Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
02-Sep-2010, 09:08 PM
#1 | |||||
| Help getting rid of Clicksor |
| |
04-Sep-2010, 12:26 AM
#2 | |||||
| |
05-Sep-2010, 11:56 PM
#3 | |||||
| Nobody? I'm hoping it's because of the holiday weekend in the US and not the fact that nobody can help me.  |
06-Sep-2010, 06:53 AM
#4 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
06-Sep-2010, 04:32 PM
#5 | |||||
| |
06-Sep-2010, 07:49 PM
#6 | |||||
| I got Combo Fix to run. I had to rename it to KomboFix.exe. It was just hanging before. The problems are still there, with Clicksor ads popping up on nearly every site I visit. Here are the contents of ComboFix.txt: ComboFix 10-09-06.03 - Administrator 09/06/2010 14:45:44.2.2 - x86 NETWORK Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1731 [GMT -7:00] Running from: c:\documents and settings\Administrator\Desktop\KomboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\g2mdlhlpx.exe C:\Thumbs.db c:\windows\system32\fonts c:\windows\system32\fonts\a010013l.afm c:\windows\system32\fonts\a010013l.pfb c:\windows\system32\fonts\a010013l.pfm c:\windows\system32\fonts\a010015l.afm c:\windows\system32\fonts\a010015l.pfb c:\windows\system32\fonts\a010015l.pfm c:\windows\system32\fonts\a010033l.afm c:\windows\system32\fonts\a010033l.pfb c:\windows\system32\fonts\a010033l.pfm c:\windows\system32\fonts\a010035l.afm c:\windows\system32\fonts\a010035l.pfb c:\windows\system32\fonts\a010035l.pfm c:\windows\system32\fonts\b018012l.afm c:\windows\system32\fonts\b018012l.pfb c:\windows\system32\fonts\b018012l.pfm c:\windows\system32\fonts\b018015l.afm c:\windows\system32\fonts\b018015l.pfb c:\windows\system32\fonts\b018015l.pfm c:\windows\system32\fonts\b018032l.afm c:\windows\system32\fonts\b018032l.pfb c:\windows\system32\fonts\b018032l.pfm c:\windows\system32\fonts\b018035l.afm c:\windows\system32\fonts\b018035l.pfb c:\windows\system32\fonts\b018035l.pfm c:\windows\system32\fonts\c059013l.afm c:\windows\system32\fonts\c059013l.pfb c:\windows\system32\fonts\c059013l.pfm c:\windows\system32\fonts\c059016l.afm c:\windows\system32\fonts\c059016l.pfb c:\windows\system32\fonts\c059016l.pfm c:\windows\system32\fonts\c059033l.afm c:\windows\system32\fonts\c059033l.pfb c:\windows\system32\fonts\c059033l.pfm c:\windows\system32\fonts\c059036l.afm c:\windows\system32\fonts\c059036l.pfb c:\windows\system32\fonts\c059036l.pfm c:\windows\system32\fonts\d050000l.afm c:\windows\system32\fonts\d050000l.pfb c:\windows\system32\fonts\d050000l.pfm c:\windows\system32\fonts\fonts.dir c:\windows\system32\fonts\fonts.scale c:\windows\system32\fonts\n019003l.afm c:\windows\system32\fonts\n019003l.pfb c:\windows\system32\fonts\n019003l.pfm c:\windows\system32\fonts\n019004l.afm c:\windows\system32\fonts\n019004l.pfb c:\windows\system32\fonts\n019004l.pfm c:\windows\system32\fonts\n019023l.afm c:\windows\system32\fonts\n019023l.pfb c:\windows\system32\fonts\n019023l.pfm c:\windows\system32\fonts\n019024l.afm c:\windows\system32\fonts\n019024l.pfb c:\windows\system32\fonts\n019024l.pfm c:\windows\system32\fonts\n019043l.afm c:\windows\system32\fonts\n019043l.pfb c:\windows\system32\fonts\n019043l.pfm c:\windows\system32\fonts\n019044l.afm c:\windows\system32\fonts\n019044l.pfb c:\windows\system32\fonts\n019044l.pfm c:\windows\system32\fonts\n019063l.afm c:\windows\system32\fonts\n019063l.pfb c:\windows\system32\fonts\n019063l.pfm c:\windows\system32\fonts\n019064l.afm c:\windows\system32\fonts\n019064l.pfb c:\windows\system32\fonts\n019064l.pfm c:\windows\system32\fonts\n021003l.afm c:\windows\system32\fonts\n021003l.pfb c:\windows\system32\fonts\n021003l.pfm c:\windows\system32\fonts\n021004l.afm c:\windows\system32\fonts\n021004l.pfb c:\windows\system32\fonts\n021004l.pfm c:\windows\system32\fonts\n021023l.afm c:\windows\system32\fonts\n021023l.pfb c:\windows\system32\fonts\n021023l.pfm c:\windows\system32\fonts\n021024l.afm c:\windows\system32\fonts\n021024l.pfb c:\windows\system32\fonts\n021024l.pfm c:\windows\system32\fonts\n022003l.afm c:\windows\system32\fonts\n022003l.pfb c:\windows\system32\fonts\n022003l.pfm c:\windows\system32\fonts\n022004l.afm c:\windows\system32\fonts\n022004l.pfb c:\windows\system32\fonts\n022004l.pfm c:\windows\system32\fonts\n022023l.afm c:\windows\system32\fonts\n022023l.pfb c:\windows\system32\fonts\n022023l.pfm c:\windows\system32\fonts\n022024l.afm c:\windows\system32\fonts\n022024l.pfb c:\windows\system32\fonts\n022024l.pfm c:\windows\system32\fonts\p052003l.afm c:\windows\system32\fonts\p052003l.pfb c:\windows\system32\fonts\p052003l.pfm c:\windows\system32\fonts\p052004l.afm c:\windows\system32\fonts\p052004l.pfb c:\windows\system32\fonts\p052004l.pfm c:\windows\system32\fonts\p052023l.afm c:\windows\system32\fonts\p052023l.pfb c:\windows\system32\fonts\p052023l.pfm c:\windows\system32\fonts\p052024l.afm c:\windows\system32\fonts\p052024l.pfb c:\windows\system32\fonts\p052024l.pfm c:\windows\system32\fonts\s050000l.afm c:\windows\system32\fonts\s050000l.pfb c:\windows\system32\fonts\s050000l.pfm c:\windows\system32\fonts\uninstal.txt c:\windows\system32\fonts\z003034l.afm c:\windows\system32\fonts\z003034l.pfb c:\windows\system32\fonts\z003034l.pfm c:\windows\system32\lsprst7.dll c:\windows\system32\nsprs.dll c:\windows\system32\tmp.reg c:\windows\system32\tmpPrst.dll Infected copy of c:\windows\system32\drivers\pci.sys was found and disinfected Restored copy from - Kitty had a snack  . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINDRIVER -------\Service_WinDriver -------\Legacy_glaide32 ((((((((((((((((((((((((( Files Created from 2010-08-06 to 2010-09-06 ))))))))))))))))))))))))))))))) . 2010-09-06 21:53 . 2010-09-06 22:00 -------- d-----w- c:\windows\LastGood 2010-09-06 21:52 . 2010-09-06 22:07 0 ----a-w- c:\windows\system32\lsprst7.dll 2010-09-06 21:52 . 2010-09-06 21:52 73 ----a-w- c:\windows\system32\nsprs.dll 2010-09-06 21:52 . 2010-09-06 21:52 0 ----a-w- c:\windows\system32\tmpPrst.dll 2010-09-06 20:15 . 2010-09-06 21:11 -------- d-----w- C:\KomboFix 2010-09-06 07:09 . 2010-09-06 07:09 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\PCHealth 2010-09-06 03:11 . 2010-05-21 21:14 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-09-06 03:00 . 2010-09-06 03:00 -------- d-----w- c:\program files\Windows Defender 2010-09-04 06:58 . 2010-08-12 12:15 15880 ----a-w- c:\windows\system32\lsdelete.exe 2010-09-04 04:20 . 2010-08-12 12:15 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys 2010-09-04 04:19 . 2010-09-04 04:19 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-09-04 03:49 . 2010-09-04 03:49 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Sunbelt Software 2010-09-04 03:48 . 2010-09-04 03:48 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70} 2010-09-02 22:59 . 2010-07-17 12:00 423656 ----a-w- c:\windows\system32\deployJava1.dll 2010-09-02 18:41 . 2010-09-02 18:41 -------- d-----w- c:\program files\Trend Micro 2010-09-01 22:49 . 2010-09-01 22:49 -------- d-----w- c:\windows\system32\wbem\Repository 2010-09-01 22:48 . 2010-09-01 22:48 -------- d-----w- c:\program files\Realtek AC97 2010-08-27 16:11 . 2010-09-01 22:48 -------- d-----w- c:\program files\Realtek AC97(2) 2010-08-14 07:09 . 2010-08-14 07:15 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet 2010-08-14 06:35 . 2010-08-14 06:35 -------- d-----w- c:\program files\Adobe Media Player 2010-08-14 06:32 . 2010-08-14 06:32 -------- d-----w- c:\program files\Common Files\Adobe AIR 2010-08-14 06:25 . 2010-08-14 06:25 -------- d-----w- c:\program files\Common Files\Macrovision Shared . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-06 21:52 . 2005-05-02 22:45 342 ----a-w- c:\windows\system32\tablet.dat 2010-09-06 04:50 . 2008-05-15 02:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2010-09-06 02:34 . 2010-01-06 03:54 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype 2010-09-06 00:50 . 2010-01-06 03:56 -------- d-----w- c:\documents and settings\Administrator\Application Data\skypePM 2010-09-06 00:50 . 2009-09-15 07:23 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs 2010-09-06 00:49 . 2009-09-15 07:23 0 ----a-w- c:\windows\system32\drivers\logiflt.iad 2010-09-04 18:49 . 2006-06-14 07:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-09-04 03:48 . 2008-12-26 03:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-09-04 03:48 . 2006-06-14 07:13 -------- d-----w- c:\program files\Lavasoft 2010-09-04 03:48 . 2005-01-20 19:50 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2010-09-03 02:19 . 2009-09-17 07:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero 2010-09-03 02:19 . 2009-09-17 07:18 -------- d-----w- c:\program files\Common Files\Nero 2010-09-03 02:12 . 2009-09-17 07:18 -------- d-----w- c:\program files\Nero 2010-09-03 02:10 . 2009-08-27 07:13 -------- d-----w- c:\program files\EA Games 2010-09-02 22:59 . 2005-10-03 20:10 -------- d-----w- c:\program files\Common Files\Java 2010-09-02 22:59 . 2005-10-03 20:11 -------- d-----w- c:\program files\Java 2010-09-02 19:53 . 2008-12-26 03:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-09-02 18:38 . 2005-05-03 23:10 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic 2010-09-02 18:35 . 2008-12-20 07:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-09-02 05:22 . 2006-06-14 07:28 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-08-24 07:03 . 2005-04-23 15:29 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-08-19 01:38 . 2009-12-06 06:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sony Online Entertainment 2010-08-14 07:10 . 2005-01-20 19:47 56192 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-14 06:48 . 2005-04-29 21:05 -------- d-----w- c:\program files\Common Files\Adobe 2010-08-12 03:59 . 2009-05-15 04:08 -------- d-----w- c:\program files\PAP40 2010-07-23 14:55 . 2009-09-17 07:33 -------- d-----w- c:\program files\YouTube Downloader 2010-07-15 15:36 . 2009-08-25 05:04 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-07-15 15:36 . 2010-07-15 15:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll 2010-07-15 15:35 . 2009-08-25 05:04 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2003-05-08 16:16 . 2005-12-18 03:44 811520 ----a-w- c:\program files\mayaNetRenderClent.exe 2003-05-08 14:32 . 2005-12-18 03:44 869376 ----a-w- c:\program files\mayaNetRenderServer.exe 2006-10-31 15:58 . 2006-10-31 15:58 13386 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll 2006-10-31 15:58 . 2006-10-31 15:58 92746 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-06-03 251240] "Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 577536] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-23 116040] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432] "Ask and Record FLV Service"="c:\program files\Ask & Record Toolbar\FLVSrvc.exe" [2009-03-10 156672] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760] "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-04 7204864] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] Alias SketchBook Snapshot.lnk - c:\program files\Alias\Alias SketchBook Pro 1.1\AliasSketchSnap.exe [2005-1-17 225280] Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2007-9-1 114688] TabUserW.exe.lnk - c:\windows\system32\Wtablet\TabUserW.exe [2003-12-4 77824] VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2008-9-17 6144] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2010-07-15 15:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux2"=wdmaud.sys [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawser vice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavaso ft Ad-Aware Service] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXES VC] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDef end] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Alias SketchBook Snapshot.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Alias SketchBook Snapshot.lnk backup=c:\windows\pss\Alias SketchBook Snapshot.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CarboniteSetupLite] 2009-08-04 08:49 318096 ----a-w- c:\program files\Carbonite\CarbonitePreinstaller.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2003-08-04 22:28 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2008-07-30 17:47 289064 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 15:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] 2005-11-04 16:38 7204864 ----a-w- c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] 2005-11-04 16:38 86016 ----a-w- c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] 2005-11-04 16:38 1519616 ----a-w- c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2005-06-03 07:52 36975 ----a-w- c:\program files\Java\jre1.5.0_04\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] 2005-05-26 17:59 100056 ----a-w- c:\progra~1\SYMNET~1\SNDMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SmartFTP\\SmartFTP.exe"= "c:\\Program Files\\Flash MX\\Flash.exe"= "c:\\Documents and Settings\\Administrator\\Desktop\\NDRServer.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\Next Limit\\RealFlow4\\realflow.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Autodesk\\Maya2008\\bin\\maya.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= "c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Autodesk\\Maya2009\\bin\\maya.exe"= "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"= "c:\\UT2004\\System\\UT2004.exe"= "c:\\Documents and Settings\\Administrator\\Application Data\\Sony Online Entertainment\\Installed Games\\Clone Wars\\CloneWars.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Glob allyOpenPorts\List] "5353:TCP"= 5353:TCP:Adobe CSI CS4 R0 amdagp8p;AMD NB AGP Bus Filter;c:\windows\system32\drivers\amdagp8p.sys [1/20/2005 12:52 PM 27648] R0 amdbusdr;amdbusdr;c:\windows\system32\drivers\AmdBusDr.sys [1/20/2005 12:53 PM 29696] R0 AMDEIDE;AMD EIDE Driver;c:\windows\system32\drivers\AmdEide.sys [1/20/2005 12:53 PM 38400] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/3/2010 9:20 PM 64288] R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/23/2009 12:42 PM 207280] R0 si3114;SiI-3114 SATALink Controller;c:\windows\system32\drivers\si3114.sys [9/3/2003 5:05 AM 54872] R0 SiWinAcc;SiWinAcc;c:\windows\system32\drivers\SiWinAcc.sys [6/9/2003 10:56 AM 10112] R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/24/2009 10:04 PM 216400] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/24/2009 10:04 PM 243024] R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 8:36 AM 308136] R2 IPMI_Driver;IPMI_Driver;c:\windows\system32\drivers\ipmidrv.sys [1/20/2005 2:00 PM 8064] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [10/23/2009 12:42 PM 358600] R2 SentinelLM;SentinelLM;c:\program files\Rainbow Technologies\SentinelLM 7.2.0 Server\English\lservnt.exe [2/23/2007 12:12 PM 675840] R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [6/3/2009 5:46 AM 92008] R2 TSMDataEngine;TSMDataEngine;c:\program files\Tyan Computer Corp\Tyan System Monitor Server Agent\TSMDataEngine.exe [1/20/2005 2:00 PM 98304] R2 tyansmb;tyansmb;c:\windows\system32\drivers\tyansmb.sys [1/20/2005 2:00 PM 15103] S1 7f3bf97f;7f3bf97f;c:\windows\system32\drivers\7f3bf97f.sys --> c:\windows\system32\drivers\7f3bf97f.sys [?] S1 a6e0d940;a6e0d940;c:\windows\system32\drivers\a6e0d940.sys --> c:\windows\system32\drivers\a6e0d940.sys [?] S1 af97b5c1;af97b5c1;c:\windows\system32\drivers\af97b5c1.sys --> c:\windows\system32\drivers\af97b5c1.sys [?] S1 cf5dd7fd;cf5dd7fd;c:\windows\system32\drivers\cf5dd7fd.sys --> c:\windows\system32\drivers\cf5dd7fd.sys [?] S2 gupdate1c98a5597189556;Google Update Service (gupdate1c98a5597189556);c:\program files\Google\Update\GoogleUpdate.exe [2/8/2009 6:27 PM 133104] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/12/2010 5:15 AM 1355928] S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/12/2010 5:15 AM 15008] S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [8/7/2007 9:17 AM 49377] . Contents of the 'Scheduled Tasks' folder 2010-09-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 04:19] 2010-09-05 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34] 2010-09-06 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-15 15:52] 2010-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-09 01:27] 2010-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-09 01:27] 2010-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-372829268-496393314-3364022493-500Core.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 08:09] 2010-09-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-372829268-496393314-3364022493-500UA.job - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 08:09] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} . - - - - ORPHANS REMOVED - - - - Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file) HKLM-Run-AVG7_CC - (no file) MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-09-06 15:08 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-372829268-496393314-3364022493-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,4f,13,f6,d5,90,e4,42,a1,8f,c5, \ "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01 ,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,8f,4f,13,f6,d5,90,e4,42,a1,8f,c5, \ [HKEY_USERS\S-1-5-21-372829268-496393314-3364022493-500\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) @SACL= [HKEY_LOCAL_MACHINE\software\Adobe\Premiere Pro\1.5\DefaultPreset] @DACL=(02 0000) @="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Settings\\DV - NTSC\\Standard 48kHz.prpreset" [HKEY_LOCAL_MACHINE\software\Adobe\Premiere Pro\1.5\Help] @DACL=(02 0000) "AdobeMediaEncoder"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\1_0_0_0.html" "Contents"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\1_0_0_0.html" "ExportToDVD"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\1_19_2_0.html" "HowToUse"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\0_0_0_0.html" "Keyboard"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\1_21_0_0.html" "Search"="c:\\Program Files\\Adobe\\Premiere Pro 1.5\\Help\\search.html" "Support"="http://www.adobe.com/support/products/premiere.html" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{60778762-8BE2-5BE8-74B1F534DECE7DD7}\{033814D8-F5F0-69C3-B63A6822FA3F97AC}\{BB1878CD-9C66-F7AC-793F8981AF2E0354}*] "63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26 ,f8, c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7FA7DB51-4296-4DCE-E915E900AF1A706F}\{6ECD6E35-CD02-B6E7-116E97829ECA1B77}\{2BCFFA55-7302-F76B-60625DCE35F7A6E2}*] "63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26 ,f8, c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version] "Version"=hex:9f,e6,84,5a,36,0c,ce,e2,39,27,d3,98,49,06,16,44,60,de,4d,bf,9 b, 4a,d2,73,9f,a0,c7,cf,d8,e3,a1,53,0c,1a,4f,3f,6f,b8,66,74,47,6a,72,dc,45,2d, \ [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00, 79, 00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00, \ [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\User Data\LocalSystem\Components\•€|˙˙˙˙"•€|ţ»Ôw*] "91A14B995DF7C0B42ABAA16065968F3A"="c:\\Program Files\\Alias\\Maya7.0\\presets\\Ashli\\" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\User Data\LocalSystem\Components\Ř•€|˙˙˙˙•€|ů•Ôw*] "91A14B995DF7C0B42ABAA16065968F3A"="c:\\Program Files\\Alias\\Maya7.0\\presets\\Ashli\\" [HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version] "Version"=hex:9f,e6,84,5a,36,0c,ce,e2,39,27,d3,98,49,06,16,44,60,de,4d,bf,9 b, 4a,d2,73,9f,a0,c7,cf,d8,e3,a1,53,0c,1a,4f,3f,6f,b8,66,74,47,6a,72,dc,45,2d, \ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(4300) c:\windows\TEMP\logishrd\LVPrcInj01.dll c:\documents and settings\Administrator\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll c:\windows\system32\tabhook.dll c:\windows\system32\ieframe.dll c:\windows\system32\OneX.DLL c:\windows\system32\eappprxy.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\AVG\AVG9\avgchsvx.exe c:\program files\AVG\AVG9\avgrsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Cisco Systems\VPN Client\cvpnd.exe c:\program files\Google\Update\1.2.183.23\GoogleCrashHandler.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\program files\Alias\Maya7.0\docs\wrapper.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PnkBstrA.exe c:\program files\Alias\Maya7.0\docs\jre\bin\java.exe c:\windows\system32\Tablet.exe c:\program files\AVG\AVG9\avgnsx.exe c:\windows\system32\wscntfy.exe c:\windows\SOUNDMAN.EXE c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.29\GoogleCrashHandler.exe c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2010-09-06 15:18:03 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-06 22:18 Pre-Run: 4,620,435,456 bytes free Post-Run: 4,153,688,064 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 - - End Of File - - A1A62FCAB65F4A9ADF198F50E3835AF6 |
07-Sep-2010, 08:40 AM
#7 | |||||
| I need to examine a couple of files Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press SAVE and choose desktop in the list of selections in that window & press save) Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished Close any open browsers Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum This will create a zip file inside C:\QooBox\quarantine named something like [38]-Submit_2008-01-17@17.50.zip at the end it will pop up an alert & open your browser and ask you to send the zip file please follow those instructions. We need to see the zip file before we can carry on with the fix If there is no pop up alert or open browser then please go to http://www.thespykiller.co.uk/index.php?board=1.0 and upload these files so I can examine them and if needed distribute them to antivirus companies. Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, If there is more than 1 file then press the more attachments button for each extra file and browse and select etc and then when all the files are listed in the windows press send to upload the files ( do not post HJT logs there as they will not get dealt with) Files to submit: the zip file inside C:\QooBox\quarantine created by combofix named something like [38]-Submit_2008-01-17@17.50.zip or to http://www.bleepingcomputer.com/subm...php?channel=38 then Run tdss killer from http://support.kaspersky.com/viruses...?qid=208280684 post back with its log
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
08-Sep-2010, 02:54 AM
#8 | |||||
| |
08-Sep-2010, 04:18 AM
#9 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
08-Sep-2010, 05:12 AM
#10 | |||||
| |
08-Sep-2010, 06:17 AM
#11 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
08-Sep-2010, 06:47 AM
#12 | |||||
| |
08-Sep-2010, 06:56 AM
#13 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
09-Sep-2010, 04:54 PM
#14 | |||||
| |
 |
| Tags |
| clicksor, clicksor.com |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| HiJackthis logfile hope to get help getting rid of keyloggers for World of Warcraft | VolvoTorgeir | Virus & Other Malware Removal | 12 | 18-Apr-2010 09:59 PM |
| Got a Virus out of nowhere and I need help GEtting RID of it | namtaewoo | General Security | 1 | 22-Feb-2009 02:55 PM |
| My computer is as slow as a slug and I can't get HOTLLAMA off my (D:) Drive!! HELP! | Zethon | Virus & Other Malware Removal | 1 | 17-Feb-2009 02:06 AM |
| how to get rid of this n2.bat | pearljp05 | Virus & Other Malware Removal | 0 | 22-May-2008 01:41 AM |
| I need help getting rid of the rest of the sub7 virus! | Kevin2001 | Earlier Versions of Windows | 1 | 12-May-2001 03:46 AM |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 02:43 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile