Results 1 to 4 of 4

Thread: Spybot Disabled, Unwanted browser redirects, malware for sure

  1. #1
    Junior Member
    Join Date
    Aug 2010
    Posts
    1

    Unhappy Spybot Disabled, Unwanted browser redirects, malware for sure

    I've been a user of Spybot for years and this is the first time its failed to protect me. I'm amazed that I was able to get into the forum without being redirected as when I search on any other topic I am immediately redirected to garbage sites. I believe I've followed all the pre-post instructions. Here is my DDS. Unfortunately as I am running XP sp3 on this box and I don't have a file zipper utility installed I cannot zip the other report. I have backed up my registry. Thanks in advance.
    Owner

    DDS (Ver_10-03-17.01) - NTFSx86
    Run by Owner at 12:28:09.31 on Tue 08/10/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2218 [GMT -4:00]


    ============== Running Processes ===============

    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\sttray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Verizon\McciTrayApp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    C:\Program Files\Sigaba\SigabaSecure\OutlookExpress\sigoetray.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    C:\Program Files\Password Safe\pwsafe.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\STacSV.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NUET49U2\dds[1].scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 10\SnagitBHO.dll
    BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - c:\program files\lastpass\LPBar.dll
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
    TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS4/contributeieplugin.dll
    TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 10\SnagitIEAddin.dll
    TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dll
    TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [AdobeBridge] "c:\program files\adobe\adobe bridge cs4\Bridge.exe" -stealth
    mRun: [SigmatelSysTrayApp] sttray.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
    mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
    mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
    mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
    mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~2\server\bin\VERSIO~2.EXE
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    StartupFolder: c:\docume~1\Owner~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\Owner~1\startm~1\programs\startup\passwo~1.lnk - c:\program files\password safe\pwsafe.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\secure~1.lnk - c:\program files\sigaba\sigabasecure\outlookexpress\sigoetray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
    IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
    IE: LastPass - file://c:\program files\lastpass\context.html?cmd=lastpass
    IE: LastPass Fill Forms - file://c:\program files\lastpass\context.html?cmd=fillforms
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238251092606
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\Owner~1\applic~1\mozilla\firefox\profiles\rjgrleqn.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
    FF - component: c:\documents and settings\Owner converse\application data\mozilla\firefox\profiles\rjgrleqn.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
    FF - component: c:\documents and settings\Owner converse\application data\mozilla\firefox\profiles\rjgrleqn.default\extensions\support@lastpass.com\platform\winnt_x86-msvc\components\lpxpcom.dll
    FF - plugin: c:\documents and settings\Owner converse\application data\facebook\npfbplugin_1_0_3.dll
    FF - plugin: c:\program files\common files\motive\npMotive.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    ---- FIREFOX POLICIES ----
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

    ============= SERVICES / DRIVERS ===============

    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-8 64288]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1352832]
    R2 QuickBooksDB17;QuickBooksDB17;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb17 --> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB17 [?]
    R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-2-26 110592]
    R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-3-18 11520]
    S1 cfslmqfu;cfslmqfu;\??\c:\windows\system32\drivers\cfslmqfu.sys --> c:\windows\system32\drivers\cfslmqfu.sys [?]
    S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 288112]

    =============== Created Last 30 ================

    2010-08-10 15:20:43 0 d-----w- c:\windows\system32\wbem\Repository
    2010-08-10 15:04:28 0 d-----w- c:\program files\VSO
    2010-08-10 14:54:17 0 d-----w- c:\docume~1\Owner~1\applic~1\Philipp Winterberg
    2010-08-10 14:54:13 0 d-----w- c:\program files\Free RAR Extract Frog
    2010-08-07 12:29:19 8056520 ----a-w- c:\program files\common files\lpuninstall.exe
    2010-08-07 12:29:18 0 d-----w- c:\program files\LastPass
    2010-08-07 12:08:16 0 d-----w- c:\docume~1\Owner~1\applic~1\FireShot
    2010-08-07 11:15:58 0 d-----w- c:\program files\VideoLAN
    2010-08-07 11:08:32 0 d-----w- C:\DECCHECK
    2010-08-05 12:19:25 0 d-----w- c:\program files\Super_DVD_Creator_9.8
    2010-08-05 10:30:15 0 d-----w- c:\docume~1\Owner~1\applic~1\Sony Creative Software Inc
    2010-08-05 10:26:23 0 d-----w- c:\program files\Sony
    2010-07-29 14:34:35 0 d-----w- c:\program files\common files\Wise Installation Wizard
    2010-07-20 14:00:36 0 d-----w- c:\program files\ClipArt
    2010-07-20 13:59:04 0 d-----w- c:\program files\docs
    2010-07-20 13:59:01 0 d-----w- c:\program files\Symbols
    2010-07-20 13:58:58 0 d-----w- c:\program files\common files\SureThing Shared
    2010-07-20 13:58:57 0 d-----w- c:\windows\MVUNINST
    2010-07-20 13:58:57 0 d-----w- c:\program files\STCD
    2010-07-17 11:50:47 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

    ==================== Find3M ====================

    2010-08-08 15:04:25 231021 ----a-w- c:\windows\fonts\AdobeFnt11.lst
    2010-06-24 13:48:37 88656 ----a-w- c:\windows\fonts\DidotLTStd-Italic.ttf
    2010-06-24 13:48:19 135904 ----a-w- c:\windows\fonts\DidotLTStd-Roman.ttf
    2010-06-24 13:48:04 108232 ----a-w- c:\windows\fonts\DidotLTStd-Headline.ttf
    2010-06-24 13:47:05 51004 ----a-w- c:\windows\fonts\AkzidenzGroteskBE-Bold.ttf
    2010-06-24 13:46:47 50192 ----a-w- c:\windows\fonts\AkzidenzGroteskBE-Light.ttf
    2010-06-24 13:45:23 50940 ----a-w- c:\windows\fonts\Univers(10)
    2010-06-24 13:44:54 53164 ----a-w- c:\windows\fonts\Univers(9)
    2010-06-24 13:44:36 66396 ----a-w- c:\windows\fonts\Univers(8)
    2010-06-24 13:43:56 50548 ----a-w- c:\windows\fonts\Univers(7)
    2010-06-24 13:43:26 66704 ----a-w- c:\windows\fonts\Univers(6)
    2010-06-24 13:43:08 70972 ----a-w- c:\windows\fonts\Univers(5)
    2010-06-24 13:42:46 84556 ----a-w- c:\windows\fonts\Univers(4)
    2010-06-24 13:42:29 85620 ----a-w- c:\windows\fonts\Univers(3)
    2010-06-24 13:42:14 45516 ----a-w- c:\windows\fonts\Univers(2)
    2010-06-24 13:40:33 71264 ----a-w- c:\windows\fonts\Trajan(2)
    2010-06-24 13:40:18 71396 ----a-w- c:\windows\fonts\Trajan
    2010-06-24 13:36:55 38860 ----a-w- c:\windows\fonts\Futura(15)
    2010-06-24 13:36:38 38596 ----a-w- c:\windows\fonts\Futura(14)
    2010-06-24 13:36:21 45784 ----a-w- c:\windows\fonts\Futura(13)
    2010-06-24 13:36:02 38788 ----a-w- c:\windows\fonts\Futura(12)
    2010-06-24 13:35:44 44592 ----a-w- c:\windows\fonts\Futura(11)
    2010-06-24 13:35:29 38764 ----a-w- c:\windows\fonts\Futura(10)
    2010-06-24 13:35:12 62188 ----a-w- c:\windows\fonts\Futura(9)
    2010-06-24 13:35:01 75732 ----a-w- c:\windows\fonts\Futura(8)
    2010-06-24 13:34:42 65612 ----a-w- c:\windows\fonts\Futura(7)
    2010-06-24 13:34:09 38040 ----a-w- c:\windows\fonts\Futura(5)
    2010-06-24 13:33:55 37272 ----a-w- c:\windows\fonts\Futura(4)
    2010-06-24 13:33:40 37008 ----a-w- c:\windows\fonts\Futura(3)
    2010-06-24 13:33:25 34924 ----a-w- c:\windows\fonts\Futura(2)
    2010-06-24 13:33:08 35356 ----a-w- c:\windows\fonts\Futura
    2010-06-24 13:28:42 56876 ----a-w- c:\windows\fonts\Frutiger(10)
    2010-06-24 13:28:13 47836 ----a-w- c:\windows\fonts\Frutiger(9)
    2010-06-24 13:27:47 42856 ----a-w- c:\windows\fonts\Frutiger(8)
    2010-06-24 13:27:18 57056 ----a-w- c:\windows\fonts\Frutiger(7)
    2010-06-24 13:27:04 40884 ----a-w- c:\windows\fonts\Frutiger(6)
    2010-06-24 13:26:45 56284 ----a-w- c:\windows\fonts\Frutiger(5)
    2010-06-24 13:26:28 57364 ----a-w- c:\windows\fonts\Frutiger(4)
    2010-06-24 13:26:01 89772 ----a-w- c:\windows\fonts\Frutiger(3)
    2010-06-24 13:22:08 40784 ----a-w- c:\windows\fonts\Frutiger
    2010-06-24 13:21:27 79212 ----a-w- c:\windows\fonts\Trade(8)
    2010-06-24 13:21:06 69592 ----a-w- c:\windows\fonts\Trade(7)
    2010-06-24 13:20:47 82036 ----a-w- c:\windows\fonts\Trade(6)
    2010-06-24 13:20:30 70748 ----a-w- c:\windows\fonts\Trade(5)
    2010-06-24 13:20:14 75292 ----a-w- c:\windows\fonts\Trade(4)
    2010-06-24 13:19:26 77384 ----a-w- c:\windows\fonts\Trade(2)
    2010-06-24 13:14:51 39084 ----a-w- c:\windows\fonts\Humanist(14)
    2010-06-24 13:14:31 37764 ----a-w- c:\windows\fonts\Humanist(13)
    2010-06-24 13:14:10 40352 ----a-w- c:\windows\fonts\Humanist(12)
    2010-06-24 13:13:32 41040 ----a-w- c:\windows\fonts\Humanist(11)
    2010-06-24 13:13:12 35340 ----a-w- c:\windows\fonts\Humanist(10)
    2010-06-24 13:12:54 35052 ----a-w- c:\windows\fonts\Humanist(9)
    2010-06-24 13:12:38 38316 ----a-w- c:\windows\fonts\Humanist(8)
    2010-06-24 13:12:22 36516 ----a-w- c:\windows\fonts\Humanist(7)
    2010-06-24 13:11:44 35468 ----a-w- c:\windows\fonts\Humanist(6)
    2010-06-24 13:11:22 34428 ----a-w- c:\windows\fonts\Humanist(5)
    2010-06-24 13:10:43 35872 ----a-w- c:\windows\fonts\Humanist(3)
    2010-06-24 13:10:26 38124 ----a-w- c:\windows\fonts\Humanist(2)
    2010-06-24 13:07:38 39568 ----a-w- c:\windows\fonts\HelveticaNeue(4)
    2010-06-24 13:07:14 39656 ----a-w- c:\windows\fonts\HelveticaNeue(3)
    2010-06-24 13:06:30 40104 ----a-w- c:\windows\fonts\HelveticaNeue
    2010-06-24 13:06:12 73176 ----a-w- c:\windows\fonts\Helvetica(2)
    2010-06-24 13:05:54 51624 ----a-w- c:\windows\fonts\Helvetica
    2010-06-24 13:05:05 72496 ----a-w- c:\windows\fonts\Minion(4)
    2010-06-24 13:04:07 104588 ----a-w- c:\windows\fonts\Minion(3)
    2010-06-24 13:03:29 98996 ----a-w- c:\windows\fonts\Minion(2)
    2010-06-24 13:03:11 112712 ----a-w- c:\windows\fonts\Minion
    2010-06-24 13:01:06 83084 ----a-w- c:\windows\fonts\Bell(4)
    2010-06-24 13:00:45 37160 ----a-w- c:\windows\fonts\Bell(3)
    2010-06-24 13:00:24 36372 ----a-w- c:\windows\fonts\Bell(2)
    2010-06-24 12:52:22 70240 ----a-w- c:\windows\fonts\Trade
    2010-06-24 11:46:49 150804 ----a-w- c:\windows\fonts\DroidSans-Bold.ttf
    2010-06-24 11:46:49 149076 ----a-w- c:\windows\fonts\DroidSans.ttf
    2010-06-24 11:45:38 95616 ----a-w- c:\windows\fonts\AllerDisplay.ttf
    2010-06-24 11:45:38 134436 ----a-w- c:\windows\fonts\Aller_Rg.ttf
    2010-06-24 11:45:38 132780 ----a-w- c:\windows\fonts\Aller_Lt.ttf
    2010-06-24 11:45:38 123556 ----a-w- c:\windows\fonts\Aller_BdIt.ttf
    2010-06-24 11:45:38 122296 ----a-w- c:\windows\fonts\Aller_LtIt.ttf
    2010-06-24 11:45:38 120876 ----a-w- c:\windows\fonts\Aller_It.ttf
    2010-06-24 11:45:37 128368 ----a-w- c:\windows\fonts\Aller_Bd.ttf
    2010-06-24 11:43:15 62196 ----a-w- c:\windows\fonts\GeosansLight-Oblique.ttf
    2010-06-24 11:43:15 60072 ----a-w- c:\windows\fonts\GeosansLight.ttf
    2010-06-24 11:42:52 80460 ----a-w- c:\windows\fonts\mentone-semibol.otf
    2010-06-24 11:42:30 52752 ----a-w- c:\windows\fonts\centabel.ttf
    2010-06-24 11:42:07 83160 ----a-w- c:\windows\fonts\DAYROM__.ttf
    2010-06-24 11:42:07 63035 ----a-w- c:\windows\fonts\TLDPR2.jpg
    2010-06-24 11:42:07 61529 ----a-w- c:\windows\fonts\TLDPR5.jpg
    2010-06-24 11:42:07 57839 ----a-w- c:\windows\fonts\TLDPR1.jpg
    2010-06-24 11:42:07 5707 ----a-w- c:\windows\fonts\DAY-O.txt
    2010-06-24 11:42:07 30088 ----a-w- c:\windows\fonts\DAYROM_X.ttf
    2010-06-24 11:42:07 19005 ----a-w- c:\windows\fonts\TLDPR4.jpg
    2010-06-24 11:42:07 14708 ----a-w- c:\windows\fonts\TLDPR3.jpg
    2010-06-24 11:41:40 128936 ----a-w- c:\windows\fonts\KIN668.TTF
    2010-06-24 11:19:18 21764 ----a-w- c:\windows\fonts\SLANT.TTF
    2010-06-24 11:18:54 9850 ----a-w- c:\windows\fonts\read_me.html
    2010-06-24 11:18:54 55820 ----a-w- c:\windows\fonts\bluehigh.ttf
    2010-06-24 11:18:54 52456 ----a-w- c:\windows\fonts\bluecond.ttf
    2010-06-24 11:18:54 51728 ----a-w- c:\windows\fonts\bluebold.ttf
    2010-06-24 11:18:54 41460 ----a-w- c:\windows\fonts\BLUEHIGD.TTF
    2010-06-24 11:18:54 34884 ----a-w- c:\windows\fonts\bluehigl.ttf
    2009-06-28 23:01:57 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat
    2009-06-28 23:01:48 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009062820090629\index.dat
    2009-06-28 23:01:57 32768 --sha-w- c:\windows\system32\config\systemprofile\privacie\index.dat

    ============= FINISH: 12:29:18.29 ===============
    Last edited by tashi; 2010-08-10 at 20:55. Reason: Changed real name to "Owner" please check logs before posting, as per FAQ. :-)

  2. #2
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    Hello and welcome to Safer Networking.

    My name is km2357 and I will be helping you to remove any infection(s) that you may have.

    I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

    If for any reason you do not understand an instruction or are just unsure then please do not guess, simply post back with your questions/concerns and we will go through it again.

    Please do not start another thread or topic, I will assist you at this thread until we solve your problems.

    Lastly the fix may take several attempts and my replies may take some time but I will stick with it if you do the same.

    Sorry for the delay in replying, the forum is very busy. If you still need help, please do the following:


    Step # 1 Download and run DDS

    Download DDS and save it to your desktop from here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.




    Step # 2: Download and Run Gmer

    Please download gmer.zip from Gmer and save it to your desktop.

    ***Please close any open programs ***

    Double-click gmer.exe. The program will begin to run.

    **Caution**
    These types of scans can produce false positives. Do NOT take any action on any "<--- ROOTKIT" entries unless advised by a trained Security Analyst


    If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

    If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure that the 'Sections' button is ticked and the 'Show All' button is unticked.
    • Click the Scan button and let the program do its work. GMER will produce a log.
    • Once the scan is complete, you may receive another notice about rootkit activity.
    • Click OK.
    • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.


    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

    Please post the results from the GMER scan in your reply.


    In your next post/reply, I need to see the following:

    1. The two DDS Logs (DDS and Attach.txt)
    2. The GMER Log

    Use multiple posts if you can't fit everything into one post
    Malware Removal University Master
    Member of ASAP & UNITE

  3. #3
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    thechairman? Do you still need help?
    Malware Removal University Master
    Member of ASAP & UNITE

  4. #4
    Emeritus
    Join Date
    Aug 2007
    Posts
    1,875

    Default

    This topic has been archived due to inactivity.

    If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a new HijackThis log with a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

    Applies only to the original poster, anyone else with similar problems please start a new topic.
    Malware Removal University Master
    Member of ASAP & UNITE

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •