Results 1 to 1 of 1

Thread: Click.giftload

  1. #1
    Junior Member
    Join Date
    Apr 2011
    Posts
    1

    Default Click.giftload

    Hello. So, like most people, I have already run most of the software not recommended to be run unless told otherwise. This includes software from this site, and software from Malwarebytes website. These programs include eXplorer.exe, Combofix, Dial-a-fix, TDSSKiller, and Hijackthis.

    For the most part, I feel I got rid of everything, but my browser is acting a little funny, and I'd just like to be certain.

    Currently, neither Malwarebytes, Spybot, or Hijackthis detect any known infections.

    Also, every time i ran combofix, it detected that AVG RT scanner was still installed, I LOOKED EVERYWHERE for it, and even used the special AVG removal tool and it still detects it. Its not under processes, regedit or in the programfiles directory.
    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Mario's at 16:08:14.84 on Fri 04/22/2011
    Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3292.2378 [GMT -7:00]
    .
    AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\Intuit\Entitlement Client\v6.0\Server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Intel\AMT\LMS.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\AVAST Software\Avast\avastUI.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
    C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\Documents and Settings\Mario's\My Documents\Downloads\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    mStart Page = hxxp://www.dell.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    mURLSearchHooks: H - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
    mRun: [picon] "c:\program files\common files\intel\privacy icon\PIconStartup.exe" -startup
    mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [ADUserMon] c:\program files\iomega\autodisk\ADUserMon.exe
    mRun: [Iomega Drive Icons] c:\program files\iomega\driveicons\ImgIcon.exe
    mRun: [Deskup] c:\program files\iomega\driveicons\deskup.exe /IMGSTART
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [DAEMON Tools-1033] "c:\program files\d-tools\daemon.exe" -lang 1033
    mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tdmnot~1.lnk - c:\program files\wave systems corp\trusted drive manager\TdmNotify.exe
    uPolicies-explorer: RestrictRun = 0 (0x0)
    mPolicies-explorer: RestrictRun = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    Handler: qbpos - {662E7FAE-5C17-491C-AD9D-98C1F66CC6A0} - c:\program files\common files\intuit\quickbooks\QBPOSProtocol.dll
    Notify: igfxcui - igfxdev.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\mario's\applic~1\mozilla\firefox\profiles\4x8jpuiu.default\
    FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2010-3-26 24064]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-17 441176]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-17 307288]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-17 19544]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-4-17 42184]
    R2 Intuit Entitlement Service v6.0;Intuit Entitlement Service v6.0;c:\program files\common files\intuit\entitlement client\v6.0\server\Intuit.Spc.Map.EntitlementClient.Server.Service.exe [2009-6-2 20480]
    R2 QBPOSDBServiceV9;QBPOS Database Manager v9;c:\program files\intuit\quickbooks point of sale 9.0\databaseserver\QBPOSDBService.exe [2010-10-4 2735992]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\common files\intel\privacy icon\uns\UNS.exe [2010-3-26 2066968]
    R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2010-3-26 166568]
    S0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys --> c:\windows\system32\drivers\d347bus.sys [?]
    S0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys --> c:\windows\system32\drivers\d347prt.sys [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]
    .
    =============== Created Last 30 ================
    .
    2011-04-19 00:22:15 -------- d-s---w- C:\ComboFix
    2011-04-19 00:18:21 -------- d-----w- C:\AVGTemp
    2011-04-18 22:05:21 -------- d-----w- c:\windows\ServicePackFiles
    2011-04-18 19:27:52 -------- d-----w- c:\docume~1\mario's\locals~1\applic~1\Deployment
    2011-04-17 23:01:56 -------- d-----w- c:\windows\system32\CatRoot2
    2011-04-17 22:45:55 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-04-17 22:45:44 40112 ----a-w- c:\windows\avastSS.scr
    2011-04-17 22:45:37 -------- d-----w- c:\program files\AVAST Software
    2011-04-16 22:53:42 -------- d-----w- c:\program files\Phyxion.net
    2011-04-14 19:43:56 -------- d-----w- c:\program files\ESET
    2011-04-14 18:19:51 -------- d-sha-r- C:\cmdcons
    2011-04-14 18:13:39 98816 ----a-w- c:\windows\sed.exe
    2011-04-14 18:13:39 89088 ----a-w- c:\windows\MBR.exe
    2011-04-14 18:13:39 256512 ----a-w- c:\windows\PEV.exe
    2011-04-14 18:13:39 161792 ----a-w- c:\windows\SWREG.exe
    2011-04-11 19:04:37 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-04-11 19:04:37 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-04-10 22:34:45 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVAST Software
    2011-04-10 21:44:55 -------- d-----w- c:\windows\system32\appmgmt
    2011-04-10 19:07:22 -------- d-----w- c:\program files\Fastcar
    2011-04-09 19:46:03 -------- d-----w- C:\Temp
    2011-03-26 18:19:36 -------- d-----w- c:\program files\D-Tools
    2011-03-26 17:37:07 -------- d-----w- c:\docume~1\mario's\locals~1\applic~1\uTorrentBar
    2011-03-26 17:37:07 -------- d-----w- c:\docume~1\mario's\locals~1\applic~1\Conduit
    2011-03-26 17:37:01 -------- d-----w- c:\program files\uTorrentBar
    2011-03-26 17:37:01 -------- d-----w- c:\docume~1\mario's\locals~1\applic~1\Temp
    2011-03-26 17:36:55 -------- d-----w- c:\program files\uTorrent
    2011-03-26 17:36:26 -------- d-----w- c:\docume~1\mario's\applic~1\uTorrent
    .
    ==================== Find3M ====================
    .
    2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-03-04 06:45:07 434176 ----a-w- c:\windows\system32\vbscript.dll
    2011-03-03 13:27:43 1866880 ----a-w- c:\windows\system32\win32k.sys
    2011-02-17 13:51:57 81920 ----a-w- c:\windows\system32\ieencode.dll
    2011-02-17 13:51:57 667136 ----a-w- c:\windows\system32\wininet.dll
    2011-02-17 13:51:57 61952 ----a-w- c:\windows\system32\tdc.ocx
    2011-02-17 12:37:38 369664 ----a-w- c:\windows\system32\html.iec
    2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll
    2011-02-11 13:25:52 229888 ----a-w- c:\windows\system32\fxscover.exe
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-08 13:33:55 978944 ----a-w- c:\windows\system32\mfc42.dll
    2011-02-08 13:33:55 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2011-02-04 21:14:11 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2011-02-04 21:14:11 348160 ----a-w- c:\windows\system32\msvcr71.dll
    .
    ============= FINISH: 16:09:02.03 ===============
    Last edited by tashi; 2011-04-23 at 08:40. Reason: Copy pasted log into topic

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •