Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Audio Ads and popups, unable to remove

  • 06-08-2010 11:52am
    #1
    Registered Users, Registered Users 2 Posts: 1,987 ✭✭✭


    I've have audio ads playing over the speakers randomly every 15 minutes or so and had popups all the time which were running under a corrupt install of internet explorer, the process was iexplore.exe, when I re-installed internet explorer the popups stopped which was ok, but the audio ads are still occurring.

    I've run a full scan will spybot, malwarebytes, spyhunter and AVG free but none of them have found anything.

    I saw other posts on the forum with regard to this problem but none of the suggestions worked.

    This is starting to really annoy me now, can anyone help me? Thanks for your help in advance.


Comments

  • Site Banned Posts: 1,167 ✭✭✭ASJ112


    Download ComboFix here :

    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them

      Click me

    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    RcAuto1.gif


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    whatnext.png


    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.


  • Registered Users, Registered Users 2 Posts: 1,987 ✭✭✭Ziycon


    Please find below the results of combofix being ran.


    ComboFix 10-08-05.06 - admin 06/08/2010 16:17:09.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.353.1033.18.2046.1528 [GMT 1:00]
    Running from: c:\documents and settings\admin\My Documents\Downloads\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\admin\Application Data\.#
    c:\documents and settings\admin\Application Data\.#\MBX@660@A141A8.###
    c:\documents and settings\admin\Application Data\.#\MBX@660@A141D8.###
    c:\documents and settings\admin\Application Data\.#\MBX@660@A14208.###
    c:\program files\INSTALL.LOG
    c:\windows\system32\images
    c:\windows\system32\images\toolbar\calendar.gif
    c:\windows\system32\images\toolbar\crlogo.gif
    c:\windows\system32\images\toolbar\export.gif
    c:\windows\system32\images\toolbar\export_over.gif
    c:\windows\system32\images\toolbar\exportd.gif
    c:\windows\system32\images\toolbar\First.gif
    c:\windows\system32\images\toolbar\first_over.gif
    c:\windows\system32\images\toolbar\Firstd.gif
    c:\windows\system32\images\toolbar\gotopage.gif
    c:\windows\system32\images\toolbar\gotopage_over.gif
    c:\windows\system32\images\toolbar\gotopaged.gif
    c:\windows\system32\images\toolbar\grouptree.gif
    c:\windows\system32\images\toolbar\grouptree_over.gif
    c:\windows\system32\images\toolbar\grouptreed.gif
    c:\windows\system32\images\toolbar\grouptreepressed.gif
    c:\windows\system32\images\toolbar\Last.gif
    c:\windows\system32\images\toolbar\last_over.gif
    c:\windows\system32\images\toolbar\Lastd.gif
    c:\windows\system32\images\toolbar\Next.gif
    c:\windows\system32\images\toolbar\next_over.gif
    c:\windows\system32\images\toolbar\Nextd.gif
    c:\windows\system32\images\toolbar\Prev.gif
    c:\windows\system32\images\toolbar\prev_over.gif
    c:\windows\system32\images\toolbar\Prevd.gif
    c:\windows\system32\images\toolbar\print.gif
    c:\windows\system32\images\toolbar\print_over.gif
    c:\windows\system32\images\toolbar\printd.gif
    c:\windows\system32\images\toolbar\Refresh.gif
    c:\windows\system32\images\toolbar\refresh_over.gif
    c:\windows\system32\images\toolbar\refreshd.gif
    c:\windows\system32\images\toolbar\Search.gif
    c:\windows\system32\images\toolbar\search_over.gif
    c:\windows\system32\images\toolbar\searchd.gif
    c:\windows\system32\images\toolbar\up.gif
    c:\windows\system32\images\toolbar\up_over.gif
    c:\windows\system32\images\toolbar\upd.gif
    c:\windows\system32\images\tree\begindots.gif
    c:\windows\system32\images\tree\beginminus.gif
    c:\windows\system32\images\tree\beginplus.gif
    c:\windows\system32\images\tree\blank.gif
    c:\windows\system32\images\tree\blankdots.gif
    c:\windows\system32\images\tree\dots.gif
    c:\windows\system32\images\tree\lastdots.gif
    c:\windows\system32\images\tree\lastminus.gif
    c:\windows\system32\images\tree\lastplus.gif
    c:\windows\system32\images\tree\Magnify.gif
    c:\windows\system32\images\tree\minus.gif
    c:\windows\system32\images\tree\minusbox.gif
    c:\windows\system32\images\tree\plus.gif
    c:\windows\system32\images\tree\plusbox.gif
    c:\windows\system32\images\tree\singleminus.gif
    c:\windows\system32\images\tree\singleplus.gif

    .
    \\.\PhysicalDrive0 - Bootkit Whistler was found and disinfected
    \\.\PhysicalDrive1 - Bootkit Whistler was found and disinfected
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    \Service_uac4pdt


    ((((((((((((((((((((((((( Files Created from 2010-07-06 to 2010-08-06 )))))))))))))))))))))))))))))))
    .

    2010-08-06 10:41 . 2010-05-21 13:14 221568
    w- c:\windows\system32\MpSigStub.exe
    2010-08-06 10:37 . 2010-08-06 10:37
    dc-h--w- c:\windows\ie8
    2010-08-06 10:32 . 2010-08-06 10:32
    d
    w- c:\program files\Windows Defender
    2010-08-06 00:12 . 2010-08-06 00:12
    d
    w- C:\$AVG
    2010-08-06 00:11 . 2010-08-06 00:11
    d
    w- c:\documents and settings\All Users\Application Data\avg9
    2010-08-05 23:39 . 2010-08-06 12:46
    d
    w- c:\program files\Enigma Software Group
    2010-08-05 22:39 . 2010-08-05 22:39
    d-sh--w- c:\documents and settings\NetworkService\PrivacIE
    2010-08-05 22:09 . 2010-08-05 22:09
    d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
    2010-07-31 09:27 . 2010-07-31 09:27
    d
    w- c:\documents and settings\admin\Local Settings\Application Data\Nero
    2010-07-26 22:20 . 2010-07-26 23:31
    d
    w- C:\temp
    2010-07-25 17:43 . 2010-07-25 17:43
    d-sh--w- c:\documents and settings\LocalService\PrivacIE
    2010-07-25 17:42 . 2010-07-25 17:42
    d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-07-25 17:39 . 2010-07-25 17:39
    d-sh--w- c:\documents and settings\admin\IETldCache
    2010-07-25 17:27 . 2010-08-06 10:34
    d
    w- c:\windows\ie8updates
    2010-07-25 17:22 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2010-07-25 17:22 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2010-07-25 17:22 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2010-07-25 17:22 . 2010-04-16 11:43 41984 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2010-07-18 10:59 . 2010-07-18 10:59
    d
    w- c:\documents and settings\admin\Application Data\Malwarebytes
    2010-07-18 10:59 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-07-18 10:59 . 2010-07-18 10:59
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-07-18 10:59 . 2010-07-18 10:59
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-07-18 10:59 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-08-06 00:27 . 2008-10-12 20:00
    d
    w- c:\program files\Common Files\Adobe
    2010-08-06 00:12 . 2009-08-05 22:20 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2010-08-06 00:12 . 2009-08-05 22:19 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2010-08-06 00:12 . 2009-08-05 22:19 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2010-08-06 00:12 . 2009-08-05 22:20 12536 ----a-w- c:\windows\system32\avgrsstx.dll
    2010-08-06 00:11 . 2009-08-05 22:19
    d
    w- c:\program files\AVG
    2010-08-05 23:31 . 2009-01-16 19:31
    d
    w- c:\program files\Common Files\Apple
    2010-08-05 22:21 . 2010-04-11 20:49
    d
    w- c:\program files\Evolution
    2010-08-03 09:42 . 2008-09-15 22:18
    d
    w- c:\documents and settings\admin\Application Data\Skype
    2010-08-03 09:05 . 2008-09-15 22:19
    d
    w- c:\documents and settings\admin\Application Data\skypePM
    2010-07-31 09:31 . 2009-04-05 15:15
    d
    w- c:\documents and settings\admin\Application Data\BitTorrent
    2010-07-31 02:50 . 2009-08-25 18:31
    d
    w- c:\documents and settings\admin\Application Data\.purple
    2010-07-31 00:55 . 2010-07-31 00:55 2157 ----a-w- c:\documents and settings\admin\Application Data\.purple\certificates\x509\tls_peers\omega.contacts.msn.com
    2010-07-29 19:48 . 2008-09-15 13:23
    d
    w- c:\documents and settings\admin\Application Data\FileZilla
    2010-07-29 19:44 . 2009-07-10 20:39
    d
    w- c:\documents and settings\admin\Application Data\EditPlus 3
    2010-06-28 22:27 . 2008-09-14 00:40 25424 ----a-w- c:\documents and settings\admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-06-28 22:16 . 2008-09-14 18:36
    d
    w- c:\program files\Common Files\Nero
    2010-06-28 22:15 . 2008-09-14 18:36
    d
    w- c:\documents and settings\All Users\Application Data\Nero
    2010-06-24 21:47 . 2010-06-24 21:47
    d
    w- c:\program files\MSXML 4.0
    2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeARM.exe
    2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AdobeExtractFiles.dll
    2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\ReaderUpdater.exe
    2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\9.2\ARM\ARM Update\AcrobatUpdater.exe
    2010-05-30 22:36 . 2010-05-30 22:36 2095 ----a-w- c:\documents and settings\admin\Application Data\.purple\certificates\x509\tls_peers\login.live.com
    2008-08-16 17:42 . 2008-08-16 17:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 17:42 . 2008-08-16 17:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 17:42 . 2008-08-16 17:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 17:42 . 2008-08-16 17:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 17:43 . 2008-08-16 17:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 17:42 . 2008-08-16 17:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 17:42 . 2008-08-16 17:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 08:41 . 2008-05-21 08:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 08:41 . 2008-05-21 08:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 08:41 . 2008-05-21 08:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 13:58 . 2008-06-05 13:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 17:42 . 2008-08-16 17:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2008-05-16 86016]
    "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2008-05-16 13529088]
    "SoundMan"="SOUNDMAN.EXE" [2004-11-15 77824]
    "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-08-06 2065760]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2010-08-06 00:12 12536 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
    backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Monitor Apache Servers.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Monitor Apache Servers.lnk
    backup=c:\windows\pss\Monitor Apache Servers.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
    backup=c:\windows\pss\VPN Client.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2009-10-03 03:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    2008-12-12 07:31 1840424 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-06-05 12:39 292136 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232
    w- c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
    2008-12-02 14:29 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    2008-11-06 07:25 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    2008-05-16 13:01 1630208 ----a-w- c:\windows\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-05-26 16:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    2008-08-11 16:46 21741864 ----a-r- c:\program files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkypeClient]
    2005-05-06 20:54 57344 ----a-r- c:\program files\PDT\VoIPVoiceIntegration\VoIPVoice Integration.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
    2008-09-28 17:13 1271032 ----a-w- d:\steam\Steam.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2009-11-26 18:37 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "PnkBstrB"=2 (0x2)
    "PnkBstrA"=3 (0x3)
    "iPod Service"=3 (0x3)
    "CVPND"=3 (0x3)
    "aspnet_state"=3 (0x3)
    "Apple Mobile Device"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "d:\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
    "d:\\Games\\Sierra\\World at War\\wic.exe"=
    "d:\\Games\\Sierra\\World at War\\wic_online.exe"=
    "d:\\Games\\Sierra\\World at War\\wic_ds.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "d:\\Electronic Arts\\Battlefield Bad Company 2\\BFBC2Updater.exe"=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

    R0 nvcchflt;NVIDIA Disk Cache Filter Driver;c:\windows\system32\drivers\nvcchflt.sys [13/09/2008 20:42 16640]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [05/08/2009 23:19 216400]
    R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [05/08/2009 23:20 243024]
    R2 Apache2.2;Apache2.2;c:\apache\bin\httpd.exe [29/04/2006 18:32 20539]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [06/08/2010 01:11 308136]
    S1 SPARKEY;sparkey driver;c:\windows\system32\drivers\sparkey.sys [28/01/2010 00:27 12320]
    S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
    S3 Tomcat6;Apache Tomcat 6;c:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [14/05/2009 00:15 57344]
    .
    Contents of the 'Scheduled Tasks' folder

    2010-08-06 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://phpmyadmin/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    TCP: {709B3A86-134E-4F40-8F0D-1F205FC0CBFA} = 192.168.0.1
    FF - ProfilePath - c:\documents and settings\admin\Application Data\Mozilla\Firefox\Profiles\1neqhi7o.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.war.ie
    FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
    FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
    MSConfigStartUp-BitTorrent DNA - c:\program files\DNA\btdna.exe
    MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
    MSConfigStartUp-SpyHunter Security Suite - c:\program files\Enigma Software Group\SpyHunter\SpyHunter3.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-08-06 16:27
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
    "ImagePath"="\"c:\mysql\bin\mysqld-nt\" --defaults-file=\"c:\mysql\my.ini\" MySQL"
    .
    LOCKED REGISTRY KEYS

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6c,f9,a7,70,ef,c4,49,49,87,a2,b4,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6c,f9,a7,70,ef,c4,49,49,87,a2,b4,\

    [HKEY_USERS\S-1-5-21-1390067357-651377827-725345543-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:40,59,9c,88,94,62,aa,4a,f1,94,b3,e7,80,41,53,14,ff,a4,db,52,76,9e,16,
    4d,a9,35,e0,22,ed,fc,1a,a3,28,37,cd,a0,54,6b,a3,7d,78,b7,b7,51,b0,6d,7f,03,\
    "??"=hex:91,4f,06,7d,f8,d4,87,0b,59,ce,86,87,b6,82,42,07

    [HKEY_USERS\S-1-5-21-1390067357-651377827-725345543-1004\Software\SecuROM\License information*]
    "datasecu"=hex:29,88,03,df,3e,17,60,49,17,e3,9e,f7,4a,7a,f5,5d,38,11,a4,92,dc,
    d8,8d,92,9e,6f,e3,f0,41,80,2e,f8,30,c9,ff,35,76,f6,9b,00,fc,dd,c2,d9,e3,29,\
    "rkeysecu"=hex:6c,9e,a6,62,a4,b0,82,df,40,e4,0e,fe,d6,87,38,89
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(2696)
    c:\windows\system32\ieframe.dll
    c:\windows\system32\OneX.DLL
    c:\windows\system32\eappprxy.dll
    c:\windows\system32\webcheck.dll
    .
    Other Running Processes
    .
    c:\program files\AVG\AVG9\avgchsvx.exe
    c:\program files\AVG\AVG9\avgrsx.exe
    c:\program files\AVG\AVG9\avgcsrvx.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\mysql\bin\mysqld-nt.exe
    c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\program files\AVG\AVG9\avgnsx.exe
    c:\windows\System32\nvsvc32.exe
    c:\windows\system32\IoctlSvc.exe
    c:\windows\system32\wdfmgr.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\windows\SOUNDMAN.EXE
    .
    **************************************************************************
    .
    Completion time: 2010-08-06 16:34:07 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-08-06 15:34

    Pre-Run: 52,373,970,944 bytes free
    Post-Run: 52,382,990,336 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    - - End Of File - - A513370DD6643C23161D01577D8B2F8E


  • Site Banned Posts: 1,167 ✭✭✭ASJ112


    looks good


    Your logs are clean


    Follow these steps to uninstall Combofix and tools used in the removal of malware

    Uninstall ComboFix

    Remove Combofix now that we're done with it.
    • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
    • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
      CF_Uninstall-1.jpg
    • Please follow the prompts to uninstall Combofix.
    • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

    • Download OTC to your desktop and run it
    • Click Yes to beginning the Cleanup process and remove these components, including this application.
    • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.


    • Please read my guide on how to prevent malware and about safe computing here
    Thank you for your patience, and performing all of the procedures requested.


  • Registered Users, Registered Users 2 Posts: 1,987 ✭✭✭Ziycon


    Nice one, all clean now. Appreciated. :)


Advertisement