What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IE ad popups spontaneously on desktop?

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
ComboFix 09-01-17.02 - Roland 2009-01-17 10:41:54.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1016.659 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Roland\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\SET11A.tmp
c:\windows\system32\SET140.tmp
c:\windows\system32\SET153.tmp
c:\windows\system32\SET1F3.tmp
c:\windows\system32\SET61.tmp

.
((((((((((((((((((((((((( Files Created from 2008-12-17 to 2009-01-17 )))))))))))))))))))))))))))))))
.

2009-01-16 20:18 . 2009-01-16 20:19 d——– C:\Rooter$
2009-01-16 16:54 . 2009-01-16 16:54 d——– c:\documents and settings\All Users\Application Data\Avg8
2009-01-16 11:22 . 2009-01-16 11:22 d——– c:\program files\Malwarebytes' Anti-Malware
2009-01-16 11:22 . 2009-01-16 11:22 d——– c:\documents and settings\Roland\Application Data\Malwarebytes
2009-01-16 11:22 . 2009-01-16 11:22 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-16 11:22 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-16 11:22 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-01-16 11:12 . 2009-01-16 11:12 410,984 –a—— c:\windows\system32\deploytk.dll
2009-01-16 10:49 . 2009-01-16 11:10 d——– c:\documents and settings\Roland\.SunDownloadManager
2009-01-13 22:00 . 2009-01-13 22:00 1,374 –a—— c:\windows\imsins.BAK
2009-01-11 20:08 . 2009-01-11 20:08 d——– c:\program files\Trend Micro
2009-01-08 20:53 . 2009-01-08 20:53 d——– c:\documents and settings\Roland\Application Data\Apple Computer
2009-01-08 20:52 . 2009-01-08 20:52 d——– c:\program files\iTunes
2009-01-08 20:52 . 2009-01-08 20:52 d——– c:\program files\iPod
2009-01-08 20:52 . 2009-01-08 20:52 d——– c:\program files\Bonjour
2009-01-08 20:52 . 2009-01-08 20:52 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-08 20:52 . 2008-04-17 13:12 107,368 –a—— c:\windows\system32\GEARAspi.dll
2009-01-08 20:52 . 2008-04-17 13:12 15,464 –a—— c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-08 20:51 . 2009-01-08 20:51 d——– c:\program files\QuickTime
2009-01-08 20:51 . 2009-01-08 20:52 d——– c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-08 20:50 . 2009-01-08 20:52 d—-c— c:\windows\system32\DRVSTORE
2009-01-08 20:50 . 2009-01-08 20:52 d——– c:\program files\Common Files\Apple
2009-01-08 20:50 . 2009-01-08 20:50 d——– c:\program files\Apple Software Update
2009-01-08 20:50 . 2009-01-08 20:50 d——– c:\documents and settings\All Users\Application Data\Apple
2009-01-07 20:36 . 2009-01-11 16:29 d——– c:\documents and settings\Roland\Application Data\LimeWire
2009-01-05 10:45 . 2009-01-05 10:45 d——– c:\program files\Windows Resource Kits
2009-01-05 10:26 . 2008-04-14 05:42 1,287,168 –a—— c:\windows\system32\SET82.tmp
2009-01-01 09:38 . 2009-01-01 09:38 d——– c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-01-01 08:50 . 2009-01-17 10:40 d——– c:\windows\system32\CatRoot2
2008-12-31 08:34 . 2008-12-31 08:34 d——– c:\program files\Belarc
2008-12-31 08:34 . 2008-02-27 12:49 3,840 –a—— c:\windows\system32\drivers\BANTExt.sys
2008-12-29 20:40 . 2008-12-29 20:46 d——– c:\documents and settings\Roland\Application Data\U3
2008-12-29 19:56 . 2008-12-29 19:56 d——– c:\program files\MSXML 6.0
2008-12-29 18:22 . 2009-01-16 16:54 8,192 –a—— c:\documents and settings\freenet
2008-12-28 21:26 . 2008-12-28 21:26 d——– c:\windows\system32\scripting
2008-12-28 21:26 . 2008-12-28 21:26 d——– c:\windows\system32\en
2008-12-28 21:26 . 2008-12-28 21:26 d——– c:\windows\l2schemas
2008-12-28 19:45 . 2008-12-28 19:45 d——– c:\program files\Common Files\Adobe AIR
2008-12-28 19:38 . 2008-04-13 16:12 1,703,936 –a—— c:\windows\system32\SETFE.tmp
2008-12-28 19:37 . 2008-04-13 16:11 997,376 –a—— c:\windows\system32\SET2CF.tmp
2008-12-28 19:36 . 2008-04-13 16:12 1,033,728 –a—— c:\windows\SET44E.tmp
2008-12-28 19:35 . 2008-04-13 16:11 1,025,024 –a—— c:\windows\system32\SET40E.tmp
2008-12-28 18:53 . 2008-12-28 18:53 d——– c:\program files\MSXML 4.0
2008-12-28 18:44 . 2008-06-13 03:05 272,128 —–c— c:\windows\system32\dllcache\bthport.sys
2008-12-28 18:43 . 2008-12-11 02:57 333,952 —–c— c:\windows\system32\dllcache\srv.sys
2008-12-28 18:43 . 2008-08-14 02:04 138,496 —–c— c:\windows\system32\dllcache\afd.sys
2008-12-28 18:38 . 2008-08-14 02:11 2,189,184 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-12-28 18:38 . 2008-08-14 02:09 2,145,280 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-12-28 18:38 . 2008-08-14 01:33 2,066,048 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-12-28 18:38 . 2008-08-14 01:33 2,023,936 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2008-12-28 18:38 . 2008-09-15 04:12 1,846,400 —–c— c:\windows\system32\dllcache\win32k.sys
2008-12-28 18:37 . 2008-04-11 11:04 691,712 —–c— c:\windows\system32\dllcache\inetcomm.dll
2008-12-28 18:37 . 2008-10-24 03:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-12-28 18:37 . 2008-10-15 08:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-12-28 18:37 . 2008-05-08 06:02 203,136 —–c— c:\windows\system32\dllcache\rmcast.sys
2008-12-28 15:39 . 2008-12-28 15:39 d——– c:\documents and settings\Roland\Application Data\Logitech
2008-12-28 15:29 . 2008-12-28 15:29 d——– c:\program files\Logitech
2008-12-28 15:29 . 2008-12-28 15:29 d——– c:\program files\Common Files\Logitech
2008-12-28 15:29 . 2006-05-25 00:12 155,648 –a—— c:\windows\system32\kemutb.dll
2008-12-28 15:29 . 2006-05-25 00:12 126,976 –a—— c:\windows\system32\KemUtil.dll
2008-12-28 15:29 . 2006-05-25 00:12 110,592 –a—— c:\windows\system32\KemWnd.dll
2008-12-28 15:29 . 2006-05-10 09:48 94,208 –a—— c:\windows\KHALMNPR.Exe
2008-12-28 15:29 . 2006-05-10 09:56 71,680 –a—— c:\windows\system32\drivers\LMouKE.Sys
2008-12-28 15:29 . 2006-05-10 09:56 56,064 –a—— c:\windows\system32\drivers\L8042mou.Sys
2008-12-28 15:29 . 2006-05-25 00:12 53,248 –a—— c:\windows\system32\KemXML.dll
2008-12-28 15:29 . 2006-05-10 09:56 27,264 –a—— c:\windows\system32\drivers\LHidKE.Sys
2008-12-28 15:29 . 2006-05-10 09:56 13,568 –a—— c:\windows\system32\drivers\L8042Kbd.sys
2008-12-28 15:29 . 2006-05-25 00:53 3,712 –a—— c:\windows\system32\drivers\LBeepKE.sys
2008-12-28 15:06 . 2008-12-28 15:06 d——– c:\windows\Samsung
2008-12-28 15:06 . 2006-03-23 08:18 454,656 –a—— c:\windows\ssndii.exe
2008-12-28 15:06 . 2003-04-17 23:29 82,432 –a—— c:\windows\system32\msxml4r.dll
2008-12-28 15:06 . 2003-04-17 23:29 44,544 –a—— c:\windows\system32\msxml4a.dll
2008-12-28 15:06 . 2000-08-03 08:52 21,776 –a—— c:\windows\system32\msxml2a.dll
2008-12-28 15:05 . 2005-03-02 20:32 151,552 –a—— c:\windows\system32\SUGO3CI.exe
2008-12-28 15:05 . 2005-03-03 02:09 57,344 –a—— c:\windows\system32\SUGO3CI.dll
2008-12-28 15:05 . 2006-01-01 22:42 22,663 –a—— c:\windows\system32\sugo3LMK.DLL
2008-12-28 15:05 . 2005-07-08 12:54 11,502 –a—— c:\windows\Dr. Printer Icon.ico
2008-12-28 15:05 . 2005-12-12 23:03 555 –a—— c:\windows\system32\sugo3LMK.SMT
2008-12-28 15:04 . 2008-12-28 15:04 d——– c:\windows\system32\drivers\Samsung
2008-12-28 15:04 . 2008-12-28 15:04 d——– c:\program files\Samsung
2008-12-28 15:04 . 2004-08-10 22:39 41,984 –a—— c:\windows\system32\drivers\DGIVECP.SYS
2008-12-28 14:30 . 2008-04-13 10:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-12-28 14:30 . 2008-04-14 05:41 21,504 –a—— c:\windows\system32\hidserv.dll
2008-12-28 14:30 . 2008-04-13 10:39 14,592 –a—— c:\windows\system32\drivers\kbdhid.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-17 05:45 ——— d—–w c:\program files\Spybot - Search & Destroy
2009-01-17 05:44 ——— d—–w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 19:12 ——— d—–w c:\program files\Java
2009-01-11 04:15 ——— d—–w c:\program files\Microsoft ActiveSync
2009-01-08 03:36 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-08 03:36 ——— d—–w c:\program files\SpywareBlaster
2008-12-29 03:43 ——— d—–w c:\program files\Common Files\Adobe
2008-12-29 01:07 ——— d—–w c:\program files\CCleaner
2008-12-28 23:29 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2006-03-21 19:47 18,864 -c–a-w c:\documents and settings\Roland\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2009-01-16_13.43.41.93 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-17 18:45:08 16,384 —-atw c:\windows\temp\Perflib_Perfdata_5b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-10-26 292152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-16 136600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R4 BOCore;BOCore;c:\program files\Comodo\CBOClean\BOCore.exe [2008-02-13 73472]
R4 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2008-12-28 3712]
.
Contents of the 'Scheduled Tasks' folder

2009-01-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\6cjg44ba.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca
FF - plugin: c:\program files\Mozilla Firefox\plugins\npsabffx.dll
FF - plugin: c:\windows\system32\SuperAdBlocker.com\npsabffx.dll

—- FIREFOX POLICIES —-
FF - user.js: keyword.enabled - true
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-17 10:45:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\Crypserv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-17 10:52:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-17 18:52:02
ComboFix2.txt 2009-01-17 17:49:10
ComboFix3.txt 2009-01-17 15:56:57
ComboFix4.txt 2009-01-17 05:40:16
ComboFix5.txt 2009-01-17 18:41:11

Pre-Run: 25,337,446,400 bytes free
Post-Run: 25,317,777,408 bytes free

197 — E O F — 2009-01-14 06:00:16
Post #19
roland67, I'm not done tormenting you. :P After giving it a test drive, you've got to come back. If everything seems OK, we will do a couple closeout procedures. When you are ready, post back with a new HijackThis log.
Post #20
Everything seems to be ok I think, or maybe not. Sorry i am not a great help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:14 PM, on 1/17/09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2005111…all/xscan53.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

–
End of file - 5798 bytes
Post #21
roland67,

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

Please re-enable any security that was disabled.
You can delete Rooter.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. I'll leave the thread open for a couple days in case issues arise. Otherwise, this thread will be closed Resolved. :thumbup:
Post #23
roland67,

Nope. Let's just do a couple things the uninstall routine would have done.

  • Make sure you have an Internet Connection.
  • Download OTCleanIt to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


Does your clock have the correct settings? If not:

If you want your clock in 12 hr vs. 24 hour format:

  • Click on Start
  • Click on Control Panel
  • Click on Regional and language options
  • Click on customize
  • Click on Time tab
  • Click on arrow to the right of time format
  • Select h:mm:ss tt
  • OK your way out
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI