After running Combofix and executing a google search, clicking on numerous links seem to be fine now. What a relief. Thanks so much.
Anything else I need to do prevention wise? I know there are several free Antivurus programs. Which one do you recommend? Thanks again.
———————————————————————————————————————————–
ComboFix 09-02-12.03 - Shaukat 2009-02-14 6:44:49.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.1525.765 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\worksnow.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated)
FW: Norton Internet Security *disabled*
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\recycler\S-3-9-36-100000051-100024987-100009437-7466.com
c:\windows\system32\drivers\gaopdxiiovmrwu.sys
c:\windows\system32\gaopdxpxgpcdgp.dll
c:\windows\system32\x64
D:\Autorun.inf
d:\recycler\S-3-9-36-100000051-100024987-100009437-7466.com
—– BITS: Possible infected sites —–
hxxp://download.esd.intuit.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Service_gaopdxserv.sys
——-\Service_iWinGamesInstaller
((((((((((((((((((((((((( Files Created from 2009-01-14 to 2009-02-14 )))))))))))))))))))))))))))))))
.
2009-02-10 23:38 . 2008-11-13 16:59 6,760,280 –a—— c:\windows\System32\NEFcodec.dll
2009-02-10 23:38 . 2008-11-03 10:34 200,704 –a—— c:\windows\System32\Strato7.dll
2009-02-08 02:50 . 2009-02-08 02:50 250 –a—— c:\windows\gmer.ini
2009-02-07 07:23 . 2009-02-07 07:23 d——– c:\users\Shaukat\AppData\Roaming\Malwarebytes
2009-02-07 07:23 . 2009-02-07 07:23 d——– c:\users\All Users\Malwarebytes
2009-02-07 07:23 . 2009-02-07 07:23 d——– c:\programdata\Malwarebytes
2009-02-07 07:23 . 2009-02-07 07:23 d——– c:\program files\Malwarebytes' Anti-Malware
2009-02-07 07:23 . 2009-01-14 16:11 38,496 –a—— c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-07 07:23 . 2009-01-14 16:11 15,504 –a—— c:\windows\System32\drivers\mbam.sys
2009-02-07 06:49 . 2009-02-07 06:49 d——– c:\program files\Trend Micro
2009-02-07 06:17 . 2009-02-07 06:17 d——– c:\program files\Browser Hijack Retaliator 4.5
2009-02-07 06:17 . 1998-06-24 13:00 244,024 –a—— c:\windows\System32\MSFLXGRD.OCX
2009-02-07 06:17 . 2000-05-22 17:00 203,976 –a—— c:\windows\System32\richtx32.ocx
2009-02-07 06:17 . 2001-10-04 13:14 184,320 –a—— c:\windows\System32\wzcsvc.dll
2009-02-07 06:17 . 2004-03-09 13:00 132,880 –a—— c:\windows\System32\MSINET.OCX
2009-02-07 06:13 . 2009-02-07 06:13 d——– c:\program files\SPGuard
2009-02-07 06:03 . 2009-02-07 06:03 d——– c:\program files\CCleaner
2009-02-03 10:33 . 2009-02-03 10:33 d——– c:\users\Shaukat\AppData\Roaming\Intuit
2009-02-03 10:32 . 2009-02-03 10:32 d——– c:\program files\Common Files\AnswerWorks 5.0
2009-02-03 10:26 . 2009-02-03 10:29 d——– c:\users\All Users\Intuit
2009-02-03 10:26 . 2009-02-03 10:29 d——– c:\programdata\Intuit
2009-02-03 10:26 . 2009-02-03 10:26 d——– c:\program files\TurboTax
2009-02-03 10:26 . 2009-02-03 10:29 d——– c:\program files\Common Files\Intuit
2009-02-01 16:34 . 2009-02-14 06:43 4 –a—— c:\windows\System32\gaopdxcounter
2009-01-23 08:22 . 2009-01-23 08:22 d——– c:\users\All Users\Yahoo! Games
2009-01-23 08:22 . 2009-01-23 08:22 d——– c:\users\All Users\Trymedia
2009-01-23 08:22 . 2009-01-23 08:22 d——– c:\programdata\Yahoo! Games
2009-01-23 08:22 . 2009-01-23 08:22 d——– c:\programdata\Trymedia
2009-01-23 08:21 . 2009-01-23 08:21 d——– c:\program files\Yahoo! Games
2009-01-20 12:03 . 2009-01-20 12:03 d——– c:\users\All Users\GameHouse
2009-01-20 12:03 . 2009-01-20 12:03 d——– c:\programdata\GameHouse
2009-01-20 11:36 . 2009-01-20 11:36 d——– c:\users\Shaukat\AppData\Roaming\GameInvest
2009-01-16 07:32 . 2009-01-16 07:32 d——– c:\program files\Common Files\Sandlot Shared
2009-01-14 21:09 . 2009-01-14 21:09 d——– c:\users\Shaukat\AppData\Roaming\Gogii Games
2009-01-14 21:09 . 2009-01-14 21:09 d——– c:\users\All Users\Gogii Games
2009-01-14 21:09 . 2009-01-14 21:09 d——– c:\programdata\Gogii Games
2009-01-14 06:14 . 2008-12-15 21:42 288,768 –a—— c:\windows\System32\drivers\srv.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-14 03:00 ——— d—–w c:\users\Shaukat\AppData\Roaming\OpenOffice.org2
2009-02-13 10:14 ——— d—–w c:\program files\Yahoo!
2009-02-11 04:38 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-22 00:07 ——— d—a-w c:\programdata\TEMP
2009-01-20 16:36 ——— d—–w c:\program files\HP Games
2009-01-16 12:32 ——— d—–w c:\programdata\Sandlot Games
2009-01-16 12:31 ——— d—–w c:\programdata\WildTangent
2009-01-16 04:06 ——— d—–w c:\program files\Brother
2009-01-15 12:54 ——— d—–w c:\program files\Nick Arcade
2009-01-15 08:04 ——— d—–w c:\program files\Windows Mail
2009-01-12 00:34 ——— d—–w c:\users\Shaukat\AppData\Roaming\Winamp
2009-01-12 00:30 ——— d—–w c:\program files\Winamp
2009-01-10 13:00 ——— d—–w c:\users\Shaukat\AppData\Roaming\SBTT
2009-01-07 01:22 ——— d—–w c:\program files\iWin Games
2009-01-06 22:07 ——— d—–w c:\users\Shaukat\AppData\Roaming\Wildgames_DressUpRush
2009-01-04 19:13 ——— d—–w c:\users\Shaukat\AppData\Roaming\Friday's games
2008-12-27 12:43 ——— d—–w c:\program files\TRENDnet
2008-12-27 02:27 ——— d—–w c:\program files\Cake Mania 3
2008-12-25 20:14 ——— d—–w c:\program files\Brownie
2008-12-25 18:18 ——— d—–r c:\users\Shaukat\AppData\Roaming\Brother
2008-12-23 22:37 ——— d—–w c:\users\Shaukat\AppData\Roaming\EleFun Games
2008-12-23 22:37 ——— d—–w c:\program files\Cake Shop
2008-12-23 22:28 ——— d—–w c:\program files\bfgclient
2008-12-23 22:23 ——— d—–w c:\program files\iWin.com
2008-12-22 00:59 ——— d—–w c:\programdata\iWin
2008-09-23 13:41 174 –sha-w c:\program files\desktop.ini
2008-08-23 20:42 20 —h–w c:\users\All Users\PKP_DLec.DAT
2008-08-23 20:42 20 —h–w c:\users\All Users\PKP_DLds.DAT
2008-08-23 20:42 20 —h–w c:\programdata\PKP_DLec.DAT
2008-08-23 20:42 20 —h–w c:\programdata\PKP_DLds.DAT
2008-10-16 08:04 67,696 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2008-10-16 08:04 54,376 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-10-16 08:04 34,952 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2008-10-16 08:04 46,720 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-10-16 08:04 172,144 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-08-05 160568]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-12-03 2356088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"MSConfig"="c:\windows\System32\msconfig.exe" [2008-01-19 227840]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2008-01-08 864256]
"Brdefprn"="c:\program files\Brother\BRHL2170\Brdefprn.exe" [2007-11-05 40960]
"BHR"="c:\program files\Browser Hijack Retaliator 4.5\BHR.exe" [2006-10-24 9375744]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
backup=c:\windows\pss\NkbMonitor.exe.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^StupAssist.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\StupAssist.lnk
backup=c:\windows\pss\StupAssist.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Shaukat^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MEMonitor.lnk]
path=c:\users\Shaukat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEMonitor.lnk
backup=c:\windows\pss\MEMonitor.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Shaukat^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.2.lnk]
path=c:\users\Shaukat\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.2.lnk
backup=c:\windows\pss\OpenOffice.org 2.2.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2007-09-10 23:43 67488 c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
–a—— 2007-01-10 06:59 115816 c:\program files\Common Files\Symantec Shared\ccApp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-17 01:11 49152 c:\program files\Hp\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
–a—— 2007-03-20 17:23 1773568 c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IS CfgWiz]
–a—— 2007-01-13 03:28 431752 c:\program files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
–a—— 2007-03-06 13:28 180224 c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
–a—— 2007-03-28 19:45 176128 c:\program files\Hp\QuickPlay\QPService.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-01-31 22:13 385024 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2008-07-22 22:52 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2008-08-03 18:02 36352 c:\program files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EA745722-0128-4F0F-B512-F7AE2C585451}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{86D3ED15-17B7-4B9B-8858-22BFFD49BD4F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{B4016589-D482-4038-99A2-51CB8DF35DB0}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{E98241C4-FEFA-4A1E-AE1E-5406C8F23C36}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A2946B34-0DB5-4E7D-8D01-60FB9DC7EF8E}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{AE0C41E7-FB91-4D48-B4D2-0B2C968BFFCA}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{C0CE38CA-D5C7-486B-A071-929DBD038A5F}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{D45D08A3-A202-453F-990A-4A9391B0DBD4}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0272BE0F-007A-4D70-B7EF-0B713EC8B392}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{8E20A3E3-1A91-408C-897E-AF2352E09386}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"TCP Query User{57BCEAE1-3196-44C4-A912-53870BF11BD2}c:\\program files\\morpheus\\morpheus.exe"= UDP:c:\program files\morpheus\morpheus.exe:Morpheus
"UDP Query User{1AE6DF80-9C40-4E02-89CE-6B5B6B5108A4}c:\\program files\\morpheus\\morpheus.exe"= TCP:c:\program files\morpheus\morpheus.exe:Morpheus
"TCP Query User{B29E91E6-A773-4C14-BAF6-3F375930E741}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{FE95A3BE-B864-4410-BAE0-6566CFD80E0B}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{A948478C-6B34-46DC-B49D-18874520539F}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{AD165BC1-F4D6-4BA5-B510-73DB682ADCB5}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{F7571D9A-154B-4A16-BA34-2E362CA4B597}c:\\program files\\hp\\hp software update\\hpwucli.exe"= UDP:c:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
"UDP Query User{53B79B02-428C-41FA-BB18-45EBC2B79ABA}c:\\program files\\hp\\hp software update\\hpwucli.exe"= TCP:c:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
"{099A0D12-A660-4901-A0D5-29A079E4E511}"= UDP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{977E1E63-7549-43BB-A967-DF09F31929F0}"= TCP:c:\program files\iWin Games\iWinGames.exe:iWin Games application.
"{EB916BB6-0EAC-4723-BE88-0D094F5719CA}"= UDP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
"{84BCE356-D5CA-43DA-87DA-6D863A235188}"= TCP:c:\program files\iWin Games\WebUpdater.exe:iWin Games updater.
"{0A370E4F-2584-4604-988B-62D53AFBF8C8}"= UDP:c:\program files\Brother\BRAdmin Light\BRAdmLight.exe:BRAdmin Light
"{2797F32F-D32E-44AB-8372-6BD5F4965A01}"= TCP:c:\program files\Brother\BRAdmin Light\BRAdmLight.exe:BRAdmin Light
"TCP Query User{9A845EA0-6D81-454B-8A15-479C2C6FFC6B}c:\\program files\\trendnet\\ipview pro\\ipview pro.exe"= UDP:c:\program files\trendnet\ipview pro\ipview pro.exe:IPView Pro
"UDP Query User{10B20537-D27B-4B05-81CC-DD8DC2BF26FF}c:\\program files\\trendnet\\ipview pro\\ipview pro.exe"= TCP:c:\program files\trendnet\ipview pro\ipview pro.exe:IPView Pro
"TCP Query User{D924AD4B-3BB3-4345-827C-58351D713D79}c:\\users\\shaukat\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= UDP:c:\users\shaukat\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"UDP Query User{158586E7-9D7B-4BAE-AC5E-A451D1748DC8}c:\\users\\shaukat\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= TCP:c:\users\shaukat\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]
R2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2009-01-06 78104]
S3 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070108.003\IDSvix86.sys [2007-04-24 212280]
S4 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832]
— Other Services/Drivers In Memory —
*NewlyCreated* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3407b607-2adf-11dd-a5e8-806e6f6e6963}]
\shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d375795a-b06f-11dc-81e4-0016d4f2e07f}]
\shell\AutoRun\command - f:\jdsecure\Windows\JDSecure20.exe
.
Contents of the 'Scheduled Tasks' folder
2009-01-19 c:\windows\Tasks\HPCeeScheduleForShaukat.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-03-23 16:23]
2009-02-13 c:\windows\Tasks\User_Feed_Synchronization-{B1FAED55-714A-4CB5-B36C-4B13016F547D}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 02:33]
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} - hxxp://www.ritzpix.com/net/Uploader/LPUploader45.cab
DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} - hxxp://192.168.254.5/xplugLiteTW.cab
FF - ProfilePath - c:\users\Shaukat\AppData\Roaming\Mozilla\Firefox\Profiles\wm9x04hi.default\
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - msn.com
1 file(s) moved.
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll
—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver;={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features;=TrustRank&client;={moz:client}&appver;={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-02-14 06:57:12
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
———————— Other Running Processes ————————
.
c:\windows\System32\audiodg.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\igfxsrvc.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2009-02-14 7:05:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-14 12:05:14
Pre-Run: 25,966,915,584 bytes free
Post-Run: 25,727,303,680 bytes free
290 — E O F — 2009-01-30 12:16:07
