Google browser redirects / malware issues

Question

Hi, I am having issues with some malware/browser redirects. I am getting redirected after doing Google searches. The links direct me to dealparty, shopzilla, scour, etc. It's not all the time, but it's happening enough that I know something is wrong. I have Symantec installed, and it runs daily. Scans have been clean for the last few days. I also ran Malware Bytes and Spybot. Those scans originally came back with Trojans, but subsequent scans have been clean. Yet, I still get the browser redirects. I use Firefox mostly. Below is my HJT log. Please let me know what else I can provide. I will monitor this thread and post replies quickly. I appreciate any help that anyone can give. Thanks!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 4:36:28 PM, on 9/28/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Intel\AMT\LMS.exeC:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exeC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\WINDOWS\system32	cpsvcs.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeC:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exeC:\WINDOWS\Explorer.EXEC:\Program Files\RealVNC\VNC4\WinVNC4.exeC:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeC:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exeC:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Citrix\GoToMeeting\457\g2mstart.exeC:\Program Files\Citrix\GoToMeeting\457\g2mcomm.exeC:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeC:\Program Files\Citrix\GoToMeeting\457\g2mlauncher.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32
otepad.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/a/timesshamrock.com/ServiceLogin?service=mail&passive=true&rm=false&continue=http%3A%2F%2Fmail.google.com%2Fa%2Ftimesshamrock.com%2F&bsv=zpwhtygjntrz&ltmpl=default&ltmplcache=2R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [StartCCC] 'C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe' MSRunO4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeO4 - HKLM\..\Run: [picon] 'C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe' -startupO4 - HKLM\..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeO4 - HKLM\..\Run: [DellControlPoint] 'C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe'O4 - HKLM\..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exeO4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe'O4 - HKLM\..\Run: [Acrobat Assistant 8.0] 'C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe'O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXEO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Common Files\Java\Java Update\jusched.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe'O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [GoToMeeting] 'C:\Program Files\Citrix\GoToMeeting\457\g2mstart.exe' '/Trigger RunAtLogon'O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exeO8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263847315659O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tshamrock.corpO17 - HKLM\Software\..\Telephony: DomainName = tshamrock.corpO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tshamrock.corpO23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exeO23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: NTRU TSS v1.2.1.29 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeO23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeO23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exeO23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe--End of file - 13046 bytes

kevinf80_1d0ac6 · Answer

Hi pcu1976,

I'm kevinf80 and I will be helping with any issues you may have. Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.
Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.
If you do not reply within 72 hours the thread will be closed, if you need more time let me know. Likewise if I do not respond within 48 hours feel free to PM me.

* If you are using any cracked software, please remove it. In addition to being illegal, when you install cracked software, you are running executable files from dubious, unknown sources. You are giving these sources access to information on your hard disk, and potential control over operation of your computer. Definition of cracked software HERE

** If you are using any P2P (file sharing) programs, please remove them before we clean your computer. The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state. That includes BitTorrent and similar programs. There is a partial list HERE

Please proceed as follows :-

Step 1

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

Combofix

Don`t forget Combofix must be saved to your desktop. <--Very important

Ensure you have disabledyour Firewall and all anti virus and anti malware programs so they do not interfere with the running of ComboFix. <---Very important

Please include the C:\ComboFix.txt in your next reply for further review.

Examples of how to disable realtime protection available at the following link :-

Disable realtime protection

Note: Do not click combofix's window with your mouse while it's running. That action may cause it to stall.

*EXTRA NOTES*

If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Step 2

Download Security Check by screen317 from HERE or HERE.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

What i`d like to see in your reply :-

Log from Combofix
Log from Security Checks

Kevin

psu1976 · Answer

Hi Kevin, Below are my logs. I could not get Microsoft Windows Recovery console to install. My machine locked up, so I skipped that (as per the instuctions for ComboFix. If you need me to try again and get that installed, I can. ComboFix 10-09-28.03 - kellyannch 09/29/2010  13:36:09.2.2 - x86Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.3326.2565 [GMT -4:00]Running from: c:\documents and settings\kellyannch\Desktop\ComboFix.exeAV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.(((((((((((((((((((((((((   Files Created from 2010-08-28 to 2010-09-29  ))))))))))))))))))))))))))))))).2010-09-22 16:10 . 2010-09-22 16:10    --------    d-----w-    c:\program files\Trend Micro2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\documents and settings\kellyannch\Application Data\Malwarebytes2010-09-22 13:12 . 2010-04-29 19:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes2010-09-22 13:12 . 2010-04-29 19:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys2010-09-21 15:34 . 2008-04-14 12:00    18944    -c--a-w-    c:\windows\system32\dllcache\simptcp.dll2010-09-21 15:34 . 2008-04-14 12:00    18944    ----a-w-    c:\windows\system32\simptcp.dll2010-09-21 15:34 . 2008-04-14 12:00    35328    -c--a-w-    c:\windows\system32\dllcache\iprip.dll2010-09-21 15:34 . 2008-04-14 12:00    35328    ----a-w-    c:\windows\system32\iprip.dll2010-09-21 15:30 . 2010-09-21 15:30    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\TechSmith2010-09-21 15:30 . 2010-09-21 15:30    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer2010-09-21 14:46 . 2010-09-21 14:46    --------    d-sh--w-    c:\documents and settings\LocalService\IECompatCache2010-09-21 14:46 . 2010-09-21 14:46    --------    d-sh--w-    c:\documents and settings\LocalService\PrivacIE2010-09-21 14:46 . 2010-09-21 14:46    --------    d-----w-    c:\documents and settings\LocalService\Application Data\Windows Search2010-09-21 13:35 . 2010-09-21 13:35    --------    d-sh--w-    c:\documents and settings\LocalService\IETldCache2010-09-21 13:19 . 2010-09-21 13:19    --------    d-----w-    c:\program files\CCleaner2010-09-21 12:58 . 2010-09-21 12:58    --------    d-sh--w-    c:\documents and settings
etadmin\IETldCache2010-09-21 12:55 . 2010-09-28 20:35    --------    d-----w-    c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2010-09-21 12:55 . 2010-09-21 13:00    --------    d-----w-    c:\program files\Spybot - Search & Destroy2010-09-20 20:43 . 2010-09-22 13:06    0    ----a-w-    c:\windows\Eyomipe.bin.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-09-29 17:34 . 2010-01-18 20:39    --------    d-----w-    c:\program files\Symantec AntiVirus2010-09-29 17:29 . 2010-01-18 21:35    0    ----a-w-    c:\documents and settings\kellyannch\Local Settings\Application Data\WavXMapDrive.bat2010-09-27 03:04 . 2010-02-15 04:04    1324    ----a-w-    c:\windows\system32\d3d9caps.dat2010-09-22 20:28 . 2010-08-12 19:55    --------    d-----w-    c:\documents and settings\All Users\Application Data\Skype2010-09-22 13:09 . 2010-01-14 07:28    --------    d-----w-    c:\program files\Microsoft Silverlight2010-09-21 15:58 . 2010-01-14 07:19    --------    d-----w-    c:\documents and settings\All Users\Application Data\Microsoft Help2010-09-21 15:44 . 2010-01-14 07:04    --------    d-----w-    c:\program files\Windows Desktop Search2010-09-21 15:30 . 2010-01-14 07:24    0    ----a-w-    c:\documents and settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat2010-09-21 13:24 . 2010-01-14 07:24    72576    ----a-w-    c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2010-09-19 10:11 . 2010-01-18 20:00    --------    d-----w-    c:\documents and settings\All Users\Application Data\FLEXnet2010-09-07 14:11 . 2010-01-14 07:17    72576    ----a-w-    c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2010-08-27 15:38 . 2010-08-27 15:38    --------    d-----w-    c:\documents and settings\All Users\Application Data\Garden Planner2010-08-27 15:38 . 2010-08-27 15:38    --------    d-----w-    c:\program files\Common Files\SWF Studio2010-08-17 13:17 . 2008-04-25 16:16    58880    ----a-w-    c:\windows\system32\spoolsv.exe2010-08-12 19:55 . 2010-08-12 19:55    56    ---ha-w-    c:\windows\system32\ezsidmv.dat2010-08-09 03:03 . 2010-08-09 03:03    503808    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\msvcp71.dll2010-08-09 03:03 . 2010-08-09 03:03    499712    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\jmc.dll2010-08-09 03:03 . 2010-08-09 03:03    348160    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\msvcr71.dll2010-08-09 03:03 . 2010-08-09 03:03    61440    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-623b7da1-n\decora-sse.dll2010-08-09 03:03 . 2010-08-09 03:03    12800    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-623b7da1-n\decora-d3d.dll2010-07-22 15:49 . 2008-04-25 16:16    590848    ----a-w-    c:\windows\system32pcrt4.dll2010-07-22 05:57 . 2009-11-03 22:26    5120    ----a-w-    c:\windows\system32\xpsp4res.dll2010-07-07 15:05 . 2010-07-07 15:05    423464    ----a-w-    c:\documents and settings\kellyannch\Application Data\E-centives\BSTIEPrintCtl1.dll2010-04-05 13:27 . 2010-03-22 18:00    28472    ----a-w-    c:\program files\mozilla firefox\plugins\atgpcdec.dll2010-08-11 18:01 . 2010-03-22 18:00    239496    ----a-w-    c:\program files\mozilla firefox\plugins\atgpcext.dll2010-04-05 13:27 . 2010-03-22 18:00    46392    ----a-w-    c:\program files\mozilla firefox\plugins\atmccli.dll2010-03-22 18:00 . 2010-03-22 18:00    98712    ----a-w-    c:\program files\mozilla firefox\plugins\ieatgpc.dll.(((((((((((((((((((((((((((((   SnapShot@2010-09-29_17.21.33   ))))))))))))))))))))))))))))))))))))))))).+ 2010-09-29 17:28 . 2010-09-29 17:28    16384              c:\windows\Temp\Perflib_Perfdata_49c.dat+ 2008-04-25 16:16 . 2010-09-29 17:32    90792              c:\windows\system32\perfc009.dat- 2008-04-25 16:16 . 2010-09-28 20:20    90792              c:\windows\system32\perfc009.dat+ 2008-04-25 16:16 . 2010-09-29 17:32    492898              c:\windows\system32\perfh009.dat- 2008-04-25 16:16 . 2010-09-28 20:20    492898              c:\windows\system32\perfh009.dat.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]@='{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}'[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]2009-06-11 23:41    49152    ----a-w-    c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]@='{CF08DA3E-C97D-4891-A66B-E39B28DD270F}'[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]2009-06-11 23:41    49152    ----a-w-    c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'GoToMeeting'='c:\program files\Citrix\GoToMeeting\457\g2mstart.exe' [2010-07-24 39816][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'SoundMAXPnP'='c:\program files\Analog Devices\Core\smax4pnp.exe' [2009-06-22 1044480]'StartCCC'='c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe' [2008-01-21 61440]'IAAnotif'='c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe' [2009-02-11 186904]'picon'='c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe' [2009-07-16 796696]'ChangeTPMAuth'='c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe' [2009-06-03 184320]'WavXMgr'='c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe' [2009-05-18 145920]'DellControlPoint'='c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe' [2009-06-12 656384]'USCService'='c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe' [2009-07-05 15872]'PDVDDXSrv'='c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' [2009-02-05 128232]'Acrobat Assistant 8.0'='c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe' [2006-10-23 620152]'ccApp'='c:\program files\Common Files\Symantec Shared\ccApp.exe' [2005-10-04 48752]'vptray'='c:\progra~1\SYMANT~1\VPTray.exe' [2005-11-15 85744]'SunJavaUpdateSched'='c:\program files\Common Files\Java\Java Update\jusched.exe' [2010-01-11 246504]'QuickTime Task'='c:\program files\QuickTime\qttask.exe' [2009-11-11 417792]'iTunesHelper'='c:\program files\iTunes\iTunesHelper.exe' [2010-02-15 141608]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2010-1-18 295606]Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Authentication Packages    REG_MULTI_SZ       msv1_0 wvauth[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]'DisableMonitoring'=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\Network Diagnostic\xpnetdiag.exe'='%windir%\system32\sessmgr.exe'='c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE'='c:\Program Files\Windows Live\Messenger\wlcsdk.exe'='c:\Program Files\Windows Live\Messenger\msnmsgr.exe'='c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe'='c:\app\eclipse\eclipse.exe'='c:\Program Files\Java\jre1.5.0_22\bin\java.exe'=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]'3389:TCP'= 3389:TCP:@xpsp2res.dll,-22009'3587:TCP'= 3587:TCP:Windows Peer-to-Peer Grouping'3540:UDP'= 3540:UDP:Peer Name Resolution Protocol (PNRP)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]'AllowInboundEchoRequest'= 1 (0x1)R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [1/14/2010 5:50 AM 24064]R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [4/25/2008 12:16 PM 14336]R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [1/14/2010 3:13 AM 2066968]R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [1/14/2010 5:50 AM 157152]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/4/2010 8:03 PM 102448]S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 2:27 PM 169200][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]p2psvc    REG_MULTI_SZ       p2psvc p2pimsvc p2pgasvc PNRPSvc..------- Supplementary Scan -------.uInternet Settings,ProxyOverride = *.localIE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.htmlIE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlIE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlIE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlIE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlIE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlIE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlIE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.htmlIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000FF - ProfilePath - c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/FF - component: c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dllFF - component: c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\extensions	witternotifier@naan.net\platform\WINNT\components
sTwitterFoxSign.dllFF - plugin: c:\program files\Mozilla Firefox\plugins
patgpc.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPcol400.dllFF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\---- FIREFOX POLICIES ----c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgbaam7a8h', true); c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgberp4a5d4ar', true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref('dom.ipc.plugins.enabled', false);.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-09-29 13:40Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ...  scanning hidden autostart entries ... scanning hidden files ...  scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]'ImagePath'='\'c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\' --defaults-file=\'c:\program files\MySQL\MySQL Server 5.0\my.ini\' MySQL'.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(848)c:\windows\system32\Ati2evxx.dll- - - - - - - > 'lsass.exe'(904)c:\windows\system32\wvauth.dllc:\windows\system32\WININET.dllc:\program files\Bonjour\mdnsNSP.dll- - - - - - - > 'explorer.exe'(4984)c:\windows\system32\WININET.dllc:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dllc:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dllc:\program files\Common Files\Microsoft Shared\OFFICE12\MSOXEV.DLLc:\windows\system32\webcheck.dllc:\windows\system32\IEFRAME.dll.Completion time: 2010-09-29  13:41:37ComboFix-quarantined-files.txt  2010-09-29 17:41ComboFix2.txt  2010-09-29 17:22Pre-Run: 461,396,807,680 bytes freePost-Run: 461,383,970,816 bytes free- - End Of File - - C3BB0E83C6643941F408E872D1F0F1F1    Results of screen317's Security Check version 0.99.5   Windows XP Service Pack 3   Internet Explorer 8  `````````````````````````````` Antivirus/Firewall Check:  Windows Security Center service is not running! This report may not be accurate!  Windows Firewall Disabled!   Symantec AntiVirus      Antivirus up to date! (On Access scanning disabled!) ``````````````````````````````` Anti-malware/Other Utilities Check:  Malwarebytes' Anti-Malware     HijackThis 2.0.2     CCleaner (remove only)    Java(TM) 6 Update 18   Out of date Java installed!  Adobe Flash Player 9 (Out of date Flash Player installed!)  Adobe Flash Player 10.1.53.64   Mozilla Firefox (3.6.8) ```````````````````````````````` Process Check:  objlist.exe by Laurent  Symantec AntiVirus DefWatch.exe    Symantec AntiVirus Rtvscan.exe    Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe  ````````````````````````````````DNS Vulnerability Check: Unknown. This method cannot test your vulnerability to DNS cache poisoning. (Wireless connection?) ``````````End of Log````````````

kevinf80_1d0ac6 · Answer

Hiya pcu1976, That log is from the second run of Combofix, I need to see the log from the first run. C:\Qoobox\Combofix.txt2 Kevin

psu1976 · Answer

Sorry, didn't realize it spit out two logs. Here you go:   ComboFix 10-09-28.03 - kellyannch 09/29/2010  13:18:36.1.2 - x86Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.3326.2082 [GMT -4:00]Running from: c:\documents and settings\kellyannch\Desktop\ComboFix.exeAV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.(((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\Administrator\Local Settings\Application Data\{E063BA79-42AB-46C1-9760-8A1302F6BC2B}c:\documents and settings\Administrator\Local Settings\Application Data\{E063BA79-42AB-46C1-9760-8A1302F6BC2B}\chrome.manifestc:\documents and settings\Administrator\Local Settings\Application Data\{E063BA79-42AB-46C1-9760-8A1302F6BC2B}\chrome\content\_cfg.jsc:\documents and settings\Administrator\Local Settings\Application Data\{E063BA79-42AB-46C1-9760-8A1302F6BC2B}\chrome\content\overlay.xulc:\documents and settings\Administrator\Local Settings\Application Data\{E063BA79-42AB-46C1-9760-8A1302F6BC2B}\install.rdfc:\documents and settings\kellyannch\g2mdlhlpx.exec:\documents and settings\kellyannch\Local Settings\Application Data\{E810E398-CFDF-4BAB-9995-5EBD8BBA965E}c:\documents and settings\kellyannch\Local Settings\Application Data\{E810E398-CFDF-4BAB-9995-5EBD8BBA965E}\chrome.manifestc:\documents and settings\kellyannch\Local Settings\Application Data\{E810E398-CFDF-4BAB-9995-5EBD8BBA965E}\chrome\content\_cfg.jsc:\documents and settings\kellyannch\Local Settings\Application Data\{E810E398-CFDF-4BAB-9995-5EBD8BBA965E}\chrome\content\overlay.xulc:\documents and settings\kellyannch\Local Settings\Application Data\{E810E398-CFDF-4BAB-9995-5EBD8BBA965E}\install.rdfc:\windows\system32\BSTIEPrintCtl1.dll.(((((((((((((((((((((((((   Files Created from 2010-08-28 to 2010-09-29  ))))))))))))))))))))))))))))))).2010-09-22 16:10 . 2010-09-22 16:10    --------    d-----w-    c:\program files\Trend Micro2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\documents and settings\kellyannch\Application Data\Malwarebytes2010-09-22 13:12 . 2010-04-29 19:39    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware2010-09-22 13:12 . 2010-09-22 13:12    --------    d-----w-    c:\documents and settings\All Users\Application Data\Malwarebytes2010-09-22 13:12 . 2010-04-29 19:39    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys2010-09-21 15:34 . 2008-04-14 12:00    18944    -c--a-w-    c:\windows\system32\dllcache\simptcp.dll2010-09-21 15:34 . 2008-04-14 12:00    18944    ----a-w-    c:\windows\system32\simptcp.dll2010-09-21 15:34 . 2008-04-14 12:00    35328    -c--a-w-    c:\windows\system32\dllcache\iprip.dll2010-09-21 15:34 . 2008-04-14 12:00    35328    ----a-w-    c:\windows\system32\iprip.dll2010-09-21 15:30 . 2010-09-21 15:30    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\TechSmith2010-09-21 15:30 . 2010-09-21 15:30    --------    d-----w-    c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer2010-09-21 14:46 . 2010-09-21 14:46    --------    d-sh--w-    c:\documents and settings\LocalService\IECompatCache2010-09-21 14:46 . 2010-09-21 14:46    --------    d-sh--w-    c:\documents and settings\LocalService\PrivacIE2010-09-21 14:46 . 2010-09-21 14:46    --------    d-----w-    c:\documents and settings\LocalService\Application Data\Windows Search2010-09-21 13:35 . 2010-09-21 13:35    --------    d-sh--w-    c:\documents and settings\LocalService\IETldCache2010-09-21 13:19 . 2010-09-21 13:19    --------    d-----w-    c:\program files\CCleaner2010-09-21 12:58 . 2010-09-21 12:58    --------    d-sh--w-    c:\documents and settings
etadmin\IETldCache2010-09-21 12:55 . 2010-09-28 20:35    --------    d-----w-    c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2010-09-21 12:55 . 2010-09-21 13:00    --------    d-----w-    c:\program files\Spybot - Search & Destroy2010-09-20 20:43 . 2010-09-22 13:06    0    ----a-w-    c:\windows\Eyomipe.bin.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-09-29 17:14 . 2010-01-18 20:39    --------    d-----w-    c:\program files\Symantec AntiVirus2010-09-28 20:16 . 2010-01-18 21:35    0    ----a-w-    c:\documents and settings\kellyannch\Local Settings\Application Data\WavXMapDrive.bat2010-09-27 03:04 . 2010-02-15 04:04    1324    ----a-w-    c:\windows\system32\d3d9caps.dat2010-09-22 20:28 . 2010-08-12 19:55    --------    d-----w-    c:\documents and settings\All Users\Application Data\Skype2010-09-22 13:09 . 2010-01-14 07:28    --------    d-----w-    c:\program files\Microsoft Silverlight2010-09-21 15:58 . 2010-01-14 07:19    --------    d-----w-    c:\documents and settings\All Users\Application Data\Microsoft Help2010-09-21 15:44 . 2010-01-14 07:04    --------    d-----w-    c:\program files\Windows Desktop Search2010-09-21 15:30 . 2010-01-14 07:24    0    ----a-w-    c:\documents and settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat2010-09-21 13:24 . 2010-01-14 07:24    72576    ----a-w-    c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2010-09-19 10:11 . 2010-01-18 20:00    --------    d-----w-    c:\documents and settings\All Users\Application Data\FLEXnet2010-09-07 14:11 . 2010-01-14 07:17    72576    ----a-w-    c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2010-08-27 15:38 . 2010-08-27 15:38    --------    d-----w-    c:\documents and settings\All Users\Application Data\Garden Planner2010-08-27 15:38 . 2010-08-27 15:38    --------    d-----w-    c:\program files\Common Files\SWF Studio2010-08-17 13:17 . 2008-04-25 16:16    58880    ----a-w-    c:\windows\system32\spoolsv.exe2010-08-12 19:55 . 2010-08-12 19:55    56    ---ha-w-    c:\windows\system32\ezsidmv.dat2010-08-09 03:03 . 2010-08-09 03:03    503808    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\msvcp71.dll2010-08-09 03:03 . 2010-08-09 03:03    499712    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\jmc.dll2010-08-09 03:03 . 2010-08-09 03:03    348160    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-442d44ae-n\msvcr71.dll2010-08-09 03:03 . 2010-08-09 03:03    61440    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-623b7da1-n\decora-sse.dll2010-08-09 03:03 . 2010-08-09 03:03    12800    ----a-w-    c:\documents and settings\kellyannch\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-623b7da1-n\decora-d3d.dll2010-07-22 15:49 . 2008-04-25 16:16    590848    ----a-w-    c:\windows\system32pcrt4.dll2010-07-22 05:57 . 2009-11-03 22:26    5120    ----a-w-    c:\windows\system32\xpsp4res.dll2010-07-07 15:05 . 2010-07-07 15:05    423464    ----a-w-    c:\documents and settings\kellyannch\Application Data\E-centives\BSTIEPrintCtl1.dll2010-04-05 13:27 . 2010-03-22 18:00    28472    ----a-w-    c:\program files\mozilla firefox\plugins\atgpcdec.dll2010-08-11 18:01 . 2010-03-22 18:00    239496    ----a-w-    c:\program files\mozilla firefox\plugins\atgpcext.dll2010-04-05 13:27 . 2010-03-22 18:00    46392    ----a-w-    c:\program files\mozilla firefox\plugins\atmccli.dll2010-03-22 18:00 . 2010-03-22 18:00    98712    ----a-w-    c:\program files\mozilla firefox\plugins\ieatgpc.dll.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]@='{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}'[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]2009-06-11 23:41    49152    ----a-w-    c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]@='{CF08DA3E-C97D-4891-A66B-E39B28DD270F}'[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]2009-06-11 23:41    49152    ----a-w-    c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'GoToMeeting'='c:\program files\Citrix\GoToMeeting\457\g2mstart.exe' [2010-07-24 39816][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'SoundMAXPnP'='c:\program files\Analog Devices\Core\smax4pnp.exe' [2009-06-22 1044480]'StartCCC'='c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe' [2008-01-21 61440]'IAAnotif'='c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe' [2009-02-11 186904]'picon'='c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe' [2009-07-16 796696]'ChangeTPMAuth'='c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe' [2009-06-03 184320]'WavXMgr'='c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe' [2009-05-18 145920]'DellControlPoint'='c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe' [2009-06-12 656384]'USCService'='c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe' [2009-07-05 15872]'PDVDDXSrv'='c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' [2009-02-05 128232]'Acrobat Assistant 8.0'='c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe' [2006-10-23 620152]'ccApp'='c:\program files\Common Files\Symantec Shared\ccApp.exe' [2005-10-04 48752]'vptray'='c:\progra~1\SYMANT~1\VPTray.exe' [2005-11-15 85744]'SunJavaUpdateSched'='c:\program files\Common Files\Java\Java Update\jusched.exe' [2010-01-11 246504]'QuickTime Task'='c:\program files\QuickTime\qttask.exe' [2009-11-11 417792]'iTunesHelper'='c:\program files\iTunes\iTunesHelper.exe' [2010-02-15 141608]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2010-1-18 295606]Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Authentication Packages    REG_MULTI_SZ       msv1_0 wvauth[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]'DisableMonitoring'=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\Network Diagnostic\xpnetdiag.exe'='%windir%\system32\sessmgr.exe'='c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE'='c:\Program Files\Windows Live\Messenger\wlcsdk.exe'='c:\Program Files\Windows Live\Messenger\msnmsgr.exe'='c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe'='c:\app\eclipse\eclipse.exe'='c:\Program Files\Java\jre1.5.0_22\bin\java.exe'=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]'3389:TCP'= 3389:TCP:@xpsp2res.dll,-22009'3587:TCP'= 3587:TCP:Windows Peer-to-Peer Grouping'3540:UDP'= 3540:UDP:Peer Name Resolution Protocol (PNRP)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]'AllowInboundEchoRequest'= 1 (0x1)R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [1/14/2010 5:50 AM 24064]R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [4/25/2008 12:16 PM 14336]R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [1/14/2010 3:13 AM 2066968]R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [1/14/2010 5:50 AM 157152]R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/4/2010 8:03 PM 102448]S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 2:27 PM 169200][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]p2psvc    REG_MULTI_SZ       p2psvc p2pimsvc p2pgasvc PNRPSvc..------- Supplementary Scan -------.uStart Page = hxxp://www.msn.com/uInternet Settings,ProxyOverride = *.localIE: Append to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.htmlIE: Convert link target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlIE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlIE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlIE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlIE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlIE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlIE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.htmlIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000FF - ProfilePath - c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/FF - component: c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dllFF - component: c:\documents and settings\kellyannch\Application Data\Mozilla\Firefox\Profiles\cnc6ylpc.default\extensions	witternotifier@naan.net\platform\WINNT\components
sTwitterFoxSign.dllFF - plugin: c:\program files\Mozilla Firefox\plugins
patgpc.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\NPcol400.dllFF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\---- FIREFOX POLICIES ----c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgbaam7a8h', true); c:\program files\Mozilla Firefox\greprefs\all.js - pref('network.IDN.whitelist.xn--mgberp4a5d4ar', true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref('dom.ipc.plugins.enabled', false);.- - - - ORPHANS REMOVED - - - -WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)**************************************************************************scanning hidden processes ...  scanning hidden autostart entries ... scanning hidden files ...  scan completed successfullyhidden files: **************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]'ImagePath'='\'c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\' --defaults-file=\'c:\program files\MySQL\MySQL Server 5.0\my.ini\' MySQL'.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(848)c:\windows\system32\Ati2evxx.dll- - - - - - - > 'lsass.exe'(904)c:\windows\system32\wvauth.dllc:\windows\system32\WININET.dllc:\program files\Bonjour\mdnsNSP.dll.Completion time: 2010-09-29  13:22:58ComboFix-quarantined-files.txt  2010-09-29 17:22Pre-Run: 461,349,072,896 bytes freePost-Run: 461,376,602,112 bytes free- - End Of File - - 8AA6309A50D0B52945C4935BE25E96DB

kevinf80_1d0ac6 · Answer

Hiya pcu1976,

Combofix never spat two logs out, you ran it the first time at 13:18 today and the second time at 13:36 today. If you want to play games do it elswhere, we are inundated with requests for help and helpers are very thin on the ground. I only come here from my home site to help out for that very reason.

Proceed as follows please :-

Step 1

We need to install the Recovery Console. This will help us restore your system in the event of a serious crash. It's very simple to complete and will only take a few moments. It may also be useful in the future.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP2 or SP3, use the SP2 package.

Transfer all files you just downloaded, to the desktop of the infected computer.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

user posted image

Drag the setup package onto ComboFix.exe and drop it.
Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console

at the next prompt, click 'NO' as we don`t need to run CF at this time.

Step 2

user posted image

Please download Malwarebytes Anti-Malware and save it to your desktop.
Alernative D/L mirror
Alternative D/L mirror

Double Click mbam-setup.exe to install the application. If you already have it installed just update and run the quick scan please.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Step 3

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on to download the ESET Smart Installer. Save it to your desktop.
Double click on the icon on your desktop.

Check
Click the button.
Accept any security warnings from your browser.
Check
Push the Start button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push
Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the button.
Push

You can refer to this animation by neomage if needed.
Frequently asked questions available Here

What i`d like in your reply :-

Confirmation Recovery console installed OK
Log from Malwarebytes
Log from ESET
System review, improvements? issues?

Kevin

psu1976 · Answer

I'm sorry. I know you're inundated and I truly appreciate your help. I mis-spoke in my reply above in my attempt to reply fast. I apologize if you got the wrong impression of me. Again, I very much appreciate that you are willing to help me and the other users. You are performing a selfless act and you should be recognized for that.

Recovery console installed OK

Updated MalwareBytes, and ran a quick scan:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4717

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/29/2010 3:29:04 PM
mbam-log-2010-09-29 (15-29-04).txt

Scan type: Quick scan
Objects scanned: 170130
Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Log from ESET (nothing popped up after the scan, but I got log.txt from C:\Program Files\ESET\ESET Online Scanner)

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=d2bd1c687eaf854cb8f5c01658f752fe
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-09-29 09:22:13
# local_time=2010-09-29 05:22:13 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=128855
# found=0
# cleaned=0
# scan_time=6278

No issues with installation of Recovery console or the MB and ESET scans. System is running well. Performed Google searches for at least 60 minutes and was not redirected to any incorrect sites. No new issues.

Thank you so much for your time and effort and walking me through these steps. It appears as though things are back to normal but if there is anything else I can provide based on my latest steps, please let me know. Again, I am truly grateful.

kevinf80_1d0ac6 · Answer

Hiya pcu1976,Your logs and observations indicate a clean system, nice work. No worries on the misunderstanding i`ll always help if needed. Proceed as follows please :-Step 1Remove Combofix now that we're done with it Please press the Windows Key and R on your keyboard. This will bring up the Run... command. Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the 'x' and '/') Please follow the prompts to uninstall Combofix. You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself. The above procedure will delete the following: ComboFix and its associated files and folders. VundoFix backups, if present The C:_OtMoveIt folder, if present Reset the clock settings. Hide file extensions, if required. Hide System/Hidden files, if required. Reset System Restore. Step 2 Download OTC by OldTimer and save it to your desktop. Alternative mirror Double click icon to start the program. If you are using Vista, please right-click and choose run as administrator Then Click the big button. You will get a prompt saying 'Being Cleanup Process'. Please select Yes. Restart your computer when prompted. Step 3From Add/Remove Programs via the Control Panel uninstall the following:Adobe Flash Player 9HijackThis 2.0.2Step 4You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 21. Go to Sun Java Scroll down to where it says 'JDK 6 Update 21 (JDK or JRE)' Click the orange Download JRE button to the right In the Platform box choose Windows. Check the box to Accept License Agreement and click Continue. Click on Windows Offline Installation, click on the link under it which says 'jre-6u21-windows-i586.exe' and save the downloaded file to your desktop. Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions. Installing this update will automatically remove old version 6 update 10 and above. Reboot your computer Step 5You have CCleaner installed, please run the cleaner section now.Step 6 Click here to download HJTInstaller Version 2.0.4 Save HJTInstaller 2.0.4 to your desktop. Doubleclick on the HJTInstall.exe icon on your desktop. By default it will install to C:\Program Files\Trend Micro\HijackThis. Click on Install. It will create a HijackThis icon on the desktop. Once installed, it will launch Hijackthis. Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad. Click on 'Edit > Select All' then click on 'Edit > Copy' to copy the entire contents of the log. Come back here to this thread and Paste the log in your next reply. DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required. What i`d like in your reply :- Confirmation all above completed OK, especially the Combofix uninstall Log from HJT System review, any issues? Kevin

psu1976 · Answer

Thanks Kevin.I have uninstalled Combofix.
I also ran OTC and ran "clean up", rebooted when prompted.
I removed Adobe Flash Player 9 and HijackThis 2.0.2
I updated Java to Version 6 Update 21, then rebooted.
Ran the CC Cleaner

Downloaded latest HJT and below is the log. (system review below log). I realized that after I rebooted from the Java update, my Norton's Symantec auto-protect gets enabled by default and I didn't notice until after I ran HJT. I hope that didn't effect the scan. If it did, or if I need to do something else, let me know.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:43:57 PM, on 9/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\tcpsvcs.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Citrix\GoToMeeting\457\g2mstart.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe
C:\Program Files\Citrix\GoToMeeting\457\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\457\g2mlauncher.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\kellyannch\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [picon] "C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup
O4 - HKLM\..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12
O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
O4 - HKLM\..\Run: [DellControlPoint] "C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
O4 - HKLM\..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [GoToMeeting] "C:\Program Files\Citrix\GoToMeeting\457\g2mstart.exe" "/Trigger RunAtLogon"
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263847315659
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tshamrock.corp
O17 - HKLM\Software\..\Telephony: DomainName = tshamrock.corp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tshamrock.corp
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NTRU TSS v1.2.1.29 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 12877 bytes

Everything seems to be working great! No bad searches on any search engine - Google, Yahoo, Bing. No redirects. No new issues and system is running fast. I think you have fixed everything! You have been so helpful. Please let me know if there is a paypal support link that I can donate to. And if there's anything else you need, just let me know.

Thanks again,
Kris

kevinf80_1d0ac6 · Answer

Hi Kris,

Thanks for the reply and requested information, everything is looking good. Knowing i`ve helped and your gratitude is the only reward I need, but thankyou for your kind offer.

Your latest logs are clean and you say that your system is running well, it would be an excellent idea to keep it that way. The following advice will go along way to keeping you secure so that you can enjoy safe and happy surfing.

Here are some tips to reduce the potential for malware infection in the future:

Make proper use of your antivirus and firewall

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, NEVER turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

You will have several programs installed, these maybe outdated and vulnerable to exploits also. To be certain, please run the free online scan by Secunia, available Here Before clicking the Start scan button, please check the box for the option Enable thorough system inspection. Just below the "Scan Options:" section, you'll see the status of what's currently processing.... user posted image

...when the scan completes, the message "Detection completed successfully" will appear in the Programs/Result section. For each problem detected, Secunia will offer a "Solution" option. Please follow those instructions to download updated versions of the programs as recommended by Secunia.

Use a safer web browser

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:

Firefox,

Opera, and

Chrome.

All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial HERE which will help you to make IE MUCH safer.

These browser add-ons will help to make your browser safer:

Web of Trust warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for Firefox and Internet Explorer.

Green to go,
Yellow for caution, and
Red to stop.

Available for Firefox only. NoScript helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at THIS article.

Here a couple of links by two security experts that will give some excellent tips and advice.
So how did I get infected in the first place by Tony Klein
How to prevent Malware by Miekiemoes
Finally this link HERE will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Please reply so I know you have read this, its been a pleasure to work with you.
Take care,

Kevin

Virus & Spyware

Google browser redirects / malware issues

Was this post helpful?