Links? [Possible Browser Hijacker]

Lockey123 · 31-12-2012 11:19pm #1

http://imageshack.us/photo/my-images/41/boardswl.jpg

Anyone else getting these?
Random words in posts are highlighted in blue like links.
They seem to be spam or something.
When I hold my mouse over them they put up like in the picture.

Any idea what's going on?

BuffyBot · 31-12-2012 11:31pm

Sounds like you've got yourself a Browser Hijacker http://en.wikipedia.org/wiki/Browser_hijacker

If you have anti-virus/Malware software, make sure it's up to date and do a scan.

Lockey123 · 31-12-2012 11:57pm

Nice one thanks

Ken. · 01-01-2013 12:27am

I've been getting the same thing on boards for the last 2 days. I thought it was just me. It's happening on boards only. I run firefox 17.0.1, Windows 7 home premium 32 bit.

Lockey123 · 01-01-2013 12:30am

Ran Malwarebytes and SuperAntispyware scans.
Still getting the same ads.

Any advice on what to do next?

Ken. · 01-01-2013 12:33am

Ive cleared the cache,cookies,ran malwarebytes and no joy. Did you download anything in the last 2 days Lockey123?. What browser do you use?.

Lockey123 · 01-01-2013 12:35am

Using Chrome. Only thing I downloaded was an album from a legit website

Ken. · 01-01-2013 12:38am

Lockey123 wrote: »

Using Chrome. Only thing I downloaded was an album from a legit website

And I've only updated an add on for firefox 5 days ago. Downloaded nothing.

Lockey123 · 01-01-2013 12:39am

Curiouser and curiouser

mp22 · 01-01-2013 5:26pm

Are either of you using adblock plus for firefox/chrome.

Ken. · 01-01-2013 5:32pm

Yes. I am.

Lockey123 · 01-01-2013 5:59pm

Yep so am I

mp22 · 01-01-2013 7:55pm

Were the malware/super antispyware scans done in safemode.

Ken. · 01-01-2013 7:57pm

Mine were.

Lockey123 · 01-01-2013 8:06pm

Mine weren't

mp22 · 01-01-2013 8:15pm

Well looks like we will have to wait for the expert (AJS) to offer some advice.The only other thing I can think off is to run Ccleaner

Ken. · 01-01-2013 8:19pm

mp22 wrote: »

Well looks like we will have to wait for the expert (AJS) to offer some advice.The only other thing I can think off is to run Ccleaner

Done that. Still there.

areyawell · 01-01-2013 8:22pm

Disable and remove all addons in Chrome and Firefox. Run Malwares Anti Malware and ensure the browser is closed when running it.

Just sounds like a bad add-on and probably not malware or virus, but do scans anyway.

ASJ112 · 01-01-2013 9:36pm

Run DDS and post its log too

http://www.bleepingcomputer.com/download/dds/

Ken. · 01-01-2013 9:51pm

Is this what you need ASJ.
Also thanks in advance for any help.

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3063.1771 [GMT 0:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Windows\PixArt\PAC7302\Monitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files\Microsoft Games\solitaire\solitaire.exe
C:\Windows.old\Program Files\Mozilla Firefox\firefox.exe
C:\Windows.old\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\svchost.exe -k HPService
.
============== Pseudo HJT Report ===============
.
uURLSearchHooks: {b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} - <orphaned>
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [ventrilo_srv.exe] c:\program files\ventsrv\ventrilo_srv.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [PAC7302_Monitor] c:\windows\pixart\pac7302\Monitor.exe
StartupFolder: c:\users\ken\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
TCP: NameServer = 89.101.160.5 89.101.160.4
TCP: Interfaces\{57C52728-7E96-49A6-B3E9-C106A6B2AF25} : DHCPNameServer = 89.101.160.5 89.101.160.4
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\
FF - prefs.js: browser.startup.homepage - chrome://superstart/content/index.html
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\ken\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1168638.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2012-12-02 08:49; superstart@enjoyfreeware.org; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\superstart@enjoyfreeware.org
FF - ExtSQL: 2012-12-02 09:06; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF - ExtSQL: 2012-12-02 09:08; fbp@fbpurity.com; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\fbp@fbpurity.com.xpi
FF - ExtSQL: 2012-12-02 09:29; en-GB@dictionaries.addons.mozilla.org; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\en-GB@dictionaries.addons.mozilla.org
FF - ExtSQL: 2012-12-02 10:40; artur.dubovoy@gmail.com; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\artur.dubovoy@gmail.com.xpi
FF - ExtSQL: 2012-12-02 19:28; thumbnailZoom@dadler.github.com; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\thumbnailZoom@dadler.github.com.xpi
FF - ExtSQL: 2012-12-07 06:24; 50c18f0dab966@50c18f0dab99f.com; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\50c18f0dab966@50c18f0dab99f.com.xpi
FF - ExtSQL: 2012-12-12 15:08; pbupload@photobucket.com; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\pbupload@photobucket.com.xpi
FF - ExtSQL: 2013-01-01 18:32; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\ken\appdata\roaming\mozilla\firefox\profiles\qo02rlf8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]
R1 MpKsl256a80f9;MpKsl256a80f9;c:\programdata\microsoft\microsoft antimalware\definition updates\{8bbd4eea-6735-4da3-bee5-fdeb2066d2db}\MpKsl256a80f9.sys [2013-1-1 29904]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-8-30 99272]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2012-12-13 3290896]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2012-11-30 382824]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-9-12 287824]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-6-10 394856]
RUnknown MpKsl64a1551f;MpKsl64a1551f; [x]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-11-9 160944]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2012-12-2 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2012-3-8 1492840]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-12-3 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-12-2 1343400]
S4 IObitUnlocker;IObitUnlocker;c:\windows.old\program files\iobit\iobit unlocker\IObitUnlocker.sys [2012-11-16 28016]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2013-01-01 19:11:18 60872 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8bbd4eea-6735-4da3-bee5-fdeb2066d2db}\offreg.dll
2013-01-01 19:11:18 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8bbd4eea-6735-4da3-bee5-fdeb2066d2db}\MpKsl256a80f9.sys
2013-01-01 19:10:19 6812136 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{8bbd4eea-6735-4da3-bee5-fdeb2066d2db}\mpengine.dll
2013-01-01 12:00:43 6812136

w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-12-31 23:12:54 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-29 21:18:02

d

w- c:\program files\PeerBlock
2012-12-27 21:11:38

d

w- c:\users\ken\appdata\roaming\NVIDIA
2012-12-27 21:08:03

d

w- c:\programdata\Vizzed
2012-12-22 15:20:15

d

w- c:\program files\EA SPORTS
2012-12-22 13:23:53 89600 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
2012-12-22 12:43:09

d

w- c:\users\ken\appdata\local\ElevatedDiagnostics
2012-12-21 09:30:03 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-21 09:30:03 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-19 11:10:06 9373032 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-12-19 11:10:06 884072 ----a-w- c:\windows\system32\nvhdagenco3220103.dll
2012-12-19 11:10:06 7819016 ----a-w- c:\windows\system32\nvcuda.dll
2012-12-19 11:10:06 6149904 ----a-w- c:\windows\system32\nvopencl.dll
2012-12-19 11:10:06 28008 ----a-w- c:\windows\system32\nvhdap32.dll
2012-12-19 11:10:06 20335976 ----a-w- c:\windows\system32\nvoglv32.dll
2012-12-19 11:10:06 1874280 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-12-19 11:10:06 17559912 ----a-w- c:\windows\system32\nvcompiler.dll
2012-12-19 11:10:06 149352 ----a-w- c:\windows\system32\drivers\nvhda32v.sys
2012-12-19 11:10:02 2606440 ----a-w- c:\windows\system32\nvcuvid.dll
2012-12-15 13:47:22

d

w- c:\users\ken\appdata\local\Adobe_Systems_Incorporate
2012-12-15 10:37:17

d

w- c:\users\ken\appdata\local\{29F16096-64BB-46E9-927D-C8B910257BF4}
2012-12-15 10:37:16

d

w- c:\users\ken\appdata\local\{BD82CB50-A26F-4BBD-A202-26ACA10DA33E}
2012-12-10 12:55:04

d

w- c:\users\ken\appdata\roaming\Malwarebytes
2012-12-10 12:54:36

d

w- c:\programdata\Malwarebytes
2012-12-10 12:54:33

d

w- c:\program files\Malwarebytes' Anti-Malware
2012-12-09 01:26:45

d

w- c:\program files\ddpoker3
2012-12-09 01:21:52

d

w- c:\users\ken\appdata\local\{DAD133B3-248D-4033-8A33-AF270D19151C}
2012-12-09 01:21:41

d

w- c:\users\ken\appdata\local\{66D28D33-1A64-4038-9E60-A8934FD713A1}
2012-12-09 01:21:40

d

w- c:\users\ken\appdata\roaming\Windows Live Writer
2012-12-09 01:21:40

d

w- c:\users\ken\appdata\local\Windows Live Writer
2012-12-09 01:21:36

d

w- c:\users\ken\appdata\local\{0B61F81A-0E51-42C8-96B1-7E4EF2C5EF04}
2012-12-09 01:21:35

d

w- c:\users\ken\appdata\local\{F63B4C35-16E9-48D1-BA74-DE7D566A7200}
2012-12-09 01:21:31

d

w- c:\users\ken\Tracing
2012-12-08 16:55:33

d

w- c:\program files\VentSrv
2012-12-08 14:08:04

d

w- c:\users\ken\appdata\roaming\Unity
2012-12-08 13:40:38

d

w- c:\users\ken\appdata\local\Unity
2012-12-05 16:59:11

d

w- c:\users\ken\appdata\roaming\OpenOffice.org
2012-12-04 19:22:06 740840

w- c:\programdata\microsoft\microsoft antimalware\definition updates\{424f6094-48ef-48cd-b840-a1298eaf177a}\gapaengine.dll
2012-12-04 14:26:55 193536 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-12-04 14:26:54 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-12-03 19:26:34

d

w- c:\windows\system32\SPReview
2012-12-03 19:25:35

d

w- c:\windows\system32\EventProviders
2012-12-03 19:06:59 974336 ----a-w- c:\windows\system32\sppobjs.dll
2012-12-03 19:05:59 89600 ----a-w- c:\windows\system32\wbem\WmiApRpl.dll
2012-12-03 19:04:56 189952 ----a-w- c:\windows\system32\wdscore.dll
2012-12-03 19:04:30 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-12-03 19:04:30 363008 ----a-w- c:\windows\system32\wbemcomn.dll
2012-12-03 19:04:30 189952 ----a-w- c:\program files\windows portable devices\sqmapi.dll
2012-12-03 19:04:15 189952 ----a-w- c:\windows\system32\sqmapi.dll
.
==================== Find3M ====================
.
2012-12-11 18:29:20 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-11 18:29:20 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-12-03 19:57:32 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-12-03 15:39:40 889192 ----a-w- c:\windows\system32\nvdispgenco32.dll
2012-12-03 15:39:40 2496976 ----a-w- c:\windows\system32\nvapi.dll
2012-12-03 15:39:40 15122280 ----a-w- c:\windows\system32\nvd3dum.dll
2012-12-03 15:39:40 12603960 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-12-03 15:39:40 1011048 ----a-w- c:\windows\system32\nvdispco32.dll
2012-12-02 10:09:36 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-12-02 10:09:35 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-12-02 10:09:35 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-12-01 04:38:18 2869608 ----a-w- c:\windows\system32\nvsvc.dll
2012-12-01 04:38:13 3984744 ----a-w- c:\windows\system32\nvcpl.dll
2012-12-01 04:37:55 645480 ----a-w- c:\windows\system32\nvvsvc.exe
2012-12-01 04:37:55 62312 ----a-w- c:\windows\system32\nvshext.dll
2012-12-01 04:37:55 108392 ----a-w- c:\windows\system32\nvmctray.dll
2012-11-30 22:43:52 438632 ----a-w- c:\windows\system32\nvStreaming.exe
2012-11-22 02:56:02 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-11-09 04:42:49 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-02 05:11:31 376832 ----a-w- c:\windows\system32\dpnet.dll
2012-10-16 07:39:52 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-10 21:14:40 52584 ----a-w- c:\windows\system32\OpenCL.dll
2012-10-04 16:47:18 169984 ----a-w- c:\windows\system32\winsrv.dll
2012-10-04 16:43:05 293376 ----a-w- c:\windows\system32\KernelBase.dll
2012-10-04 14:57:58 271360 ----a-w- c:\windows\system32\conhost.exe
2012-10-04 14:41:50 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-10-04 14:41:50 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-04 14:41:50 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-04 14:41:50 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
.
============= FINISH: 20:48:50.15 ===============

Lockey123 · 01-01-2013 9:56pm

DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 27/10/2010 13:02:38
System Uptime: 01/01/2013 10:33:48 (10 hours ago)
.
Motherboard: Acer | | JE51_MV
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz | uPGA-478 | 1196/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 285 GiB total, 171.102 GiB free.

is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP203: 12/12/2012 07:14:05 - Windows Update
RP204: 16/12/2012 19:00:25 - Windows Backup
RP205: 25/12/2012 09:48:05 - Windows Update
RP206: 30/12/2012 19:00:29 - Windows Backup
.
==== Installed Programs ======================
.
Accounts
Acer Backup Manager
Acer Crystal Eye Webcam
Acer ePower Management
Acer eRecovery Management
Acer GameZone Console
Acer Registration
Acer ScreenSaver
Acer Updater
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Help Center 2.1
Adobe Photoshop Elements 5.0
Adobe Reader X (10.1.4)
Adobe Shockwave Player 11.6
Airport Mania First Flight
Amazonia
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.3.13 (Unicode)
Audible Download Manager
Babylon toolbar on IE
Backup Manager Basic
Bing Bar
Bonjour
Cake Mania
CyberLink PowerDVD 9
CyberView CS - ImageBox 1.1d
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
DivX Setup
Dream Day First Home
eSobi v2
ETDWare PS/2-x64 7.0.6.5_WHQL
ExpressFiles
F.lux
Free Video Converter V 3.1
Galapago
Google Chrome
Google Earth Plug-in
Google SketchUp 8
Google Toolbar for Internet Explorer
Google Update Helper
Graboid Video 2.05
Heroes of Hellas
Hi-Rez Studios Authenticate and Update Service
HP Photo Creations
HP Photosmart 5510d series Basic Device Software
HP Photosmart 5510d series Help
HP Photosmart 5510d series Product Improvement Study
HP Update
iCloud
Identity Card
Intel(R) Graphics Media Accelerator Driver
Intel(R) Rapid Storage Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 25
Java(TM) 6 Update 31 (64-bit)
Java(TM) 7 Update 4 (64-bit)
Junk Mail filter update
Launch Manager
LogMeIn Hamachi
Malwarebytes Anti-Malware version 1.70.0.1100
Merriam Websters Spell Jam
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office Home and Student 2010 - English
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MobileMe Control Panel
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
MyWinLocker
MyWinLocker Suite
Norton 360
Norton Online Backup
Notepad++
NTI Media Maker 9
Octoshape add-in for Adobe Flash Player
OVTScanner_X64
Poker Pop
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
RealUpgrade 1.1
Safari
Sage Instant V16 Workbooks
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition
Shredder
Sky Go Desktop
Skype™ 5.10
Spin & Win
Spotify
SUPERAntiSpyware
swMSM
The Official Driver Theory Test 5th Edition (Revised October 2011)
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
VC80CRTRedist - 8.0.50727.6195
VirtualDJ Home FREE
VLC media player 1.0.1
Web Assistant 2.0.0.485
Web Optimizer
Welcome Center
Windows iLivid Toolbar
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 4.00 (32-bit)
ZoomEx
.
==== Event Viewer Messages From Past Week ========
.
31/12/2012 10:52:39, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
29/12/2012 21:34:45, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.5. The computer with the IP address 192.168.1.4 did not allow the name to be claimed by this computer.
27/12/2012 11:31:06, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 25.93.177.19. The computer with the IP address 25.191.66.65 did not allow the name to be claimed by this computer.
26/12/2012 20:16:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.
01/01/2013 14:20:46, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RpcSs service.
01/01/2013 14:06:11, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
01/01/2013 00:47:16, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.
.
==== End Of File ===================

ASJ112 · 01-01-2013 10:05pm

Ken open firefox, click the help tab at the top, click "Restart with add-ons disabled". Go to boards.ie and tell me the popup still occurs

Ken. · 01-01-2013 10:10pm

Seems to be gone.

CaSCaDe711 · 01-01-2013 10:10pm

After updating your anti virus and anti malware software, do scans in Safe Mode.

Lockey123 · 01-01-2013 10:11pm

Disabled all extensions on chrome. They seem to be gone.
Thanks for all the help

CORaven · 05-01-2013 12:46am

Interesting. As a matter of interest, did both of ye have the extension/addin X-notifier or WebMail Notifier installed on yer browsers? That could be the problem.

Ken. · 05-01-2013 1:16am

CORaven wrote: »

Interesting. As a matter of interest, did both of ye have the extension/addin X-notifier or WebMail Notifier installed on yer browsers? That could be the problem.

Forgive my ignorance but what are they. I'm gonna say i don't have them

CORaven · 05-01-2013 1:44am

ken wrote: »

Forgive my ignorance but what are they. I'm gonna say i don't have them

They are both email checking extensions I use developed by the same guy - X-notifier for Chrome and WebMail Notifier for Firefox. In a previous version he added in 3rd party software that did more or less the same problem you had - added links and pictures to webpages for advertising. The latest updated removed them due to widespread disapprovement by the community that use the extensions. Whatever 3rd party software he had, some extension ye were using is using it too.

Ken. · 05-01-2013 1:50am

I don't have any email notifier.

Links? [Possible Browser Hijacker]

Comments