Hi folks,
I seem to have contracted something to hinder my viewing pleasure. Every time I've searched with Google and then clicked a link I get shifted to another site.
I've already done as many updates to AVG, Online Armor, and Spybot that are available as well as Malwarebytes. Have run all to no avail.
Here is my DDS log:
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Tall Emu\Online Armor\oacat.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\ps2.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Tall Emu\Online Armor\oahlp.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe
I can post the above but the next section that begins with Pseudo HJT Report will not allow me to post it. I get an IE error saying website not available when I try to post the rest of the log.
Any help is much appreciated. Thank you, Bob
Hello cabinover and welcome to What the Tech! Please follow these guidelines while we work on your PC:
Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any colored text in my posts indicates a clickable link.
You should print any instructions I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.
Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
[external image: Posted Image] Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Hi RP and thanks for helping me. I'll attach the two DDS files however after downloading the GMER program and running it I've gotten nowhere. It will run for about 3-4 minutes and then shut down the computer to restart.
Seems I can only attach the one file. Upon trying the other it just hangs up.
Gotta head out for work. I'll try this again later on in Safe Mode.
Beautiful, now when I attempt to post one of the reports I get an IE error message saying cannot connect to Internet. I do have both reports now though so we're one step ahead.
BTW, the rootkitunhooker keeps getting kicked back because the file is too large according the WTT.
I still only have one of the two DDS logs. I'll need the complete DDS.txt report. Sorry, but it' very important that I see full diagnostic logs before we start fixing.
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 12:59:43.78 on Tue 07/27/2010
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2039.1262 [GMT -4:00]
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - There is a line here that I cannot list or I get that IE error message, after the } - there is a windows update but everytime I put it in I get a loading icon that won't go away. See Post 15 for the script
🖼Click to load external image (Posted Image) You are infected with a Rootkit. I recommend that you limit your online activity until we have your system clean and change all your passwords from a different, clean computer.
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Well I ran the combofix, it went through checking stages while I took a shower. When I came out the welcome screen was up. After a while it loaded and said preparing a log. In the meantime my spybot loaded. I don't know if something was blocked but I never saw a log. Would it save somewhere that I can access?
Just had my daughter try that and it came back with Windows cannot find.
I just got home and also tried it the same way. Also went to C:, and into the ComboFix file, no txt file in there either.
