1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Search Results window keeps popping up

Discussion in 'Malware and Virus Removal Archive' started by abnewallo, 2009/05/09.

  1. 2009/05/09
    abnewallo Lifetime Subscription

    abnewallo Well-Known Member Thread Starter

    Joined:
    2005/02/28
    Messages:
    89
    Likes Received:
    0
    [Active]Search Results window keeps popping up

    Please find a hijackthis report attached.

    The windows 'Search results' window keeps popping up.
     

    Attached Files:

    abnewallo,
    #1
  2. 2009/05/09
    Admin.

    Admin. Administrator Administrator Staff

    Joined:
    2001/12/30
    Messages:
    6,687
    Likes Received:
    107
    Hi,

    Read this post as indicated at the top of this forum & follow the instructions.
     
    Admin.,
    #2


  3. to hide this advert.

  4. 2009/05/10
    abnewallo Lifetime Subscription

    abnewallo Well-Known Member Thread Starter

    Joined:
    2005/02/28
    Messages:
    89
    Likes Received:
    0
    dds reports inserted as requested

    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Joyce at 7:30:27.56 on Sun 05/10/2009
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.160 [GMT -4:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\DellSupport\DSAgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
    svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\MDM.EXE
    C:\Documents and Settings\Joyce\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uInternet Connection Wizard,ShellNext = hxxp://www1.la.dell.com/content/default.aspx?c=tt&l=en&s=gen
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [CommCtr] c:\progra~1\net2ph~1\CommCtr.exe -auto
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [IntelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [igfxtray] c:\windows\system32\igfxtray.exe
    mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
    mRun: [igfxpers] c:\windows\system32\igfxpers.exe
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\symant~1.lnk - c:\program files\microsoft office\office\1033\OLFSNT40.EXE
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237637219226
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237638057614
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
    DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
    DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Notify: avgrsstarter - avgrsstx.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-3-21 325896]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-3-21 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-3-21 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-3-21 298776]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-3-21 210216]
    S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-3-21 33176]

    =============== Created Last 30 ================

    2009-05-09 21:57 <DIR> --d-h--- C:\$AVG8.VAULT$
    2009-05-09 18:32 <DIR> --d----- c:\program files\PCPitstop
    2009-05-09 18:32 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PCPitstop
    2009-05-09 18:22 <DIR> --d----- c:\program files\Trend Micro
    2009-04-17 10:22 410,984 a------- c:\windows\system32\deploytk.dll
    2009-04-17 10:22 73,728 a------- c:\windows\system32\javacpl.cpl
    2009-04-16 07:18 284,160 -------- c:\windows\system32\dllcache\pdh.dll
    2009-04-16 07:18 473,600 -------- c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 07:18 401,408 -------- c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 07:18 227,840 -------- c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 07:18 110,592 -------- c:\windows\system32\dllcache\services.exe
    2009-04-16 07:18 35,328 -------- c:\windows\system32\dllcache\sc.exe
    2009-04-16 07:17 729,088 -------- c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 07:17 617,472 -------- c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 07:17 453,120 -------- c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 07:17 714,752 -------- c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 07:15 2,560 -------- c:\windows\system32\xpsp4res.dll
    2009-04-16 07:15 1,203,922 -------- c:\windows\system32\dllcache\sysmain.sdb
    2009-04-16 07:15 215,552 -------- c:\windows\system32\dllcache\wordpad.exe
    2009-04-11 13:43 257,536 a------- c:\windows\BiImg.dll
    2009-04-11 13:43 221,184 a------- c:\windows\TIFF32.DLL
    2009-04-11 13:43 110,592 a------- c:\windows\JPEG32.DLL
    2009-04-11 13:43 262,144 a------- c:\windows\system32\BiMMonNT.dll
    2009-04-11 13:43 143,360 a------- c:\windows\system32\BiMRmvNT.dll
    2009-04-11 13:43 73,728 a------- c:\windows\system32\BiMResNT.dll
    2009-04-11 13:43 53,248 a------- c:\windows\system32\BiMAppNT.exe
    2009-04-11 13:43 <DIR> --d----- c:\program files\Net2Phone CommCenter

    ==================== Find3M ====================

    2009-05-01 10:26 11,952 a------- c:\windows\system32\avgrsstx.dll
    2009-05-01 10:26 325,896 a------- c:\windows\system32\drivers\avgldx86.sys
    2009-05-01 10:26 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
    2009-03-21 10:06 989,696 -------- c:\windows\system32\dllcache\kernel32.dll
    2009-03-21 08:16 5,058 a------- c:\windows\help\hhcolreg.dat
    2009-03-21 00:14 77,915 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
    2009-03-08 14:09 638,816 a------- c:\windows\system32\dllcache\iexplore.exe
    2009-03-08 14:09 391,536 a------- c:\windows\system32\dllcache\iedkcs32.dll
    2009-03-08 04:41 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
    2009-03-08 04:39 11,063,808 a------- c:\windows\system32\dllcache\ieframe.dll
    2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
    2009-03-08 04:34 914,944 a------- c:\windows\system32\dllcache\wininet.dll
    2009-03-08 04:34 1,206,784 a------- c:\windows\system32\dllcache\urlmon.dll
    2009-03-08 04:34 236,544 a------- c:\windows\system32\dllcache\webcheck.dll
    2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
    2009-03-08 04:34 43,008 a------- c:\windows\system32\dllcache\licmgr10.dll
    2009-03-08 04:34 105,984 a------- c:\windows\system32\dllcache\url.dll
    2009-03-08 04:34 193,536 a------- c:\windows\system32\dllcache\msrating.dll
    2009-03-08 04:34 109,568 a------- c:\windows\system32\dllcache\occache.dll
    2009-03-08 04:33 759,296 a------- c:\windows\system32\dllcache\VGX.dll
    2009-03-08 04:33 18,944 a------- c:\windows\system32\dllcache\corpol.dll
    2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
    2009-03-08 04:33 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
    2009-03-08 04:33 726,528 a------- c:\windows\system32\dllcache\jscript.dll
    2009-03-08 04:33 229,376 a------- c:\windows\system32\dllcache\ieaksie.dll
    2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
    2009-03-08 04:33 420,352 a------- c:\windows\system32\dllcache\vbscript.dll
    2009-03-08 04:33 125,952 a------- c:\windows\system32\dllcache\ieakeng.dll
    2009-03-08 04:32 72,704 a------- c:\windows\system32\dllcache\admparse.dll
    2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
    2009-03-08 04:32 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
    2009-03-08 04:32 163,840 a------- c:\windows\system32\dllcache\ieakui.dll
    2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
    2009-03-08 04:32 71,680 a------- c:\windows\system32\dllcache\iesetup.dll
    2009-03-08 04:32 55,808 a------- c:\windows\system32\dllcache\iernonce.dll
    2009-03-08 04:32 128,512 a------- c:\windows\system32\dllcache\advpack.dll
    2009-03-08 04:32 94,720 a------- c:\windows\system32\dllcache\inseng.dll
    2009-03-08 04:32 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
    2009-03-08 04:32 1,985,024 a------- c:\windows\system32\dllcache\iertutil.dll
    2009-03-08 04:32 611,840 a------- c:\windows\system32\dllcache\mstime.dll
    2009-03-08 04:24 68,608 a------- c:\windows\system32\dllcache\hmmapi.dll
    2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
    2009-03-08 04:22 156,160 a------- c:\windows\system32\dllcache\msls31.dll
    2009-03-08 04:11 445,952 a------- c:\windows\system32\dllcache\ieapfltr.dll
    2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
    2009-02-28 00:55 105,984 -------- c:\windows\system32\dllcache\iecompat.dll
    2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
    2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
    2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
    2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
    1998-12-08 22:53 186,368 a------- c:\program files\common files\IRAREG.DLL
    1998-12-08 22:53 99,840 a------- c:\program files\common files\IRAABOUT.DLL
    1998-12-08 22:53 70,144 a------- c:\program files\common files\IRAMDMTR.DLL
    1998-12-08 22:53 48,640 a------- c:\program files\common files\IRALPTTR.DLL
    1998-12-08 22:53 31,744 a------- c:\program files\common files\IRAWEBTR.DLL
    1998-12-08 22:53 17,920 a------- c:\program files\common files\IRASRIAL.DLL

    ============= FINISH: 7:30:54.25 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-03-16.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/20/2009 12:44:27 PM
    System Uptime: 5/10/2009 7:17:06 AM (0 hours ago)

    Motherboard: Dell Computer Corp. | | 0TC667
    Processor: Intel(R) Celeron(R) CPU 2.40GHz | Microprocessor | 2394/533mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 71 GiB total, 59.737 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP1: 3/20/2009 12:44:32 PM - System Checkpoint
    RP2: 3/20/2009 12:47:49 PM - Removed Adobe Acrobat - Reader 6.0.2 Update
    RP3: 3/20/2009 12:48:40 PM - Removed Adobe Reader 6.0.1
    RP4: 3/20/2009 11:55:19 PM - Removed Norton Security Center
    RP5: 3/21/2009 12:06:30 AM - Installed Windows XP Service Pack 3.
    RP6: 3/21/2009 8:12:58 AM - Installed Microsoft Office 2000 SR-1 Standard
    RP7: 3/21/2009 8:21:33 AM - Installed Adobe Reader 9.1.
    RP8: 3/21/2009 8:23:06 AM - Software Distribution Service 3.0
    RP9: 3/21/2009 8:33:41 AM - Software Distribution Service 3.0
    RP10: 3/21/2009 8:55:22 AM - Installed AVG Free 8.5
    RP11: 3/21/2009 8:59:54 AM - Installed Windows Media Player 11
    RP12: 3/21/2009 9:00:20 AM - Installed Windows XP Wudf01000.
    RP13: 3/21/2009 9:02:20 AM - Installed Windows XP MSCompPackV1.
    RP14: 3/21/2009 9:03:49 AM - Software Distribution Service 3.0
    RP15: 3/21/2009 9:07:31 AM - Software Distribution Service 3.0
    RP16: 3/21/2009 9:28:28 AM -
    RP17: 3/21/2009 9:29:09 AM - Shockwave Player
    RP18: 3/28/2009 11:37:30 AM - Avg8 Update
    RP19: 3/28/2009 12:35:18 PM - Installed Dell Support Center (Support Software).
    RP20: 3/29/2009 1:16:20 PM - System Checkpoint
    RP21: 3/31/2009 8:28:16 AM - System Checkpoint
    RP22: 4/3/2009 12:56:43 PM - System Checkpoint
    RP23: 4/4/2009 1:08:33 PM - System Checkpoint
    RP24: 4/5/2009 9:58:29 AM - Avg8 Update
    RP25: 4/5/2009 10:01:17 AM - Avg8 Update
    RP26: 4/7/2009 8:29:12 AM - Installed Windows Internet Explorer 8.
    RP27: 4/7/2009 8:30:25 AM - Software Distribution Service 3.0
    RP28: 4/8/2009 9:36:15 AM - System Checkpoint
    RP29: 4/9/2009 3:43:32 PM - System Checkpoint
    RP30: 4/10/2009 1:58:35 PM - Avg8 Update
    RP31: 4/11/2009 1:43:33 PM - Printer Driver Net2Phone Fax Image Driver Installed
    RP32: 4/14/2009 7:43:47 AM - System Checkpoint
    RP33: 4/15/2009 8:32:00 AM - System Checkpoint
    RP34: 4/16/2009 9:31:52 AM - System Checkpoint
    RP35: 4/16/2009 12:06:58 PM - Software Distribution Service 3.0
    RP36: 4/17/2009 10:15:10 AM - Avg8 Update
    RP37: 4/17/2009 10:22:01 AM - Installed Java(TM) 6 Update 13
    RP38: 4/18/2009 12:26:40 PM - System Checkpoint
    RP39: 4/20/2009 12:47:23 PM - System Checkpoint
    RP40: 4/21/2009 1:00:55 PM - System Checkpoint
    RP41: 4/22/2009 2:09:50 PM - System Checkpoint
    RP42: 4/24/2009 11:45:18 AM - System Checkpoint
    RP43: 4/25/2009 11:59:44 AM - System Checkpoint
    RP44: 4/26/2009 12:58:22 PM - System Checkpoint
    RP45: 4/28/2009 11:53:40 AM - System Checkpoint
    RP46: 4/29/2009 1:52:07 PM - System Checkpoint
    RP47: 4/29/2009 4:26:27 PM - Software Distribution Service 3.0
    RP48: 5/1/2009 10:23:00 AM - Avg8 Update
    RP49: 5/1/2009 10:27:16 AM - Avg8 Update
    RP50: 5/2/2009 10:44:42 AM - System Checkpoint
    RP51: 5/3/2009 11:30:35 AM - System Checkpoint
    RP52: 5/4/2009 12:37:40 PM - System Checkpoint
    RP53: 5/5/2009 12:47:54 PM - System Checkpoint
    RP54: 5/6/2009 12:55:36 PM - System Checkpoint
    RP55: 5/7/2009 1:05:35 PM - System Checkpoint
    RP56: 5/9/2009 6:52:29 PM - System Checkpoint

    ==== Installed Programs ======================

    Acrobat.com
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.1
    Adobe Shockwave Player 11
    Alchemy 1.2
    AVG 8.5
    Big Money Deluxe 1.22
    BookWorm Deluxe 1.03
    Choice Guard
    Classic PhoneTools
    Critical Update for Windows Media Player 11 (KB959772)
    Dell Driver Reset Tool
    Dell Support Center (Support Software)
    Dell System Restore
    DellSupport
    getPlus(R) for Adobe
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Intel(R) 537EP V9x DFV PCI Modem
    Intel(R) Extreme Graphics 2 Driver
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wired Connections
    Java 2 Runtime Environment, SE v1.4.2_03
    Java(TM) 6 Update 13
    McAfee SiteAdvisor
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft Application Error Reporting
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 SR-1 Standard
    Microsoft Plus! Digital Media Edition Installer
    Microsoft Plus! Photo Story 2 LE
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works 7.0
    Modem Event Monitor
    Modem Helper
    Modem On Hold
    MSN
    MSVCRT
    Musicmatch for Windows Media Player
    Net2Phone CommCenter
    Security Update for CAPICOM (KB931906)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127-v2)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923789)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    Segoe UI
    Skypeâ„¢ 4.0
    Spelling Dictionaries Support For Adobe Reader 9
    Update for Windows Internet Explorer 8 (KB968220)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    WebCyberCoach 3.2 Dell
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 10
    Windows Media Player 11
    Windows XP Service Pack 3

    ==== Event Viewer Messages From Past Week ========

    5/9/2009 6:13:17 PM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 0013208848C1 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
    5/10/2009 7:17:33 AM, error: Dhcp [1002] - The IP address lease 192.168.0.101 for the Network Card with network address 0013208848C1 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).

    ==== End Of File ===========================
     
    abnewallo,
    #3
  5. 2009/05/11
    abnewallo Lifetime Subscription

    abnewallo Well-Known Member Thread Starter

    Joined:
    2005/02/28
    Messages:
    89
    Likes Received:
    0
    Panda Active scan report

    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-05-11 04:32:01
    PROTECTIONS: 1
    MALWARE: 20
    SUSPECTS: 0
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    AVG Anti-Virus Free 8.5 Yes Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Cookies\joyce@tribalfusion[1].txt
    00145881 Cookie/NewMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@anm.co[1].txt
    00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@maxserving[1].txt
    00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@belnk[1].txt
    00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@dist.belnk[2].txt
    00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@www.myaffiliateprogram[1].txt
    00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@com[1].txt
    00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Cookies\joyce@com[1].txt
    00167733 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@z1.adserver[1].txt
    00167744 Cookie/GoStats TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@gostats[2].txt
    00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@www.burstbeacon[1].txt
    00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@server.iad.liveperson[1].txt
    00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@stat.onestat[2].txt
    00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@ads.pointroll[1].txt
    00182104 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@phg.hitbox[1].txt
    00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@target[1].txt
    00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@ct.360i[1].txt
    00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@did-it[1].txt
    00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Cookies\joyce@atwola[1].txt
    00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce_spicer@ads.addynamix[1].txt
    02908816 Cookie/Starware TrackingCookie No 0 Yes No C:\Documents and Settings\Joyce\Desktop\jspicer\ Root\Documents and Settings\Joyce Spicer\Cookies\joyce spicer@h.starware[2].txt
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location !
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description !
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
     
    abnewallo,
    #4
  6. 2009/05/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Under Configuration and Preferences, click the Preferences button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Scan for tracking cookies.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * Back on the main screen, under Scan for Harmful Software click Scan your computer.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, under Complete Scan, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.
    NOTE: Tracking cookies may be omitted from the log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log to your next reply.

    RESTART COMPUTER

    STEP 4. Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackThis log.
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #5

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...