Yesterday i've searched for a cooking recipe on a russian website and when i clicked on a link that Google showed me as a search result i found out that my antivirus (Avira) found something like JAVA/Exdoer.BV then antivirus sent it to quarantine and deleted. When i closed and reenter Firefox i did not notice anything wrong but when i wanted to watch a video on YouTube it showed me that the loading is in progreess but it never loaded.
The same problem i faced with any other website with online videos or music that needs to be loaded. Then i found out that i can't download anything also, in other words i can browse internet pages but i can not load videos, music or download anything.
Shorty i started to search for a solution. I tried scanning for viruses with my Avira antivirus then i tried Local Disk>Properties>Disk Cleanup but with no results at the end. I also tried Start>Help and Support>Undo changes to your computer with System Restore but still nothing.
Desperately i tried to find a solution. I tried to browse with Internet Explorer but the same problem was with IE browser. Then I went to Firefox Tools>Add-ons>Plugins and saw that Microsoft .Net Framework Assistant was version 1.0.0 and RealPlayer Browser Record Plugin was turned off.
Then i selected Firefox RealPlayer and Microsoft .NET update and it somehow updated and when i reentered Firefox i discovered that video and music loading and downloading was available but for a short period of time… after that i could only browse webpages.
Does anyone know what im dealing with or what should i do?
Hi Alonzo,
My name is
Tomk . I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic.
Are you able to produce any of the logs requested in the
How to get help topic?
Here, let's just try to get one set.
Please download DDS by sUBs from one of the following links and save it to your desktop.
Disable any script blocking protection (How to Disable your Security Programs ) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. —————————————————
Post DDS.txt report in your next replyAttach Attach.txt Attachments area and then clicking Browse . Browse to where you saved the file, and click Open and the click UPLOAD .
Thank you to the reply Tomk.
.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Run by [removed] at 22:54:53 on 2011-06-14
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1033.18.511.90 [GMT 3:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://google.icq.com
uSearch Bar = hxxp://google.icq.com/search/search_frame.php
mURLSearchHooks: Winamp Search Class: {57bca5fa-5dbb-45a2-b558-1755c3f6253b} - c:\program files\winamp toolbar\winamptb.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\apppatch\ghwwyxr.dat,
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Доступ к платному контенту FieryAds v2.0.1: {6d125299-c2a9-4dbc-bec3-6f7124e39a41} - c:\docume~1\aleksa~1\applic~1\fieryads\FieryAds.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Uniblue RegistryBooster 2009] c:\program files\uniblue\registrybooster\RegistryBooster.exe /S
uRun: [Download Master] c:\program files\download master\dmaster.exe -autorun
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
uRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exe
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe
mRun: [DAEMON Tools-1033] "c:\program files\drtools\daemon.exe" -lang 1033
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [Sony Ericsson PC Suite] "c:\program files\sony ericsson\mobile2\application launcher\Application Launcher.exe" /startoptions
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [EstEID AIP switch] "c:\program files\it arendus\id-kaart\aipswitch.exe" 1
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [NPSStartup]
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: []
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: []
dRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime
StartupFolder: c:\docume~1\aleksa~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\aleksa~1\startm~1\programs\startup\ubisof~1.lnk - c:\program files\ubi soft\register\schedule.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\aticat~1.lnk - c:\program files\ati technologies\ati.ace\CLI.exe
IE: {8DAE90AD-4583-4977-9DD4-4360F7A45C74}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{CACEC9B1-741C-4A25-9073-5DFCEEE01B82} : DhcpNameServer = 192.168.1.254
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\aleksandr\application data\mozilla\firefox\profiles\liy2eg1u.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yandex.ru/?clid=22042
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1(2).dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npjp2(2).dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npidcard.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npWebLaunch.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 UP55bus;UP55bus;c:\windows\system32\drivers\UP55bus.sys [2005-12-1 155136]
R0 UP55prt;UP55prt;c:\windows\system32\drivers\UP55prt.sys [2005-12-1 5248]
R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [2003-8-1 29239]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-5-19 11608]
R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [2004-9-1 188416]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-5-19 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-5-19 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-5-19 61960]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-3-22 54752]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-6-23 233472]
R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [2004-8-3 62976]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-6-23 36608]
S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys –> c:\windows\system32\drivers\av5flt.sys [?]
S3 cpuz132;cpuz132;\??\c:\docume~1\aleksa~1\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\aleksa~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 cxbu0wdm;CardMan 1021;c:\windows\system32\drivers\cxbu0wdm.sys [2009-6-24 114304]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [2010-6-23 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [2010-6-23 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [2010-6-23 121856]
.
=============== File Associations ===============
.
JSEFile=c:\progra~1\pandas~1\pandat~1\PAVSCRIP.EXE "%1" %*
VBEFile=c:\progra~1\pandas~1\pandat~1\PAVSCRIP.EXE "%1" %*
VBSFile=c:\progra~1\pandas~1\pandat~1\PAVSCRIP.EXE "%1" %*
.
=============== Created Last 30 ================
.
2011-06-14 18:05:42 ——– d-s—w- C:\ComboFix
2011-06-13 20:12:43 ——– d-sha-r- C:\cmdcons
2011-06-13 20:09:07 98816 —-a-w- c:\windows\sed.exe
2011-06-13 20:09:07 518144 —-a-w- c:\windows\SWREG.exe
2011-06-13 20:09:07 256512 —-a-w- c:\windows\PEV.exe
2011-06-13 20:09:07 208896 —-a-w- c:\windows\MBR.exe
2011-06-13 19:54:35 ——– d—–w- c:\windows\system32\wbem\repository\FS
2011-06-13 19:54:35 ——– d—–w- c:\windows\system32\wbem\Repository
2011-06-12 08:47:16 ——– d—–w- c:\program files\ESET
2011-06-11 14:27:46 11776 —-a-w- c:\program files\mozilla firefox\plugins\nprjplug.dll
2011-06-11 14:27:25 ——– d—–w- c:\program files\common files\xing shared
2011-06-11 14:27:05 150712 —-a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2011-06-11 14:26:56 105472 —-a-w- c:\program files\mozilla firefox\plugins\nprpjplug.dll
2011-06-10 21:18:25 ——– d—–w- c:\documents and settings\aleksandr\local settings\application data\ESET
2011-05-19 08:13:46 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-16 14:07:59 453456 —-a-w- c:\windows\system32\d3dx10_41.dll
2011-05-16 14:06:57 81768 —-a-w- c:\windows\system32\xinput1_3.dll
2011-05-16 13:58:44 ——– d–h–w- c:\windows\msdownld.tmp
2011-05-16 13:58:32 ——– d—–w- c:\windows\Logs
.
==================== Find3M ====================
.
2011-06-14 18:17:46 277504 —-a-w- c:\windows\apppatch\ghwwyxr.dat
.
============= FINISH: 22:56:30,01 ===============
Ried is already helping you here:
http://www.techsupportforum.com/forums/f50…eat-580071.html
It is a really bad idea to be getting advice from two different helpers. Please continue with her there.
Your post has been Moved, Closed or Edited for one of the following reasons:
1.) You posted multiple topics and only one is required
2.) You are spamming links to other places without approval
3.) Abusive language or other problems in your text
4.) Your topic is too old (20 days or more) and no replies from you after a volunteer tried to help you
This is a family oriented forum to help those that need help.
==============================
