1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Clicking on Webpage and IE directs to different page

Discussion in 'Malware and Virus Removal Archive' started by WesternKY, 2009/09/24.

  1. 2009/09/24
    WesternKY Lifetime Subscription

    WesternKY Well-Known Member Thread Starter

    Joined:
    2004/05/15
    Messages:
    69
    Likes Received:
    0
    [Active] Clicking on Webpage and IE directs to different page

    :confused: I am clicking on a link thinking that what I click on will come up. Well recently I click on a link, something wild will come up. Example: I was looking for a manual for my radio. When I clicked on the link, a travel agency webpage came up. I went to another link, and health food web page came up. Can someone tell me out there what is going on???? Is there something wrong with my computer. This is driving me crazy! I am using Windows internet explorer. Thanks in advance
     
    WesternKY,
    #1
  2. 2009/09/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Read this post, then post the requested DDS log(s).
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/09/24
    WesternKY Lifetime Subscription

    WesternKY Well-Known Member Thread Starter

    Joined:
    2004/05/15
    Messages:
    69
    Likes Received:
    0
    DDS (Ver_09-07-30.01) - NTFSx86
    Run by Valued Customer at 21:21:41.64 on Thu 09/24/2009
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.295 [GMT -5:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
    C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\AVG\AVG8\avgcsrvx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    svchost
    C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Valued Customer\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
    BHO: {b035573a-5f43-4862-a194-87d027c63012} - c:\windows\system32\InternetExplorer.dll
    BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: ALOT Toolbar: {5aa2ba46-9913-4dc7-9620-69ab0fa17ae7} - c:\program files\alot\bin\alot.dll
    TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
    mRun: [ScanSoft OmniPage 16-reminder] "d:\program files\scansoft\omnipage16\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\omnipage 16\ereg\Ereg.ini "
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    uPolicies-system: EnableProfileQuota = 1 (0x1)
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    Trusted Zone: motive.com\pattta.att
    Trusted Zone: motive.com\patttbc.att
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    TCP: NameServer = 85.255.112.173,85.255.112.122
    TCP: {9F3AA72C-75EE-49A4-99AB-199F7C1F9561} = 85.255.112.173,85.255.112.122
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Notify: avgrsstarter - avgrsstx.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-5-2 335240]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-5-2 27784]
    R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-5-2 108552]
    R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]
    R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-1 908056]
    R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-1 297752]
    R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
    R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
    S1 drvdrv;drvdrv;\??\c:\program files\drv\drv.sys --> c:\program files\drv\drv.sys [?]
    S2 drv;drv;c:\windows\system32\svchost.exe -k drv [2006-2-28 14336]
    S2 mrtRate;mrtRate; [x]
    S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;c:\windows\system32\drivers\ADM8511.SYS [2008-5-2 20160]

    =============== Created Last 30 ================


    ==================== Find3M ====================

    2009-08-29 20:24 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
    2009-08-29 20:24 11,952 a------- c:\windows\system32\avgrsstx.dll
    2004-07-30 10:56 90,112 a------- c:\program files\common files\PCSBclean.exe
    2004-07-26 16:30 291,840 a------- c:\program files\common files\PCSBoff.exe
    2008-05-27 11:43 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008052720080528\index.dat

    ============= FINISH: 21:21:48.40 ===============
     
    WesternKY,
    #3
  5. 2009/09/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    2nd part of DDS log is missing.
     
    broni,
    #4
  6. 2009/09/26
    WesternKY Lifetime Subscription

    WesternKY Well-Known Member Thread Starter

    Joined:
    2004/05/15
    Messages:
    69
    Likes Received:
    0
    Here you go. Thank you for your patience with me.

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-07-30.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/1/2008 4:52:21 AM
    System Uptime: 9/17/2009 8:05:29 AM (181 hours ago)

    Motherboard: Gigabyte Technology Co., Ltd. | | M61PME-S2
    Processor: AMD Athlon(tm) Processor LE-1620 | Socket M2 | 2410/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 75 GiB total, 45.167 GiB free.
    D: is FIXED (NTFS) - 149 GiB total, 135.662 GiB free.
    E: is CDROM ()
    F: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID:
    Description:
    Device ID: ACPI\NVRAIDBUS\3&2411E6FE&0
    Manufacturer:
    Name:
    PNP Device ID: ACPI\NVRAIDBUS\3&2411E6FE&0
    Service:

    ==== System Restore Points ===================

    RP105: 3/2/2009 10:12:07 PM - System Checkpoint
    RP106: 3/4/2009 9:16:45 PM - Avg8 Update
    RP107: 3/10/2009 2:33:20 AM - System Checkpoint
    RP108: 3/11/2009 3:20:59 AM - System Checkpoint
    RP109: 3/11/2009 8:00:22 AM - Software Distribution Service 3.0
    RP110: 3/13/2009 6:19:53 AM - System Checkpoint
    RP111: 3/14/2009 9:15:19 AM - System Checkpoint
    RP112: 3/15/2009 10:57:45 AM - System Checkpoint
    RP113: 3/15/2009 9:32:20 PM - Software Distribution Service 3.0
    RP114: 3/19/2009 9:00:21 AM - Software Distribution Service 3.0
    RP115: 3/20/2009 8:10:22 AM - Avg8 Update
    RP116: 3/21/2009 9:06:33 AM - System Checkpoint
    RP117: 3/22/2009 2:48:24 PM - System Checkpoint
    RP118: 3/25/2009 6:51:07 AM - System Checkpoint
    RP119: 3/26/2009 9:16:36 PM - Avg8 Update
    RP120: 3/31/2009 5:26:13 AM - System Checkpoint
    RP121: 4/1/2009 5:51:15 AM - System Checkpoint
    RP122: 4/2/2009 7:05:15 AM - System Checkpoint
    RP123: 4/4/2009 10:13:44 PM - System Checkpoint
    RP124: 4/6/2009 7:19:49 PM - System Checkpoint
    RP125: 4/7/2009 7:33:56 PM - System Checkpoint
    RP126: 4/9/2009 8:42:41 AM - Installed Java(TM) 6 Update 13
    RP127: 4/10/2009 9:32:43 AM - System Checkpoint
    RP128: 4/11/2009 10:32:47 AM - System Checkpoint
    RP129: 4/12/2009 11:32:41 AM - System Checkpoint
    RP130: 4/13/2009 12:32:41 PM - System Checkpoint
    RP131: 4/14/2009 1:32:44 PM - System Checkpoint
    RP132: 4/15/2009 9:00:31 AM - Software Distribution Service 3.0
    RP133: 4/15/2009 9:08:15 PM - Avg8 Update
    RP134: 4/16/2009 9:09:47 PM - System Checkpoint
    RP135: 4/17/2009 10:09:46 PM - System Checkpoint
    RP136: 4/18/2009 10:15:53 PM - System Checkpoint
    RP137: 4/19/2009 11:09:47 PM - System Checkpoint
    RP138: 4/21/2009 12:09:47 AM - System Checkpoint
    RP139: 4/22/2009 1:09:47 AM - System Checkpoint
    RP140: 4/23/2009 2:09:48 AM - System Checkpoint
    RP141: 4/24/2009 3:09:47 AM - System Checkpoint
    RP142: 4/25/2009 4:09:47 AM - System Checkpoint
    RP143: 4/26/2009 5:09:48 AM - System Checkpoint
    RP144: 4/27/2009 6:09:48 AM - System Checkpoint
    RP145: 4/28/2009 7:09:33 AM - System Checkpoint
    RP146: 4/29/2009 8:09:33 AM - System Checkpoint
    RP147: 4/29/2009 9:00:42 AM - Software Distribution Service 3.0
    RP148: 4/30/2009 8:30:54 AM - Software Distribution Service 3.0
    RP149: 5/1/2009 8:44:54 AM - System Checkpoint
    RP150: 5/2/2009 4:26:06 PM - System Checkpoint
    RP151: 5/3/2009 5:04:51 PM - System Checkpoint
    RP152: 5/4/2009 5:05:54 PM - System Checkpoint
    RP153: 5/5/2009 5:06:04 PM - System Checkpoint
    RP154: 5/6/2009 6:06:05 PM - System Checkpoint
    RP155: 5/7/2009 7:06:06 PM - System Checkpoint
    RP156: 5/11/2009 8:07:01 PM - Avg8 Update
    RP157: 5/11/2009 8:11:15 PM - Avg8 Update
    RP158: 5/12/2009 10:29:03 PM - System Checkpoint
    RP159: 5/13/2009 9:00:41 AM - Software Distribution Service 3.0
    RP160: 5/13/2009 9:01:23 PM - Configured Microsoft Office Small Business 2007
    RP161: 5/13/2009 9:20:26 PM - Configured Microsoft Office Small Business 2007
    RP162: 5/16/2009 9:47:24 AM - Avg8 Update
    RP163: 5/17/2009 10:33:15 AM - System Checkpoint
    RP164: 5/18/2009 11:33:14 AM - System Checkpoint
    RP165: 5/19/2009 9:06:16 AM - Avg8 Update
    RP166: 5/19/2009 9:07:27 AM - Avg8 Update
    RP167: 5/20/2009 9:33:21 AM - System Checkpoint
    RP168: 5/21/2009 10:33:20 AM - System Checkpoint
    RP169: 5/22/2009 11:33:15 AM - System Checkpoint
    RP170: 5/23/2009 12:33:15 PM - System Checkpoint
    RP171: 5/24/2009 1:33:15 PM - System Checkpoint
    RP172: 5/25/2009 2:33:15 PM - System Checkpoint
    RP173: 5/26/2009 2:33:21 PM - System Checkpoint
    RP174: 5/27/2009 3:33:21 PM - System Checkpoint
    RP175: 5/28/2009 4:33:21 PM - System Checkpoint
    RP176: 5/29/2009 5:33:23 PM - System Checkpoint

    ==== Installed Programs ======================

    123 CopyDVD Gold
    123 CopyDVD Gold 2009
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    Ad-Aware
    Adobe Flash Player 10 ActiveX
    Adobe Reader 8.1.2
    Agere Systems PCI-SV92PP Soft Modem
    ALOT Toolbar
    Ask Toolbar
    ATT-PRT22
    AutoUpdate
    AVG Free 8.5
    AviSynth 2.5
    Bible Explorer 4 for LESSONmaker
    Business Contact Manager for Outlook 2007 SP1
    CCScore
    Citrix XenApp Web Plugin
    Critical Update for Windows Media Player 11 (KB959772)
    DivX
    DVD Decrypter (Remove Only)
    DVD Shrink 3.2
    ESSBrwr
    ESSCDBK
    ESScore
    ESSgui
    ESSini
    ESSPCD
    ESSPDock
    ESSSONIC
    ESSTOOLS
    essvatgt
    fflink
    FrostWire 4.18.1
    Google Toolbar for Internet Explorer
    High Definition Audio Driver Package - KB888111
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB952287)
    HP My Display
    Java(TM) 6 Update 13
    Java(TM) 6 Update 7
    kgcbaby
    kgcbase
    kgchday
    kgchlwn
    kgcinvt
    kgckids
    kgcmove
    kgcvday
    Kodak EasyShare software
    KSU
    LESSONmaker 8 Complete Edition
    LightScribe System Software 1.17.90.1
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0 Service Pack 1
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Digital Image Pro 7.0
    Microsoft IntelliPoint 6.2
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Primary Interop Assemblies
    Microsoft Office Accounting 2008
    Microsoft Office Accounting 2008 Equifax Addin
    Microsoft Office Accounting 2008 Fixed Asset Manager
    Microsoft Office Accounting 2008 PayPal Addin
    Microsoft Office Accounting ADP Payroll Addin
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional Edition 2003
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Small Business 2007
    Microsoft Office Small Business Connectivity Components
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
    Microsoft SQL Server 2005 Tools Express Edition
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB933579)
    Nero 7 Essentials
    neroxml
    netbrdg
    Notifier
    NVIDIA Drivers
    OfotoXMI
    PC Study Bible (remove only)
    PC Study Bible 3 - Pulpit Comm.
    PC Study Bible 3.3A - The Wycliffe Bible Commentary
    PowerDVD
    Quicken 2003 Premier Home & Business
    QuickTime
    Realtek High Definition Audio Driver
    Roxio Easy Media Creator 8 Content
    Roxio Easy Media Creator 8 Suite
    ScanSoft OmniPage 16
    SDK
    Security Update for 2007 Microsoft Office System (KB951550)
    Security Update for 2007 Microsoft Office System (KB951944)
    Security Update for 2007 Microsoft Office System (KB960003)
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft Office Excel 2007 (KB959997)
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)
    Security Update for Microsoft Office Publisher 2007 (KB950114)
    Security Update for Microsoft Office system 2007 (KB954326)
    Security Update for Microsoft Office system 2007 (KB956828)
    Security Update for Microsoft Office Word 2007 (KB956358)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    SFR
    SHASTA
    skin0001
    SKINXSDK
    Spybot - Search & Destroy
    staticcr
    tooltips
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft Office Outlook 2007 (KB952142)
    Update for Outlook 2007 Junk Email Filter (kb968503)
    Update for Windows Internet Explorer 8 (KB968220)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951618-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    VPRINTOL
    WebFldrs XP
    Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Search 4.0
    Windows XP Service Pack 3
    WIRELESS
    WORDsearch Preaching Library
    XML Paper Specification Shared Components Pack 1.0

    ==== Event Viewer Messages From Past Week ========

    9/17/2009 8:07:05 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: drvdrv
    9/17/2009 8:07:00 AM, error: Service Control Manager [7023] - The drv service terminated with the following error: The specified module could not be found.
    9/17/2009 8:07:00 AM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
    9/17/2009 8:01:08 AM, error: Service Control Manager [7034] - The Portrait Displays Display Tune Service service terminated unexpectedly. It has done this 1 time(s).
    9/17/2009 7:59:55 AM, error: Service Control Manager [7034] - The SQL Server (MSSMLBIZ) service terminated unexpectedly. It has done this 1 time(s).
    9/17/2009 7:59:42 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

    ==== End Of File ===========================
     
    WesternKY,
    #5
  7. 2009/09/26
    WesternKY Lifetime Subscription

    WesternKY Well-Known Member Thread Starter

    Joined:
    2004/05/15
    Messages:
    69
    Likes Received:
    0
    Broni,
    Did I post what you needed for the 2nd part of DDS?
     
    WesternKY,
    #6
  8. 2009/09/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes, thank you :)

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #7

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...