25 . 2010-01-25 14:25 ——– d—–w- c:\documents and settings\Rikki\Application Data\Blitware
2010-01-25 14:25 . 2010-01-25 14:25 ——– d—–w- c:\program files\Driver Robot
2010-01-24 14:05 . 2010-01-24 14:03 ——– d—–w- c:\program files\MIDIOX
2010-01-21 13:39 . 2007-12-28 18:12 ——– d—–w- c:\program files\Common Files\LightScribe
2010-01-21 13:31 . 2010-01-21 13:30 ——– d—–w- c:\documents and settings\Rikki\Application Data\Multi File Downloader
2010-01-21 12:27 . 2010-01-17 00:11 ——– d—–w- c:\documents and settings\Rikki\Application Data\Dropbox
2010-01-21 00:49 . 2008-02-15 22:06 ——– d—–w- c:\program files\NCH Swift Sound
2010-01-17 16:33 . 2008-06-23 21:07 ——– d—–w- c:\program files\DivX
2010-01-17 00:12 . 2010-01-17 00:12 89854 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\Uninstall.exe
2010-01-16 20:31 . 2010-01-16 20:01 ——– d—–w- c:\documents and settings\Rikki\Application Data\YouSendIt
2010-01-16 20:01 . 2010-01-16 20:01 ——– d—–w- c:\program files\YouSendIt
2010-01-16 14:23 . 2010-01-16 14:23 ——– d—–w- c:\program files\TC Electronic
2010-01-15 21:59 . 2008-08-04 00:21 ——– d—–w- c:\program files\AVG
2009-12-31 00:48 . 2009-12-31 00:48 21968784 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\Dropbox.exe
2009-07-19 14:40 . 2009-04-01 17:57 728384 —-a-w- c:\program files\ST2InstrCache.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-05-06 17:11 1145736 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-05-06 1145736]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Rikki\Application Data\Dropbox\bin\DropboxExt.13.dll

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCommonGroups"= 0 (0x0)
"NoSimpleStartMenu"= 0 (0x0)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDFSTab"= 0 (0x0)
"NoFileAssociate"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Rikki^Start Menu^Programs^Startup^OneNote Table Of Contents.onetoc2]
path=c:\documents and settings\Rikki\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2
backup=c:\windows\pss\OneNote Table Of Contents.onetoc2Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 01:04 39792 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\basicsmssmenu]
2007-10-09 16:21 169328 —-a-w- c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 12:00 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EM_EXEC]
2002-05-01 09:50 28672 —-a-w- c:\progra~1\MOUSEW~1\system\EM_EXEC.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 00:47 31016 —-a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
2005-05-11 02:46 200069 —-a-w- c:\program files\Syncrosoft\POS\H2O\cledx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-09-11 03:40 86960 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection]
2001-11-29 01:00 28672 —-a-w- c:\program files\Creative\SBLive\Program\ADGJDet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kX Mixer]
2008-04-04 23:10 500224 —-a-w- c:\windows\system32\kxmixer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2009-11-20 14:30 2363392 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-01-07 16:07 429392 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Matrox Powerdesk]
2004-09-14 09:13 684032 ——w- c:\windows\system32\PDesk\pdesk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NewsUpd]
2000-08-04 02:50 44032 —-a-w- c:\program files\Creative\News\NewsUpd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-01-05 16:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2007-04-16 15:28 577536 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics]
2004-01-26 11:38 866816 —-a-w- c:\program files\Thomson\SpeedTouch USB\dragdiag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 04:17 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
2000-05-11 01:00 90112 ——w- c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Window Washer]
2005-03-08 10:02 910336 —-a-w- c:\program files\Webroot\Washer\wwDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WINDVDPatch]
2002-07-02 17:56 24576 —-a-w- c:\windows\system32\CTHELPER.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YouSendIt.exe]
2009-10-02 14:32 82432 —-a-w- c:\program files\YouSendIt\Express\YouSendIt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\Rikki\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/03/2010 18:15 64288]
R1 lstone;Pinnacle Systems DV500 Overlay;c:\windows\system32\drivers\LStone2k.sys [26/01/2010 00:00 256113]
R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [26/01/2010 00:00 5543]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [09/03/2010 12:35 236368]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [09/03/2010 12:35 19160]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [04/02/2010 15:52 1229232]
S3 echo1394;Onyx 400F service;c:\windows\system32\drivers\echo1394.sys [16/05/2007 18:34 59264]
S3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [04/04/2008 23:10 568320]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-11-20 14:28 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-03-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 18:14]

2010-02-21 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.2.0.5\DriverRobot.exe [2010-01-25 08:53]

2010-03-11 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2009-05-06 17:11]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Rikki\Application Data\Mozilla\Firefox\Profiles\gjddc4oy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://eu.ixquick.com/do/metasearch.pl|http://www.startpage.com/|http://www.inbox.com/
FF - plugin: c:\windows\system32\C2MP\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 14:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ôw*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
Completion time: 2010-03-11 14:41:39
ComboFix-quarantined-files.txt 2010-03-11 14:41
ComboFix2.txt 2010-03-11 11:59

Pre-Run: 19,405,123,584 bytes free
Post-Run: 19,366,825,984 bytes free

- - End Of File - - 29384A890D9AD07120CAE11D34C3B875


mbam:


Malwarebytes' Anti-Malware 1.44
Database version: 3852
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

11/03/2010 15:03:12
mbam-log-2010-03-11 (15-03-12).txt

Scan type: Quick Scan
Objects scanned: 139491
Time elapsed: 6 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Kaspersky:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, March 11, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, March 11, 2010 12:42:51
Records in database: 3767439
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 162111
Threats found: 1
Infected objects found: 1
Suspicious objects found: 0
Scan duration: 04:14:59


File name / Threat / Threats count
C:\System Volume Information\_restore{1172776B-B66E-4359-8733-30AED1818A08}\RP42\A0019112.sys Infected: Rootkit.Win32.TDSS.u 1

Selected area has been scanned.



thanks again
Post #8
Hi

Please do the following:


Please open this link HERE in a new window.

In the box marked Link to topic where this file was requested: please paste in the following text
http://forums.whatthetech.com/browser_hijack_64_15_72_104_t110825.html

Click the Browse button and navigate to C:\Qoobox\Quarantine

There should be a zip file there called [4]-Submit_****-**-**_**.**.**.zip ( the * denotes Date and Time stamp - yours will be close to 11/03/2010 14:28:31 )
Select this file and click Open
In the Largest box please put
File Requested By CatByte
Failed Collect::

Finally click SendFile

Please return here and let me know when that file has been uploaded.


NEXT

Please post a fresh DDS and Attach.txt and advise how your computer is running now and if there are any outstanding issues.
Post #9
Hi there file uploaded hers recent dds log: DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 11:16:45.43 on 12/03/2010 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.511.105 [GMT 0:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Rikki\Desktop\MALWARE\dds.com ============== Pseudo HJT Report =============== BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE uPolicies-explorer: NoDFSTab = 0 (0x0) uPolicies-explorer: NoFileAssociate = 0 (0x0) uPolicies-explorer: NoChangeAnimation = 0 (0x0) uPolicies-explorer: = uPolicies-explorer: NoInstrumentation = 1 (0x1) mPolicies-explorer: NoCommonGroups = 0 (0x0) mPolicies-explorer: NoSimpleStartMenu = 0 (0x0) mPolicies-explorer: NoSMMyPictures = 0 (0x0) mPolicies-explorer: NoStartMenuMyMusic = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab TCP: {4765DD29-E64B-4D44-8523-07042C8C6299} = 212.139.132.6 212.139.132.7 Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL LSA: Authentication Packages = msv1_0 nwprovau mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe" ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\rikki\applic~1\mozilla\firefox\profiles\gjddc4oy.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://eu.ixquick.com/do/metasearch.pl|http://www.startpage.com/|http://www.inbox.com/ FF - plugin: c:\windows\system32\c2mp\npdivx32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-3-6 64288] R1 lstone;Pinnacle Systems DV500 Overlay;c:\windows\system32\drivers\LStone2k.sys [2010-1-26 256113] R1 MemAlloc;MemAlloc;c:\windows\system32\drivers\MemAlloc.sys [2010-1-26 5543] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-3-9 236368] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-3-9 19160] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1229232] S3 echo1394;Onyx 400F service;c:\windows\system32\drivers\echo1394.sys [2007-5-16 59264] S3 kxwdmdrv;kX WDM Driver Service;c:\windows\system32\drivers\kx.sys [2008-4-4 568320] =============== Created Last 30 ================ 2010-03-11 14:28:27 1235 —-a-w- C:\CF-Submit.htm 2010-03-11 11:19:27 0 d-sha-r- C:\cmdcons 2010-03-11 11:15:59 98816 —-a-w- c:\windows\sed.exe 2010-03-11 11:15:59 77312 —-a-w- c:\windows\MBR.exe 2010-03-11 11:15:59 261632 —-a-w- c:\windows\PEV.exe 2010-03-11 11:15:59 161792 —-a-w- c:\windows\SWREG.exe 2010-03-10 18:09:48 0 d—–w- c:\program files\Trend Micro 2010-03-10 14:49:20 0 d—–w- c:\program files\Spyware Doctor 2010-03-10 14:45:23 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-03-09 12:35:18 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-09 12:35:15 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-03-09 12:35:15 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-03-09 12:27:14 0 d—–w- c:\docume~1\rikki\applic~1\Malwarebytes 2010-03-09 12:27:00 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-03-06 18:15:08 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys 2010-03-06 18:14:58 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-03-06 18:11:48 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-03-05 15:40:08 0 d—–w- c:\windows\system32\wbem\Repository 2010-02-24 10:08:28 306688 —-a-w- c:\windows\IsUninst.exe 2010-02-24 10:07:13 0 d—–w- c:\program files\Sonic Foundry Plug-Ins 2010-02-23 20:47:23 0 d—–w- c:\program files\YAMAHA 2010-02-19 20:16:15 0 d—–w- c:\docume~1\rikki\applic~1\Antares 2010-02-19 20:12:30 1181022 —-a-w- c:\windows\system32\TmpA5962671 2010-02-19 20:11:54 1764177 —-a-w- c:\windows\system32\TmpA5926968 2010-02-19 17:44:39 0 d—–w- c:\program files\Sony Setup ==================== Find3M ==================== 2010-03-07 11:05:56 2608 —-a-w- c:\windows\system32\d3d9caps.dat 2010-02-05 12:13:29 7296 —-a-w- c:\windows\system32\drivers\osaio.sys 2010-02-05 11:22:47 2496 —-a-w- c:\windows\system32\d3d8caps.dat 2010-01-30 13:12:39 6475776 —-a-w- c:\windows\system32\PSP VintageWarmer2.dll 2009-07-19 14:40:11 728384 —-a-w- c:\program files\ST2InstrCache.dat ============= FINISH: 11:16:59.98 =============== Computer running fine browser seems to be back to normal, hope this has solved it, again many thanks for continued help throughout
Post #10
Hi,

Please do the following:

submit a file to virustotal for analysis
  • Use the browse button on that page to navigate to the location of the file to be scanned.
  • In the right hand panel,
  • click on the file c:\windows\system32\TmpA5962671
  • then click the open button.
  • The file will now be displayed in the submit box.
  • Scroll down a bit and click "send file", wait for the results

Make sure you have copied and saved the results before continuing.

Do the same for this file as well:

c:\windows\system32\TmpA5926968



NEXT:

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop.
  • Scroll down to where it says JDK 6 Update 18 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Post #11 last edited
Hi there here are logs from virus total: (info at start regarding current status is not what was visable on results page, this is how it showed when copied and pasted into notebook) File TmpA5926968 received on 2010.03.12 14:49:14 (UTC) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 0/42 (0%) Loading server information… Your file is queued in position: 3. Estimated start time is between 56 and 80 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.50 2010.03.12 - AhnLab-V3 5.0.0.2 2010.03.11 - AntiVir 8.2.1.180 2010.03.12 - Antiy-AVL 2.0.3.7 2010.03.12 - Authentium 5.2.0.5 2010.03.12 - Avast 4.8.1351.0 2010.03.11 - Avast5 5.0.332.0 2010.03.12 - AVG 9.0.0.787 2010.03.12 - BitDefender 7.2 2010.03.12 - CAT-QuickHeal 10.00 2010.03.12 - ClamAV 0.96.0.0-git 2010.03.12 - Comodo 4237 2010.03.12 - DrWeb 5.0.1.12222 2010.03.12 - eSafe 7.0.17.0 2010.03.11 - eTrust-Vet 35.2.7357 2010.03.12 - F-Prot 4.5.1.85 2010.03.11 - F-Secure 9.0.15370.0 2010.03.12 - Fortinet 4.0.14.0 2010.03.09 - GData 19 2010.03.12 - Ikarus T3.1.1.80.0 2010.03.12 - Jiangmin 13.0.900 2010.03.12 - K7AntiVirus 7.10.995 2010.03.11 - Kaspersky 7.0.0.125 2010.03.12 - McAfee 5917 2010.03.11 - McAfee+Artemis 5917 2010.03.11 - McAfee-GW-Edition 6.8.5 2010.03.12 - Microsoft 1.5502 2010.03.12 - NOD32 4939 2010.03.12 - Norman 6.04.08 2010.03.12 - nProtect 2009.1.8.0 2010.03.12 - Panda 10.0.2.2 2010.03.11 - PCTools 7.0.3.5 2010.03.12 - Prevx 3.0 2010.03.12 - Rising 22.38.04.03 2010.03.12 - Sophos 4.51.0 2010.03.12 - Sunbelt 5836 2010.03.12 - Symantec 20091.2.0.41 2010.03.12 - TheHacker 6.5.2.0.231 2010.03.12 - TrendMicro 9.120.0.1004 2010.03.12 - VBA32 3.12.12.2 2010.03.12 - ViRobot 2010.3.12.2224 2010.03.12 - VirusBuster 5.0.27.0 2010.03.12 - Additional information File size: 1764177 bytes MD5…: 2d16a0e6b53744c96d34d29b4e612c59 SHA1..: 4f4276e0f76d6291259492d2c20ba0eeae05f5e5 SHA256: 8260c173357793c955d8775631bfe64535093c0ec75a8f0b328a055fefad8122 ssdeep: 49152:3NOaAZ7InGFyJqQ9sWsvMkNSM6Kkht2/BQcy:dOnenGFcqQ9snR4MKH2JQ cy PEiD..: - PEInfo: - RDS…: NSRL Reference Data Set - pdfid.: - trid..: OGG Vorbis Audio (77.7%) OGG stream (generic) (22.1%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned File TmpA5962671 received on 2010.03.12 14:42:13 (UTC) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 0/41 (0%) Loading server information… Your file is queued in position: ___. Estimated start time is between ___ and ___ . Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Compact Print results Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result a-squared 4.5.0.50 2010.03.12 - AhnLab-V3 5.0.0.2 2010.03.11 - AntiVir 8.2.1.180 2010.03.12 - Antiy-AVL 2.0.3.7 2010.03.12 - Authentium 5.2.0.5 2010.03.12 - Avast 4.8.1351.0 2010.03.11 - Avast5 5.0.332.0 2010.03.12 - AVG 9.0.0.787 2010.03.12 - BitDefender 7.2 2010.03.12 - CAT-QuickHeal 10.00 2010.03.12 - ClamAV 0.96.0.0-git 2010.03.12 - Comodo 4237 2010.03.12 - DrWeb 5.0.1.12222 2010.03.12 - eSafe 7.0.17.0 2010.03.11 - eTrust-Vet 35.2.7357 2010.03.12 - F-Prot 4.5.1.85 2010.03.11 - F-Secure 9.0.15370.0 2010.03.12 - Fortinet 4.0.14.0 2010.03.09 - GData 19 2010.03.12 - Ikarus T3.1.1.80.0 2010.03.12 - Jiangmin 13.0.900 2010.03.12 - K7AntiVirus 7.10.995 2010.03.11 - Kaspersky 7.0.0.125 2010.03.12 - McAfee 5917 2010.03.11 - McAfee+Artemis 5917 2010.03.11 - McAfee-GW-Edition 6.8.5 2010.03.12 - Microsoft 1.5502 2010.03.12 - NOD32 4939 2010.03.12 - Norman 6.04.08 2010.03.12 - nProtect 2009.1.8.0 2010.03.12 - Panda 10.0.2.2 2010.03.11 - PCTools 7.0.3.5 2010.03.12 - Rising 22.38.04.03 2010.03.12 - Sophos 4.51.0 2010.03.12 - Sunbelt 5836 2010.03.12 - Symantec 20091.2.0.41 2010.03.12 - TheHacker 6.5.2.0.231 2010.03.12 - TrendMicro 9.120.0.1004 2010.03.12 - VBA32 3.12.12.2 2010.03.12 - ViRobot 2010.3.12.2224 2010.03.12 - VirusBuster 5.0.27.0 2010.03.12 - Additional information File size: 1181022 bytes MD5…: 93b030a1743408ff30b2409feecaec27 SHA1..: 2cb915c3760504cacfc51e95c72a8b360eceaeec SHA256: eb93eb855c0a57042d7f396832e3db47f23f6ac4496e2355685203ff98806882 ssdeep: 24576:tBDYS/jxtlHTuP+9bR+uk+WMzueGEjWfl0wV0mWdK7jSm97QHinZx:tBtx nTg+9V+uOMafEjm0GKd+pQH8Zx PEiD..: - PEInfo: - RDS…: NSRL Reference Data Set - pdfid.: - trid..: OGG Vorbis Audio (77.7%) OGG stream (generic) (22.2%) sigcheck: publisher….: n/a copyright….: n/a product……: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments…..: n/a signers……: - signing date.: - verified…..: Unsigned Adobe acrobat crashed when downloading: operating system error(16263.103.5468.8000) Was able to instal from desktop Computer running slowly since bringing avg and ad aware back on line, no browser redirecting happening, no funny cookies showing up
Post #12
Hi,

Try a defrag and startup lite

Download and run Auslogics Disc Defragmenter

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve performance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.


Your log appears to be clean of malware

use TempFile cleaner, to clear out all the temp files that might be bogging down your system:

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.


NEXT


Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]




NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

If any logs/tools remain on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.


    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.


  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI