 |
||
Redirect issues w/Google help requested
|
||
|
|
|
|||||||
| Register | Projects | Blogs | FAQ | Search | Today's Posts | Mark Forums Read |
2010-06-21, 11:58
|
#1 |
|
Junior Member
Join Date: May 2009
Posts: 24
|
Redirect issues w/Google help requested
To Guru it may concern,
I am having redirect issues when using Google. May also be happening in IE but am not 100% sure. Getting seek.ind.in & whattoseek redirects. Thanks for your help in advance, Sportdman Here is my HiJackThis log ********************************* Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 2:56:11 AM, on 6/21/2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Ahead\InCD\InCDsrv.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe D:\Program Files\Bonjour\mDNSResponder.exe D:\Program Files\Flip Video\FlipShare\FlipShareService.exe D:\WINDOWS\System32\inetsrv\inetinfo.exe D:\Program Files\Google\Update\GoogleUpdate.exe D:\Program Files\Java\jre6\bin\jqs.exe D:\Program Files\Network Associates\Common Framework\FrameworkService.exe D:\Program Files\Network Associates\VirusScan\mcshield.exe D:\Program Files\Network Associates\VirusScan\vstskmgr.exe D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\system32\HPZipm12.exe D:\PROGRA~1\Dantz\RETROS~1\retrorun.exe D:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe D:\Program Files\support.com\bin\tgcmd.exe D:\WINDOWS\system32\WDBtnMgr.exe D:\Program Files\BillP Studios\WinPatrol\winpatrol.exe D:\WINDOWS\system32\ctfmon.exe D:\WINDOWS\explorer.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\Trend Micro\HijackThis\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [UpdateMedia] D:\Program Files\MediaUpdate\UpdateMedia.exe O4 - HKLM\..\Run: [ShStatEXE] "D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [tgcmd] "D:\Program Files\support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe O4 - HKLM\..\Run: [openvpn-gui] D:\Program Files\OpenVPN\bin\openvpn-gui.exe O4 - HKLM\..\Run: [WinPatrol] D:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - Startup: ERUNT AutoBackup.lnk = D:\Program Files\ERUNT\AUTOBACK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing) O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing) O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/...areControl.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02...s/MSNPUpld.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...nt/swflash.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\System32\browseui.dll O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FlipShare Service - Unknown owner - D:\Program Files\Flip Video\FlipShare\FlipShareService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - D:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - D:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - D:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - D:\Program Files\Network Associates\VirusScan\mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - D:\Program Files\Network Associates\VirusScan\vstskmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - D:\Program Files\OpenVPN\bin\openvpnserv.exe O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe O23 - Service: ReaConverter scheduler service (rcp_service) - ReaSoft - D:\Program Files\ReaConverter 5.5 Pro\rcp_scheduler.exe O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - D:\PROGRA~1\Dantz\RETROS~1\retrorun.exe O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - D:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 9344 bytes I forgot to attache my DDS reports. Here they are. Thanks in advance, Sportdman ******************************************* DDS (Ver_10-03-17.01) - NTFSx86 Run by JonMarlowe at 3:03:02.85 on Mon 06/21/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.767.247 [GMT -7:00] ============== Running Processes =============== D:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe D:\WINDOWS\System32\svchost.exe -k netsvcs D:\Program Files\Ahead\InCD\InCDsrv.exe svchost.exe svchost.exe D:\WINDOWS\system32\spoolsv.exe svchost.exe D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe D:\Program Files\Bonjour\mDNSResponder.exe D:\Program Files\Flip Video\FlipShare\FlipShareService.exe D:\WINDOWS\System32\inetsrv\inetinfo.exe D:\Program Files\Google\Update\GoogleUpdate.exe D:\Program Files\Java\jre6\bin\jqs.exe D:\Program Files\Network Associates\Common Framework\FrameworkService.exe D:\Program Files\Network Associates\VirusScan\mcshield.exe D:\Program Files\Network Associates\VirusScan\vstskmgr.exe D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe D:\WINDOWS\System32\nvsvc32.exe D:\WINDOWS\system32\HPZipm12.exe D:\PROGRA~1\Dantz\RETROS~1\retrorun.exe D:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe D:\WINDOWS\System32\svchost.exe -k imgsvc D:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\Network Associates\VirusScan\SHSTAT.EXE D:\Program Files\Network Associates\Common Framework\UpdaterUI.exe D:\WINDOWS\system32\WDBtnMgr.exe D:\Program Files\BillP Studios\WinPatrol\winpatrol.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\taskmgr.exe D:\WINDOWS\explorer.exe D:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe D:\Documents and Settings\JonMarlowe\Desktop\dds.scr ============== Pseudo HJT Report =============== mSearch Bar = hxxp://www.google.com/ie mWindow Title = Microsoft Internet Explorer presented by Comcast uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - d:\progra~1\yahoo!\companion\installs\cpn2\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - d:\progra~1\yahoo!\companion\installs\cpn2\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - d:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - d:\program files\yahoo!\common\yiesrvc.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - d:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - d:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - d:\progra~1\yahoo!\companion\installs\cpn2\yt.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - d:\program files\google\google toolbar\GoogleToolbar_32.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File mRun: [UpdateMedia] d:\program files\mediaupdate\UpdateMedia.exe mRun: [ShStatEXE] "d:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "d:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey mRun: [tgcmd] "d:\program files\support.com\bin\tgcmd.exe" /server mRun: [WD Button Manager] WDBtnMgr.exe mRun: [openvpn-gui] d:\program files\openvpn\bin\openvpn-gui.exe mRun: [WinPatrol] d:\program files\billp studios\winpatrol\winpatrol.exe -expressboot mRun: [QuickTime Task] "d:\program files\quicktime\qttask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "d:\program files\adobe\reader 9.0\reader\Reader_sl.exe" StartupFolder: d:\docume~1\jonmar~1\startm~1\programs\startup\erunta~1.lnk - d:\program files\erunt\AUTOBACK.EXE IE: E&xport to Microsoft Excel - d:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ IE: {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ IE: {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - d:\program files\yahoo!\common\yiesrvc.dll DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - d:\program files\yahoo!\common\Yinsthelper.dll DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} - hxxps://disneyblast.go.com/v3/setup/activex/DIGHardwareControl.cab DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\WPDShServiceObj.dll SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll ================= FIREFOX =================== FF - ProfilePath - d:\docume~1\jonmar~1\applic~1\mozilla\firefox\profiles\r03wfihw.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com FF - plugin: d:\documents and settings\jonmarlowe\application data\move networks\plugins\npqmp071505000011.dll FF - plugin: d:\documents and settings\jonmarlowe\application data\mozilla\firefox\profiles\r03wfihw.default\extensions\runtime@panda3d.org\platform\winnt_x86-msvc\plugins\nppanda3d.dll FF - plugin: d:\documents and settings\jonmarlowe\local settings\application data\unity\webplayer\loader\npUnity3D32.dll FF - plugin: d:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: d:\program files\mozilla firefox\plugins\npatgpc.dll FF - plugin: d:\program files\mozilla firefox\plugins\NPcol400.dll FF - plugin: d:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - plugin: d:\program files\unity\webplayer\loader\npUnity3D32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); d:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); d:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); d:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); d:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); d:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 $sys$cor;$sys$cor;d:\windows\system32\drivers\$sys$cor.sys [2004-10-6 18432] R1 $sys$crater;$sys$crater;d:\windows\system32\$sys$filesystem\crater.sys [2004-10-7 11904] R1 adda;adda;d:\windows\system32\adda.sys [2010-6-12 80896] R2 FlashNT;FlashNT;d:\windows\system32\drivers\flashnt.sys [2002-12-23 72784] R2 McAfeeFramework;McAfee Framework Service;d:\program files\network associates\common framework\FrameworkService.exe [2004-9-12 106586] R2 McShield;Network Associates McShield;d:\program files\network associates\virusscan\mcshield.exe [2003-9-29 237657] R2 McTaskManager;Network Associates Task Manager;d:\program files\network associates\virusscan\vstskmgr.exe [2003-9-29 69706] R2 Sdselect;Sdselect;d:\windows\system32\drivers\sdselect.sys [2002-12-23 73296] R3 NaiAvFilter1;NaiAvFilter1;d:\windows\system32\drivers\naiavf5x.sys [2003-9-29 83008] R3 tap0801;TAP-Win32 Adapter V8;d:\windows\system32\drivers\tap0801.sys [2006-10-1 26624] S2 gupdate;Google Update Service (gupdate);d:\program files\google\update\GoogleUpdate.exe [2010-1-30 135664] S3 rcp_service;ReaConverter scheduler service;d:\program files\reaconverter 5.5 pro\rcp_scheduler.exe [2007-11-30 558592] =============== Created Last 30 ================ 2010-06-21 08:52:31 77312 ----a-w- d:\windows\MBR.exe 2010-06-13 02:56:02 80896 ----a-w- d:\windows\system32\adda.sys 2010-06-10 18:12:30 743424 -c----w- d:\windows\system32\dllcache\iedvtool.dll ==================== Find3M ==================== 2010-06-21 08:31:55 1744 ----a-w- d:\windows\system32\d3d9caps.dat 2010-06-13 02:56:15 1632 ----a-w- d:\windows\system32\d3d8caps.dat 2010-05-06 10:41:53 916480 ----a-w- d:\windows\system32\wininet.dll 2010-05-02 05:22:50 1851264 ----a-w- d:\windows\system32\win32k.sys 2010-04-29 22:39:38 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys 2010-04-29 22:39:26 20952 ----a-w- d:\windows\system32\drivers\mbam.sys 2010-04-26 22:58:12 256512 ----a-w- d:\windows\PEV.exe 2010-04-20 05:30:08 285696 ----a-w- d:\windows\system32\atmfd.dll 2010-03-24 04:53:01 74288 ----a-w- d:\docume~1\jonmar~1\applic~1\GDIPFONTCACHEV1.DAT 2004-07-24 05:25:12 49570 ----a-w- d:\program files\common files\Nina Card.STO 2003-08-16 03:10:21 3000704 ----a-w- d:\program files\PokerStarsInstall.exe 2003-08-13 03:54:46 1291040 ----a-w- d:\program files\WindowsXP-KB823980-x86-ENU.exe 2003-07-17 03:00:16 301500 ----a-w- d:\program files\PPAL.EXE 2003-07-16 04:49:31 5282816 ----a-w- d:\program files\ParadisePokerSetup.exe 2003-07-09 06:56:49 11646328 ----a-w- d:\program files\acdsee.exe 2001-08-23 12:00:00 94784 --sh--w- d:\windows\twain.dll 2008-04-14 00:12:07 50688 --sh--w- d:\windows\twain_32.dll 2008-04-14 00:11:56 1028096 --sha-w- d:\windows\system32\mfc42.dll 2008-04-14 00:12:01 57344 --sha-w- d:\windows\system32\msvcirt.dll 2008-04-14 00:12:01 413696 --sha-w- d:\windows\system32\msvcp60.dll 2008-04-14 00:12:02 551936 --sh--w- d:\windows\system32\oleaut32.dll 2008-04-14 00:12:32 11776 --sha-w- d:\windows\system32\regsvr32.exe ============= FINISH: 3:04:29.22 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 12/16/2002 11:35:17 PM System Uptime: 6/19/2010 11:09:18 PM (28 hours ago) Motherboard: IBM | | IBM Processor: Intel(R) Pentium(R) 4 CPU 2.00GHz | WMT478/NWD | 1993/100mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (FAT) - 2 GiB total, 1.01 GiB free. D: is FIXED (NTFS) - 35 GiB total, 4.111 GiB free. E: is CDROM () F: is CDROM () ==== Disabled Device Manager Items ============= Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Linksys Wireless-G PCI Adapter Device ID: PCI\VEN_1814&DEV_0201&SUBSYS_00321737&REV_01\4&122329E2&0&70F0 Manufacturer: Linksys, A Division of Cisco Systems, Inc. Name: Linksys Wireless-G PCI Adapter PNP Device ID: PCI\VEN_1814&DEV_0201&SUBSYS_00321737&REV_01\4&122329E2&0&70F0 Service: RT2500 Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318} Description: PS/2 Compatible Mouse Device ID: ACPI\PNP0F13\0 Manufacturer: Microsoft Name: PS/2 Compatible Mouse PNP Device ID: ACPI\PNP0F13\0 Service: i8042prt ==== System Restore Points =================== RP2195: 5/23/2010 9:22:44 AM - System Checkpoint RP2196: 5/24/2010 10:22:35 AM - System Checkpoint RP2197: 5/25/2010 10:33:28 AM - System Checkpoint RP2198: 5/26/2010 11:23:40 AM - System Checkpoint RP2199: 5/26/2010 10:13:34 PM - Software Distribution Service 3.0 RP2200: 5/27/2010 10:22:33 PM - System Checkpoint RP2201: 5/28/2010 10:21:17 PM - Installed HiJackThis RP2202: 5/29/2010 10:32:02 PM - System Checkpoint RP2203: 5/30/2010 10:40:11 PM - System Checkpoint RP2204: 6/1/2010 12:14:09 AM - System Checkpoint RP2205: 6/2/2010 1:39:10 AM - System Checkpoint RP2206: 6/3/2010 2:31:47 AM - System Checkpoint RP2207: 6/3/2010 9:03:55 PM - Software Distribution Service 3.0 RP2208: 6/4/2010 9:31:53 PM - System Checkpoint RP2209: 6/5/2010 10:32:57 PM - System Checkpoint RP2210: 6/6/2010 11:31:50 PM - System Checkpoint RP2211: 6/8/2010 12:20:23 AM - System Checkpoint RP2212: 6/9/2010 12:41:13 AM - System Checkpoint RP2213: 6/10/2010 1:31:49 AM - System Checkpoint RP2214: 6/10/2010 1:49:01 PM - Software Distribution Service 3.0 RP2215: 6/11/2010 2:00:42 PM - System Checkpoint RP2216: 6/12/2010 2:51:28 PM - System Checkpoint RP2217: 6/13/2010 3:51:34 PM - System Checkpoint RP2218: 6/14/2010 3:52:40 PM - System Checkpoint RP2219: 6/15/2010 4:51:29 PM - System Checkpoint RP2220: 6/16/2010 5:51:27 PM - System Checkpoint RP2221: 6/17/2010 6:51:28 PM - System Checkpoint RP2222: 6/18/2010 7:51:28 PM - System Checkpoint RP2223: 6/19/2010 8:51:34 PM - System Checkpoint RP2224: 6/20/2010 10:00:58 PM - System Checkpoint ==== Installed Programs ====================== 3100_3200_3300_Help 3100_3200_3300trb 3200 3ivx MPEG-4 5.0.3 (remove only) Acrobat.com Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 9.3.2 Adobe Shockwave Player 11.5 AiO_Scan_CDA AiOSoftwareNPI Alphabet Express Apple Application Support Apple Mobile Device Support Apple Software Update Applian Director ArcSoft PhotoImpression 4 Ask Toolbar Audacity 1.3.10 (Unicode) AutoUpdate Bonjour BufferChm CALI CD Updater CALI Library 2003-2004 CCleaner (remove only) Comcast High-Speed Internet Install Wizard Compatibility Pack for the 2007 Office system Coupon Printer for Windows CP_CalendarTemplates1 cp_OnlineProjectsConfig CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config cp_PosterPrintConfig Critical Update for Windows Media Player 11 (KB959772) CueTour CutePDF Writer 2.8 Destinations DeviceFunctionQFolder Digimax Reader Digimax V70 Digimax Viewer 2.1 DivX Converter DivX Player DivX Web Player DocProc DocProcQFolder DocumentViewer ERUNT 1.1j Fax_CDA Fisher-PriceŽ Ready for Preschool FlashPath FlipShare Google Earth Google Toolbar for Internet Explorer Google Update Helper HighMAT Extension to Microsoft Windows XP CD Writing Wizard HiJackThis HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Format SDK (KB902344) Hotfix for Windows Media Format SDK (KB910998) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Customer Participation Program 7.0 HP Document Viewer 7.0 HP Driver Diagnostics HP Imaging Device Functions 7.0 HP Photo Printing Software HP Photosmart Premier Software 6.5 HP Photosmart, Officejet and Deskjet 7.0.A hp psc 900 series HP Share-to-Web HP Software Update HP Solution Center 7.0 HP Update HPPhotoSmartExpress HPProductAssistant InetDctr InstantShareDevices InstantShareDevicesMFC Intel(R) Network Connections Drivers iTunes Java Web Start Java(TM) 6 Update 13 LAME v3.98.2 for Audacity Linksys Wireless-G PCI Adapter Malwarebytes' Anti-Malware MarketResearch Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Digital Image Pro 7.0 Microsoft Fighter Ace II Microsoft Flight Simulator 2002 Microsoft FrontPage Client - English Microsoft Office XP Media Content Microsoft Office XP Standard Microsoft RAW Image Thumbnailer and Viewer for Windows XP Version 1.0 (Build 50) Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual J# .NET (English) Microsoft Visual J# .NET Redistributable Package(ENU) v1.0.4205 Microsoft Visual Studio .NET Professional - English Microsoft Windows Journal Viewer Move Media Player Mozilla Firefox (3.6.3) MSN Gaming Zone MSN Music Assistant MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nero PhotoShow Elite Nero Suite NewCopy_CDA Norton PC Checkup NVIDIA Windows 2000/XP Display Drivers OCR Software by I.R.I.S 7.0 OGA Notifier 2.0.0048.0 OpenVPN 2.0.9-gui-1.0.3 PanoStandAlone PhotoGallery Picasa 2 PL-2303 USB-to-Serial PLI's Multistate Bar Review PokerStars Preschool v1.0 ProductContextNPI QuickTime QuickTime for Windows (32-bit) RandMap ReaConverter 5.5 Pro Readme RealPlayer Replay Media Catcher Retrospect 6.5 Safari SafeSurfing Scan ScannerCopy Security Update for CAPICOM (KB931906) Security Update for Windows Internet Explorer 8 (KB971961) Security Update for Windows Internet Explorer 8 (KB972260) Security Update for Windows Internet Explorer 8 (KB974455) Security Update for Windows Internet Explorer 8 (KB976325) Security Update for Windows Internet Explorer 8 (KB978207) Security Update for Windows Internet Explorer 8 (KB981332) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953155) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB970483) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB976323) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) SightSpeed (remove only) SkinsHP1 SlideShow SolutionCenter Sonic_PrimoSDK Spybot - Search & Destroy Spybot - Search & Destroy 1.5.2.20 SpywareBlaster 4.3 Status Toolbox TrayApp Ulead Movie Wizard SE VCD Unity Web Player Unload Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 8 (KB972636) Update for Windows Internet Explorer 8 (KB976662) Update for Windows Internet Explorer 8 (KB976749) Update for Windows Internet Explorer 8 (KB980182) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) URGE Visual J# .NET Visual J# .NET Redistributable Package Visual Studio .NET Professional - English Visual Studio.NET Baseline - English WebEx WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 8 Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 Windows XP Service Pack 3 WinPatrol 2009 WizCom InfoScan Desktop Writing Blaster Yahoo! Address AutoComplete Yahoo! Browser Services Yahoo! Install Manager Yahoo! Internet Mail Yahoo! Messenger Yahoo! Music Jukebox Yahoo! Toolbar ==== Event Viewer Messages From Past Week ======== 6/14/2010 7:29:09 AM, error: Dhcp [1002] - The IP address lease 10.10.38.41 for the Network Card with network address 00FF84F54890 has been denied by the DHCP server 10.10.32.0 (The DHCP Server sent a DHCPNACK message). ==== End Of File =========================== Last edited by Blade81; 2010-06-21 at 16:45. Reason: Two posts merged |
|
|
2010-06-25, 18:16
|
#2 |
|
Security Expert
Join Date: Oct 2006
Location: Finland
Posts: 20,805
|
Hi,
Download GMER here by clicking download exe -button and then saving it your desktop:
__________________
Microsoft MVP Consumer Security 2008 2009 2010 ASAP & UNITE member since 2006 I don't help with logs thru PM. If you have problems create a thread in the forum, please. Malware removal instructions are for the correspondent user's case only. |
|
|
2010-06-26, 02:06
|
#3 |
|
Junior Member
Join Date: May 2009
Posts: 24
|
Thanks for helping me out
Blade81,
Here is the GMER log and fresh DDS as requested. I have attached them in the zip file. Thanks in advance for your help. Sportdman |
|
|
|
2010-06-26, 10:00
|
#4 |
|
Security Expert
Join Date: Oct 2006
Location: Finland
Posts: 20,805
|
Hi,
Please visit this webpage for download links, and instructions for running ComboFix tool: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully first. Please continue as follows:
When the tool is finished, it will produce a report for you. Please include the following reports for further review, and so we may continue cleansing the system: C:\ComboFix.txt New dds log. A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
__________________
Microsoft MVP Consumer Security 2008 2009 2010 ASAP & UNITE member since 2006 I don't help with logs thru PM. If you have problems create a thread in the forum, please. Malware removal instructions are for the correspondent user's case only. |
|
|
|
2010-06-26, 10:59
|
#5 |
|
Junior Member
Join Date: May 2009
Posts: 24
|
Ran ComboFix
Blade81,
The log file from Combofix and the DDS files are attached. When Combofix was creating the log file I received a warning from WinPatrol about a DLL change. I did not know what the DLL was so I clicked "No" to accepting the change. I have attached a screen shot of the WinPatrol DLL alert. Thanks, sportdman |
|
|
|
2010-06-26, 12:39
|
#6 |
|
Security Expert
Join Date: Oct 2006
Location: Finland
Posts: 20,805
|
Hi,
Disable WinPatrol and McAfee before the next steps. Open notepad and copy/paste the text in the quotebox below into it: Code:
http://forums.spybot.info/showthread.php?p=375549#post375549
Suspect::[76]
d:\windows\system32\adda.sys
DDS::
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
Regnull::
[HKEY_USERS\S-1-5-21-823518204-308236825-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{73E93356-3B95-4EE9-A9D7-A5A2F629F2C4}*]
Save this as CFScript A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.  Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe Then post the resultant log. Uninstall Ask Toolbar if not installed on purpose. Download ATF (Atribune Temp File) CleanerŠ by Atribune to your desktop. Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you use Firefox: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you use Opera: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here. Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
__________________
Microsoft MVP Consumer Security 2008 2009 2010 ASAP & UNITE member since 2006 I don't help with logs thru PM. If you have problems create a thread in the forum, please. Malware removal instructions are for the correspondent user's case only. |
|
|
|
2010-06-27, 08:39
|
#7 |
|
Junior Member
Join Date: May 2009
Posts: 24
|
Blade81,
I disabled McAfee and Winpatrol before performing your instructions. I performed your instructions in the following order: I ran Combofix. I uninstalled ASK TOOLBAR. I ran ATFCLEANER, I ran the Kaspersky scan as instructed. I ran DDS. Attached are the log files from Combofix, DDS, and Kaspersky. Thanks for your help, Sportdman |
|
|
|
2010-06-27, 10:18
|
#8 |
|
Security Expert
Join Date: Oct 2006
Location: Finland
Posts: 20,805
|
Hi,
Open notepad and copy/paste the text in the quotebox below into it: Code:
Driver:: adda File:: d:\windows\system32\adda.sys Save this as CFScript A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use. Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe Then post the resultant log + fresh dds.txt log. Does redirecting still occur?
__________________
Microsoft MVP Consumer Security 2008 2009 2010 ASAP & UNITE member since 2006 I don't help with logs thru PM. If you have problems create a thread in the forum, please. Malware removal instructions are for the correspondent user's case only. |
|
|
|
2010-06-27, 11:45
|
#9 |
|
Junior Member
Join Date: May 2009
Posts: 24
|
No more re-direct issues
Blade81,
After running the last combofix script I did not have any re-direct issues with google searches. Looks like the issue is resolved. Attached are the logs you requested. What is left to button up the issue? Is there a way to immunize against this problem? Thanks in advance, sportdman |
|
|
|
2010-06-27, 12:03
|
#10 |
|
Security Expert
Join Date: Oct 2006
Location: Finland
Posts: 20,805
|
Hi,
If no other problems left, it's time to secure your system to prevent against further intrusions. THESE STEPS ARE VERY IMPORTANT Let's reset system restore Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points. 1. Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK. NOTE: only do this ONCE,NOT on a regular basis Now lets uninstall ComboFix:
Please download OTC and save it to desktop.
Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so. UPDATING WINDOWS AND INTERNET EXPLORER IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates. If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update. Make your Internet Explorer more secure This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
Just a final reminder for you. I am trying to stress these two points. UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks. Make sure all of your security programs are up to date. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Once again, please post and tell me how things are going with your system... problems etc. Have a great day, Blade 
__________________
Microsoft MVP Consumer Security 2008 2009 2010 ASAP & UNITE member since 2006 I don't help with logs thru PM. If you have problems create a thread in the forum, please. Malware removal instructions are for the correspondent user's case only. |
|
|
| Thread Tools | |
| Display Modes | |
|
|
Linear Mode
