Results 1 to 2 of 2

Thread: I dont know i think i hve the redirect virus

  1. 2010-09-17, 14:37 #1
    jes003
    jes003 is offline
    Junior Member
    Join Date
    Sep 2010
    Posts
    1

    Default I dont know i think i hve the redirect virus

    Well, i got a message on facebook from a freind, and it was a video, so i clicked it and then it said it eneded flash player, so i did that , then i got the virus, and what happenes is sometimes i get redirected to different pages, and my norton antivirrus keeps coming up with security alerts.. well here is the DDS thing.

    Hoping you can help...
    Mitch
    ----------------------------------------------------------------------------
    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Administrator at 22:16:46.40 on Fri 17/09/2010
    Internet Explorer: 6.0.2900.5512
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.411 [GMT 10:00]

    AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
    FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
    C:\Program Files\PDF Complete\pdfsvc.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
    C:\Program Files\PDF Complete\pdfsty.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\WINDOWS\system32\msiexec.exe
    c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
    C:\Program Files\Megaupload\Mega Manager\MegaManager.exe
    C:\Documents and Settings\Administrator\My Documents\My Downloads\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uSearch Page =
    uSearch Bar =
    uInternet Settings,ProxyOverride = *.local
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.1.0.37\coIEPlg.dll
    BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.1.0.37\IPSBHO.DLL
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.1.0.37\coIEPlg.dll
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    mRun: [PDF Complete] "c:\program files\pdf complete\pdfsty.exe"
    mRun: [SetRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\documents and settings\administrator\start menu\programs\startup\CURSECLIENTSTARTUP.del
    StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
    Notify: igfxcui - igfxdev.dll
    SEH: ShellObj Class: {f552dde6-2090-4bf4-b924-6141e87789a5} - c:\progra~1\greatis\regrun~1\RRShell.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\dqde5l8j.default\
    FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\dqde5l8j.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
    FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\dqde5l8j.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
    FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\coffplgn\components\coFFPlgn.dll
    FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\ipsffplgn\components\IPSFFPl.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBook.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBookDB.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpNeoLogger.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSaturn.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSeymour.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartSelect.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartWebPrinting.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSWPOperation.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPLogging.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTC.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTL.dll
    FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXREStub.dll
    FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\dqde5l8j.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
    FF - plugin: c:\documents and settings\administrator\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
    FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
    FF - plugin: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\plugins\nphpclipbook.dll
    FF - plugin: c:\windows\system32\npOGPPlugin.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1201000.025\SymDS.sys [2010-9-17 339504]
    R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1201000.025\SymEFA.sys [2010-9-17 666672]
    R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20100901.003\BHDrvx86.sys [2010-9-1 692272]
    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1201000.025\Ironx86.sys [2010-9-17 134704]
    R1 wad;wad;c:\windows\system32\drivers\wad.sys [2010-9-16 28544]
    R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.1.0.37\ccSvcHst.exe [2010-9-17 126904]
    R2 pdfcDispatcher;PDF Document Manager;c:\program files\pdf complete\pdfsvc.exe [2009-9-9 534040]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-9-17 102448]
    R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20100916.001\IDSXpx86.sys [2010-9-17 331640]
    R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\virusdefs\20100916.034\NAVENG.SYS [2010-9-17 85424]
    R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\virusdefs\20100916.034\NAVEX15.SYS [2010-9-17 1362608]
    R4 RegGuard;RegGuard;\??\c:\windows\system32\drivers\regguard.sys --> c:\windows\system32\drivers\regguard.sys [?]
    S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2009-9-9 36608]
    S3 NetHook_ControlCenter;ArtOfPing ControlCenter;c:\program files\pingfu udp\ControlCenter.sys [2008-2-11 74752]
    S3 NetHook_Interceptor;ArtOfPing TDI Interceptor;c:\program files\pingfu udp\Interceptor.sys [2008-3-23 40448]
    S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

    =============== Created Last 30 ================

    2010-09-17 11:55:31 0 d-----w- c:\program files\UnHackMe
    2010-09-17 10:27:08 50 ----a-w- c:\windows\MegaManager.INI
    2010-09-17 10:26:07 0 d-----w- c:\docume~1\admini~1\applic~1\Megaupload
    2010-09-17 10:25:32 0 d-----w- c:\program files\Megaupload
    2010-09-17 02:34:25 0 d-----w- c:\windows\RestoreSafeDeleted
    2010-09-17 02:30:26 0 d-sh--r- C:\desktop.ini
    2010-09-17 02:30:26 0 d-sh--r- C:\comment.htt
    2010-09-17 02:30:26 0 d-sh--r- C:\autorun.inf
    2010-09-17 02:30:24 2 --shatr- c:\windows\winstart.bat
    2010-09-17 02:29:18 57556 ----a-w- c:\windows\guard.bmp
    2010-09-17 02:29:11 0 d-----w- c:\program files\Greatis
    2010-09-17 00:11:56 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
    2010-09-17 00:11:56 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
    2010-09-17 00:11:56 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
    2010-09-17 00:11:56 126512 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
    2010-09-17 00:11:56 0 d-----w- c:\program files\Symantec
    2010-09-17 00:11:56 0 d-----w- c:\program files\common files\Symantec Shared
    2010-09-17 00:11:20 0 d-----w- c:\windows\system32\drivers\NIS
    2010-09-17 00:11:17 0 d-----w- c:\program files\Norton Internet Security
    2010-09-17 00:11:15 0 d-----w- c:\docume~1\alluse~1\applic~1\Norton
    2010-09-17 00:10:06 0 d-----w- c:\program files\NortonInstaller
    2010-09-17 00:10:06 0 d-----w- c:\docume~1\alluse~1\applic~1\NortonInstaller
    2010-09-16 10:11:53 189986 ----a-w- c:\windows\system32\dllcache\c_1361.nls
    2010-09-16 10:10:45 8704 ----a-w- c:\windows\system32\kbdjpn.dll
    2010-09-16 10:10:45 8704 ----a-w- c:\windows\system32\dllcache\kbdjpn.dll
    2010-09-16 10:10:45 8192 ----a-w- c:\windows\system32\kbdkor.dll
    2010-09-16 10:10:45 8192 ----a-w- c:\windows\system32\dllcache\kbdkor.dll
    2010-09-16 10:10:45 6144 ----a-w- c:\windows\system32\kbd101c.dll
    2010-09-16 10:10:45 6144 ----a-w- c:\windows\system32\dllcache\kbd101c.dll
    2010-09-16 10:10:45 5632 ----a-w- c:\windows\system32\kbd103.dll
    2010-09-16 10:10:45 5632 ----a-w- c:\windows\system32\dllcache\kbd103.dll
    2010-09-16 10:10:42 6144 ----a-w- c:\windows\system32\kbd101b.dll
    2010-09-16 10:10:42 6144 ----a-w- c:\windows\system32\dllcache\kbd101b.dll
    2010-09-16 10:10:41 6144 ----a-w- c:\windows\system32\kbd106.dll
    2010-09-16 10:10:41 6144 ----a-w- c:\windows\system32\dllcache\kbd106.dll
    2010-09-16 09:19:50 1 ---h--w- c:\windows\bk23567.dat
    2010-09-16 09:19:50 1 ----a-w- c:\windows\fdgg34353edfgdfdf
    2010-09-16 07:54:50 664 ----a-w- c:\windows\system32\d3d9caps.dat
    2010-09-16 07:42:27 59904 ----a-w- c:\windows\system32\WAD.del
    2010-09-16 07:42:27 28544 ----a-w- c:\windows\system32\drivers\wad.sys
    2010-09-16 07:41:59 182784 ----a-w- c:\windows\ANDY128.del
    2010-09-11 00:56:11 0 d-----w- c:\program files\World of Warcraft
    2010-09-09 09:15:02 40 ----a-w- c:\windows\RSoftInfo.dat
    2010-09-09 08:37:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Blizzard Entertainment
    2010-09-09 08:36:44 0 d-----w- c:\docume~1\alluse~1\applic~1\Blizzard
    2010-09-09 08:29:27 0 d-----w- c:\program files\common files\Blizzard Entertainment
    2010-09-05 23:23:24 0 d-----w- c:\program files\Hero Editor
    2010-09-04 05:23:36 0 d-----w- c:\program files\Diablo II
    2010-08-29 01:04:10 56 ----a-w- c:\windows\SpeederXP.INI
    2010-08-27 07:22:27 0 d-----w- c:\program files\iPod
    2010-08-27 07:17:09 5632 ----a-w- c:\windows\system32\ptpusb.dll
    2010-08-27 07:17:04 159232 ----a-w- c:\windows\system32\ptpusd.dll
    2010-08-26 22:53:07 1888 ----a-w- c:\windows\system32\msexcr.ini
    2010-08-22 01:48:24 21840 ----atw- c:\windows\system32\SIntfNT.dll
    2010-08-22 01:48:24 17212 ----atw- c:\windows\system32\SIntf32.dll
    2010-08-22 01:48:24 12067 ----atw- c:\windows\system32\SIntf16.dll
    2010-08-22 01:43:51 68844 ----a-w- c:\windows\DIIUnin.dat
    2010-08-22 01:43:49 2829 ----a-w- c:\windows\DIIUnin.pif
    2010-08-22 01:43:48 94208 ----a-w- c:\windows\DIIUnin.exe
    2010-08-21 07:50:52 0 d-----w- c:\program files\G-Hotkey

    ==================== Find3M ====================

    2010-09-07 08:17:20 46 ----a-w- c:\documents and settings\administrator\jagex_runescape_preferences.dat
    2010-09-07 08:13:20 99 ----a-w- c:\documents and settings\administrator\jagex_runescape_preferences2.dat
    2010-09-05 23:23:08 249856 ------w- c:\windows\Setup1.exe
    2010-09-05 23:23:05 73216 ----a-w- c:\windows\ST6UNST.EXE
    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-17 13:17:06 58880 ------w- c:\windows\system32\dllcache\spoolsv.exe
    2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll
    2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    2010-07-22 15:49:15 590848 ------w- c:\windows\system32\dllcache\rpcrt4.dll
    2010-07-22 05:57:20 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
    2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll
    2010-06-24 12:22:03 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
    2010-06-24 12:21:59 599040 ------w- c:\windows\system32\dllcache\msfeeds.dll
    2010-06-24 12:21:59 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
    2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
    2010-06-24 12:21:58 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll
    2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
    2010-06-24 07:51:58 11077120 ------w- c:\windows\system32\dllcache\ieframe.dll
    2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
    2010-06-23 13:44:04 1851904 ------w- c:\windows\system32\dllcache\win32k.sys
    2010-06-23 10:18:34 0 ----a-w- c:\documents and settings\administrator\jagex__preferences3.dat
    2010-06-21 22:15:55 165725 ----a-w- c:\windows\hpoins44.dat
    2010-06-21 15:27:11 354304 ------w- c:\windows\system32\dllcache\srv.sys

    ============= FINISH: 22:17:40.45 ===============
    Attach.zip
  2. 2010-09-21, 01:14 #2
    ken545
    ken545 is offline
    Security Expert ken545's Avatar
    Join Date
    Nov 2005
    Location
    Stamford, CT
    Posts
    13,356

    Default




    Please read Before You Post
    While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

    Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware execpt for the programs we may run.





    Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean






    Please download Malwarebytes from Here or Here

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected .
    • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
    Post the report please
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules