Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

IE and Firefox Hijacked and Chrome won't connect

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 21st, 2010, 1:26 am

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 00:20 on 21/04/2010 by J....n J.....d (Administrator - Elevation successful)

========== filefind ==========

Searching for "*ftdisk*"
C:\cmdcons\FTDISK.SY_ --a--- 60791 bytes [18:52 17/08/2001] [18:52 17/08/2001] 345CA06DF0C008EA223F924391B4C205
C:\ftdisk.sys.sys --a--- 125056 bytes [07:48 18/04/2010] [05:17 16/04/2010] 6AC26732762483366C3969C9E4D2259D
C:\WINDOWS\system32\dllcache\ftdisk.sys --a--c 125056 bytes [11:00 10/08/2004] [19:10 19/04/2010] 6AC26732762483366C3969C9E4D2259D
C:\WINDOWS\system32\drivers\ftdisk.sys --a--- 125056 bytes [11:00 10/08/2004] [19:10 19/04/2010] 6AC26732762483366C3969C9E4D2259D

Searching for "*iastor*"
C:\WINDOWS\dell\iastor\iastor.cat --a--- 8278 bytes [06:41 22/05/2006] [06:41 22/05/2006] 2E3C024419060C15DC9532C11FD8D73C
C:\WINDOWS\dell\iastor\iastor.inf --a--- 5742 bytes [16:18 11/05/2006] [16:18 11/05/2006] 6A9AB910B565B5108538C5E01CDECA43
C:\WINDOWS\dell\iastor\iastor.PNF --a--- 11516 bytes [19:15 17/09/2008] [19:15 17/09/2008] 492524055B3DC44849C9D6552FEFDF3B
C:\WINDOWS\dell\iastor\iastor.sys --a--- 247808 bytes [16:30 11/05/2006] [16:30 11/05/2006] 294110966CEDD127629C5BE48367C8CF
C:\WINDOWS\system32\drivers\iaStor.sys --a--- 247808 bytes [16:30 11/05/2006] [16:30 11/05/2006] 294110966CEDD127629C5BE48367C8CF

-=End Of File=-
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm
Advertisement
Register to Remove

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 21st, 2010, 1:56 am

Hi jtjag03

Uninstall ComboFix

  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK

Download the latest version of ComboFix and run it
Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 21st, 2010, 2:37 am

Is there a normal time it takes combofix to run after a reboot. The first time you had me run it, it was quick and required no reboot. This time it did. After the reboot it's been sitting there with the blue box stating "ComboFix is preparing to run" for about two hours now.
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 21st, 2010, 10:55 am

Hi jtjag03

it should not take longer than 10 minutes,have you tried to restart the computer "normally"
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 21st, 2010, 12:27 pm

Combofix had asked to restart as part of it's process, saying it had found rootkit activity, but hung up after it restarted. I killed it and let windows load. Ran it again. It didn't ask to reboot this time and finished normally.

ComboFix 10-04-20.04 - J....n J.....d 04/21/2010 11:06:12.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1406 [GMT -5:00]
Running from: c:\documents and settings\J....n J.....d\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2010-03-21 to 2010-04-21 )))))))))))))))))))))))))))))))
.

2010-04-20 17:50 . 2010-04-20 17:50 242696 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-04-20 17:49 . 2010-04-20 17:49 1689952 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-04-20 11:49 . 2010-04-20 11:49 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-18 07:48 . 2010-04-16 05:17 125056 ----a-w- C:\ftdisk.sys.sys
2010-04-17 18:41 . 2010-04-17 18:41 -------- d-----w- C:\_OTM
2010-04-17 18:29 . 2010-04-17 18:29 -------- d-----w- c:\documents and settings\J....n J.....d\Local Settings\Application Data\avG
2010-04-17 18:29 . 2010-04-17 18:29 -------- d-----w- c:\documents and settings\All Users\Application Data\avG
2010-04-13 16:41 . 2010-04-13 16:42 -------- d-----w- c:\program files\trend micro
2010-04-13 16:41 . 2010-04-13 16:42 -------- d-----w- C:\rsit
2010-04-13 00:11 . 2010-04-13 00:11 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2010-04-13 00:11 . 2010-04-13 00:11 -------- d-----w- c:\program files\IObit
2010-04-12 01:00 . 2010-04-12 02:01 -------- d-----w- c:\documents and settings\J....n J.....d\DoctorWeb
2010-04-11 20:38 . 2010-04-11 20:38 52224 ----a-w- c:\documents and settings\J....n J.....d\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-04-11 20:38 . 2010-04-11 20:38 117760 ----a-w- c:\documents and settings\J....n J.....d\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-04-11 20:37 . 2010-04-11 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-04-11 20:36 . 2010-04-11 20:44 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-04-11 20:36 . 2010-04-11 20:36 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\SUPERAntiSpyware.com
2010-04-11 16:36 . 2010-04-11 18:31 -------- d-----w- c:\windows\BDOSCAN8
2010-04-09 13:30 . 2010-04-09 13:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2010-04-09 03:24 . 2010-04-09 03:24 -------- d-sh--w- c:\documents and settings\J....n J.....d\PrivacIE
2010-04-09 03:21 . 2010-04-09 03:21 -------- d-----w- c:\windows\system32\XPSViewer
2010-04-09 03:21 . 2010-04-09 03:21 -------- d-----w- c:\program files\Reference Assemblies
2010-04-09 03:21 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-04-09 03:20 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-04-09 03:20 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-04-09 03:20 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-04-09 03:20 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-04-09 03:20 . 2010-04-09 03:21 -------- d-----w- C:\13e426ba417ad14154aeffdb
2010-04-09 03:20 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-04-09 03:20 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-04-09 03:20 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-04-09 03:20 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-04-09 03:08 . 2010-04-09 03:08 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-04-09 03:04 . 2010-04-09 03:04 -------- d-sh--w- c:\documents and settings\J....n J.....d\IETldCache
2010-04-09 02:54 . 2010-02-25 06:24 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-04-09 02:54 . 2010-02-25 06:24 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-04-09 02:54 . 2010-04-09 02:54 -------- d-----w- c:\windows\ie8updates
2010-04-09 02:54 . 2010-02-16 04:50 64000 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-04-09 02:53 . 2010-04-09 02:53 -------- dc-h--w- c:\windows\ie8
2010-04-09 02:12 . 2010-04-09 02:12 -------- d-----w- c:\windows\ServicePackFiles
2010-04-09 01:59 . 2010-04-09 01:59 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-04-09 01:59 . 2010-04-09 03:10 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-04-09 00:57 . 2010-02-24 15:16 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-04-09 00:55 . 2010-04-09 00:55 -------- d-----w- c:\program files\Windows Defender
2010-04-08 22:00 . 2010-04-08 22:01 -------- d-----w- c:\program files\CCleaner
2010-04-08 22:00 . 2010-04-08 22:00 388096 ----a-r- c:\documents and settings\J....n J.....d\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-04-08 22:00 . 2010-04-08 22:00 -------- d-----w- c:\program files\TrendMicro
2010-03-27 06:31 . 2010-03-27 06:31 67424 ---ha-w- c:\windows\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-21 06:11 . 2009-07-20 22:47 1145 --sha-w- c:\windows\system32\mmf.sys
2010-04-21 05:33 . 2010-02-26 07:20 0 ----a-w- c:\documents and settings\J....n J.....d\Local Settings\Application Data\prvlcl.dat
2010-04-20 21:58 . 2008-11-24 05:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-20 17:50 . 2009-11-20 20:31 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-20 11:49 . 2010-04-08 03:21 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-20 09:44 . 2008-09-18 12:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-04-19 19:10 . 2004-08-10 11:00 125056 ----a-w- c:\windows\system32\drivers\ftdisk.sys
2010-04-16 09:23 . 2008-09-18 01:03 -------- d-----w- c:\program files\Google
2010-04-13 01:43 . 2009-07-22 04:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-04-11 20:36 . 2009-03-04 23:07 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-09 13:24 . 2009-06-12 13:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-04-09 03:37 . 2008-09-18 00:41 85072 ----a-w- c:\documents and settings\J....n J.....d\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-09 02:19 . 2008-11-24 05:44 -------- d-----w- c:\program files\Microsoft Works
2010-04-09 00:30 . 2008-09-18 03:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-09 00:30 . 2009-01-06 03:15 -------- d-----w- c:\program files\Logitech
2010-04-09 00:29 . 2009-09-01 04:45 -------- d-----w- c:\program files\Democracy2
2010-04-08 17:11 . 2009-07-22 04:19 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-04-08 08:42 . 2010-04-08 08:42 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\Malwarebytes
2010-04-08 08:42 . 2010-04-08 08:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-08 08:42 . 2010-04-08 08:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-08 02:55 . 2008-09-18 02:11 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\uTorrent
2010-03-30 05:46 . 2010-04-08 08:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 05:45 . 2010-04-08 08:42 20824 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-20 12:02 . 2009-11-30 22:00 79488 ----a-w- c:\documents and settings\J....n J.....d\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-03-14 13:13 . 2010-03-14 13:13 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-03-14 13:13 . 2008-09-18 04:14 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-03-14 13:12 . 2008-09-18 04:14 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-03-11 03:10 . 2010-02-01 06:09 48128 ----a-w- c:\documents and settings\J....n J.....d\fbchathistory.dat
2010-03-10 06:15 . 2004-08-10 11:00 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-02 04:13 . 2009-10-04 03:27 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-26 07:41 . 2010-02-26 07:38 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\wootalyzer
2010-02-26 07:37 . 2010-02-26 07:37 -------- d-----w- c:\program files\Wootalyzer
2010-02-25 06:24 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2010-02-25 04:59 . 2009-02-05 19:55 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\ZoomBrowser EX
2010-02-25 04:58 . 2009-02-05 19:54 -------- d-----w- c:\documents and settings\J....n J.....d\Application Data\CameraWindowDC
2010-02-24 12:31 . 2004-08-10 11:00 454016 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-02-16 17:35 . 2005-03-30 01:21 2143744 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 16:57 . 2005-03-30 01:01 2021888 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-12 04:47 . 2004-08-10 11:00 100864 ----a-w- c:\windows\system32\6to4svc.dll
2010-02-11 12:01 . 2004-08-10 11:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2010-02-23 19:04 1664256 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-02-23 1664256]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
"Google Update"="c:\documents and settings\J....n J.....d\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-03-18 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"nwiz"="nwiz.exe" [2009-03-27 1657376]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 282624]
"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-02-05 198160]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

c:\documents and settings\J....n J.....d\Start Menu\Programs\Startup\
DING!.lnk - c:\program files\Southwest Airlines\Ding\Ding.exe [2006-6-22 462848]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BlackBerry Desktop Redirector.lnk - c:\program files\Research In Motion\BlackBerry\Redirector.exe [2008-5-30 1319024]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-03-14 13:13 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^J....n J.....d^Start Menu^Programs^Startup^MagicDisc.lnk]
path=c:\documents and settings\J....n J.....d\Start Menu\Programs\Startup\MagicDisc.lnk
backup=c:\windows\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-03-06 21:19 236016 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Documents and Settings\\J....n J.....d\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/21/2009 10:38 PM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/17/2008 11:14 PM 216200]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/20/2009 3:31 PM 242896]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/17/2010 11:15 AM 66632]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/14/2010 8:13 AM 308064]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [4/12/2010 7:11 PM 311568]
S2 gupdate1c9ad70bf1e8c19;Google Update Service (gupdate1c9ad70bf1e8c19);c:\program files\Google\Update\GoogleUpdate.exe [3/25/2009 12:40 PM 133104]
S2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [7/20/2009 5:47 PM 2560]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1029456]
S3 QCEmerald;Logitech QuickCam Web(PID_0850);c:\windows\system32\drivers\lvce.sys [1/5/2009 10:17 PM 44544]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/17/2010 11:15 AM 12872]
.
Contents of the 'Scheduled Tasks' folder

2010-04-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-18 08:58]

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-25 17:40]

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-25 17:40]

2010-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-2139871995-1801674531-1003Core.job
- c:\documents and settings\J....n J.....d\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-01 07:15]

2010-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-2139871995-1801674531-1003UA.job
- c:\documents and settings\J....n J.....d\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-01 07:15]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = localhost;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
TCP: {B6CC1067-4963-42B5-8030-E47DCB9EA05D} = 192.168.1.254,192.168.1.1
FF - ProfilePath - c:\documents and settings\J....n J.....d\Application Data\Mozilla\Firefox\Profiles\0nuudx8y.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\J....n J.....d\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\J....n J.....d\Application Data\Move Networks\plugins\npqmp071701000002.dll
FF - plugin: c:\documents and settings\J....n J.....d\Application Data\Mozilla\Firefox\Profiles\0nuudx8y.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(592)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-04-21 11:18:35
ComboFix-quarantined-files.txt 2010-04-21 16:18
ComboFix2.txt 2010-04-16 03:11

Pre-Run: 85,509,521,408 bytes free
Post-Run: 85,694,156,800 bytes free

- - End Of File - - 3EA806716A5DB7E9AAE5FF93874DF13C
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 21st, 2010, 1:12 pm

Hi jtjag03

Please run Gmer and post the log.

How's the computer running now

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 21st, 2010, 5:13 pm

Got rid of XP antivirus 2010. Have been doing random searches and haven't been redirected yet. Everything else seems to be running well at the moment. I'll run GMER in a minute and post the results when I get a chance in a few hours.
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 21st, 2010, 9:56 pm

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-21 20:54:23
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\pxtdypow.sys


---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA0F887E]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA0F8BFE]

INT 0x01 \??\C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\mbr.sys B899E2A4

Code \??\C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\catchme.sys pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB81F5380, 0x34C81F, 0xE8000020]
init C:\WINDOWS\system32\drivers\monfilt.sys entry point in "init" section [0xB1ADD280]
? C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !
? C:\DOCUME~1\JUSTIN~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\ehome\ehtray.exe[612] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\ehome\ehtray.exe[612] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\WINDOWS\ehome\ehtray.exe[612] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\ehome\ehtray.exe[612] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\ehome\ehtray.exe[612] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00CC0001
.text C:\WINDOWS\ehome\ehtray.exe[612] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\ehome\ehtray.exe[612] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\ehome\ehtray.exe[612] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\ehome\ehtray.exe[612] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\ehome\ehtray.exe[612] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\WINDOWS\ehome\ehtray.exe[612] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\ehome\ehtray.exe[612] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\iTunes\iTunesHelper.exe[796] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00CE0001
.text C:\Program Files\iTunes\iTunesHelper.exe[796] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[796] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\iTunes\iTunesHelper.exe[796] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00C00001
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[1592] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00960001
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Creative\Mixer\CTSVolFE.exe[1752] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\system32\ctfmon.exe[2228] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[2228] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\WINDOWS\system32\ctfmon.exe[2228] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[2228] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\ctfmon.exe[2228] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00BA0001
.text C:\WINDOWS\system32\ctfmon.exe[2228] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\ctfmon.exe[2228] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\ctfmon.exe[2228] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\ctfmon.exe[2228] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[2228] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\ctfmon.exe[2228] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\system32\ctfmon.exe[2228] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00BA0001
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\system32\RUNDLL32.EXE[2476] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00CE0001
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Microsoft ActiveSync\Wcescomm.exe[2780] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\WINDOWS\stsystra.exe[2940] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[2940] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\WINDOWS\stsystra.exe[2940] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[2940] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\WINDOWS\stsystra.exe[2940] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 009B0001
.text C:\WINDOWS\stsystra.exe[2940] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\stsystra.exe[2940] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\stsystra.exe[2940] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\WINDOWS\stsystra.exe[2940] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\stsystra.exe[2940] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\WINDOWS\stsystra.exe[2940] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\WINDOWS\stsystra.exe[2940] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00B10001
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE[3220] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00C50001
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[3348] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 00B80001
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe[3868] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ntdll.dll!NtCreateKey 7C90D0EE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ntdll.dll!NtCreateKey + 4 7C90D0F2 2 Bytes [17, 5F] {POP SS; POP EDI}
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ntdll.dll!NtSetValueKey 7C90DDCE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ntdll.dll!NtSetValueKey + 4 7C90DDD2 2 Bytes [14, 5F] {ADC AL, 0x5f}
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] kernel32.dll!LoadLibraryExW + C4 7C801BB5 4 Bytes CALL 003F0001
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] kernel32.dll!CreateProcessW 7C802332 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] kernel32.dll!CreateProcessA 7C802367 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ADVAPI32.dll!CreateProcessAsUserW 77DEA8B1 6 Bytes JMP 5F100F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ADVAPI32.dll!CreateProcessWithLogonW 77E15EFD 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E15F01 2 Bytes [05, 5F]
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ADVAPI32.dll!CreateServiceA 77E37359 6 Bytes JMP 5F190F5A
.text C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe[3908] ADVAPI32.dll!CreateServiceW 77E374F1 6 Bytes JMP 5F1C0F5A

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \FileSystem\Fastfat \Fat A7B81C8A

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULserv
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULl
Reg HKLM\SYSTEM\ControlSet001\Services\ESQULserv.sys\modules@ESQULclk

---- EOF - GMER 1.0.15 ----
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 22nd, 2010, 11:55 am

Hi jtjag03

1 - Run Malwarebytes' Anti-Malware

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • Make sure the "Perform full scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  1. Click on the Show Results button to see a list of any malware that was found.
  2. Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
    We will take care of the System Volume Information items later.
  3. When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  4. The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  5. Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


2 - Status Check
Please reply with

the Malwarebytes' Anti-Malware Log
description of any problems you are having with your PC

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 22nd, 2010, 7:05 pm

Everything seems to be running fine right now.

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4023

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/22/2010 3:45:29 PM
mbam-log-2010-04-22 (15-45-29).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 270821
Time elapsed: 2 hour(s), 4 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 23rd, 2010, 2:29 am

Hi jtjag03

looks good, but we will run one online scan to be sure that there is nothing left

1 - Clean temp files

  • Please download TFC to your desktop
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • If prompted, click Yes to reboot.

NOTE: Save your work.TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

2 - Eset online scannner

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Please go here then click on: Image
  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

4 - Status Check
Please reply with

1. the Eset online scannner report
2. a fresh HijackThis log

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 23rd, 2010, 12:50 pm

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=2b4830e61afa944ba4478428257cc3a0
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-04-23 10:25:15
# local_time=2010-04-23 05:25:15 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1024 16777175 100 0 13173311 13173311 0 0
# compatibility_mode=4352 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=200135
# found=3
# cleaned=0
# scan_time=13093
C:\Documents and Settings\J....n J.....d\DoctorWeb\Quarantine\freeripmp3.exe a variant of Win32/AdInstaller application 00000000000000000000000000000000 I
C:\Music\Nero.8.Ultra.Edition.8.3.2.1.Incl.Keymaker\Nero.8.Ultra.Edition.8.3.2.1.Incl.Keymaker\Nero-8.3.2.1_eng_trial.exe Win32/Toolbar.AskSBar application 00000000000000000000000000000000 I
C:\Qoobox\32788R22FWJFW\ftdisk.sys Win32/Olmarik.XG trojan 00000000000000000000000000000000 I


Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 11:49:34 AM, on 4/23/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Southwest Airlines\Ding\Ding.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\J....n J.....d\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: BlackBerry Desktop Redirector.lnk = C:\Program Files\Research In Motion\BlackBerry\Redirector.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc ... oscan8.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B6CC1067-4963-42B5-8030-E47DCB9EA05D}: NameServer = 192.168.1.254,192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c9ad70bf1e8c19) (gupdate1c9ad70bf1e8c19) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 14614 bytes
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 24th, 2010, 1:37 am

Hi jtjag03

  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  • Close all open windows and browsers/email, etc...
  • Click on the "Fix Checked" button
  • When completed, close the application.

How's the computer running now? Any problems?

Thanks peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby jtjag03 » April 24th, 2010, 5:26 pm

Done. Everything seems to be working ok right now. Haven't been redirected or had any random popups in a while. Chrome is even working again.
jtjag03
Regular Member
 
Posts: 28
Joined: April 8th, 2010, 8:43 pm

Re: IE and Firefox Hijacked and Chrome won't connect

Unread postby peku006 » April 25th, 2010, 1:33 am

Hi jtjag03

Your log now appears to be clean. Congratulations!

To remove all of the tools we used and the files and folders they created do the following:

Delete SystemLook from your desktop.

Download OTC by Old Timer and save it to your Desktop.

  • Double-click OTC.exe
  • Click the CleanUp! button
  • Select Yes when the Begin cleanup Process? Prompt appears
  • If you are prompted to Reboot during the cleanup, select Yes
  • The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore.
  • Click Apply, and then click OK.
  • Reboot.
Turn ON System Restore
  • On the Desktop, right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • UN-Check *Turn off System Restore*.
  • Click Apply, and then click OK.
This will remove all restore points except the new one you just created.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Here are some things that I think are worth having a look at if you don't already know a bout them:.

  • WinPatrol
    As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. For more information, please visit HERE.
  • SpywareBlaster
    SpywareBlaster sets killbits in the registry to prevent known malicious ActiveX controls from installing on your computer. If you don't know what ActiveX controls are, see HERE. You can download SpywareBlaster from HERE.
  • Hosts File
    For added protection you may also like to add a host file. A simple explanation of what a Hosts file does is HERE and for more information regarding host files read HERE.
  • Use an alternative Internet Browser
    Many of the exploits are directed to users of Internet Explorer. Try using a different browser instead: Firefox or Opera

Here is a great article by miekiemoes How to prevent Malware.

Finally I am trying to make one point very clear. It is ABSOLUTELY ESSENTIAL to keep all of your security programs up to date.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Happy surfing and stay clean!

peku006
User avatar
peku006
MRU Emeritus
MRU Emeritus
 
Posts: 3357
Joined: May 14th, 2007, 2:18 pm
Location: Norway
Advertisement
Register to Remove

PreviousNext

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 47 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware