What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ads through Internet Explorer, lsass.exe - system error, expected troj

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I'm currently running Windows XP Professional SP3. I am a Firefox user who almost never uses Internet Explorer, but yesterday a random ad popped up using the IE browser. When I closed it, an alert saying this page has an unspecified potential security risk showed up, and asked if I would like to continue, and I clicked no. After that, Microsoft Phishing Filter appeared asking if I wanted to turn it on, turn it off, or ask me later. I didn't know if this was legitimate, so I closed out of it everytime it popped up. After this happened, I just wanted to do a system restore, but I noticed all of my system restore points were wiped out. Now, the pop-up ads appear around every 30-60 minutes (varies) through IE. Also, I noticed that the iexplore.exe process was running even though I closed the ad and all associated windows. When I ended the process, iexplore.exe, IE just opens again with alerts such as the Microsoft Phishing Filter, if I want to set IE as my default browser, and an alert about a privacy icon and cookies. It's a never ending cycle everytime I try to close the process again, with the same alerts showing up and the process showing up again. There was also an instance where two processes with the name, iexplore.exe, were running. I ran MBAM, and it removed some malware. I then ran Avast!, and it removed another malware and a trojan. I then ran CCleaner and used it to delete my Temporary Internet Files. I then ran Spybot, and it removed a lot of spyware from my computer. However, after all of that, the popup ads still appear along with IE starting again everytime I end the process. I'm also noticing that my computer is failing to create restore points on its own after I installed programs such as MBAM, CCleaner, and Spybot. Avast! was the only program I've been using beforehand. After running all of those programs, I decided to call it a night and turned my computer off to prevent any further damage. However, when I turned my computer back on in the afternoon, the following error showed up: "lsass.exe - System Error" or "Isass.exe - System Error" (not sure if the first letter is a "L" or " capital i". The error said: "Security Accounts Manager initialization failed because of the following error: The system cannot find the path specified. Error status: 0xc000003a. Please click OK to shutdown this system and reboot into Safe Mode, check the event log for more detailed information." I clicked OK, but it actually rebooted as normal, and not in Safe Mode. After it rebooted though, all the user accounts showed up, and I was able to log in to my username. I need my computer to do a lot of work, so I couldn't help but continue to use it. As a precaution though, I've disconnected my wireless while doing my studies unless I really need to use it. I've been trying to find a solution for this problem online until I stumbled onto this forum by searching for the name of a trojan Avast! recently blocked while I connected back to my wireless. Someone had a similar problem, but not quite the same. After reading the forum guidelines, I downloaded OTL and followed the instructions word for word. If needed, I would be more than glad to scan my computer with HijackThis and DDS as well. Also, I'm planning on leaving my computer on, in case I'm not able to log back in. At this point, I really don't know what else to do. All help will be appreciated. Sorry, I replied to my original post twice as I posted the OTL and Extras logs below.
Post #4
Hi

Please do the following:

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
MOD - C:\WINDOWS\system32\bootetup.dll ()
O36 - AppCertDlls: dpnsgini - (C:\WINDOWS\system32\bootetup.dll) - C:\WINDOWS\system32\bootetup.dll ()
[2010/07/09 03:23:03 | 000,047,616 | -H– | M] () – C:\WINDOWS\System32\bootetup.dll

:Commands
[emptyflash]
[purity]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the OTL log


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


NEXT

Download Bootkit remover to your desktop
This is a rar file if you do not have a program to open it then download and install Peazip
  • Extract Remover.exe to your desktop
  • Double click Remover.exe to run it
  • It will show a Black screen with some data on it
  • Right click on the screen and select > Select All
  • Press Control+C
  • Now open a notepad and press Control+V
  • Post the resultant log here please
Post #5 last edited
Thanks for your response. I followed the instructions above word for word. After the OTL program was done, I believe it said, it needed to reboot in order to delete more files and to press OK. The program just kind of sat there, but it said it was completed. Besides the OTL window, nothing else was visible aside from my wallpaper, so I just turned my computer off and then turned it back on. When I logged back in, OTL ran and opened a log titled 07102010_031017. I copied and pasted the OTL log below. There was no alert that said the GMER application was finished, but when GMER stopped scanning, I went ahead and saved the log I tried attaching the Gmer.txt log, but it was bigger than 250K. I will post the Gmer.txt log along with the Bootkit remover log in my next replies. Also, when I had to turn my wireless back on to post these logs, Avast! said that a trojan horse was found and allowed me to abort the connection. The file name was, http:// klarkbon.com/43256G32FD2GS/ (I put a space in between the http:// and the rest of the file name to prevent any possible damage). The malware name was JS:Downloader-XB [Trj] All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\dpnsgini:C:\WINDOWS\system32\bootetup.dll deleted successfully. C:\WINDOWS\system32\bootetup.dll moved successfully. File C:\WINDOWS\System32\bootetup.dll not found. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default User User: Eugene ->Flash cache emptied: 405 bytes User: Gemma ->Flash cache emptied: 834 bytes User: LocalService User: Mary ->Flash cache emptied: 22351 bytes User: My Friend ->Flash cache emptied: 651 bytes User: NetworkService Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Eugene ->Temp folder emptied: 1684 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 2989 bytes ->FireFox cache emptied: 11290085 bytes ->Flash cache emptied: 0 bytes User: Gemma ->Temp folder emptied: 36612 bytes ->Temporary Internet Files folder emptied: 663609 bytes ->Java cache emptied: 21373253 bytes ->FireFox cache emptied: 38832466 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 199817 bytes User: Mary ->Temp folder emptied: 52323488 bytes ->Temporary Internet Files folder emptied: 1002482 bytes ->Java cache emptied: 35454200 bytes ->FireFox cache emptied: 85185962 bytes ->Flash cache emptied: 0 bytes User: My Friend ->Temp folder emptied: 643957465 bytes ->Temporary Internet Files folder emptied: 9175066 bytes ->Java cache emptied: 99293203 bytes ->FireFox cache emptied: 179530951 bytes ->Flash cache emptied: 0 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 45343225 bytes ->Java cache emptied: 14 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 4804088 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 7729232 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 64699052 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 149123 bytes RecycleBin emptied: 1611366273 bytes Total Files Cleaned = 2,778.00 mb OTL by OldTimer - Version 3.2.8.1 log created on 07102010_031017 Files\Folders moved on Reboot… C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\VRI3FUR7\st moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\VRI3FUR7\st[11] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\VRI3FUR7\st[1] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\VRI3FUR7\VVPMCAMZ0WEWCA899Q77CAYRUIAMCAHW6W90CAR3A9VACAP8NGUOCAXLEWI4CAI9120HCARQR8G TCAS5N6X1CAXED3C3CAEWSCQ3CAY8J554CAV821A7CAW4Z6ZJCAFNBFROCA26IUMECAS5DJ6V.htm moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\PIBPKBQN\st[3] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ONGSUYPS\CAE71JJVCA9VWFGQCAM1HVVRCAZW1W2WCAL6J34ECAYMG9G1CA406DLWCAS90D60CA931495CAS K7WUNCAD99Z95CA1WFREPCA8AI6M7CADO7URLCA1C9N91CAL2AD1FCAO278UKCAPI8QVECAGN328L moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ONGSUYPS\CAFFEU86CA5T25TYCAPWNBSPCA285ZXUCAIUYWG9CAZRSW8WCA3ECXR8CAF9IV4PCA2SWIUBCA6 3705MCAWR9W0ECAMG88U2CACRTOXECADOYYJ1CA2L9FUWCA6YAZ58CAMXA5D0CAPT57OYCAHE5BHE moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ONGSUYPS\st[4] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\N1FPY67P\CAQ7B8JPCAQIFM98CA09LG83CAII0VAZCA69DYCRCAKC5K53CAH11J10CAYVPMC3CAVK7TI8CAJ JXTW3CAJV9HD3CACR6VWYCAEJ1PCQCAFUZ1UBCAQ5JIHCCA5YVHWFCAEXGNO4CASU15R4CALMOSBD moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\N1FPY67P\st[2].htm moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\LWTNBE8E\CA8VWCNCCA7JKSWXCAV49FN5CAVM8LOICACCVPSKCAJ6RZ13CACEE8IUCAW94DKPCAMW4BIICA1 S02HBCAA0ETPBCA4JAAFHCAA5NWJKCAWSWR6LCACUZOKMCA2OSFS4CAEU20X1CAL4PYL1CATB6HPT moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\LWTNBE8E\CAQ73LLZCARLGNWWCAASN6ZJCA8Y6NFTCAZA46JGCA9D3CKNCAE0V0X1CAKW427QCAZZNOOACAI E0G7JCAP3340ECAAAKSTWCAMGDIA8CA28C3DZCAPAMCU5CA5KXLJSCAU4XVCSCAD3P88NCA7JE6WG moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\LWTNBE8E\CAQX43RNCAZAA3A5CAQA4O5DCAVICM71CAM0AIXLCANE2YOHCAHC6O0MCASH330DCAW0W0A4CAQ 6NP9ACAV088HXCARVG4YSCA864ED2CAAG9R1KCAMAJPK4CAUXUVZNCACAZEBZCAIOT3VJCA7JXBLN moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\LWTNBE8E\CAUR47AYCACB8JFUCADHWGLVCAZD7FXKCA2WTND8CAZ3NIQYCATEYRNWCAWFOXKTCAHGA99XCA2 AC9T5CAX3LQH7CALL9XBQCAGHEKGPCAN6DNFUCA3C6XD8CAE5A499CAYVTS6FCASJUGZACA52W2QN moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CVM83U0I\iframe3[1].htm moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CVM83U0I\st[3] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CVM83U0I\st[8] moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\62NU2WMY\st[1].htm moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0BP81XBK\banner[4].htm moved successfully. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0BP81XBK\CA6YV5HPCABLTXS2CAF9UQVUCAQYAGL3CA2051RQCABISCENCAGM22PMCAKR7D49CA9LZ05SCA6 X19YCCAIAUW87CATD3K0PCAHSNTBVCA2Q2OQSCA93BK08CAKCEWHUCAUG7CGRCALU8L0ICATVRTYT moved successfully. C:\WINDOWS\temp\_avast4_\Webshlock.txt moved successfully. C:\WINDOWS\temp\hsperfdata_SYSTEM\3468 moved successfully. C:\WINDOWS\temp\jar_cache2560749005499667157.tmp moved successfully. C:\WINDOWS\temp\Perflib_Perfdata_678.dat moved successfully. C:\WINDOWS\temp\~DF556B.tmp moved successfully. C:\WINDOWS\System32\config\systemprofile\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully. Registry entries deleted on Reboot…
Post #6 last edited
I tried to copy/paste the Gmer.txt log, but it said it was too long, so I'm going to try to break it down. [attachment removed]
Post #8
Here's the Bootkit remover log: Bootkit Remover version 1.0.0.1 © 2009 eSage Lab www.esagelab.com \\.\C: -> \\.\PhysicalDrive0 MD5: 454f8f8f464d74f8b4b6306cbff41597 Size Device Name MBR Status ——————————————– 37 GB \\.\PhysicalDrive0 Unknown boot code Unknown boot code has been found on some of your physical disks. To inspect the boot code manually, dump the master boot sector: remover.exe dump [output_file] To disinfect the master boot sector, use the following command: remover.exe fix Press any key to quit…
Post #9
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #10
I disabled Avast! and ran ComboFix, and I think it said, it would temporarily disable my CD emulation drivers. After, it rebooted my computer, and when I logged in, ComboFix downloaded and installed Microsoft Windows Recovery Console. The scan was successful, but before the scan, I did notice a message in the ComboFix window saying, "Could Not Find C:\ComboFix\AddDriver0?".

Also, after the scan was finished and ComboFix closed, I noticed a couple of things. Avast! was no longer running, and I can't get the background protection (I don't know the correct term) to start again. I can only get the manual scanner to run. Also, a new icon on my desktop was created of Internet Explorer, and the Microsoft Phishing Filter seems to be a lot more active than usual. And when I opened Firefox, it asked if I wanted to make Firefox my default browser, which is strange because I've already had it set as my default browser. Weary of clicking anything, I just closed the window when it asked me if I wanted to set Firefox as my default browser.

Here's the ComboFix log:

ComboFix 10-07-10.01 - My Friend 07/11/2010 1:11.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.464 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100710-2] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-06-11 to 2010-07-11 )))))))))))))))))))))))))))))))
.

2010-07-11 06:11 . 2010-07-11 06:12 ——– d—–w- C:\quarantine
2010-07-11 05:59 . 2010-07-11 05:59 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Yahoo
2010-07-11 05:59 . 2010-07-11 05:59 ——– d—–w- c:\documents and settings\LocalService\Application Data\Yahoo!
2010-07-10 08:10 . 2010-07-10 08:10 ——– d—–w- C:\_OTL
2010-07-09 02:55 . 2010-07-09 02:56 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-08 08:12 . 2010-07-08 08:28 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-08 08:12 . 2010-07-08 08:23 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-07-08 07:35 . 2010-07-08 07:35 ——– d—–w- c:\program files\CCleaner
2010-07-08 02:20 . 2010-07-08 02:20 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Yahoo
2010-07-08 02:19 . 2010-07-08 02:19 ——– d—–w- c:\documents and settings\NetworkService\Application Data\Yahoo!
2010-07-07 23:12 . 2010-07-07 23:12 ——– d—–w- c:\documents and settings\My Friend\Application Data\Malwarebytes
2010-07-07 23:11 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-07 23:11 . 2010-07-07 23:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-07 23:11 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-07 23:11 . 2010-07-08 02:32 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-07 22:43 . 2010-07-07 22:43 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2010-06-27 06:40 . 2010-06-27 06:40 67480 —-a-w- c:\documents and settings\Mary\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-16 06:52 . 2010-06-16 06:52 ——– d—–w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-10 12:54 . 2010-02-23 13:31 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-30 05:53 . 2009-12-06 19:06 ——– d—–w- c:\program files\Diablo II
2010-06-17 21:10 . 2008-10-03 18:18 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-06-16 06:50 . 2009-07-16 09:26 ——– d—–w- c:\program files\Starcraft
2010-06-16 06:50 . 2010-06-02 01:11 ——– d—–w- c:\program files\Coupons
2010-06-16 06:50 . 2010-06-02 04:49 ——– d—–w- c:\program files\PDFCreator
2010-06-16 06:49 . 2009-12-06 11:59 ——– d—–w- c:\program files\Common Files\Blizzard Entertainment
2010-06-04 09:04 . 2010-06-04 09:04 ——– d—–w- c:\documents and settings\Mary\Application Data\Apple Computer
2010-05-27 12:51 . 2010-05-27 12:51 ——– d—–w- c:\documents and settings\Mary\Application Data\InterVideo
2010-05-13 17:59 . 2010-05-04 21:23 ——– d—–w- c:\documents and settings\My Friend\Application Data\uTorrent
2010-05-04 17:20 . 2008-04-14 12:00 832512 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 17:20 . 2008-04-14 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:20 . 2008-04-14 12:00 17408 —-a-w- c:\windows\system32\corpol.dll
2010-05-02 05:22 . 2008-04-14 12:00 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2008-04-14 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
2009-04-07 00:29 . 2009-04-07 00:29 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-04-07 00:29 . 2009-04-07 00:29 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"AGRSMMSG"="AGRSMMSG.exe" [2005-11-16 88209]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-09 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-03 102492]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 1015808]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-08 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/28/2009 4:31 AM 114768]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [10/2/2008 6:03 PM 58016]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/28/2009 4:31 AM 20560]
S3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [10/2/2008 4:29 PM 87936]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/17/2009 5:04 AM 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-06-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-06-16 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-12 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\My Friend\Application Data\Mozilla\Firefox\Profiles\0dzjyy3y.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-11 01:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(692)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(748)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-07-11 01:23:56
ComboFix-quarantined-files.txt 2010-07-11 06:23

Pre-Run: 10,585,399,296 bytes free
Post-Run: 10,565,578,752 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F1BFBF3BFC23972E38E5FFBF3EC8A6F3
Post #11
Hi,

Please do the following:

Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.


NEXT

Do you connect via a router?

If you do,

Please reset the router, then flush the DNS

  • This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
  • Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
  • If you don’t know the router's default password, you can look it up. HERE
  • You also need to reconfigure any security settings you had in place prior to the reset.
  • You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.


  • Go to Start > Run > type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.


NEXT

Please advise how the computer is running and if there are any outstanding issues.



Note: some things are reset back to default by running our tools. Select FireFox as your default browser.
Post #12 last edited

NEXT

Do you connect via a router?

If you do,

Please reset the router, then flush the DNS

  • This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router.
  • Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
  • If you don’t know the router's default password, you can look it up. HERE
  • You also need to reconfigure any security settings you had in place prior to the reset.
  • You may also need to consult with your Internet service provider to find out which DNS servers your network should be using.


  • Go to Start > Run > type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.


Thank you for your help. I had a few questions before I start the next process. I tried going to the website above to find my router's default password, but I wasn't sure in where to go. I was redirected to this site, http://www.opendns.com/solutions/business/ For the part about security settings and DNS servers, I'm not too sure about what to do either. And I was just wondering, what does flush DNS do and how will it help? Sorry for all of the questions and if I came off as rude in any way, I wasn't too sure in what I was doing or what to do after the first step.
Post #14
Thanks, I think I have a better understanding now. I had a couple of more questions.

What 's the purpose of resetting the router?

How exactly can I get my router's default password? When I clicked on the website you provided, I didn't know where to go to find it. The link you game me redirected me to here: http://www.opendns.com/solutions/business/

In regards to DNS servers, if I need to ask my ISP for which DNS servers my network should be using, what exactly do I do with them afterwards?

Sorry for pestering you with all of these questions.
Post #15
what is the make and model of your router, it will probably be in the set up information when you first installed your router, did you write it down anywhere?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI