What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] adzgalore popup infection and combofix log

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
OK, I downloaded something that infected me with popups from "adzgalore".
I ran combofix, and the log is below. Now what do I do to stop the ads?

many thanks
pbass


pgreen" - 2008-10-28 9:17:37 - ComboFix 07-07-12.3 - Service Pack 3

/wow section - STAGE #8

((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-28 )))))))))))))))))))))))))))))))


2008-10-28 05:32 d——– C:\LITTLE_FEAT
2008-10-28 05:20 d——– C:\Program Files\DVD Shrink
2008-10-28 05:20 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
2008-10-28 05:11 d——– C:\Program Files\Adzgalore Games Collection
2008-10-28 05:10 90,948 –a—— C:\WINDOWS\system32\cupchrmtkccof.dll-uninst.exe
2008-10-28 05:10 78,621 –a—— C:\WINDOWS\system32\qddiaojbmdcskegd.exe
2008-10-28 05:10 102,190 –a—— C:\WINDOWS\system32\cont_adzgalore-remove.exe
2008-10-28 04:48 d——– C:\DOCUME~1\pgreen\APPLIC~1\CyberLink
2008-10-27 14:34 172,032 –a—— C:\WINDOWS\system32\difsidnzlovzcoo.dll
2008-10-20 06:05 600,576 –a—— C:\WINDOWS\system32\cupchrmtkccof.dll
2008-10-13 19:38 d——– C:\Program Files\MSECache
2008-10-07 10:51 364,032 –a—— C:\WINDOWS\system32\nsk1D1.dll


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-10-28 13:22:28 ——– d—–w C:\DOCUME~1\pgreen\APPLIC~1\FrostWire
2008-10-28 12:53:48 ——– d—–w C:\DOCUME~1\pgreen\APPLIC~1\Skype
2008-10-28 12:06:30 ——– d—–w C:\DOCUME~1\pgreen\APPLIC~1\skypePM
2008-10-26 14:52:10 ——– d—–w C:\DOCUME~1\pgreen\APPLIC~1\Apple Computer
2008-10-10 19:00:00 ——– d—–w C:\Program Files\Norton Security Scan
2008-10-03 12:22:15 ——– d—–w C:\Program Files\Picasa2
2008-09-15 12:12:56 1,846,400 —-a-w C:\WINDOWS\system32\win32k.sys
2008-09-11 02:25:26 ——– d—–w C:\DOCUME~1\pgreen\APPLIC~1\FileZilla
2008-09-11 02:13:21 ——– d—–w C:\Program Files\FileZilla FTP Client
2008-09-10 23:30:05 ——– d—–w C:\Program Files\Messenger
2008-09-10 12:23:48 ——– d—–w C:\Program Files\Movie Maker
2008-09-10 12:16:25 ——– d—–w C:\Program Files\Windows NT
2008-09-08 10:41:42 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2005-12-06 23:26:01 27,144 —-a-w C:\DOCUME~1\pgreen\APPLIC~1\GDIPFONTCACHEV1.DAT


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
2006-10-26 11:28 440384 –a—— C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-04-17 21:05 66912 –a—— C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 04:16 59032 –a—— C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F3F4EC3-7F0F-DA1E-2E6A-9EECF2070202}]
2008-10-27 14:34 172032 –a—— C:\WINDOWS\system32\difsidnzlovzcoo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1fc48534-e14e-98a9-89ba-2d0ad5246f80}]
2008-10-07 10:51 364032 –a—— C:\WINDOWS\system32\nsk1D1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
2008-03-25 16:34 308856 –a—— C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5b5ded64-74ae-477b-ab0d-74d0d8f38d6e}]
2007-07-08 15:10 172032 –a—— C:\WINDOWS\system32\cfhdjan.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
2006-10-31 16:29 198136 –a—— C:\Program Files\Yahoo!\Common\yiesrvc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2008-06-10 04:27 509328 –a—— C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c1ce531-09e9-4fc5-9803-1c2956615786}]
2008-08-09 08:44 103936 –a—— C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-09-10 19:56 2554944 -ra—— c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2008-10-27 18:58 652784 –a—— C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D1F4E78F-EE40-FB3B-3FB5-B5D278EBB2CD}]
2008-10-20 06:05 600576 –a—— C:\WINDOWS\system32\cupchrmtkccof.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-04-17 21:05 267592 –a—— C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nForce Tray Options"="sstray.exe" [2002-11-13 03:34 C:\WINDOWS\system32\sstray.exe]
"nwiz"="nwiz.exe" [2003-07-28 16:19 C:\WINDOWS\system32\nwiz.exe]
"StorageGuard"="C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 01:01]
"F-StopW"="C:\Program Files\FSI\F-Prot\F-StopW.EXE" [2003-09-29 15:05]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13]
"tgcmd"="C:\Program Files\support.com\bin\tgcmd.exe" [2002-04-24 21:37]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 17:47]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 17:37]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 11:18]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-06 06:38]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 18:22]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-25 16:33]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 20:12]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" []
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 17:07]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 22:49]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-02 14:17]
"Oeai"="C:\DOCUME~1\pgreen\MYDOCU~1\SKS~1\dexplore.exe" []
"Qadk"="C:\Program Files\Common Files\?ymbols\?pool32.exe" []
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 15:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - netsvcs
napagent
hkmsvc


Contents of the 'Scheduled Tasks' folder
2008-10-27 19:06:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
2008-10-10 19:09:47 C:\WINDOWS\tasks\Norton Security Scan.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 09:22:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2008-10-28 9:23:12
C:\ComboFix-quarantined-files.txt … 2008-10-28 09:23
C:\ComboFix2.txt … 2007-08-05 19:01
C:\ComboFix3.txt … 2007-07-12 07:14

— E O F —
Post #2
pbass,

The first thing you do is drag that copy of ComboFix to your trash bin! That version of ComboFix is over a year old. Tools we used are constantly updated (especially ComboFix). As malware changes, the writers of the trash often change their garbage to effect the tools. Running an out of date version can have cataclysmic results. Do not run any more tools without being directed!

Next

Download HijackThis from Here .
  • If using Internet Explorer, Please select RUN
  • If Using Firefox, Download to your Desktop and then Double-Click on Icon to start installation.
  • Choose the default location of C:\Program Files\Trend Micro\HijackThis as the destination. HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!
  • Click the Install button.
  • Accept the license agreement .
  • The progam will place a shortcut on your desktop. This will make it easier for you to access the tool when required.
  • Click Do a system scan and save a log file. A Notepad file will open.
  • To post the text, first you must highlight the entire text and then press the (Ctrl+C) keys which copies it to your clipboard.
  • Now paste the log into this thread using the (Ctrl + V) buttons.


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI