1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Yahoo won't load on IE7

Discussion in 'Malware and Virus Removal Archive' started by dawgyjay, 2009/07/17.

  1. 2009/07/17
    dawgyjay

    dawgyjay Inactive Thread Starter

    Joined:
    2009/03/27
    Messages:
    4
    Likes Received:
    0
    [Active] Yahoo won't load on IE7

    Hi. Sometime yesterday afternoon I stopped being able to connect to any Yahoo page. It worked and then all of the sudden didn't. It seems to be the only web page affected. I'm not redirected to any sites using other search engines. I've deleted all my cookies and whatnot. I've checked the security settings and it isn't a restricted site. I placed it in the trusted sites. I've run my virus protection (Kaspersky) and nothing showed up. I ran Malwarebytes and it did not find any Spyware. I even installed IE8 and that didn't solve the issue either. I can access using another computer. I'm stumped. Here is a copy of the DDS log. It's the only log that opened. i didn't get a 2nd log. I'm not sure how to sscript blocking (or if it's even enabled) and my apologies if that's why I didn't get a 2nd log. Thanks for your help.

    DDS (Ver_09-06-26.01) - NTFSx86
    Run by Owner at 18:08:29.88 on Fri 07/17/2009
    Internet Explorer: 8.0.6001.18783
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.1790.828 [GMT -4:00]

    AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    SP: Kaspersky Internet Security *enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\rundll32.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\SMINST\BLService.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Windows\system32\WLANExt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Owner\Desktop\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uSearch Bar = Preserve
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    mURLSearchHooks: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    BHO: MRI_DISABLED - No File
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
    mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\eventr~1.lnk - c:\program files\the print shop 23\Remind.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
    uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
    Trusted Zone: yahoo.com\www
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1238553668925&h=d8af199110103221286cda29bf8f3ae1/&filename=jinstall-6u13-windows-i586-jc.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    Notify: klogon - c:\windows\system32\klogon.dll
    AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll

    ============= SERVICES / DRIVERS ===============

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2008-7-9 20496]
    R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-25 365952]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-25 24652]
    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-25 193840]
    R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-5-9 43040]
    S2 Norton Internet Security;Norton Internet Security; "c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 --> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]

    =============== Created Last 30 ================

    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\eu-ES
    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\ca-ES
    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\vi-VN
    2009-07-16 23:45 <DIR> --d----- c:\windows\system32\EventProviders
    2009-07-16 23:20 12,240,896 a------- c:\windows\system32\NlsLexicons0007.dll
    2009-07-16 23:19 2,868,224 a------- c:\windows\system32\mf.dll
    2009-07-16 23:18 897,000 a------- c:\windows\system32\drivers\tcpip.sys
    2009-07-16 23:17 1,382,912 a------- c:\windows\system32\WMVSDECD.DLL
    2009-07-16 23:16 1,689,600 a------- c:\windows\system32\wscui.cpl
    2009-07-16 23:15 705,536 a------- c:\windows\system32\SmiEngine.dll
    2009-07-16 23:15 218,624 a------- c:\windows\system32\wdscore.dll
    2009-07-16 23:15 130,560 a------- c:\windows\system32\PkgMgr.exe
    2009-07-16 23:15 247,808 a------- c:\windows\system32\drvstore.dll
    2009-07-16 21:22 <DIR> --d----- c:\program files\iPod
    2009-07-14 17:28 289,792 a------- c:\windows\system32\atmfd.dll
    2009-07-14 17:28 156,672 a------- c:\windows\system32\t2embed.dll
    2009-07-14 17:28 72,704 a------- c:\windows\system32\fontsub.dll
    2009-07-14 17:28 34,304 a------- c:\windows\system32\atmlib.dll
    2009-07-14 17:28 23,552 a------- c:\windows\system32\lpk.dll
    2009-07-14 17:28 10,240 a------- c:\windows\system32\dciman32.dll
    2009-07-05 17:00 766 a------- c:\windows\system\CRIcon.ico
    2009-06-24 10:38 391,696 a------- c:\users\owner\appdata\roaming\GDIPFONTCACHEV1.DAT

    ==================== Find3M ====================

    2009-07-17 03:31 712,736 a--sh--- c:\windows\system32\drivers\fidbox2.dat
    2009-07-17 03:29 3,516 a--sh--- c:\windows\system32\drivers\fidbox2.idx
    2009-07-17 00:13 51,200 a------- c:\windows\inf\infpub.dat
    2009-07-17 00:13 143,360 a------- c:\windows\inf\infstrng.dat
    2009-07-17 00:13 86,016 a------- c:\windows\inf\infstor.dat
    2009-07-17 00:07 6,472,736 a--sh--- c:\windows\system32\drivers\fidbox.dat
    2009-07-17 00:07 52,696 a--sh--- c:\windows\system32\drivers\fidbox.idx
    2009-07-17 00:04 665,600 a------- c:\windows\inf\drvindex.dat
    2009-07-13 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-13 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
    2009-07-05 16:47 27,839 a------- c:\programdata\nvModes.dat
    2009-07-05 16:47 27,839 a------- c:\progra~2\nvModes.dat
    2009-05-20 17:48 105,395 a------- c:\windows\system32\drivers\klin.dat
    2009-05-20 17:48 94,643 a------- c:\windows\system32\drivers\klick.dat
    2009-05-09 01:50 915,456 a------- c:\windows\system32\wininet.dll
    2009-05-09 01:34 71,680 a------- c:\windows\system32\iesetup.dll
    2009-04-23 08:15 784,896 a------- c:\windows\system32\rpcrt4.dll
    2009-04-23 08:14 623,616 a------- c:\windows\system32\localspl.dll
    2009-04-21 07:39 2,034,688 a------- c:\windows\system32\win32k.sys
    2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini
    2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
    2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
    2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
    2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
    2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
    2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
    2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
    2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

    ============= FINISH: 18:09:34.27 ===============
     
    dawgyjay,
    #1
  2. 2009/07/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I don't think, we're dealing here with any infection, but let's check couple of things.
    First of all, 2nd part of DDS log is missing, so please, provide it.

    I can see also some Norton's leftovers.
    Download, and run Norton Removal Tool: http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039

    Download avz4.zip from here
    • Unzip it to your desktop to a folder named avz4
    • Double click on AVZ.exe to run it.
    • Run an update by clicking the Auto Update button on the Right of the Log window: [​IMG]
    • Click Start to begin the update
    Note: If you recieve an error message, chose a different source, then click Start again
    • After the update, from the "File " menu, choose "Standard Scripts "
    • Put a check next to item 2: Advanced System Analysis
    • Click Execute selected scripts
    • At the next prompt, click the Yes button
    • Let the scan run and click "OK" when the completion prompt pops up
    • Now Close out of the Standard Scripts window, and exit AVZ
    • Navigate to the avz4 folder and locate the folder LOG
    • Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
    • Upload virusinfo_syscheck.zip, to http://www.filedropper.com/. Provide download link.
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/07/18
    dawgyjay

    dawgyjay Inactive Thread Starter

    Joined:
    2009/03/27
    Messages:
    4
    Likes Received:
    0
    Thanks for your help. I followed your steps and ran the Norton removal tool as well as AZV. I have uploaded the file and here is the download link: http://www.filedropper.com/virusinfosyscheck.

    Also, as I mentioned in my first post, I did not get a 2nd log when I ran DDS. I ran it again after following your suggestions. I rec'd the 2nd log this time. Here they are. Thanks again for your help.
    :
    DDS (Ver_09-06-26.01) - NTFSx86
    Run by Owner at 1:34:59.38 on Sat 07/18/2009
    Internet Explorer: 8.0.6001.18783
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.1790.782 [GMT -4:00]

    AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    SP: Kaspersky Internet Security *enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
    FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\SMINST\BLService.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Owner\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uSearch Bar = Preserve
    uStart Page = hxxp://yahoo.com/
    uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
    mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb
    uInternet Settings,ProxyOverride = *.local
    mURLSearchHooks: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    BHO: MRI_DISABLED - No File
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
    TB: New York Yankees Toolbar: {c7e292f8-1f8d-40a6-8fa6-e6e83d51e7e1} - c:\program files\new_york_yankees\tbNew0.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
    uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
    mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\eventr~1.lnk - c:\program files\the print shop 23\Remind.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
    uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Banner Ad Blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
    IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
    Trusted Zone: yahoo.com\www
    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
    DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab
    DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1238553668925&h=d8af199110103221286cda29bf8f3ae1/&filename=jinstall-6u13-windows-i586-jc.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    Notify: klogon - c:\windows\system32\klogon.dll
    AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll

    ============= SERVICES / DRIVERS ===============

    R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
    R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\drivers\klim6.sys [2008-7-9 20496]
    R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-25 365952]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-3-25 24652]
    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-25 193840]
    R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-5-9 43040]

    =============== Created Last 30 ================

    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\eu-ES
    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\ca-ES
    2009-07-17 00:05 <DIR> --d----- c:\windows\system32\vi-VN
    2009-07-16 23:45 <DIR> --d----- c:\windows\system32\EventProviders
    2009-07-16 23:20 12,240,896 a------- c:\windows\system32\NlsLexicons0007.dll
    2009-07-16 23:19 2,868,224 a------- c:\windows\system32\mf.dll
    2009-07-16 23:18 897,000 a------- c:\windows\system32\drivers\tcpip.sys
    2009-07-16 23:17 1,382,912 a------- c:\windows\system32\WMVSDECD.DLL
    2009-07-16 23:16 1,689,600 a------- c:\windows\system32\wscui.cpl
    2009-07-16 23:15 705,536 a------- c:\windows\system32\SmiEngine.dll
    2009-07-16 23:15 218,624 a------- c:\windows\system32\wdscore.dll
    2009-07-16 23:15 130,560 a------- c:\windows\system32\PkgMgr.exe
    2009-07-16 23:15 247,808 a------- c:\windows\system32\drvstore.dll
    2009-07-16 21:22 <DIR> --d----- c:\program files\iPod
    2009-07-14 17:28 289,792 a------- c:\windows\system32\atmfd.dll
    2009-07-14 17:28 156,672 a------- c:\windows\system32\t2embed.dll
    2009-07-14 17:28 72,704 a------- c:\windows\system32\fontsub.dll
    2009-07-14 17:28 34,304 a------- c:\windows\system32\atmlib.dll
    2009-07-14 17:28 23,552 a------- c:\windows\system32\lpk.dll
    2009-07-14 17:28 10,240 a------- c:\windows\system32\dciman32.dll
    2009-07-05 17:00 766 a------- c:\windows\system\CRIcon.ico
    2009-06-24 10:38 391,696 a------- c:\users\owner\appdata\roaming\GDIPFONTCACHEV1.DAT

    ==================== Find3M ====================

    2009-07-18 01:34 745,504 a--sh--- c:\windows\system32\drivers\fidbox2.dat
    2009-07-18 01:20 6,555,168 a--sh--- c:\windows\system32\drivers\fidbox.dat
    2009-07-18 01:20 53,340 a--sh--- c:\windows\system32\drivers\fidbox.idx
    2009-07-18 01:20 3,600 a--sh--- c:\windows\system32\drivers\fidbox2.idx
    2009-07-17 00:13 51,200 a------- c:\windows\inf\infpub.dat
    2009-07-17 00:13 143,360 a------- c:\windows\inf\infstrng.dat
    2009-07-17 00:13 86,016 a------- c:\windows\inf\infstor.dat
    2009-07-17 00:04 665,600 a------- c:\windows\inf\drvindex.dat
    2009-07-13 13:36 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-13 13:36 19,096 a------- c:\windows\system32\drivers\mbam.sys
    2009-07-05 16:47 27,839 a------- c:\programdata\nvModes.dat
    2009-07-05 16:47 27,839 a------- c:\progra~2\nvModes.dat
    2009-05-20 17:48 105,395 a------- c:\windows\system32\drivers\klin.dat
    2009-05-20 17:48 94,643 a------- c:\windows\system32\drivers\klick.dat
    2009-05-09 01:50 915,456 a------- c:\windows\system32\wininet.dll
    2009-05-09 01:34 71,680 a------- c:\windows\system32\iesetup.dll
    2009-04-23 08:15 784,896 a------- c:\windows\system32\rpcrt4.dll
    2009-04-23 08:14 623,616 a------- c:\windows\system32\localspl.dll
    2009-04-21 07:39 2,034,688 a------- c:\windows\system32\win32k.sys
    2008-01-20 22:43 174 a--sh--- c:\program files\desktop.ini
    2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
    2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
    2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
    2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
    2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
    2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
    2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
    2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

    ============= FINISH: 1:35:49.83 ===============

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-06-26.01)

    Microsoft® Windows Vistaâ„¢ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 3/9/2009 11:41:15 PM
    System Uptime: 7/18/2009 1:21:08 AM (0 hours ago)

    Motherboard: Wistron | | 303C
    Processor: AMD Athlon Dual-Core QL-62 | Socket A | 2000/133mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 222 GiB total, 174.613 GiB free.
    D: is FIXED (NTFS) - 11 GiB total, 1.828 GiB free.
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================


    ==== Installed Programs ======================

    Activation Assistant for the 2007 Microsoft Office suites
    ActiveCheck component for HP Active Support Library
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.1.2
    Adobe Shockwave Player
    Adobe Shockwave Player 11.5
    AIM 6
    Apple Mobile Device Support
    Apple Software Update
    Atheros Driver Installation Program
    Bonjour
    CA Yahoo! Anti-Spy (remove only)
    Choice Guard
    Cisco EAP-FAST Module
    Cisco LEAP Module
    Cisco PEAP Module
    Compatibility Pack for the 2007 Office system
    Conexant HD Audio
    CyberLink DVD Suite
    Diamond Mind Baseball version 9
    DMB Encyclopedia 9a patch
    DMB Encyclopedia 9b patch
    DMB Encyclopedia version 9
    DMB version 9a patch
    DMB version 9b patch
    DMB version 9c patch
    ESU for Microsoft Vista
    HDAUDIO Soft Data Fax Modem with SmartCP
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Doc Viewer
    HP DVD Play 3.7
    HP Help and Support
    HP Quick Launch Buttons 6.40 H2
    HP Total Care Advisor
    HP Update
    HP User Guides 0118
    HP Wireless Assistant
    HPAsset component for HP Active Support Library
    HPNetworkAssistant
    HPTCSSetup
    iMusic Tools
    iTunes
    Java(TM) 6 Update 13
    Java(TM) 6 Update 7
    Kaspersky Internet Security 2009
    LabelPrint
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB929729)
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Office XP Professional
    Microsoft Silverlight
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Web Publishing Wizard 1.52
    MLB.com Shuffle (remove only)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    muvee Reveal
    My HP Games
    NetWaiting
    New_York_Yankees Toolbar
    Norton Internet Security
    NVIDIA Drivers
    Power2Go
    PowerDirector
    QuickTime
    Realtek USB 2.0 Card Reader
    Sony Picture Utility
    Sony USB Driver
    Spelling Dictionaries Support For Adobe Reader 9
    Synaptics Pointing Device Driver
    The Print Shop 23
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Viewpoint Media Player
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Yahoo! Install Manager
    Yahoo! Software Update
    Yahoo! Toolbar

    ==== End Of File ===========================
     
    dawgyjay,
    #3
  5. 2009/07/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    For some reason, your Filedropper link doesn't work. Can you try to upload the file one more time?
     
    broni,
    #4
  6. 2009/07/18
    dawgyjay

    dawgyjay Inactive Thread Starter

    Joined:
    2009/03/27
    Messages:
    4
    Likes Received:
    0
    dawgyjay,
    #5
  7. 2009/07/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    We're not dealing with any malware problem here.

    Couple of things...

    Unless you installed Viewpoint Manager knowledgeably...
    Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
    Uninstall any of the following programs associated with Viewpoint:
    * Viewpoint Manager
    * Viewpoint Media Player
    * Viewpoint Toolbar
    This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ( "drive-by-install ") as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.
    Restart computer.

    Close IE.
    Go Start>All Programs>Accessories>System Tools, and click on Internet Explorer (no add-ons). Same problem?

    Did you try Firefox to see, if you have same problem?
     
    broni,
    #6

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...