#1
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
[Inactive] IE opening by itself
Hi, i've been redirected here, internet explorer keeps opening up by itself. here are the results of the dds log thingsHJT Report ===============js : browser.search.selectedEngine - Googlejs : browser.startup.homepage - hxxp://www.aintitcool.com/js : keyword.URL - hxxp://search.addthis.com/search?pco=fxe-3.0.0&locale=en-GB&q=js : yahoo.homepage.dontask - truec:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);ms ms AMD Phenom(tm) II X4 965 Processor | AM2 | 3400/200mhzSP2 )SP2 )SP2 (KB954430)SP2 (KB973688)
Didn't find the information you thought to find?Similar Threads
#2
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,977
Computer Experience:
I see you have P2P software ( Azures, Limewire, BitTorrent, uTorrent etc… ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , and here .I would strongly recommend that you uninstall them, and read the links above for educational value! Note:
#3
Malware Analyst
Profile: Join Date: Jan 2010
Location: Australia
Posts: 874
Computer Experience:
Ok. I see some infection there so I will get you to run another couple of tools please.Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html ) to your desktop.mbam-setup.exe and follow the prompts to install the program.Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish. here Perform quick scan , then click Scan. Show Results to view the results.Remove Selected .Post the log back here .log-date.txt log-date.txt Make sure that you restart the computer. OTL Custom Scan box paste this in:atapi .sysQuick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt . These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy ) the contents of these files, one at a time, and post them back here.
#4
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
the p2p software is for the legal dvd torrents the nine inch nails fan community create using the free footage released by the band, i'd like to think i didnt get something from there but i guess you never know...
#5
Malware Analyst
Profile: Join Date: Jan 2010
Location: Australia
Posts: 874
Computer Experience:
Are you running OTL?
#6
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
yeah doing it now
#7
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
OTL Extras logfile created on: 09/03/2010 10:51:03 - Run 1========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )SP2 )========== HKEY_CURRENT_USER Uninstall List ========== ========== Last 10 Event Log Errors ==========
#8
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
that was the extras one this is the otl========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== 64bit: - [2009/11/04 16:47:32 | 000,155,456 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)64bit: - [2009/10/28 11:50:32 | 000,696,848 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)64bit: - [2009/10/14 14:31:44 | 000,116,224 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe -- (WDDMService)64bit: - [2009/10/07 01:47:10 | 000,191,000 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcS64)64bit: - [2009/07/14 01:41:59 | 000,229,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wwansvc.dll -- (WwanSvc)64bit: - [2009/07/14 01:41:56 | 000,202,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbiosrvc.dll -- (WbioSrvc)64bit: - [2009/07/14 01:41:56 | 000,163,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpo.dll -- (Power)64bit: - [2009/07/14 01:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)64bit: - [2009/07/14 01:41:54 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sppuinotify.dll -- (sppuinotify)64bit: - [2009/07/14 01:41:54 | 000,029,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sensrsvc.dll -- (SensrSvc)64bit: - [2009/07/14 01:41:53 | 000,327,168 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\pnrpsvc.dll -- (PNRPsvc)64bit: - [2009/07/14 01:41:53 | 000,327,168 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\pnrpsvc.dll -- (p2pimsvc)64bit: - [2009/07/14 01:41:53 | 000,187,904 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\provsvc.dll -- (HomeGroupProvider)64bit: - [2009/07/14 01:41:53 | 000,067,072 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\SysNative\RpcEpMap.dll -- (RpcEptMapper)64bit: - [2009/07/14 01:41:53 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\pnrpauto.dll -- (PNRPAutoReg)64bit: - [2009/07/14 01:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)64bit: - [2009/07/14 01:41:18 | 000,231,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ListSvc.dll -- (HomeGroupListener)64bit: - [2009/07/14 01:40:54 | 001,127,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FntCache.dll -- (FontCache)64bit: - [2009/07/14 01:40:28 | 000,314,368 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp )64bit: - [2009/07/14 01:40:28 | 000,291,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\defragsvc.dll -- (defragsvc)64bit: - [2009/07/14 01:40:13 | 000,083,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\bthserv.dll -- (bthserv)64bit: - [2009/07/14 01:40:10 | 000,100,864 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\SysNative\bdesvc.dll -- (BDESVC)64bit: - [2009/07/14 01:40:05 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AxInstSv.dll -- (AxInstSV)64bit: - [2009/07/14 01:40:01 | 000,032,256 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appidsvc.dll -- (AppIDSvc)64bit: - [2009/07/14 01:39:51 | 001,503,744 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbengine.exe -- (wbengine)64bit: - [2009/07/14 01:39:28 | 003,524,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\sppsvc.exe -- (sppsvc)64bit: - [2009/07/14 01:39:11 | 000,689,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FXSSVC.exe -- (Fax)64bit: - [2009/03/30 16:19:56 | 002,297,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)64bit: - [2008/12/18 12:05:28 | 000,155,648 | ---- | M] (Stardock Corporation) [Auto | Running] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)Dhcp )========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== http://g.uk.msn.com/USCON/2 http://g.uk.msn.com/USCON/2 ========== FireFox ========== js ..browser.search.defaultenginename: "AddThis"js ..browser.search.order.1: "Web Search"js ..browser.search.order.2: "Google"js ..browser.search.selectedEngine: "Google"js ..browser.startup.homepage: "http ://www.aintitcool.com/"js ..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3js ..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.0.0js ..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org :1.19js ..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315js ..keyword.URL: "http ://search.addthis.com/search?pco=fxe-3.0.0&locale=en-GB&q="64bit: - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files (x86)\McAfee\MSK\mskapbho64.dll ()64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Windows\SysNative\wshbth.dll (Microsoft Corporation)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_13)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)64bit: - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - Reg Error: Key error. File not found64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found64bit: - Protocol\Handler\ms -help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)64bit: - HKLM\..comfile [open] -- "%1" %*64bit: - HKLM\..exefile [open] -- "%1" %*64bit: Ias - C:\Windows\SysNative\ias [2009/07/14 03:20:14 | 000,000,000 | ---D | M]64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation)64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation)64bit: Themes - C:\Windows\SysNative\themeservice.dll (Microsoft Corporation)64bit: BDESVC - C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation)========== Files/Folders - Created Within 14 Days ========== ========== Files - Modified Within 14 Days ========== ms ms ========== Files Created - No Company Name ========== ms ms ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > < MD5 for: ATAPI .SYS > atapi .sysatapi .sys< MD5 for: CNGAUDIT.DLL > < MD5 for: IASTORV.SYS > < MD5 for: NETLOGON.DLL > < MD5 for: NVSTOR.SYS > < MD5 for: SCECLI.DLL > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > Unable to obtain MD5 -- C:\Windows\SysWOW64\wininet.dll< %systemroot%\System32\config\*.sav >
#9
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
oops, sorry, it went a bit crazy there
#10
Malware Analyst
Profile: Join Date: Jan 2010
Location: Australia
Posts: 874
Computer Experience:
That's looking ok to me. Is IE still opening?
#11
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,977
Computer Experience:
Quote:
Originally Posted by
PCRKnight
the p2p software is for the legal dvd torrents the nine inch nails fan community create using the free footage released by the band, i'd like to think i didnt get something from there but i guess you never know....
You did get yourself infected, and usually that doesn't happen by itself. Read the links & educate yourself.
#12
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
no it doesnt seem to be happening anymore thats awesome, thanks everyone, really appreciate it
#13
Malware Analyst
Profile: Join Date: Jan 2010
Location: Australia
Posts: 874
Computer Experience:
Lets just make sure you are clear before you go.Kaspersky WebScanner disable real time protection applications as they sometimes interfere with the scan. this link for any applicable programs you may have (check under How to Temporarily Disable your Anti-virus ).Accept If your pop –up blocker blocks any windows from opening.Run on the window that opens.Windows Vista users you must open the web browser using the Run as Administrator command - accessible from the right-click menu from the browser shortcut.The program will launch and then begin downloading the latest definition files.
When completed, under Scan on the left side, click on My Computer .
This will start the scan of your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Click Report on the left side.
Click the Save Report button, and in the Save dialog box, type a name for the scan report file that you want to create and select its type as Text file . Click OK to save the file.
Copy and paste that information in your next post.
#14
Member
Profile: Join Date: Mar 2010
Posts: 10
Computer Experience:
it took ages but it's finished, looks like i still got a couple thingsJS .Pdfka.bub 1
#15
Malware Analyst
Profile: Join Date: Jan 2010
Location: Australia
Posts: 874
Computer Experience:
This should fix them;Download and Run ATF Cleaner ATF (Atribune Temp File) Cleaner© by Atribune to your desktop. ATF Cleaner.exe to open it. Main choose: Windows Temp Empty Selected button. Firefox: Firefox at the top and choose: Select All Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Opera: Opera at the top and choose: Select All Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Exit on the Main menu to close the program.Go to Start > Control Panel double-click on the Software icon > add/remove programs.
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
Select it and click Remove.
Then Download and install the newest version from here:
http ://www.java.com/en/download/manual.jsp
All times are GMT +1. The time now is 08:50 .
