Shaenaus
Topic Starter
Hello,
I am attempting to clean my sister's Windows XP desktop computer which seems to be infected with Adware (multiple pop op windows appear when opening Firefox or Internet Explorer). There may be other issues such as malware or viruses but I haven't had long enough with the computer to investigate.
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 14:28:46.75 on Wed 30/06/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.237 [GMT 10:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Cyberlink\Shared Files\brs.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Documents and Settings\David\Start Menu\Programs\Startup\monskc32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
c:\program files\mcafee.com\shared\mcinfo.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\Documents and Settings\David\Desktop\dds.scr
c:\program files\real\realplayer\RealPlay.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.iprimus.com.au/
uDefault_Page_URL = hxxp://www.iprimus.com.au
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.IPrimus.com.au;10.*;172.16.*;172.17.*;172.18.*;172.19.*;172.20.*;172.21.*;172.
22.*;172.23.*;172.24.*;172.25.*;172.26.*;172.27.*;172.28.*;172.29.*;172.30.*;172.
31.*;192.168.*;;*.local
uInternet Settings,ProxyServer = proxy.iprimus.com.au:8080
mSearchAssistant = hxxp://www.google.com/ie
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\sdra64.exe,
BHO: 0B49E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No File
BHO: rsion - No File
BHO: `B3D70E-1895-11CF-8E15-001234567890} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
BHO: ¨¨8-01DD-4d91-8333-CF10577473F7} - No File
BHO: °B497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MSKAgent.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [EPSON Stylus CX5500 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticap.exe /fu "c:\windows\temp\E_S6B.tmp" /EF "HKCU"
uRun: [BitComet] "c:\documents and settings\david\desktop\temp\bitcomet\BitComet.exe" /tray
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [Bait 64] c:\docume~1\david\applic~1\2downl~1\bore list heart.exe
uRun: [cleansweep.exe] c:\cleansweep.exe\cleansweep.exe
uRun: [Iyiye] rundll32.exe "c:\windows\kbjlprb.dll",Startup
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\mcupdate.exe
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"
mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"
mRun: [BDRegion] c:\program files\cyberlink\shared files\brs.exe
mRun: [vptray] c:\program files\navnt\vptray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Odajudi] rundll32.exe "c:\windows\utabonat.dll",Startup
mRun: [CleanUp] c:\progra~1\mcafee.com\shared\mcappins.exe /v=3 /cleanup
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\david\startm~1\programs\startup\imvu.lnk - c:\program files\imvu\IMVUClient.exe
StartupFolder: c:\documents and settings\david\start menu\programs\startup\monskc32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\david\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www4.snapfish.com.au/SnapfishActivia.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://shelbyprettyprincessrulz.spaces.msn.com//PhotoUpload/MsnPUpld.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxdev.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\david\applic~1\mozilla\firefox\profiles\9gozxyl5.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com.au
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101849&gct=&gc=1&q=
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\documents and settings\david\application data\mozilla\firefox\profiles\9gozxyl5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\david\desktop\temp\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: c:\documents and settings\david\desktop\temp\divx\divx web player\npdivx32.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {F76DDB26-BB84-4954-9395-CE30EB8664F3} - c:\documents and settings\david\local settings\application data\{F76DDB26-BB84-4954-9395-CE30EB8664F3}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
============= SERVICES / DRIVERS ===============
R2 CAN300;CAN300;c:\windows\system32\drivers\can300.sys [2005-8-3 10224]
R2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\Mcdetect.exe [2005-8-24 126976]
R2 McTskshd.exe;McAfee Task Scheduler;c:\progra~1\mcafee.com\agent\mctskshd.exe [2005-8-24 122368]
R2 NAVAPEL;NAVAPEL;c:\program files\navnt\Navapel.sys [2001-9-24 9232]
R2 Norton AntiVirus Server;Norton AntiVirus Client;c:\program files\navnt\rtvscan.exe [2001-9-24 454656]
R3 NAVAP;NAVAP;c:\program files\navnt\navap.sys [2001-9-24 176208]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100623.002\NAVENG.sys [2010-6-24 85552]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100623.002\NAVEX15.sys [2010-6-24 1347504]
S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};\??\c:\program files\cyberlink\powerdvd8\000.fcl –> c:\program files\cyberlink\powerdvd8\000.fcl [?]
S2 gupdate1ca8e7346fd63f8;Google Update Service (gupdate1ca8e7346fd63f8);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 133104]
S2 suh4niiio;BsHelpCS;c:\windows\system32\lyssu.exe –> c:\windows\system32\lyssu.exe [?]
S3 Ascnuntin;Ascnuntin; [x]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2005-7-25 245760]
=============== Created Last 30 ================
2010-06-23 08:06 120 a——- c:\windows\Ccumituyihitama.dat
2010-06-23 08:06 0 a——- c:\windows\Cmulu.bin
2010-06-16 13:54 –dsh— c:\documents and settings\david\IECompatCache
2010-06-16 13:51 –dsh— c:\windows\system32\lowsec
2010-06-16 13:51 4 a——- c:\docume~1\david\applic~1\avdrn.dat
2010-06-16 13:49 –dsh— c:\documents and settings\david\PrivacIE
2010-06-16 13:44 –dsh— c:\documents and settings\david\IETldCache
2010-06-16 13:35 12,800 ——– c:\windows\system32\dllcache\xpshims.dll
2010-06-16 13:35 743,424 ——– c:\windows\system32\dllcache\iedvtool.dll
2010-06-16 13:35 247,808 ——– c:\windows\system32\dllcache\ieproxy.dll
2010-06-16 13:35 –d—– c:\windows\ie8updates
2010-06-16 13:34 41,984 ——– c:\windows\system32\dllcache\iecompat.dll
2010-06-16 13:29 -cd-h— c:\windows\ie8
2010-06-16 13:24 –d—– c:\docume~1\david\applic~1\Windows Desktop Search
2010-06-16 13:23 –d—– c:\program files\Windows Desktop Search
2010-06-16 13:23 –d—– c:\windows\system32\GroupPolicy
2010-06-16 13:20 192,000 ——– c:\windows\system32\dllcache\offfilt.dll
2010-06-16 13:20 98,304 ——– c:\windows\system32\dllcache\nlhtml.dll
2010-06-16 13:20 29,696 ——– c:\windows\system32\dllcache\mimefilt.dll
2010-06-16 11:51 3,558,912 ——– c:\windows\system32\dllcache\moviemk.exe
2010-06-16 10:18 20,992 a——- c:\windows\system32\drivers\RTL8139.sys
2010-06-16 10:18 20,992 a——- c:\windows\system32\dllcache\rtl8139.sys
2010-06-10 11:00 1,902 ——– c:\windows\system32\SetupBD.din
2010-06-10 10:59 –d—– C:\drvrtmp
==================== Find3M ====================
2010-05-05 23:30 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe
2010-05-05 03:20 133,120 a——- c:\windows\system32\dllcache\extmgr.dll
2010-05-04 22:39 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2010-05-02 15:22 1,851,264 a——- c:\windows\system32\win32k.sys
2010-05-02 15:22 1,851,264 ——– c:\windows\system32\dllcache\win32k.sys
2010-04-20 15:30 285,696 a——- c:\windows\system32\atmfd.dll
2010-04-20 15:30 285,696 ——– c:\windows\system32\dllcache\atmfd.dll
2010-04-06 04:52 2,462,720 a——- c:\windows\system32\dllcache\WMVCore.dll
2010-04-05 16:49 499,712 a——- c:\windows\system32\msvcp71.dll
2008-12-17 16:48 45,256 ac—— c:\docume~1\david\applic~1\GDIPFONTCACHEV1.DAT
2008-02-07 20:26 32 ac—— c:\docume~1\alluse~1\applic~1\ezsid.dat
2007-06-19 10:45 92,064 ac—— c:\documents and settings\david\mqdmmdm.sys
2007-06-19 10:45 79,328 ac—— c:\documents and settings\david\mqdmserd.sys
2007-06-19 10:45 66,656 ac—— c:\documents and settings\david\mqdmbus.sys
2007-06-19 10:45 25,600 ac—— c:\documents and settings\david\usbsermptxp.sys
2007-06-19 10:45 22,768 ac—— c:\documents and settings\david\usbsermpt.sys
2007-06-19 10:45 9,232 ac—— c:\documents and settings\david\mqdmmdfl.sys
2007-06-19 10:45 6,208 ac—— c:\documents and settings\david\mqdmcmnt.sys
2007-06-19 10:45 5,936 ac—— c:\documents and settings\david\mqdmwhnt.sys
2007-06-19 10:45 4,048 ac—— c:\documents and settings\david\mqdmcr.sys
2008-08-25 16:34 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082520080826\index.dat
2007-05-04 16:03 49,152 ac-sh— c:\windows\temp\history\history.ie5\mshist012007050420070505\index.dat
2010-01-16 08:51 32,768 ac-sh— c:\windows\temp\history\history.ie5\mshist012010011620100117\index.dat
============= FINISH: 14:30:33.48 ===============
Thanks for your help.
