Results 1 to 7 of 7

Thread: Pop-ups from google, spybot not running properly

  1. #1
    Junior Member
    Join Date
    Feb 2009
    Posts
    3

    Default Pop-ups from google, spybot not running properly

    Hi I'm having a few problems with my computer. I'm getting pop-ups when I click on results from search engines. I downloaded ad-aware and that was able to remove a number or browser hijackers (I think that's what they were called)

    I then tried downloading Spybot S&D, but I got an error saying it couldn't resolve the host. I managed to get on here and get it installed from a direct link, with the install updates immediately box unchecked. But when I try to open it nothing comes up. Is there meant to be some sort of interface? All I can access is the menu from right clicking the icon in the system tray.

    My hijack this log is below

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:38:39 PM, on 2/8/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DeltaIITray.exe
    C:\Program Files\ClocX\ClocX.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    E:\Program Files\bin\jusched.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    E:\RocketDock\RocketDock.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\svchost.exe
    E:\Program Files\bin\jqs.exe
    C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    D:\Downloads\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\DeltaIITray.exe
    O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS\system32\DeltaIITray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\bin\jusched.exe"
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [RocketDock] "E:\RocketDock\RocketDock.exe"
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\bin\jp2iexp.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FF4DC1DA-4705-4C5F-8788-C8777EE9FA62}: NameServer = 208.67.222.222,208.67.220.220
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\bin\jqs.exe
    O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 7273 bytes

  2. #2
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi there,


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer


    Download ResetTeaTimer.bat to the Desktop (right click the link and select save)
    http://downloads.subratam.org/ResetTeaTimer.bat
    Double click ResetTeaTimer.bat to remove all entries set by TeaTimer (and preventing TeaTimer to restore them upon reactivation).


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New HijackThis log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member
    Join Date
    Feb 2009
    Posts
    3

    Default

    I am unable to run spybot, whenever I click on it nothing happens. Should I disable TeaTimer by ending it in the processes list, and then run combofix or what should I do?

    Thank you for your help btw

  4. #4
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Yes, do like you said there and kill TeaTimer process thru task manager.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member
    Join Date
    Feb 2009
    Posts
    3

    Default

    Hi, I ran combofix ok there and it had to restart during it, teatimer was back on whenever it was finished so I don't know if that affected it.

    Here's the logs:

    ComboFix 09-02-12.03 - Munchies 2009-02-13 17:58:00.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.760 [GMT 0:00]
    Running from: c:\documents and settings\Munchies\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\autorun.inf
    c:\program files\Mozilla Firefox\components\iamfamous.dll
    c:\recycler\S-4-4-81-100020106-100010920-100020451-6970.com
    c:\windows\IE4 Error Log.txt
    c:\windows\system32\drivers\gaopdxswextlwg.sys
    c:\windows\system32\gaopdxcounter
    c:\windows\system32\gaopdxkcdppadr.dll
    D:\Autorun.inf
    d:\recycler\S-4-4-81-100020106-100010920-100020451-6970.com
    E:\Autorun.inf
    e:\recycler\S-4-4-81-100020106-100010920-100020451-6970.com

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_gaopdxserv.sys


    ((((((((((((((((((((((((( Files Created from 2009-01-13 to 2009-02-13 )))))))))))))))))))))))))))))))
    .

    2009-11-27 13:20 . 2008-09-12 10:44 206,256 --a------ c:\windows\system32\idmmbc.dll
    2009-02-10 21:46 . 2009-02-10 21:46 <DIR> d-------- c:\program files\TweetDeck
    2009-02-10 21:46 . 2009-02-10 21:46 <DIR> d-------- c:\program files\Common Files\Adobe AIR
    2009-02-10 21:46 . 2009-02-10 21:46 <DIR> d-------- c:\documents and settings\Munchies\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
    2009-02-10 11:50 . 2008-04-14 04:42 221,184 --a------ c:\windows\system32\wmpns.dll
    2009-02-10 11:50 . 2009-02-10 11:50 23,392 --a------ c:\windows\system32\nscompat.tlb
    2009-02-10 11:50 . 2009-02-10 11:50 16,832 --a------ c:\windows\system32\amcompat.tlb
    2009-02-08 16:11 . 2009-02-08 16:11 <DIR> d-------- c:\documents and settings\Administrator
    2009-02-08 15:46 . 2009-02-08 15:51 <DIR> d-------- c:\program files\Spybot - Search & Destroy
    2009-02-08 15:46 . 2009-02-08 15:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-05 00:21 . 2009-02-05 00:21 <DIR> d-------- c:\program files\Lavasoft
    2009-02-05 00:21 . 2009-02-05 00:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-02-04 21:48 . 2009-02-04 21:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
    2009-02-04 18:41 . 2008-03-03 14:25 5,702 --ah----- c:\windows\nod32restoretemdono.reg
    2009-02-04 18:41 . 2008-03-03 18:21 568 --ah----- c:\windows\nod32fixtemdono.reg
    2009-02-04 18:39 . 2009-02-04 18:39 <DIR> d-------- c:\program files\ESET
    2009-02-04 18:39 . 2009-02-04 18:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
    2009-02-03 20:39 . 2009-02-05 15:01 <DIR> d-------- c:\documents and settings\Munchies\Application Data\Mathematica
    2009-02-03 20:39 . 2009-02-05 15:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\Mathematica
    2009-02-03 20:38 . 2009-02-03 20:38 <DIR> d-------- c:\windows\Downloaded Installations
    2009-02-03 20:38 . 2009-02-03 20:38 <DIR> d-------- c:\program files\Wolfram Research
    2009-02-03 20:37 . 2008-11-10 21:53 378,152 --a------ c:\windows\system32\ml32i3.dll
    2009-02-03 20:37 . 2008-11-10 21:53 333,096 --a------ c:\windows\system32\mltcpip32.mlp
    2009-02-03 20:37 . 2008-11-10 21:53 267,560 --a------ c:\windows\system32\ml32i2.dll
    2009-02-03 20:37 . 2008-11-10 21:53 255,272 --a------ c:\windows\system32\ml32i1.dll
    2009-02-03 20:37 . 2008-11-10 21:53 185,640 --a------ c:\windows\system32\mlmodule32.dll
    2009-02-03 20:37 . 2008-11-10 21:53 107,816 --a------ c:\windows\system32\mltcp32.mlp
    2009-02-03 20:37 . 2008-11-10 21:53 103,720 --a------ c:\windows\system32\mlshm32.mlp
    2009-02-03 20:37 . 2008-11-10 21:53 95,528 --a------ c:\windows\system32\mlmap32.mlp
    2009-02-03 20:32 . 2009-02-03 20:32 <DIR> d-------- c:\documents and settings\Munchies\Application Data\DAEMON Tools Pro
    2009-02-03 20:32 . 2009-02-03 20:32 <DIR> d-------- c:\documents and settings\Munchies\Application Data\DAEMON Tools
    2009-02-03 20:31 . 2009-02-03 20:31 <DIR> d-------- c:\program files\DAEMON Tools Lite
    2009-02-03 20:31 . 2009-02-03 20:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
    2009-02-03 20:29 . 2009-02-03 20:29 717,296 --a------ c:\windows\system32\drivers\sptd.sys
    2009-02-03 20:28 . 2009-02-03 20:33 <DIR> d-------- c:\documents and settings\Munchies\Application Data\DAEMON Tools Lite
    2009-02-03 00:16 . 2006-10-26 19:56 32,592 --a------ c:\windows\system32\msonpmon.dll
    2009-02-03 00:14 . 2009-02-03 00:14 <DIR> d-------- c:\program files\MSBuild
    2009-02-03 00:14 . 2009-02-03 00:14 <DIR> d-------- c:\program files\Microsoft Works
    2009-02-03 00:09 . 2009-02-03 00:13 <DIR> d-------- c:\windows\SHELLNEW
    2009-02-03 00:09 . 2009-02-03 02:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-02-03 00:08 . 2009-02-03 00:08 <DIR> dr-h----- C:\MSOCache
    2009-02-02 21:43 . 2006-08-16 10:23 86,016 --a------ c:\windows\system32\ma_cmidn.dll
    2009-02-02 21:43 . 2006-08-16 10:24 82,944 --a------ c:\windows\system32\USBMN1X1.DLL
    2009-02-02 21:43 . 2006-08-16 10:24 24,128 --a------ c:\windows\system32\drivers\USBMM1X1.SYS
    2009-02-02 21:43 . 2006-08-16 10:24 22,208 --a------ c:\windows\system32\drivers\USBMN1X1.SYS
    2009-02-02 21:43 . 2006-08-16 10:23 21,888 --a------ c:\windows\system32\drivers\ma_cmidi.sys
    2009-02-02 21:43 . 2006-08-16 10:24 17,920 --a------ c:\windows\system32\USBMM1X1.DLL
    2009-02-02 21:43 . 2006-08-16 10:23 17,920 --a------ c:\windows\system32\MA_CMIDI.DLL
    2009-02-02 21:43 . 2006-08-16 10:23 14,272 --a------ c:\windows\system32\MA_CMIDI.DRV
    2009-02-02 21:43 . 2006-08-16 10:24 13,504 --a------ c:\windows\system32\drivers\USB11LDR.SYS
    2009-02-02 21:43 . 2006-08-16 10:24 12,272 --a------ c:\windows\system32\USBMM1X1.DRV
    2009-02-02 21:43 . 2006-08-16 10:24 7,330 --a------ c:\windows\system32\USBMM1X1.VXD
    2009-02-02 21:43 . 2006-08-16 10:23 7,282 --a------ c:\windows\system32\MA_CMIDI.VXD
    2009-02-02 13:06 . 2009-02-02 13:06 <DIR> d-------- c:\program files\Steinberg
    2009-02-02 13:06 . 2009-02-02 13:06 <DIR> d-------- c:\program files\Common Files\Digidesign
    2009-02-02 12:46 . 2008-04-14 00:15 60,032 --a------ c:\windows\system32\drivers\USBAUDIO.sys
    2009-02-02 12:46 . 2008-04-14 00:15 60,032 --a--c--- c:\windows\system32\dllcache\usbaudio.sys
    2009-02-02 12:46 . 2008-04-14 00:15 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
    2009-02-02 12:46 . 2008-04-14 00:15 32,128 --a--c--- c:\windows\system32\dllcache\usbccgp.sys
    2009-02-02 01:19 . 2009-02-02 01:20 <DIR> d-------- c:\program files\ASIO4ALL v2
    2009-02-02 01:16 . 2009-02-02 01:16 <DIR> d-------- c:\program files\VstPlugins
    2009-02-02 01:16 . 2002-07-07 22:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
    2009-02-02 01:13 . 2009-02-02 01:13 <DIR> d-------- c:\program files\Outsim
    2009-02-02 01:06 . 2009-02-02 01:20 <DIR> d-------- c:\program files\Image-Line
    2009-02-01 22:46 . 2009-02-01 22:47 <DIR> d-------- c:\documents and settings\Munchies\Application Data\Ableton
    2009-02-01 22:45 . 2008-03-14 13:22 1,060,864 --a------ c:\windows\system32\MFC71.dll
    2009-02-01 22:45 . 2008-03-14 13:22 499,712 --a------ c:\windows\system32\msvcp71.dll
    2009-02-01 22:45 . 2008-03-14 13:22 348,160 --a------ c:\windows\system32\msvcr71.dll
    2009-02-01 22:45 . 2008-03-14 13:22 233,472 --a------ c:\windows\system32\REX Shared Library.dll
    2009-01-28 16:24 . 2009-01-28 16:24 <DIR> d-------- c:\program files\Common Files\PACE Anti-Piracy
    2009-01-28 16:24 . 2009-01-28 16:24 <DIR> d-------- c:\documents and settings\Munchies\Application Data\PACE Anti-Piracy
    2009-01-28 16:24 . 2009-01-28 16:24 <DIR> d-------- c:\documents and settings\Munchies\Application Data\Cycling '74
    2009-01-28 16:24 . 2009-01-28 16:24 <DIR> d-------- c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
    2009-01-28 16:05 . 2009-01-28 16:05 78,648 --a------ c:\windows\system32\drivers\tpkd.sys
    2009-01-25 14:15 . 2009-01-25 14:15 <DIR> d-------- c:\program files\TVAnts
    2009-01-21 17:17 . 2009-01-21 17:17 <DIR> d-------- c:\documents and settings\Munchies\Application Data\Sports Interactive
    2009-01-16 21:49 . 2009-01-16 21:49 244 --ah----- C:\sqmnoopt00.sqm
    2009-01-16 21:49 . 2009-01-16 21:49 232 --ah----- C:\sqmdata00.sqm
    2009-01-16 18:44 . 2009-01-16 18:46 <DIR> d-------- c:\documents and settings\Munchies\Application Data\InfraRecorder

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-12 22:20 --------- d-----w c:\documents and settings\Munchies\Application Data\foobar2000
    2009-02-12 20:29 --------- d-----w c:\documents and settings\Munchies\Application Data\uTorrent
    2009-02-11 12:47 --------- d-----w c:\documents and settings\Munchies\Application Data\DMCache
    2009-02-05 00:20 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-02-02 21:43 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-02-02 21:43 --------- d-----w c:\program files\M-Audio
    2009-01-06 15:22 --------- d-----w c:\documents and settings\Munchies\Application Data\CoSoSys
    2009-01-03 21:19 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
    2008-12-22 15:21 --------- d-----w c:\documents and settings\Munchies\Application Data\OpenOffice.org
    2008-12-22 15:19 --------- d-----w c:\program files\OpenOffice.org 3
    2008-12-22 15:19 --------- d-----w c:\program files\JRE
    2008-12-22 15:19 --------- d-----w c:\program files\Java
    2008-12-22 15:18 --------- d-----w c:\program files\Common Files\Java
    2008-12-21 04:55 --------- d-----w c:\program files\Magic Video Converter
    2008-12-21 04:51 --------- d-----w c:\program files\MyDVDTools
    2008-12-20 19:08 --------- d-----w c:\documents and settings\All Users\Application Data\NexonEU
    2008-12-20 16:27 --------- d-----w c:\documents and settings\All Users\Application Data\NexonUS
    2008-12-20 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\PMB Files
    2008-12-20 16:05 --------- d-----w c:\program files\Pando Networks
    2008-12-18 18:54 410,984 ----a-w c:\windows\system32\deploytk.dll
    2008-12-17 22:50 --------- d-----w c:\program files\Common Files\InstallShield
    2008-12-17 00:40 --------- d-----w c:\program files\Internet Download Manager
    2008-12-15 11:01 --------- d-----w c:\documents and settings\Munchies\Application Data\IDM
    2008-12-14 17:02 361,344 ----a-w c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
    2008-12-14 16:56 --------- d-----w c:\documents and settings\Munchies\Application Data\mIRC
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Google Update"="c:\documents and settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-12-10 133104]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "M-Audio Taskbar Icon"="c:\windows\System32\DeltaIITray.exe" [2008-03-03 236040]
    "DeltaIITaskbarApp"="c:\windows\system32\DeltaIITray.exe" [2008-03-03 236040]
    "Adobe Reader Speed Launcher"="e:\reader\Reader_sl.exe" [2008-06-12 34672]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
    "iTunesHelper"="E:\iTunesHelper.exe" [2008-11-20 290088]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8523776]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
    "SunJavaUpdateSched"="e:\program files\bin\jusched.exe" [2008-12-18 136600]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
    "nwiz"="nwiz.exe" [2007-11-07 c:\windows\system32\nwiz.exe]

    c:\documents and settings\Munchies\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    "midi1"= ma_cmidn.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "e:\\PPStream\\PPStream.exe"=
    "e:\\PPStream\\PPSAP.exe"=
    "e:\\TVUPlayer\\TVUPlayer.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "e:\\iTunes.exe"=
    "e:\\Program Files\\mIRC\\mirc.exe"=
    "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
    "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
    "c:\\Documents and Settings\\All Users\\Application Data\\NexonEU\\NGM\\NGM.exe"=
    "e:\program files\Combat Arms EU\CombatArms.exe"= e:\program files\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
    "e:\program files\Combat Arms EU\Engine.exe"= e:\program files\Combat Arms EU\Engine.exe:*Enabled:Engine.exe
    "e:\\Program Files\\Combat Arms EU\\NMService.exe"=
    "e:\\SopCast\\adv\\SopAdver.exe"=
    "e:\\SopCast\\SopCast.exe"=
    "c:\\Program Files\\TVAnts\\Tvants.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "e:\\Program Files\\Mathematica\\Mathematica.exe"=
    "e:\\Program Files\\Mathematica\\MathKernel.exe"=
    "e:\\Program Files\\Mathematica\\math.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "56112:TCP"= 56112:TCP:Pando Media Booster
    "56112:UDP"= 56112:UDP:Pando Media Booster

    R3 DELTAII;Service for M-Audio Delta Driver (WDM);c:\windows\system32\drivers\deltaII.sys [2008-12-10 302728]
    S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-08-23 3584]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1491950412-2009852829-4049741679-1003.job
    - c:\documents and settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-12-10 20:29]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-WMPNSCFG - c:\program files\Windows Media Player\WMPNSCFG.exe


    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
    IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
    IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    LSP: c:\windows\system32\idmmbc.dll
    TCP: {FF4DC1DA-4705-4C5F-8788-C8777EE9FA62} = 208.67.222.222,208.67.220.220
    FF - ProfilePath - c:\documents and settings\Munchies\Application Data\Mozilla\Firefox\Profiles\kk03ui6e.default\
    FF - component: c:\documents and settings\Munchies\Application Data\IDM\idmmzcc2\components\idmmzcc.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonEU\NGM\npNxGameeu.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\documents and settings\Munchies\Application Data\Mozilla\Firefox\Profiles\kk03ui6e.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
    FF - plugin: c:\documents and settings\Munchies\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
    FF - plugin: e:\mozilla plugins\npitunes.dll
    FF - plugin: e:\program files\bin\new_plugin\npdeploytk.dll
    FF - plugin: e:\program files\bin\new_plugin\npjp2.dll
    FF - plugin: e:\program files\VLC\npvlc.dll
    FF - plugin: e:\reader\browser\nppdf32.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-13 18:00:33
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0a00705c-0337-41e4-857e-59516a362e20}]
    @Denied: (Full) (Everyone)
    "Model"=dword:00000026
    "Therad"=dword:00000001
    "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,fe,0b,5f,82,50,
    a3,3f,27,05,98,32,02,34,2b,da,61,f4,98,bf,a8,5f,4b,5c,c2,d0,82,9d,b6,c7,c0,\

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
    @Denied: (Full) (Everyone)
    "scansk"=hex(0):33,5f,33,8d,09,de,f2,da,ce,58,20,51,17,98,1f,57,f3,ff,5e,4b,8f,
    ef,b7,34,e9,00,fd,04,19,17,b9,b4,52,6d,48,8b,7e,d0,d2,8d,00,00,00,00,00,00,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'lsass.exe'(712)
    c:\windows\system32\idmmbc.dll
    .
    Completion time: 2009-02-13 18:01:58
    ComboFix-quarantined-files.txt 2009-02-13 18:01:39

    Pre-Run: 18,766,925,824 bytes free
    Post-Run: 18,985,951,232 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    257 --- E O F --- 2009-02-03 02:42:43






    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:13:01 PM, on 2/13/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    E:\Program Files\bin\jqs.exe
    C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Munchies\Desktop\HiJackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\DeltaIITray.exe
    O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\WINDOWS\system32\DeltaIITray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\bin\jusched.exe"
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Munchies\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\bin\jp2iexp.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FF4DC1DA-4705-4C5F-8788-C8777EE9FA62}: NameServer = 208.67.222.222,208.67.220.220
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\bin\jqs.exe
    O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 6723 bytes



    Thanks again. Spybot is now working, and there are no longer any redirects from google.

  6. #6
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    Looks better but there are some steps left


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. This should now work. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer


    Download ResetTeaTimer.bat to the Desktop (right click the link and select save)
    http://downloads.subratam.org/ResetTeaTimer.bat
    Double click ResetTeaTimer.bat to remove all entries set by TeaTimer (and preventing TeaTimer to restore them upon reactivation).


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Driver::
    NOD32FiXTemDono
    
    Folder::
    c:\documents and settings\Munchies\Application Data\uTorrent

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here. If you get a message that latest Java must be installed "enable" the Java add-ons in IE7. Do that using "manage add-ons" from the IE7 toolbar.


    Post back its report, a fresh hjt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Due to inactivity, this thread will now be closed.

    Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

    If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •