1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active IE8 Re-directing from chosen web site

Discussion in 'Malware and Virus Removal Archive' started by steveo65, 2009/11/17.

Page 1 of 2
  1. 2009/11/17
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    [Active] IE8 Re-directing from chosen web site

    :mad: When I use Bing, google, ect to search a query, and then choose a website, I get re-directed to multiple different sites. they're all different, but One comes more than others. They all have a cursive looking 2 in front of the "http" in the address bar first, then it switches to another "type" of search site. I have ran Malwarebytes multiple times. I have also ran IObit Security 360 and Windows Saftey Scanner to no avail. I have Microsoft Security Essentials installed and active. I have also tried uninstalling IE8 and reinstalling. This is on a Dell with XP SP3.
     
    steveo65,
    #1
  2. 2009/11/18
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Admin.,
    #2


  3. to hide this advert.

  4. 2009/11/18
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    I cannot run dds, It flashes a black screen then goes away. Not sure how to remove any script blockers or if how to check if I have script blocking on.
     
    steveo65,
    #3
  5. 2009/11/18
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Moved to the Malware & Virus Removal forum - please wait for advice from our Malware analysts.
     
    PeteC,
    #4
  6. 2009/11/18
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    The website that it gets re-directed to is allgive.com. This happens most of the time
     
    steveo65,
    #5
  7. 2009/11/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      • Double click on combofix.exe & follow the prompts.
      • When finished, it will produce a report for you.
      • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
      **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

      Make sure, you re-enable your security programs, when you're done with Combofix.

      DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


      Download HijackThis:
      http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
      by clicking on Download HijackThis Installer
      Install, and run it.
      Post HijackTHis log.
      Do NOT attempt to fix anything!

      NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #6
  8. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    Combo fix Log

    ComboFix 09-11-18.07 - Ronnie G 11/19/2009 8:30.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2610 [GMT -5:00]
    Running from: c:\documents and settings\Ronnie G\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Ronnie G\My Documents\ZbThumbnail.info
    C:\Redemption.ECF

    Infected copy of c:\windows\System32\DRIVERS\atapi.sys was found and disinfected
    Restored copy from - Kitty ate it :p
    .
    ((((((((((((((((((((((((( Files Created from 2009-10-19 to 2009-11-19 )))))))))))))))))))))))))))))))
    .

    2009-11-17 23:22 . 2009-11-17 23:25 -------- dc-h--w- c:\windows\ie8
    2009-11-17 23:10 . 2009-11-17 23:29 -------- d--h--w- c:\windows\msdownld.tmp
    2009-11-17 17:54 . 2009-11-03 01:42 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-11-17 17:43 . 2009-11-17 17:43 -------- d-----w- c:\program files\Microsoft Security Essentials
    2009-11-17 17:37 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
    2009-11-17 17:37 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\dllcache\kbdhid.sys
    2009-11-17 02:12 . 2009-11-17 02:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-11-17 02:12 . 2009-11-17 02:12 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2009-11-17 02:10 . 2004-04-06 12:38 40080 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-11-11 15:01 . 2009-11-11 15:01 -------- d-----w- c:\documents and settings\Ronnie G\Local Settings\Application Data\Conduit
    2009-11-11 15:01 . 2009-11-04 21:49 635664 ----a-w- c:\documents and settings\Ronnie G\Application Data\IObit\Common\TB_Helper.exe
    2009-11-06 15:19 . 2009-11-06 15:19 -------- d-----w- c:\documents and settings\Ronnie G\Local Settings\Application Data\Mozilla
    2009-10-27 01:14 . 2009-10-27 01:15 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Ahead
    2009-10-24 05:11 . 2009-10-24 05:33 -------- d-----w- c:\program files\Common Files\LightScribe
    2009-10-24 05:06 . 2009-10-27 01:14 -------- d-----w- c:\documents and settings\Ronnie G\Local Settings\Application Data\Ahead
    2009-10-24 05:01 . 2009-10-24 05:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
    2009-10-24 04:54 . 2009-10-24 05:00 -------- d-----w- c:\program files\Common Files\Ahead
    2009-10-24 04:54 . 2009-10-24 04:54 -------- d-----w- c:\program files\Nero
    2009-10-24 04:54 . 2009-10-24 04:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
    2009-10-23 05:25 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
    2009-10-23 05:24 . 2009-10-23 05:24 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
    2009-10-23 05:23 . 2009-11-11 15:01 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\IObit
    2009-10-23 05:23 . 2009-10-23 05:24 -------- d-----w- c:\program files\IObit
    2009-10-23 05:13 . 2009-10-23 05:13 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-10-23 05:11 . 2009-10-23 05:11 -------- d-----w- c:\program files\Windows Media Connect 2
    2009-10-23 05:07 . 2009-10-23 05:09 -------- d-----w- c:\windows\system32\drivers\UMDF
    2009-10-23 05:07 . 2009-10-23 05:07 -------- d-----w- c:\windows\system32\LogFiles
    2009-10-23 04:56 . 2009-10-23 04:56 2560 ----a-w- c:\windows\_MSRSTRT.EXE
    2009-10-23 01:44 . 2009-10-23 01:44 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Malwarebytes
    2009-10-23 01:44 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-10-23 01:44 . 2009-10-23 01:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-10-23 01:44 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-10-23 01:44 . 2009-10-23 01:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-23 01:33 . 2009-10-23 01:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2009-10-23 01:32 . 2009-10-23 01:32 -------- d-----w- c:\documents and settings\Ronnie G\Local Settings\Application Data\PCHealth
    2009-10-22 22:39 . 2009-11-18 17:20 -------- d-----w- c:\program files\Windows Live Safety Center
    2009-10-22 22:19 . 2009-10-22 22:19 -------- d-----w- C:\caec1421f5513857dd3a28
    2009-10-22 22:07 . 2001-08-17 17:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
    2009-10-22 22:07 . 2001-08-17 17:48 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
    2009-10-22 01:42 . 2009-10-22 01:42 -------- d-----w- c:\windows\system32\XPSViewer
    2009-10-22 01:42 . 2009-10-22 01:42 -------- d-----w- c:\program files\MSBuild
    2009-10-22 01:41 . 2009-10-22 01:41 -------- d-----w- c:\program files\Reference Assemblies
    2009-10-22 01:38 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
    2009-10-22 01:38 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-10-22 01:38 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
    2009-10-22 01:38 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-10-22 01:38 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-10-22 01:38 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
    2009-10-22 01:38 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-10-22 01:38 . 2009-10-22 01:41 -------- d-----w- C:\34c3370f8fea2b84bdbf34cdce
    2009-10-21 19:08 . 2009-09-16 14:22 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
    2009-10-21 19:08 . 2009-09-16 14:22 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2009-10-21 19:08 . 2009-09-16 14:22 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2009-10-21 19:08 . 2009-09-16 14:22 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2009-10-21 18:51 . 2009-09-16 14:22 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
    2009-10-21 17:35 . 2009-10-21 17:35 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\McAfee
    2009-10-21 17:24 . 2009-11-17 02:38 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
    2009-10-21 17:00 . 2009-10-21 17:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
    2009-10-21 16:56 . 2009-10-21 16:56 -------- d-----w- c:\documents and settings\Ronnie G\Local Settings\Application Data\Citrix
    2009-10-20 16:24 . 2009-10-20 16:24 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\KodakCredentialStore
    2009-10-20 16:20 . 2009-10-20 16:20 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Skinux
    2009-10-20 15:10 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\imapi2fs.dll
    2009-10-20 15:10 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\dllcache\imapi2fs.dll
    2009-10-20 15:10 . 2008-05-02 10:49 62976 ------w- c:\windows\system32\dllcache\cdrom.sys
    2009-10-20 15:10 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\imapi2.dll
    2009-10-20 15:10 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\dllcache\imapi2.dll
    2009-10-20 15:08 . 2009-10-20 15:08 77824 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Staging\ess\bindbins\BindBins.exe
    2009-10-20 15:08 . 2009-10-20 15:08 229376 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Staging\QUICK\procheck.exe
    2009-10-20 15:08 . 2009-10-20 15:08 23766320 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Staging\QUICK\QuickTimeInstaller.exe
    2009-10-20 15:08 . 2009-10-20 15:08 62976 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Staging\creative\content\setup.exe
    2009-10-20 15:07 . 2009-10-20 15:07 175104 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Staging\creative\app\setup.exe
    2009-10-20 15:06 . 2009-10-20 15:06 45056 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\sysfiles\kb945060\kb945060.exe
    2009-10-20 15:06 . 2009-10-20 15:06 1187840 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_140001_1c6e32\EasyShrx.Dll
    2009-10-20 15:06 . 2009-07-10 12:59 2684304 ----a-r- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_140001_1c6e32\Setup.exe
    2009-10-20 15:04 . 2009-10-20 15:04 114688 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\EasyShareSetup\$Registration\KodakCameraAPI_8.0.20.1.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-11-18 02:25 . 2005-06-13 15:26 -------- d--ha-w- c:\documents and settings\All Users\Application Data\GTek
    2009-11-18 02:13 . 2009-06-23 20:08 -------- d-----w- c:\program files\Microsoft SQL Server
    2009-10-27 01:14 . 2004-04-10 03:23 114152 ----a-w- c:\documents and settings\Ronnie G\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-10-23 05:02 . 2004-04-06 12:31 -------- d-----w- c:\program files\Viewpoint
    2009-10-23 04:52 . 2009-04-02 04:36 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Move Networks
    2009-10-23 02:47 . 2004-04-06 12:28 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-10-23 02:43 . 2008-08-13 01:33 -------- d-----w- c:\program files\AIM
    2009-10-23 02:42 . 2008-08-13 01:37 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Aim
    2009-10-21 19:53 . 2009-05-26 17:33 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\CallingID
    2009-10-21 19:51 . 2009-05-26 17:31 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\comcasttb
    2009-10-21 18:20 . 2009-04-22 00:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-10-21 18:00 . 2006-07-18 14:28 -------- d-----w- c:\documents and settings\Ronnie G\Application Data\Lavasoft
    2009-10-21 03:13 . 2004-04-06 12:36 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee.com
    2009-10-20 16:23 . 2006-06-17 11:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
    2009-10-20 15:24 . 2006-06-17 11:39 -------- d-----w- c:\program files\Kodak
    2009-10-20 15:23 . 2006-06-17 11:50 -------- d-----w- c:\program files\Common Files\Kodak
    2009-10-20 03:03 . 2004-08-31 15:57 -------- d-----w- c:\program files\Common Files\Adobe
    2009-09-11 14:18 . 2002-08-29 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-09-04 21:03 . 2003-09-19 16:37 58880 ----a-w- c:\windows\system32\msasn1.dll
    2009-08-29 08:08 . 2006-06-23 15:33 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-08-26 08:00 . 2002-08-29 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MoneyAgent "= "c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
    "cdloader "= "c:\documents and settings\Ronnie G\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]
    "Advanced SystemCare 3 "= "c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-11-04 2334856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray "= "c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
    "HotKeysCmds "= "c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
    "Dell AIO Printer A920 "= "c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
    "Malwarebytes Anti-Malware (reboot) "= "c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
    "NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "SecurDisc "= "c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-11-26 1629480]
    "InCD "= "c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-11-26 1057064]
    "MSSE "= "c:\program files\Microsoft Security Essentials\msseces.exe" [2009-09-13 1048392]
    "IObit Security 360 "= "c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-11-14 1278736]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @= "Service "
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\31805273901853145531598401393338
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComcastAntispyClient
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBLKsk
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmd
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe "=
    "c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Documents and Settings\\Ronnie G\\Application Data\\mjusbsp\\magicJack.exe "=

    R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [10/23/2009 12:24 AM 312592]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/7/2007 8:23 PM 24652]

    --- Other Services/Drivers In Memory ---

    *Deregistered* - mbr
    *Deregistered* - PROCEXP113
    .
    Contents of the 'Scheduled Tasks' folder

    2004-04-10 c:\windows\Tasks\ISP signup reminder 1.job
    - c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 00:12]

    2009-11-19 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.bing.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mWindow Title = Windows Internet Explorer provided by Comcast
    IE: E&xport to Microsoft Excel
    Trusted Zone: internet
    Trusted Zone: mcafee.com
    DPF: {D57262F5-9637-4E67-BC59-88C53EA76FC3} - hxxp://imagelab.bestbuy.com/en/ulcontrolxp.cab
    .
    - - - - ORPHANS REMOVED - - - -

    SafeBoot-mcmscsvc
    SafeBoot-MCODS



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-11-19 08:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cc,e8,fd,cf,f8,33,fc,41,92,5e,bd,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cc,e8,fd,cf,f8,33,fc,41,92,5e,bd,\
    .
    Completion time: 2009-11-19 08:42
    ComboFix-quarantined-files.txt 2009-11-19 13:41

    Pre-Run: 13,437,693,952 bytes free
    Post-Run: 13,454,872,576 bytes free

    - - End Of File - - 57A1C9BD5E0CAC1B704855829C3F1EF7
     
    steveo65,
    #7
  9. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    HijackThis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:42:51 AM, on 11/19/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Microsoft Security Essentials\msseces.exe
    C:\Program Files\IObit\IObit Security 360\IS360tray.exe
    C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
    C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Ronnie G\Desktop\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe "
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
    O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe "
    O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Ronnie G\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
    O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
    O15 - Trusted Zone: http://*.mcafee.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
    O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146102766515
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155650676625
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.19.9/ttinst.cab
    O16 - DPF: {D57262F5-9637-4E67-BC59-88C53EA76FC3} (ULcontrol Control) - http://imagelab.bestbuy.com/en/ulcontrolxp.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O24 - Desktop Component 0: (no name) - http://images.kodakgallery.com/photos2087/2/10/54/91/77/5/577915410206_0_ALB.jpg

    --
    End of file - 8191 bytes
     
    steveo65,
    #8
  10. 2009/11/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :dir
C:\caec1421f5513857dd3a28 /s
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    ================================================================

    Download Security Check from HERE, and save it to your Desktop.

    * Double-click SecurityCheck.exe
    * Follow the onscreen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    ===============================================================

    Have you ever used McAfee?
     
    broni,
    #9
  11. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    Look log

    SystemLook v1.0 by jpshortstuff (29.08.09)
    Log created at 23:47 on 19/11/2009 by Ronnie G (Administrator - Elevation successful)

    ========== dir ==========

    C:\caec1421f5513857dd3a28 - Parameters: "/s "

    ---Files---
    DHtmlHeader.html --a--- 15616 bytes [00:24 15/08/2009] [00:24 15/08/2009]
    header.bmp --a--- 7306 bytes [00:24 15/08/2009] [00:24 15/08/2009]
    HotFixInstaller.exe --a--- 318800 bytes [00:32 15/08/2009] [00:32 15/08/2009]
    NDP20SP2-KB974417.msp --a--- 11110912 bytes [00:32 15/08/2009] [00:32 15/08/2009]
    ParameterInfo.xml --a--- 3547 bytes [00:24 15/08/2009] [00:24 15/08/2009]
    watermark.bmp --a--- 110348 bytes [00:24 15/08/2009] [00:24 15/08/2009]

    C:\caec1421f5513857dd3a28\1025 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1028 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1029 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1030 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1031 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1032 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1033 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1035 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1036 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1037 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1038 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1040 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1041 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1042 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1043 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1044 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1045 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1046 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1049 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1053 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\1055 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\2052 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\2070 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\3076 d----- [22:19 22/10/2009]

    C:\caec1421f5513857dd3a28\3082 d----- [22:19 22/10/2009]

    -=End Of File=-
     
    steveo65,
    #10
  12. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    Checkup log

    Results of screen317's Security Check version 0.99.0
    Windows XP Service Pack 3
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    ``````````````````````````````
    Anti-malware/Other Utilities Check:
    HijackThis 2.0.2
    Java 2 Runtime Environment, SE v1.4.2
    Adobe Flash Player 10
    Adobe Reader 9.2
    ``````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Windows Defender MSMpEng.exe
    ``````````````````````````````
    DNS Vulnerability Check:
    GREAT! (Not vulnerable to DNS cache poisoning)

    `````````End of Log```````````
     
    steveo65,
    #11
  13. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    In answer to the Macaffe question, yes that is what let it in. Removed and went with Microsoft Security Essentials.
     
    steveo65,
    #12
  14. 2009/11/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    How is redirection issue right now?

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Restart computer.

    =================================================================

    Download and run McAfee Consumer Product Removal Tool: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml

    =====================================================================

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    ******************************************************************************************
    Due to a bug in Malwarebytes, you may see in MBAM's log following entries:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi (Rootkit)
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\atapi (Rootkit)
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi (Rootkit)
    DO NOT remove those entries!
    If you do, your computer will become UN-bootable.
    The issue has been fixed in the latest MBAM update, so, it's EXTREMELY important, you update MBAM before you run it.
    ****************************************************************************************

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!


    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #13
  15. 2009/11/19
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    re-direct seems to be gone. gonna follow the rest of the steps then get back with you. Thanks
     
    steveo65,
    #14
  16. 2009/11/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very good :)
     
    broni,
    #15
  17. 2009/11/20
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    While the scan is running on the other machine, can I ask, what was it and how could it have been acquired?
     
    steveo65,
    #16
  18. 2009/11/20
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Combofix said:
    Infected copy of atapi.sys will cause redirections.

    How, it happened? Nobody will be able to answer your question. There is no tool, which would tell you, where the infection came from.
     
    broni,
    #17
  19. 2009/11/20
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    Malwarebytes log

    Malwarebytes' Anti-Malware 1.41
    Database version: 3201
    Windows 5.1.2600 Service Pack 3

    11/20/2009 2:08:07 PM
    mbam-log-2009-11-20 (14-08-07).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 172985
    Time elapsed: 59 minute(s), 11 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 1
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    steveo65,
    #18
  20. 2009/11/20
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    HijackThis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:50:14 PM, on 11/20/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
    C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
    C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    C:\Program Files\Microsoft Security Essentials\msseces.exe
    C:\Program Files\IObit\IObit Security 360\IS360tray.exe
    C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\IObit\IObit Security 360\is360.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe "
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
    O4 - HKLM\..\Run: [MSSE] "c:\Program Files\Microsoft Security Essentials\msseces.exe" -hide
    O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe "
    O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Ronnie G\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
    O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
    O15 - Trusted Zone: http://*.mcafee.com
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
    O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146102766515
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155650676625
    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
    O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.19.9/ttinst.cab
    O16 - DPF: {D57262F5-9637-4E67-BC59-88C53EA76FC3} (ULcontrol Control) - http://imagelab.bestbuy.com/en/ulcontrolxp.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
    O24 - Desktop Component 0: (no name) - http://images.kodakgallery.com/photos2087/2/10/54/91/77/5/577915410206_0_ALB.jpg

    --
    End of file - 8523 bytes
     
    steveo65,
    #19
  21. 2009/11/20
    steveo65

    steveo65 Well-Known Member Thread Starter

    Joined:
    2008/10/21
    Messages:
    135
    Likes Received:
    0
    Superantivirus log

    The first time I ran SAV it found 54 adware.*** infections. But i cant find a log. I ran it a second time and came up clean. All seems to be well now.
     
    steveo65,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...