Being redirected when I click search results

Geri,
Im baaack...
Did system resore to last nite. However, that was before I disabled Spybots TeaTimer, etc. I will start over on the last directions you gave me before I lost (then got back) my internet..

 

OK Lets make sure your internet settings are correct.

Go To
Control panel
Internet options
Connections tab
Click on LAN Settings
Make sure "Automatically detect settings" box is checked.

Proxy server is unchecked. ckick OK, Apply and OK.

Close Control Panel.

I'll do some more digging here also.

Geri

 

OK Good.

 

Dear patient Geri,
So i proceeded to follow directions from post #9, (after I restored the Notepad again), and the same exact thing happened again..lost internet connection. Had to restore back to last nite again. I did however think to post the log from dragging the CFScript to combo fix, but I lost it along the way, you probably want me to go back and do it again so you can see what is happening, right?

 

Hi fortunateden
OK, Lets hold off here.
I'm going to ask noahdfear to stop in here ahd have a look. Somrthings not right and lets not push it yet.

Please wait for any comments from Dave or instructions from me after he takes a look.

Geri

 

Hi fortunateden,

Please delete the current copy of ComboFix you have and download a fresh copy from here.

Disable TeaTimer and reboot. Close ALL open programs and windows then run ComboFix (no CFScript) and post the log it creates. If your internet connection is not working after running ComboFix, restart your machine and check it again.

Post the new C:\ComboFix.txt log.

 

Thanks for helping out Dave,


Here is the log as follows from the fresh copy of Combofix. I did in fact have to restart to get internet connection, and TeaTimer is disabled...


ComboFix 08-01-06.4 - Dennille Christensen 2008-01-05 22:30:13.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.65 [GMT -6:00]
Running from: C:\Documents and Settings\Dennille Christensen\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-05 21:26 . 2008-01-05 21:26 <DIR> d-------- C:\Program Files\Spyware Terminator
2008-01-05 21:26 . 2008-01-05 21:26 <DIR> d-------- C:\Documents and Settings\Dennille Christensen\Application Data\Spyware Terminator
2008-01-05 21:26 . 2008-01-05 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-01-05 19:25 . 2008-01-05 21:26 <DIR> d-------- C:\REST2514
2008-01-04 19:24 . 2008-01-04 19:24 <DIR> d-------- C:\Deckard
2008-01-04 18:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-02 20:10 . 2008-01-02 20:10 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-30 17:03 . 2007-12-30 17:03 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-30 17:03 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-12-30 17:03 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-30 15:00 . 2007-12-30 15:17 <DIR> d-------- C:\Program Files\Nsauditor
2007-12-30 13:01 . 2007-12-30 13:01 <DIR> d-------- C:\Program Files\Nick Jr. Arcade

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 01:19 --------- d-----w C:\Program Files\MSN Encarta Plus
2008-01-05 01:19 --------- d-----w C:\Program Files\Microsoft Works
2008-01-05 01:19 --------- d-----w C:\Program Files\ICQ
2008-01-01 19:11 --------- d-----w C:\Program Files\Google
2007-12-30 19:01 --------- d-----w C:\Program Files\Common Files\Scanner
2007-12-30 18:01 --------- d-----w C:\Program Files\Yahoo!
2007-05-20 16:59 529 -c-ha-w C:\Documents and Settings\Dennille Christensen\hpothb07.dat
2005-02-16 02:34 164 -c-ha-w C:\Documents and Settings\All Users\hpothb07.dat
2005-02-16 02:34 0 -c-ha-w C:\Documents and Settings\All Users\Application Data\hpothb07.dat
2005-02-16 02:31 169 -c-ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
2005-02-16 02:29 0 -c-ha-w C:\Documents and Settings\Dennille Christensen\Application Data\hpothb07.dat
2005-02-16 02:29 0 -c-ha-w C:\Documents and Settings\Default User\hpothb07.dat
2004-09-27 14:33 380,928 -csh--r C:\WINDOWS\system32\??plorer.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-04_18.37.54.87 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-03 15:53:22 40,196 -c--a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-05 00:35:44 40,196 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:53:22 311,934 -c--a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-05 00:35:44 311,934 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-12-30 19:02:45 206,788 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-06 03:27:11 515,124 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39D93272-EF47-0C97-D753-6D550585703D}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 16:18 1670144]
"MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]
"Microsoft Internet Acceleration Utility "= "iau.exe" []
"Internet Connection Wizard "= "stisvsq.exe" []
"Games Acceleration "= "svshost.exe" []
"Internet Mail and News "= "msqdevl.exe" []
"Microsoft Management Console "= "lssas.exe" []
"Multimedia extensions "= "mservice.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan "= "SOUNDMAN.EXE" [2003-06-10 04:12 55296 C:\WINDOWS\soundman.exe]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-05-06 12:49 180269]
"Microsoft Internet Acceleration Utility "= "iau.exe" []
"SSC_UserPrompt "= "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [ ]
"Internet Connection Wizard "= "stisvsq.exe" []
"Games Acceleration "= "svshost.exe" []
"Internet Mail and News "= "msqdevl.exe" []
"Microsoft Management Console "= "lssas.exe" []
"Multimedia extensions "= "mservice.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a--c--- 2000-07-13 14:00 28739 c:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-11-15 16:18 1670144 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV CfgWiz]
C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pzd]
-r-hsc--- 2004-09-27 08:33 380928 C:\WINDOWS\System32\??plorer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2003-11-20 20:06 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runwin32]
C:\WINDOWS\runwin32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2004-06-03 21:05 32881 C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SVCHOST]
C:\WINDOWS\svchost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPS]
C:\PROGRA~1\Toolbar\TBPS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2004-05-06 12:49 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Usrr]
C:\Documents and Settings\Dennille Christensen\Application Data\rncr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winhost]
C:\WINDOWS\win.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wininet32]
C:\WINDOWS\wininet32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
C:\Program Files\Common Files\WinTools\WToolsA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\You've Got Pictures Screensaver]
C:\Program Files\You've Got Pictures Screensaver\ygpsstra.exe


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-05 22:32:42
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-05 22:33:42
ComboFix-quarantined-files.txt 2008-01-06 04:33:18
ComboFix2.txt 2008-01-06 04:25:44
ComboFix3.txt 2008-01-06 03:22:27
ComboFix4.txt 2008-01-06 01:46:56
ComboFix5.txt 2008-01-05 00:38:27
.
2007-12-13 09:05:34 --- E O F ---

 

Hi fortunateden
OK, Dave told us to continue.
He said Combofix kills your internet connection when it runs but normally enables it after it runs, but this time something is interfering with it.
So if you lose connection again after running the CFScript just restart your computer.

OK go back to post # 9 and follow it through, I did a slight change there so make sure you follow it as it is now.

Thanks
Geri

 

Hi Again Geri,
Here is the log from ComboFix, (which did have to restart PC again after because loss of internet):
ComboFix 08-01-06.4 - Dennille Christensen 2008-01-06 13:19:27.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.107 [GMT -6:00]
Running from: C:\Documents and Settings\Dennille Christensen\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dennille Christensen\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\DOCUME~1\DENNIL~1\DESKTOP\SUPERG~2.EXE
C:\Documents and Settings\Dennille Christensen\Application Data\rncr.exe
C:\WINDOWS\runwin32.exe
C:\WINDOWS\svchost.exe 7
C:\WINDOWS\System32\fkrbtmin.dll
C:\WINDOWS\win.exe
C:\WINDOWS\wininet32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\DENNIL~1\DESKTOP\SUPERG~2.EXE
C:\Documents and Settings\All Users\Application Data\Spyware Terminator
C:\Documents and Settings\All Users\Application Data\Spyware Terminator\fileobjinfo.sys
C:\Documents and Settings\All Users\Application Data\Spyware Terminator\sp_rsdel.exe
C:\Documents and Settings\Dennille Christensen\Application Data\Spyware Terminator
C:\Documents and Settings\Dennille Christensen\Application Data\Spyware Terminator\BIN_RSDATA.SPT
C:\Documents and Settings\Dennille Christensen\Application Data\Spyware Terminator\LanguageAct\language.inf
C:\Documents and Settings\Dennille Christensen\Application Data\Spyware Terminator\LanguageAct\language.txt.old
C:\Program Files\Spyware Terminator
C:\Program Files\Spyware Terminator\BIN_STDATA.SPT
C:\Program Files\Spyware Terminator\BIN_STDATA_DIF.SPT
C:\Program Files\Spyware Terminator\BIN_STQUEUE.SPT
C:\Program Files\Spyware Terminator\BIN_STUIUS.SPT
C:\Program Files\Spyware Terminator\languages\brazilians.inf
C:\Program Files\Spyware Terminator\languages\czech.inf
C:\Program Files\Spyware Terminator\languages\english.inf
C:\Program Files\Spyware Terminator\languages\french.inf
C:\Program Files\Spyware Terminator\languages\german.inf
C:\Program Files\Spyware Terminator\languages\hungarian.inf
C:\Program Files\Spyware Terminator\languages\italiano.inf
C:\Program Files\Spyware Terminator\languages\korean.inf
C:\Program Files\Spyware Terminator\languages\polish.inf
C:\Program Files\Spyware Terminator\languages\portuguese.inf
C:\Program Files\Spyware Terminator\languages\russian.inf
C:\Program Files\Spyware Terminator\languages\serbian.inf
C:\Program Files\Spyware Terminator\languages\spanish.inf
C:\Program Files\Spyware Terminator\languages\swedish.inf
C:\Program Files\Spyware Terminator\languages\turkish.inf
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Spyware Terminator\sptcontmenu.dll
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
C:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe
C:\Program Files\Spyware Terminator\STServer.Exe
C:\Program Files\Spyware Terminator\unins000.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-06 to 2008-01-06 )))))))))))))))))))))))))))))))
.

2008-01-05 19:25 . 2008-01-05 21:26 <DIR> d-------- C:\REST2514
2008-01-04 19:24 . 2008-01-04 19:24 <DIR> d-------- C:\Deckard
2008-01-04 18:24 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-02 20:10 . 2008-01-02 20:10 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-30 17:03 . 2007-12-30 17:03 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-30 17:03 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-12-30 17:03 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-30 15:00 . 2007-12-30 15:17 <DIR> d-------- C:\Program Files\Nsauditor
2007-12-30 13:01 . 2007-12-30 13:01 <DIR> d-------- C:\Program Files\Nick Jr. Arcade

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 01:19 --------- d-----w C:\Program Files\MSN Encarta Plus
2008-01-05 01:19 --------- d-----w C:\Program Files\Microsoft Works
2008-01-05 01:19 --------- d-----w C:\Program Files\ICQ
2008-01-01 19:11 --------- d-----w C:\Program Files\Google
2007-12-30 19:01 --------- d-----w C:\Program Files\Common Files\Scanner
2007-12-30 18:01 --------- d-----w C:\Program Files\Yahoo!
2007-05-20 16:59 529 -c-ha-w C:\Documents and Settings\Dennille Christensen\hpothb07.dat
2005-02-16 02:34 164 -c-ha-w C:\Documents and Settings\All Users\hpothb07.dat
2005-02-16 02:34 0 -c-ha-w C:\Documents and Settings\All Users\Application Data\hpothb07.dat
2005-02-16 02:31 169 -c-ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
2005-02-16 02:29 0 -c-ha-w C:\Documents and Settings\Dennille Christensen\Application Data\hpothb07.dat
2005-02-16 02:29 0 -c-ha-w C:\Documents and Settings\Default User\hpothb07.dat
2004-09-27 14:33 380,928 -csh--r C:\WINDOWS\system32\??plorer.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-04_18.37.54.87 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-03 15:53:22 40,196 -c--a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-01-05 00:35:44 40,196 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-03 15:53:22 311,934 -c--a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-01-05 00:35:44 311,934 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2007-12-30 19:02:45 206,788 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-06 03:27:11 515,124 -c--a-w C:\WINDOWS\system32\Restore\rstrlog.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-11-15 16:18 1670144]
"MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan "= "SOUNDMAN.EXE" [2003-06-10 04:12 55296 C:\WINDOWS\soundman.exe]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-05-06 12:49 180269]
"SSC_UserPrompt "= "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 18:04 5562368]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a--c--- 2000-07-13 14:00 28739 c:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-11-15 16:18 1670144 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV CfgWiz]
C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2003-11-20 20:06 77824 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2004-06-03 21:05 32881 C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2004-05-06 12:49 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe


.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-06 13:23:42
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-06 13:24:32
ComboFix-quarantined-files.txt 2008-01-06 19:24:12
ComboFix2.txt 2008-01-06 04:33:43
ComboFix3.txt 2008-01-06 04:25:44
ComboFix4.txt 2008-01-06 03:22:27
ComboFix5.txt 2008-01-06 01:46:56
.
2007-12-13 09:05:34 --- E O F ---


Okay, now I just clicked on the link for OTMoveIt2 in your post, and it is giving me an error message, "Problem loading page, can't find server ".
I added dot coms and https to the link thinking that would help, but it did not.

 

Hi
OK try this link.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

 

Hi
After you've followed the rest of post # 9 please post a new dss log.

Thanks
Geri

 

I am getting an error message, "Error creating log file ", then when I click on OK, another one, "Error creating resore file ". I copied and pasted the link C:\WINDOWS\System32\??plorer.exe /u on the first pane on the left, and also the first box ( Unregister D11's and Ocx..) box was checked by default, is that OK?

 

Hi
Are you trying to do both the file remove and the Purity at the same time?
You have to remove this file first.

Copy and paste this in the left pane C:\WINDOWS\System32\??plorer.exe /u then click the moveit button.

Yes thats OK

Then do the Purity in the bottom box after the removal of the file.

Let me know

Geri

 

Nope, not trying to do the Purity at the same time. I just tried it again to make sure, and I get those error messages right after I click Move it...

 

OK lets try it this way.

Put this into the move it box and click moveit.

C:\WINDOWS\System32\??plorer.exe

Let me know.

Geri

 

Same error message, this is what shows up for results on the right hand side....
File/Folder not found.
File/Folder C:\WINDOWS\System32\??plorer.exe not found.

OTMoveIt2 v1.0.5 log created on 01062008_160553

 

Hi
OK, lets skip that for now.

Please do the rest of the post # 9

Then post a new dss log.

Thanks
Geri

 

Geri,

Here is the main.txt file, as well as extra.txt file from DSS. When I do combofix, am I supposed to be doing it with the CFScript, or no? I haven't done that yet because I was'nt clear. Also on DSS 5 items on your list for me to delete, werent on HJT: 02 BHO.no name;03 Crawler toolbar;04 supergranny; 08 Extra content; and 08 Crawler..something. Making progress, yes?

 

Oops, almost forgot the logs

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 1.0
Architecture: X86; Language: English

CPU 0: Intel(R) Celeron(R) CPU 2.60GHz
Percentage of Memory in Use: 69%
Physical Memory (total/avail): 253.98 MiB / 77.64 MiB
Pagefile Memory (total/avail): 625.41 MiB / 441.36 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1931.43 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 37.27 GiB total, 30.26 GiB free.
D: is CDROM (CDFS)

\\.\PHYSICALDRIVE0 - ST340015A - 37.27 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 37.27 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Dennille Christensen\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=LUCKYSCOMPUTER
ComSpec=C:\WINDOWS\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Dennille Christensen
LOGONSERVER=\\LUCKYSCOMPUTER
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0209
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\DENNIL~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\DENNIL~1\LOCALS~1\Temp
USERDOMAIN=LUCKYSCOMPUTER
USERNAME=Dennille Christensen
USERPROFILE=C:\Documents and Settings\Dennille Christensen
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Dennille Christensen (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f "C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c "C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll "
Adobe Flash Player Plugin --> C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
CompuServe --> C:\Program Files\Common Files\csshare\csunins_us.exe
Conexant SoftK56 Modem(M) --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F00&SUBSYS_8D8B155D\HXFSETUP.EXE -U -IVEN_14F1&DEV_2F00&SUBSYS_200214F1
Digimax L60 /Kenox X60 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6F126E91-9E8C-4AE5-9B96-17FE3ABFF1EE}\Setup.exe"
Digimax Master --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}\Setup.exe" -l0x9 -removeonly
Digital Camera Driver --> MsiExec.exe /I{3FB6CB89-46CA-4E5A-83B4-EFF6EF2FAA30}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Memories Disc --> MsiExec.exe /X{B376402D-58EA-45EA-BD50-DD924EB67A70}
HP Photo and Imaging 2.0 - All-in-One --> MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1}
HP Photo and Imaging 2.0 - All-in-One Drivers --> MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}
HP Photo and Imaging 2.0 - hp psc 1200 series --> C:\Program Files\Hewlett-Packard\Digital Imaging\{7C8BB31C-E09E-4c7d-BBF1-45E33B467FE1}\Setup\hpzscr01.exe -datfile hposcr02.dat -forcereboot
hp psc 1200 series --> MsiExec.exe /X{C900EF06-2E76-49C7-8DB0-41F629B21DC5}
ICQ --> C:\PROGRA~1\ICQ\ICQUninstall.EXE
Intel(R) Extreme Graphics Driver --> RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Java 2 Runtime Environment, SE v1.4.2_05 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142050}
Lernout & Hauspie TruVoice for Microsoft Agent --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\cgminst.inf, RemoveCgram
Microsoft Money 2003 --> MsiExec.exe /I{01F9D88C-3C86-4E82-840A-101A3221F67A}
Microsoft Money 2003 System Pack --> MsiExec.exe /I{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}
Microsoft Works 6.0 --> MsiExec.exe /I{F8D0829C-9C6F-11D3-8080-00C04FA329AA}
Mozilla Firefox (2.0.0.11) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MySpaceIM --> C:\Program Files\MySpace\IM\Uninstall.exe
QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\System32\QuickTime\Uninstall.log
RealArcade --> C:\Program Files\Real\RealArcade\Update\rnuninst.exe RealNetworks|RealArcade|1.2
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
SafetyBar for Microsoft Outlook --> MsiExec.exe /X{B81C0196-F7E9-447A-95D8-E18CF6DFB3DF}
Screensaver marilyn slideshow --> C:\WINDOWS\marilyn slideshow.scr -u
Screensaver new_marilyn --> C:\WINDOWS\new_marilyn.scr -u
Shutterfly Plugin --> C:\PROGRA~1\SHUTTE~1\UNWISE.EXE C:\PROGRA~1\SHUTTE~1\INSTALL.LOG
Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe "
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe "
Windows Backup Utility --> MsiExec.exe /I{76EFFC7C-17A6-479D-9E47-8E658C1695AE}
Yahoo! Toolbar --> rundll32.exe C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YCOMP5~1.DLL,DllCommand ui
Yahoo! Widgets --> C:\PROGRA~1\Yahoo!\Widgets\uninstall.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type3628 / Error
Event Submitted/Written: 01/05/2008 08:52:38 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application firefox.exe, version 1.8.20071.12718, hang module js3250.dll, version 4.0.0.0, hang address 0x00031f51.

Event Record #/Type3626 / Error
Event Submitted/Written: 01/04/2008 09:58:36 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application MySpaceIM.exe, version 1.0.716.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type3625 / Error
Event Submitted/Written: 01/04/2008 09:58:35 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application MySpaceIM.exe, version 1.0.716.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type3614 / Error
Event Submitted/Written: 12/30/2007 10:07:02 AM
Event ID/Source: 1002 / Application Hang
Event Description:
Hanging application MySpaceIM.exe, version 1.0.716.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Event Record #/Type3613 / Error
Event Submitted/Written: 12/15/2007 10:17:15 AM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application firefox.exe, version 1.8.20071.12718, faulting module firefox.exe, version 1.8.20071.12718, fault address 0x002ef16f.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type19703 / Warning
Event Submitted/Written: 01/06/2008 01:27:03 PM
Event ID/Source: 11050 / dnscache
Event Description:
The DNS Client service could not contact any DNS servers for
a repeated number of attempts. For the next 30 seconds the
DNS Client service will not use the network to avoid further
network performance problems. It will resume its normal behavior
after that. If this problem persists, verify your TCP/IP
configuration, specifically check that you have a preferred
(and possibly an alternate) DNS server configured. If the problem
continues, verify network conditions to these DNS servers or contact
your network administrator.

Event Record #/Type19699 / Warning
Event Submitted/Written: 01/06/2008 01:24:13 PM
Event ID/Source: 1003 / Dhcp
Event Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 00402B798DE7. The following
error occurred:
%%121.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Event Record #/Type19689 / Warning
Event Submitted/Written: 01/06/2008 06:00:15 AM
Event ID/Source: 36 / W32Time
Event Description:
The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Event Record #/Type19676 / Warning
Event Submitted/Written: 01/05/2008 10:33:15 PM
Event ID/Source: 1003 / Dhcp
Event Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 00402B798DE7. The following
error occurred:
%%121.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Event Record #/Type19655 / Warning
Event Submitted/Written: 01/05/2008 10:25:22 PM
Event ID/Source: 1003 / Dhcp
Event Description:
Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 00402B798DE7. The following
error occurred:
%%121.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.



-- End of Deckard's System Scanner: finished at 2008-01-06 16:58:33 ------------

Deckard's System Scanner v20071014.68
Run by Dennille Christensen on 2008-01-06 16:56:58
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
15: 2008-01-06 22:57:03 UTC - RP1059 - Deckard's System Scanner Restore Point
14: 2008-01-06 19:19:12 UTC - RP1058 - ComboFix created restore point
13: 2008-01-06 04:21:30 UTC - RP1057 - ComboFix created restore point
12: 2008-01-06 03:25:42 UTC - RP1056 - Restore Operation
11: 2008-01-06 03:17:44 UTC - RP1055 - ComboFix created restore point


-- First Restore Point --
1: 2008-01-01 19:03:54 UTC - RP1045 - Spybot-S&D Spyware removal


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 254 MiB (512 MiB recommended).


-- HijackThis (run as Dennille Christensen.exe) --------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:57:42 PM, on 1/6/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Dennille Christensen\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Dennille Christensen.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_16_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe "
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MySpaceIM] "C:\Program Files\MySpace\IM\MySpaceIM.exe "
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Snapfish Picture Mover.lnk = C:\Program Files\Snapfish Picture Mover\SnapfishPictureMover.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) -
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} -
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {A1B09066-C95C-4EF6-8DFD-3DD0AFE610B6} - http://pak02.pictures.aol.com/ygp/aol/plugin/screensaver/YGPPicScreensaver.9.0.1.4.cab
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://aol123.pogo.com/game/deluxe/zuma/popcaploader_v5.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 4967 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20080102-212012-528 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=...Y4BUL+bELYDaF2ASqjxe3npuaeAQgWHqMcWcJlnqmWP0=
backup-20080102-220527-730 O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
backup-20080102-220544-402 O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll (file missing)
backup-20080102-220608-416 O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
backup-20080102-220608-592 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
backup-20080102-220639-932 O8 - Extra context menu item: Crawler Search - tbr:iemenu
backup-20080104-191535-115 O2 - BHO: (no name) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - (no file)
backup-20080104-191535-231 O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
backup-20080104-191535-241 O2 - BHO: (no name) - {39D93272-EF47-0C97-D753-6D550585703D} - C:\WINDOWS\System32\fkrbtmin.dll (file missing)
backup-20080104-191535-244 O8 - Extra context menu item: &Search - ?p=ZNfox000
backup-20080104-191535-250 O4 - HKCU\..\Run: [supergrannyam.exe] C:\DOCUME~1\DENNIL~1\DESKTOP\SUPERG~2.EXE /r
backup-20080104-191535-324 R3 - URLSearchHook: (no name) - - (no file)
backup-20080104-191535-382 O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
backup-20080104-191535-416 O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
backup-20080104-191535-581 O3 - Toolbar: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - (no file)
backup-20080104-191535-600 O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
backup-20080104-191535-998 O16 - DPF: {11111111-1111-1111-1111-111111113456} - file://c:\info6_s.cab
backup-20080104-191536-136 O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc1.webresponse.one.microsoft.com/media/xp/TLIEFlash.CAB
backup-20080104-191536-415 O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
backup-20080104-191536-501 O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -
backup-20080104-191536-587 O16 - DPF: {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} -
backup-20080104-191536-628 O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} (Java Plug-in 1.4.2_05) -
backup-20080104-191536-712 O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/06972700cbe1de42ce17/netzip/RdxIE601.cab
backup-20080104-191536-906 O16 - DPF: {2C8EEB84-6D60-11D4-BD64-0050048A82BF} -
backup-20080104-191536-965 O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} -
backup-20080104-191537-371 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
backup-20080104-191537-429 O17 - HKLM\System\CCS\Services\Tcpip\..\{FA57200C-FFB2-472D-819A-FC6A12A8590B}: NameServer = 208.67.220.220,208.67.222.222
backup-20080104-191537-699 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
backup-20080104-191537-809 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
backup-20080106-164942-153 O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -
backup-20080106-164942-356 O16 - DPF: {11111111-1111-1111-1111-111111113456} -
backup-20080106-164942-522 O16 - DPF: {2C8EEB84-6D60-11D4-BD64-0050048A82BF} -
backup-20080106-164942-626 O16 - DPF: {11111111-1111-1111-1111-111111113457} -
backup-20080106-164942-997 O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
backup-20080106-164943-239 O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} -
backup-20080106-164943-260 O16 - DPF: {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} -
backup-20080106-164943-680 O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} -
backup-20080106-164943-735 O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} -

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 mdmxsdk - c:\windows\system32\drivers\mdmxsdk.sys <Not Verified; Conexant; Diagnostic Interface>
R3 HSF_DP - c:\windows\system32\drivers\hsf_dp.sys <Not Verified; Conexant Systems; SoftK56>
R3 HSFHWBS2 - c:\windows\system32\drivers\hsfhwbs2.sys <Not Verified; Conexant Systems; SoftK56>
R3 ialm - c:\windows\system32\drivers\ialmnt5.sys <Not Verified; Intel Corporation; Intel Graphics Accelerator Drivers for Windows NT(R)>
R3 winachsf - c:\windows\system32\drivers\hsf_cnxt.sys <Not Verified; Conexant Systems; SoftK56>

S3 CoachUsb (Coach Digital Camera on USB) - c:\windows\system32\drivers\coachusb.sys <Not Verified; FotoNation Ltd.; USB Driver for Digital Camera>
S3 CoachVc (Coach Video Capture) - c:\windows\system32\drivers\coachvc.sys <Not Verified; Accapella Ltd.; Video Capture Minidriver for Digital Camera>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2007-12-06 and 2008-01-06 -----------------------------

2008-01-05 19:25:01 0 d-------- C:\REST2514
2008-01-04 19:24:32 4194304 --a------ C:\Documents and Settings\Dennille Christensen\ntuser.dat
2008-01-02 20:10:56 0 d-------- C:\Program Files\Trend Micro
2007-12-30 17:03:51 118784 --a------ C:\WINDOWS\System32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-12-30 17:03:50 0 d-------- C:\Program Files\SpywareBlaster
2007-12-30 15:00:58 0 d-------- C:\Program Files\Nsauditor
2007-12-30 13:01:48 0 d-------- C:\Program Files\Nick Jr. Arcade


-- Find3M Report ---------------------------------------------------------------

2008-01-04 19:19:47 0 d-------- C:\Program Files\MSN Encarta Plus
2008-01-04 19:19:46 0 d-------- C:\Program Files\Movie Maker
2008-01-04 19:19:44 0 d-------- C:\Program Files\Microsoft Works
2008-01-04 19:19:43 0 d-------- C:\Program Files\Messenger
2008-01-04 19:19:42 0 d-------- C:\Program Files\ICQ
2008-01-01 13:11:22 0 d-------- C:\Program Files\Google
2007-12-30 13:01:56 0 d-------- C:\Program Files\Common Files\Scanner
2007-12-30 12:01:50 0 d-------- C:\Program Files\Yahoo!


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan "= "SOUNDMAN.EXE" [06/10/2003 04:12 AM C:\WINDOWS\soundman.exe]
"TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05/06/2004 12:49 PM]
"SSC_UserPrompt "= "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [11/15/2004 04:18 PM]
"MySpaceIM "= "C:\Program Files\MySpace\IM\MySpaceIM.exe" [08/13/2007 06:04 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM "=C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk
backup=C:\WINDOWS\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Common Files\Symantec Shared\ccApp.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
c:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV CfgWiz]
C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT "

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot




-- End of Deckard's System Scanner: finished at 2008-01-06 16:58:33 ------------

 

Hi
OK that's looking much better. Let me go through it in detail in the mean time do this.

You don't need to run combofix again.

Please scan again with HJT and fix these, they showed back up.

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} -
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} -

Now close all windows other than HiJackThis, then click Fix Checked.

Close HJT

>>Make sure you follow the Mozilla Firefox or Opera instructions also.which ever one you use.<<
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• 
  Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Reboot your computer.

Post a new HJT log.

Thanks
Geri