View Full Version : not able to access any known malware removal tools via internet programs
I haven't been able to access any known malware, spyware or security tools, even if it tries to download. it also doesn't let me get to pages i need to get to from search engines.
here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:47:57 PM, on 6/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\SecurityStatusSDK\SSDK02.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRman000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188387548515
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/cinematycoon.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
thanks
Hello soopse
Welcome to Safer Networking.
Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
That said, All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.
Please download Malwarebytes' Anti-Malware from Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) or Here (http://www.besttechie.net/tools/mbam-setup.exe)
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.<-- Don't forget this
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a New Hijackthis log.
I can't install the program, and i cant get any updates for malware programs already installed, as well as not being able to get new programs
the setup is not working, so what should I do?
for clarification and specifics, Malwarebytes' Anti-Malware does not install.
in fact, I cannot update any existing malaware protection software, access known malaware protection sites, nor install/update new malaware protection/detection software.
What next steps do you recommend?
You have Super Anti Spyware installed, even if it wont update, run a scan if you can and post the log.
See if you can run these
Download GMER's application from here:
http://www.gmer.net/gmer.zip
Unzip it and start the GMER.exe
Click the Rootkit tab and click the Scan button.
Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results in your next reply.
At the download site, before you download it, change the name to Combo-fix.exe
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link (http://www.bleepingcomputer.com/forums/topic114351.html) for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://i24.photobucket.com/albums/c30/ken545/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://i24.photobucket.com/albums/c30/ken545/whatnext.jpg
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Do I use the GMER application first then post, await response before looking into the Comb0-Fix.exe method?
Whatever one you can run, GMER would be nice first , it will show if a Rootkit is present that is preventing you from running any programs.
Another option with Combofix, if you cant download it, then what you need to do is use a known clean computer and down load it from there to your desktop, right click on it and rename it to combo-fix.exe, then transfer it to a CD ( not a thumb drive if you can help it ) there are infections currently around that will infect a thumb drive and I am not sure what your infected with, then copy and paste combo-fix.exe from the CD to the infected computers desktop, there is nothing to install, just click it to run.
I didn't run combo-fix.exe - a little nervous given some of the warnings I've read on some of these fixes.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/09/2008 at 07:39 PM
Application Version : 4.20.1046
Core Rules Database Version : 3541
Trace Rules Database Version: 1530
Scan type : Complete Scan
Total Scan Time : 00:41:48
Memory items scanned : 360
Memory threats detected : 1
Registry items scanned : 5294
Registry threats detected : 30
File items scanned : 23195
File threats detected : 125
Adware.MyWebSearch
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
[MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable
C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel
HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable
HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32
HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{07B18EA9-A523-4961-B6BB-170DE4475CCA}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKU\S-1-5-21-1275210071-492894223-725345543-1006\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
Adware.Tracking Cookie
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.shopica[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.realtechnetwork[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@kontera[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.newgrounds[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.ppctracking[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@dealtime[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@mediaplex[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@insightexpressai[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ad.yieldmanager[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@doubleclick[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@msnaccountservices.112.2o7[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@anad.tacoda[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@server.cpmstar[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@casalemedia[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@statcounter[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@socialmedia[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@server.iad.liveperson[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adcentriconline[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@realmedia[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@gamestats[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@shopica[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@pro-market[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@tribalfusion[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.pointroll[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.burstbeacon[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ehg-futurepub.hitbox[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@stats.adbrite[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@clicktorrent[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@burstnet[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@smileycentral[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@atdmt[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@maxserving[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ehg-gamespyinc.hitbox[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@msnportal.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@apmebf[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@a.websponsors[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@microsoftwga.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@banners2.battleon[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@viamtvcom.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@revenue[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.gamestats[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@server.iad.liveperson[3].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.revsci[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@e-2dj6wflokjd5sap.stats.esomniture[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@questionmarket[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@advertising[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@media.adrevolver[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adserver.easyad[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.3dstats[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adtech[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@maxis.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@softonic.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@login.revenueloop[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@4.adbrite[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@fastclick[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@microsoftwlmessengermkt.112.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@account.live[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@imrworldwide[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@serving-sys[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@bs.serving-sys[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@track.bestbuy[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@eas.apm.emediate[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adrevolver[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adlegend[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@trafficmp[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adbrite[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@banners.battleon[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@prospect.adbureau[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@data.coremetrics[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@clickbank[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ad1.clickhype[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.burstnet[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@iacas.adbureau[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@overture[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adecn[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@popularscreensavers[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@cgm.adbureau[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@atwola[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@media.adrevolver[3].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@clicksor[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ehg-aarp.hitbox[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@awarenesstech.122.2o7[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@specificclick[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@eyewonder[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@tremor.adbureau[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@revsci[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@adopt.euroclick[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@247realmedia[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@banners.dragonfable[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@azjmp[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@hitbox[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@stat.onestat[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@zedo[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.googleadservices[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@stat.dealtime[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@viacom.adbureau[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@www.googleadservices[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.sun[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@media.mtvnservices[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ads.associatedcontent[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@videoegg.adbureau[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@media6degrees[1].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@ehg-gamespot.hitbox[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@tacoda[2].txt
C:\Documents and Settings\Sean_2\Cookies\sean_2@starzmedia.122.2o7[1].txt
C:\Documents and Settings\dad\Cookies\dad@ads.revsci[1].txt
C:\Documents and Settings\dad\Cookies\dad@apmebf[2].txt
C:\Documents and Settings\dad\Cookies\dad@enhance[2].txt
C:\Documents and Settings\dad\Cookies\dad@overture[1].txt
C:\Documents and Settings\dad\Cookies\dad@revsci[2].txt
C:\Documents and Settings\dad\Cookies\dad@www.findstuff[1].txt
C:\Documents and Settings\dad\Cookies\dad@www.googleadservices[1].txt
C:\Documents and Settings\dad\Cookies\dad@zedo[2].txt
C:\Documents and Settings\Sean\Cookies\sean@atdmt[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@advertising[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@bs.serving-sys[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@doubleclick[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@mywebsearch[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@searchfeed[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\system@serving-sys[2].txt
Also ran GMER
GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-19 16:39:44
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.15 ----
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xEEDDAF20]
Code E16BD558 ZwEnumerateKey
Code E16BD638 ZwFlushInstructionCache
Code F7808E0B pIofCallDriver
Code F780967A pIofCompleteRequest
---- Kernel code sections - GMER 1.0.15 ----
PAGE ntoskrnl.exe!ZwEnumerateKey 8056EF30 5 Bytes JMP E16BD55C
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80576A6A 5 Bytes JMP E16BD63C
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\Explorer.EXE[2056] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00C4000A
.text C:\WINDOWS\Explorer.EXE[2056] WS2_32.dll!send 71AB428A 5 Bytes JMP 00C6000A
.text C:\WINDOWS\Explorer.EXE[2056] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 00C5000A
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip msfwhlpr.sys (OneCare Firewall Helper Driver/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp msfwhlpr.sys (OneCare Firewall Helper Driver/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp msfwhlpr.sys (OneCare Firewall Helper Driver/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp msfwhlpr.sys (OneCare Firewall Helper Driver/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Modules - GMER 1.0.15 ----
Module \systemroot\system32\drivers\TDSSserv.sys (*** hidden *** ) F7807000-F7813000 (49152 bytes)
---- Threads - GMER 1.0.15 ----
Thread System [4:540] F7808D68
---- Services - GMER 1.0.15 ----
Service C:\WINDOWS\system32\drivers\TDSSserv.sys (*** hidden *** ) [SYSTEM] tdssserv <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys
Reg HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys@ driver
Reg HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdssserv.sys
Reg HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdssserv.sys@ driver
Reg HKLM\SYSTEM\CurrentControlSet\Services\tdssserv
Reg HKLM\SYSTEM\CurrentControlSet\Services\tdssserv@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\tdssserv@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\tdssserv@imagepath \systemroot\system32\drivers\TDSSserv.sys
Reg HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\tdssserv.sys
Reg HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\tdssserv.sys@ driver
Reg HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Network\tdssserv.sys
Reg HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Network\tdssserv.sys@ driver
Reg HKLM\SYSTEM\ControlSet002\Services\tdssserv
Reg HKLM\SYSTEM\ControlSet002\Services\tdssserv@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\tdssserv@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\tdssserv@imagepath \systemroot\system32\drivers\TDSSserv.sys
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@affid 61
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@subid v2test6
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@control 0x1C 0x04 0x10 0x10 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@prov 10010
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@googleadserver pagead2.googlesyndication.com
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata@flagged 1
---- Files - GMER 1.0.15 ----
File C:\WINDOWS\system32\drivers\tdssserv.sys 41472 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\system32\tdssadw.dll 77824 bytes executable
File C:\WINDOWS\system32\TDSSerrors.log 33 bytes
File C:\WINDOWS\system32\tdssinit.dll 58824 bytes
File C:\WINDOWS\system32\tdssl.dll 16896 bytes executable
File C:\WINDOWS\system32\tdsslog.dll 11264 bytes
File C:\WINDOWS\system32\tdssmain.dll 29696 bytes
File C:\WINDOWS\system32\tdssserf.dll 12288 bytes
File C:\WINDOWS\system32\tdssservers.dat 254 bytes
File C:\WINDOWS\Temp\TDSS3459.tmp 18432 bytes executable
File C:\WINDOWS\Temp\tdssd4fe.tmp 0 bytes
File C:\WINDOWS\Temp\tdssd9b1.tmp 0 bytes
File C:\WINDOWS\Temp\tdsseaa9.tmp 0 bytes
---- EOF - GMER 1.0.15 ----
C:\WINDOWS\system32\drivers\TDSSserv.sys
This is a rootkit thats causing you all your grief, Combofix will remove it. Just disable your AV and any spyware programs you have running and run Combofix, should only take about 10 min or so.
How does this look now?
ComboFix 09-06-18.02 - dad 06/19/2009 18:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.766.511 [GMT -4:00]
Running from: E:\Combo-Fix.exe
AV: Windows Live OneCare *On-access scanning enabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4}
FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB}
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\windows\system32\drivers\tdssserv.sys
c:\windows\system32\tdssadw.dll
c:\windows\system32\TDSSerrors.log
c:\windows\system32\tdssinit.dll
c:\windows\system32\tdsslog.dll
c:\windows\system32\tdssmain.dll
c:\windows\system32\tdssserf.dll
c:\windows\system32\tdssservers.dat
c:\program files\FunWebProducts\Shared\03AA68AA.dat
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\program files\Internet Explorer\msimg32.dll
c:\program files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
c:\program files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files\MyWebSearch\bar\1.bin\M3MSG.DLL
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
c:\program files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\00020E00.bin
c:\program files\MyWebSearch\bar\Cache\00020FE4.bin
c:\program files\MyWebSearch\bar\Cache\000210FD.bin
c:\program files\MyWebSearch\bar\Cache\0002134F.bin
c:\program files\MyWebSearch\bar\Cache\0004D4FF
c:\program files\MyWebSearch\bar\Cache\000B8AC5.bin
c:\program files\MyWebSearch\bar\Cache\000B8CC9.bin
c:\program files\MyWebSearch\bar\Cache\000B8DB3.bin
c:\program files\MyWebSearch\bar\Cache\000B8EAD.bin
c:\program files\MyWebSearch\bar\Cache\01795CFB
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\system32\drivers\tdssserv.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_tdssserv
-------\Legacy_tdssserv
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
((((((((((((((((((((((((( Files Created from 2009-05-19 to 2009-06-19 )))))))))))))))))))))))))))))))
.
2009-06-19 00:47 . 2009-06-19 00:47 -------- d-----w- c:\program files\Trend Micro
2009-06-19 00:46 . 2009-06-19 00:46 -------- d-----w- c:\program files\ERUNT
2009-06-18 21:18 . 2000-01-14 21:42 45568 ----a-w- c:\windows\UniFish3.exe
2009-06-18 21:16 . 2009-06-18 21:16 -------- d-----w- c:\documents and settings\Sean_2\Application Data\Yahoo!
2009-06-18 21:14 . 2009-06-18 21:14 -------- d-----w- c:\program files\Hasbro Interactive
2009-06-18 21:12 . 2009-06-18 21:12 -------- d-sh--w- c:\documents and settings\Sean_2\IETldCache
2009-06-16 17:44 . 2009-06-16 17:44 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-16 16:18 . 2009-06-16 16:18 29352 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll
2009-06-16 16:18 . 2009-06-16 16:18 23720 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll
2009-06-16 16:18 . 2009-06-16 16:18 23056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll
2009-06-16 16:18 . 2009-06-16 16:18 221208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll
2009-06-16 16:18 . 2009-06-16 16:18 21160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll
2009-06-16 16:18 . 2009-06-16 16:18 110248 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll
2009-06-16 16:11 . 2007-11-28 02:56 91328 ----a-w- c:\windows\system32\drivers\msfwdrv.sys
2009-06-16 16:11 . 2007-11-28 02:56 116416 ----a-w- c:\windows\system32\drivers\msfwhlpr.sys
2009-06-16 16:10 . 2008-05-15 20:15 53168 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2009-06-16 16:10 . 2009-06-16 16:10 -------- d-----w- c:\windows\system32\bits
2009-06-16 16:09 . 2007-03-29 12:56 7168 -c----w- c:\windows\system32\dllcache\bitsprx4.dll
2009-06-16 16:09 . 2007-03-29 12:56 7168 ------w- c:\windows\system32\bitsprx4.dll
2009-06-16 16:06 . 2009-06-16 16:06 -------- d-sh--w- c:\documents and settings\dad\PrivacIE
2009-06-16 16:01 . 2009-06-16 16:01 -------- d-----w- c:\windows\system32\NtmsData
2009-06-16 15:26 . 2009-06-19 00:00 -------- d-----w- c:\program files\Microsoft Windows OneCare Live
2009-06-16 15:10 . 2009-06-16 15:10 -------- d-sh--w- c:\documents and settings\dad\IECompatCache
2009-06-16 14:19 . 2009-06-16 14:19 -------- d-sh--w- c:\documents and settings\dad\IETldCache
2009-06-16 14:18 . 2009-06-16 14:18 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-16 14:13 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-16 14:13 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-16 14:12 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-16 14:09 . 2009-06-16 14:12 -------- dc-h--w- c:\windows\ie8
2009-06-15 23:32 . 2007-08-07 00:28 442368 ----a-r- c:\windows\system32\vp6vfw.dll
2009-06-09 00:32 . 2009-06-09 00:32 -------- d-----w- c:\documents and settings\Sean\Local Settings\Application Data\Apple
2009-06-09 00:30 . 2009-06-09 00:30 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 13:31 . 2009-05-18 16:24 -------- d-----w- c:\program files\Common Files\Apple
2009-06-19 13:30 . 2008-08-25 20:00 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-19 00:26 . 2008-12-09 23:56 6144 ----a-w- c:\documents and settings\Sean_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10001.dll
2009-06-19 00:26 . 2008-12-09 23:56 22528 ----a-w- c:\documents and settings\Sean_2\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10000.dll
2009-06-18 21:22 . 2007-08-30 13:29 291 ----a-w- c:\windows\PowerReg.dat
2009-06-16 16:24 . 2009-06-16 16:24 209960 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch3\dplugins\2.0.1.600\OneCareDiagPlugin.dll
2009-06-16 15:20 . 2008-08-29 01:42 -------- d-----w- c:\program files\CCleaner
2009-06-15 23:22 . 2008-02-18 19:44 -------- d-----w- c:\program files\Windows Media Bonus Pack for Windows XP
2009-06-15 23:21 . 2007-08-30 13:28 -------- d-----w- c:\program files\Infogrames Interactive
2009-06-15 23:18 . 2007-08-29 11:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-15 23:14 . 2008-02-20 11:46 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-14 17:03 . 2008-02-23 18:16 1057 ----a-w- c:\windows\eReg.dat
2009-05-18 17:02 . 2009-05-18 17:02 -------- d-----w- c:\documents and settings\Sean_2\Application Data\EuroTalk
2009-05-18 16:29 . 2009-05-18 16:29 -------- d-----w- c:\program files\iTunes
2009-05-18 16:29 . 2009-05-18 16:29 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-18 16:29 . 2009-05-18 16:29 -------- d-----w- c:\program files\iPod
2009-05-18 16:26 . 2009-05-18 16:26 -------- d-----w- c:\program files\QuickTime
2009-05-18 16:22 . 2009-05-18 16:22 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-05-18 16:20 . 2008-09-05 23:47 -------- d-----w- c:\program files\Safari
2009-05-13 05:15 . 2004-08-04 04:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:44 . 2004-08-04 04:56 344064 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 09:58 . 2004-08-04 03:17 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2004-08-04 04:56 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2009-03-22 13:57 . 2009-03-22 13:56 253320 ----a-w- c:\documents and settings\Sean_2\Application Data\Microsoft\IdentityCRL\Production\ppcrlui.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-08-20 1576176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TCASUTIEXE"="TCAUDIAG -off" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-16 136600]
"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 196608]
"YOP"="c:\progra~1\Yahoo!\YOP\yop.exe" [2008-06-03 509224]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2009-03-22 63864]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9e.exe" [2007-11-21 218496]
c:\documents and settings\Sean_2\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-11-21 233472]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 20:28 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk
backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"56271:TCP"= 56271:TCP:Pando Media Booster
"56271:UDP"= 56271:UDP:Pando Media Booster
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/19/2008 11:34 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/19/2008 11:34 PM 55024]
R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [3/22/2009 10:59 AM 24936]
R2 tcaicchg;tcaicchg;c:\windows\system32\TCAICCHG.SYS [8/29/2007 7:18 AM 21233]
R2 TCAITDI;TCAITDI Protocol;c:\windows\system32\drivers\TCAITDI.SYS [8/29/2007 7:18 AM 19534]
R3 PPJoyBus;Parallel Port Joystick Bus device driver;c:\windows\system32\drivers\PPJoyBus.sys [1/23/2004 5:33 PM 13952]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/19/2008 11:34 PM 7408]
S3 MaplomL;MaplomL; [x]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-06-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2009-06-19 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 17:58]
2009-06-18 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-12-29 17:58]
2009-06-19 c:\windows\Tasks\User_Feed_Synchronization-{9A7C1762-CEB9-42EB-B7FE-3D279B0B211F}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
HKLM-Run-POINTER - point32.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.globeandmail.com
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRman000
DPF: CabBuilder - hxxp://ak.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 19:01
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1c,52,f7,97,4f,fc,25,48,aa,35,ec,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1c,52,f7,97,4f,fc,25,48,aa,35,ec,\
[HKEY_USERS\S-1-5-21-1275210071-492894223-725345543-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(668)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(1748)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
c:\program files\Microsoft Windows OneCare Live\winss.exe
c:\program files\Microsoft Hardware\Mouse\point32.exe
c:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-06-19 19:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-19 23:06
Pre-Run: 5,971,988,480 bytes free
Post-Run: 5,914,439,680 bytes free
298 --- E O F --- 2009-06-16 14:26
Great, good job :bigthumb: You should see a big difference in your system now.
Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.
Now download and install Malwarebytes, update it and run the Quick Scan, post the log and a new Hijackthis log please
If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a new HijackThis log with a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.