keagle
2010-10-10, 20:28
Okay, I read the rules and don't quite understand them...but here goes anyway.
Trying to clean a friends computer. Cleaned everything except these two: Thank You for any help in advance...lol.
Fraud.WindowsProtectionSuite
and
Microsoft.Windows.RedirectedHosts
The computer in question has spybot (which detected it, but could not remove it), Malwarebytes (which can't even find it). Neither program has been updated for several months :sad: and the computer cannot go online at this time. Anyway to update 'malwarebytes' manually? From a flash drive? Thank You for any help in advance...lol.
Here's a Hijackthis Log File:
Error Message:
First it says it can't write to the 'hosts' file and if there's something in there, it can't fix it.
Then:
An unexpected error has occurred at procedure: modMain_CheckOther1Item()
Error #75 - Path/File access error
Please email me at http://forums.spybot.info/misc.php?do=email_dev&email=bWVyaWpuQHNweXdhcmVpbmZvLmNvbQ==, reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible
Windows version: Windows NT 5.01.2600
MSIE version: 8.0.6001.18372
HijackThis version: 1.99.1
This message has been copied to your clipboard.
Click OK to continue the rest of the scan.
Logfile of HijackThis v1.99.1
Scan saved at 9:44:02 PM, on 10/9/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
C:\Documents and Settings\Brandi\Desktop\Utilities\Installers\hijack this\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com (http://www.secure-plus-payments.com)
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com (http://www.securesoftwarebill.com)
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 216.45.48.244 www.google.com (http://www.google.com)
O1 - Hosts: 216.45.48.244 google.com
O1 - Hosts: 216.45.48.244 google.com.au
O1 - Hosts: 216.45.48.244 www.google.com.au (http://www.google.com.au)
O1 - Hosts: 216.45.48.244 google.be
O1 - Hosts: 216.45.48.244 www.google.be (http://www.google.be)
O1 - Hosts: 216.45.48.244 google.com.br
O1 - Hosts: 216.45.48.244 www.google.com.br (http://www.google.com.br)
O1 - Hosts: 216.45.48.244 google.ca
O1 - Hosts: 216.45.48.244 www.google.ca (http://www.google.ca)
O1 - Hosts: 216.45.48.244 google.ch
O1 - Hosts: 216.45.48.244 www.google.ch (http://www.google.ch)
O1 - Hosts: 216.45.48.244 google.de
O1 - Hosts: 216.45.48.244 www.google.de (http://www.google.de)
O1 - Hosts: 216.45.48.244 google.dk
O1 - Hosts: 216.45.48.244 www.google.dk (http://www.google.dk)
O1 - Hosts: 216.45.48.244 google.fr
O1 - Hosts: 216.45.48.244 www.google.fr (http://www.google.fr)
O1 - Hosts: 216.45.48.244 google.ie
O1 - Hosts: 216.45.48.244 www.google.ie (http://www.google.ie)
O1 - Hosts: 216.45.48.244 google.it
O1 - Hosts: 216.45.48.244 www.google.it (http://www.google.it)
O1 - Hosts: 216.45.48.244 google.co.jp
O1 - Hosts: 216.45.48.244 www.google.co.jp (http://www.google.co.jp)
O1 - Hosts: 216.45.48.244 google.nl
O1 - Hosts: 216.45.48.244 www.google.nl (http://www.google.nl)
O1 - Hosts: 216.45.48.244 google.no
O1 - Hosts: 216.45.48.244 www.google.no (http://www.google.no)
O1 - Hosts: 216.45.48.244 google.co.nz
O1 - Hosts: 216.45.48.244 www.google.co.nz (http://www.google.co.nz)
O1 - Hosts: 216.45.48.244 google.pl
O1 - Hosts: 216.45.48.244 www.google.pl (http://www.google.pl)
O1 - Hosts: 216.45.48.244 google.se
O1 - Hosts: 216.45.48.244 www.google.se (http://www.google.se)
O1 - Hosts: 216.45.48.244 google.co.uk
O1 - Hosts: 216.45.48.244 www.google.co.uk (http://www.google.co.uk)
O1 - Hosts: 216.45.48.244 google.co.za
O1 - Hosts: 216.45.48.244 www.google.co.za (http://www.google.co.za)
O1 - Hosts: 216.45.48.244 www.google-analytics.com (http://www.google-analytics.com)
O1 - Hosts: 216.45.48.244 www.bing.com (http://www.bing.com)
O1 - Hosts: 216.45.48.244 search.yahoo.com
O1 - Hosts: 216.45.48.244 www.search.yahoo.com (http://www.search.yahoo.com)
O1 - Hosts: 216.45.48.244 uk.search.yahoo.com
O1 - Hosts: 216.45.48.244 ca.search.yahoo.com
O1 - Hosts: 216.45.48.244 de.search.yahoo.com
O1 - Hosts: 216.45.48.244 fr.search.yahoo.com
O1 - Hosts: 216.45.48.244 au.search.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB666] command.com /c del "C:\Documents and Settings\Brandi\Start Menu\Programs\Spy Protector\Spy Protector.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2046] cmd.exe /c del "C:\Documents and Settings\Brandi\Start Menu\Programs\Spy Protector\Spy Protector.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7147] command.com /c del "C:\Program Files\Free Offers from Freeze.com\dolphinico.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6395] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\dolphinico.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8558] command.com /c del "C:\Program Files\Free Offers from Freeze.com\registryCleaner.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7197] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\registryCleaner.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9345] command.com /c del "C:\Program Files\Free Offers from Freeze.com\wfallsaw.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1482] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\wfallsaw.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1260] command.com /c del "C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3297] cmd.exe /c del "C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6015] command.com /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPCommon.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4268] cmd.exe /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPCommon.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7442] command.com /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD86] cmd.exe /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPIEAddOn.dll"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v47/scrabblecubes/scrabblecubes.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Around%20the%20World%20in%2080%20Days/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd....b?1131912450283
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://www.worldwinner.com/games/v46/wordmojo/wordmojo.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Fish%20Tycoon/Images/armhelper.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: eafdddfdca - C:\WINDOWS\
O20 - Winlogon Notify: ebbcbeeffb - C:\WINDOWS\
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: UPFBX - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UPFBX.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
===========================
Edit
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)
Trying to clean a friends computer. Cleaned everything except these two: Thank You for any help in advance...lol.
Fraud.WindowsProtectionSuite
and
Microsoft.Windows.RedirectedHosts
The computer in question has spybot (which detected it, but could not remove it), Malwarebytes (which can't even find it). Neither program has been updated for several months :sad: and the computer cannot go online at this time. Anyway to update 'malwarebytes' manually? From a flash drive? Thank You for any help in advance...lol.
Here's a Hijackthis Log File:
Error Message:
First it says it can't write to the 'hosts' file and if there's something in there, it can't fix it.
Then:
An unexpected error has occurred at procedure: modMain_CheckOther1Item()
Error #75 - Path/File access error
Please email me at http://forums.spybot.info/misc.php?do=email_dev&email=bWVyaWpuQHNweXdhcmVpbmZvLmNvbQ==, reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible
Windows version: Windows NT 5.01.2600
MSIE version: 8.0.6001.18372
HijackThis version: 1.99.1
This message has been copied to your clipboard.
Click OK to continue the rest of the scan.
Logfile of HijackThis v1.99.1
Scan saved at 9:44:02 PM, on 10/9/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
C:\Documents and Settings\Brandi\Desktop\Utilities\Installers\hijack this\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com (http://www.secure-plus-payments.com)
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com (http://www.securesoftwarebill.com)
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 216.45.48.244 www.google.com (http://www.google.com)
O1 - Hosts: 216.45.48.244 google.com
O1 - Hosts: 216.45.48.244 google.com.au
O1 - Hosts: 216.45.48.244 www.google.com.au (http://www.google.com.au)
O1 - Hosts: 216.45.48.244 google.be
O1 - Hosts: 216.45.48.244 www.google.be (http://www.google.be)
O1 - Hosts: 216.45.48.244 google.com.br
O1 - Hosts: 216.45.48.244 www.google.com.br (http://www.google.com.br)
O1 - Hosts: 216.45.48.244 google.ca
O1 - Hosts: 216.45.48.244 www.google.ca (http://www.google.ca)
O1 - Hosts: 216.45.48.244 google.ch
O1 - Hosts: 216.45.48.244 www.google.ch (http://www.google.ch)
O1 - Hosts: 216.45.48.244 google.de
O1 - Hosts: 216.45.48.244 www.google.de (http://www.google.de)
O1 - Hosts: 216.45.48.244 google.dk
O1 - Hosts: 216.45.48.244 www.google.dk (http://www.google.dk)
O1 - Hosts: 216.45.48.244 google.fr
O1 - Hosts: 216.45.48.244 www.google.fr (http://www.google.fr)
O1 - Hosts: 216.45.48.244 google.ie
O1 - Hosts: 216.45.48.244 www.google.ie (http://www.google.ie)
O1 - Hosts: 216.45.48.244 google.it
O1 - Hosts: 216.45.48.244 www.google.it (http://www.google.it)
O1 - Hosts: 216.45.48.244 google.co.jp
O1 - Hosts: 216.45.48.244 www.google.co.jp (http://www.google.co.jp)
O1 - Hosts: 216.45.48.244 google.nl
O1 - Hosts: 216.45.48.244 www.google.nl (http://www.google.nl)
O1 - Hosts: 216.45.48.244 google.no
O1 - Hosts: 216.45.48.244 www.google.no (http://www.google.no)
O1 - Hosts: 216.45.48.244 google.co.nz
O1 - Hosts: 216.45.48.244 www.google.co.nz (http://www.google.co.nz)
O1 - Hosts: 216.45.48.244 google.pl
O1 - Hosts: 216.45.48.244 www.google.pl (http://www.google.pl)
O1 - Hosts: 216.45.48.244 google.se
O1 - Hosts: 216.45.48.244 www.google.se (http://www.google.se)
O1 - Hosts: 216.45.48.244 google.co.uk
O1 - Hosts: 216.45.48.244 www.google.co.uk (http://www.google.co.uk)
O1 - Hosts: 216.45.48.244 google.co.za
O1 - Hosts: 216.45.48.244 www.google.co.za (http://www.google.co.za)
O1 - Hosts: 216.45.48.244 www.google-analytics.com (http://www.google-analytics.com)
O1 - Hosts: 216.45.48.244 www.bing.com (http://www.bing.com)
O1 - Hosts: 216.45.48.244 search.yahoo.com
O1 - Hosts: 216.45.48.244 www.search.yahoo.com (http://www.search.yahoo.com)
O1 - Hosts: 216.45.48.244 uk.search.yahoo.com
O1 - Hosts: 216.45.48.244 ca.search.yahoo.com
O1 - Hosts: 216.45.48.244 de.search.yahoo.com
O1 - Hosts: 216.45.48.244 fr.search.yahoo.com
O1 - Hosts: 216.45.48.244 au.search.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB666] command.com /c del "C:\Documents and Settings\Brandi\Start Menu\Programs\Spy Protector\Spy Protector.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2046] cmd.exe /c del "C:\Documents and Settings\Brandi\Start Menu\Programs\Spy Protector\Spy Protector.lnk"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7147] command.com /c del "C:\Program Files\Free Offers from Freeze.com\dolphinico.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6395] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\dolphinico.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8558] command.com /c del "C:\Program Files\Free Offers from Freeze.com\registryCleaner.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7197] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\registryCleaner.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9345] command.com /c del "C:\Program Files\Free Offers from Freeze.com\wfallsaw.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1482] cmd.exe /c del "C:\Program Files\Free Offers from Freeze.com\wfallsaw.ico"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1260] command.com /c del "C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3297] cmd.exe /c del "C:\Program Files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6015] command.com /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPCommon.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4268] cmd.exe /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPCommon.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7442] command.com /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPIEAddOn.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD86] cmd.exe /c del "C:\Program Files\Media Access Startup\1.3.0.790\HPIEAddOn.dll"
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: LaunchU3.exe.lnk = ?
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v47/scrabblecubes/scrabblecubes.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Around%20the%20World%20in%2080%20Days/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd....b?1131912450283
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://www.worldwinner.com/games/v46/wordmojo/wordmojo.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Fish%20Tycoon/Images/armhelper.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: eafdddfdca - C:\WINDOWS\
O20 - Winlogon Notify: ebbcbeeffb - C:\WINDOWS\
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: UPFBX - Unknown owner - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\UPFBX.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
===========================
Edit
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)