Firefox/IE hijacked can't run Malware/Spybot Please help!!

lilhurricane Crunchin' For Cures Premium,Mod join:2003-01-11 Purple Zone clubs:	reply to dkappaman (topic move) Firefox/IE hijacked can't run Malware/Spybot Please Moderator Action The post that was here, has been moved to a new topic .. »Firefox/IE hijacked can't run Malware/Spybot Please help!!
	to forum · permalink · · 2009-06-09 16:46:08 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman Re: Firefox/IE hijacked can't run Malware/Spybot Please help!! Oops, I missed seeing your response! Glad to hear everything is sorted for you And Glad we could help!
	to forum · permalink · · 2009-04-11 10:16:36 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman Removed all versions of java, installed newest version. Deleted my restore points and rebooted. Created a new system restore point as of today. Thanks so much for your help, my computer is running great!
	to forum · permalink · · 2009-04-09 19:32:05 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman Nope As long as you followed these final cleanup steps »Re: Firefox/IE hijacked can't run Malware/Spybot Please help!! and got your old versions of Sun Java removed, you should be good to go!
	to forum · permalink · · 2009-04-08 08:52:24 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman so everything seems to be running great is there anything else i should do?
	to forum · permalink · · 2009-04-07 13:58:34 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman Great! Thanks for the confirm
	to forum · permalink · · 2009-04-04 09:42:16 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman all set extracted right to service packs
	to forum · permalink · · 2009-04-04 07:53:35 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL 1 edit	reply to dkappaman Here (attached file in a zip file) is your original file mst123.dll. It is clean and legit. Extract the contents to the directory you removed it from (I believe you said it was a servicepack folder). The bad one would have been in the system32 folder (not anywhere else) and it was probably already removed. I had to put it into a zip file in order to upload it to you here. Please confirm when you have it and I'll then remove the attachment from this post Edit: Attachment removed, no longer needed -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2009 Proud Member of ASAP (Alliance of Security Analysis Professionals)
	to forum · permalink · · 2009-04-02 20:31:03 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman no my recycle bin was emptied after I deleted it can you please post it thanks
	to forum · permalink · · 2009-04-02 15:27:19 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL 1 edit	reply to dkappaman One more thing. You deleted the wrong file in a prior instruction, however, I also had you upload a copy of it to me. It was this one: quote: ok so my mst123.dll was in my servicepacks folder and not in the sysytem32 folder. I found it and deleted it to which I replied: quote: mst123.dll is a legitmate file in Service Packs. The bad one was only in the System32 directory, if still present. Many times malware masquerades with a file name identical to legitimate files but in a different location. If that file is still in your recycle bin, please put it back. (The legit mst123.dll belongs to the program NetMeeting - so in that directory if you see that is fine). If it is still present in the system32 folder it should NOT be there and that is the only one to delete. I asked you earlier to restore the file from the recycle bin if still there. Did you do that? If not, I can attach the legitmate copy of mst123.dll that you sent me. -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2009 Proud Member of ASAP (Alliance of Security Analysis Professionals)
	to forum · permalink · · 2009-04-02 08:42:23 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman Thanks, that looks good No signs of malware remaining. Now some other issues, like too many old versions of Sun Java and you only need the most current version. And too many toolbars got installed without your knowledge (more on that later. Sun Java Your Sun Java is very out of date and a security vulnerability! Old versions left on your pc, even after updating can be vulnerable to malware exploit. Go to Start / Control Panel and look in Add/Remove programs. Remove all old versions of Sun Java. They will appear in the "J's" J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100} J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} J2SE Runtime Environment 5.0 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150070} Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF} Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010} Then go get the latest up to date version here: http://www.java.com/en/download/manual.jsp But! Watch our for the (yet another) toolbar offered. During the install of new Java version, if you see this screen be sure uncheck the box offering another toolbar you don't need. You only need the new Java package. Here's why removing old versions of Sun Java is important: Potential Vulnerability with Sun Java auto update http://www.dslreports.com/forum/remark,14738046 This is a vulnerability in that Sun Java new updated versions do not remove prior vulnerable versions. You will have to remember to do that manually whenever you update your Sun Java. ............. Toolbars These days a lot of (legitimate) programs are offering a toolbar install along with their own install. Many times this toolbar isn't necessary and/or people are not paying attention and end up with too many toolbars installed that aren't wanted or being used, cluttering up your browser. I noticed you have all these installed. You can remove any you don't need or want via the Control Panel in Add/Remove programs - you can uninstall from there. Yahoo Google AVG MSN AVG's toolbar is a custom one that is made by the folks who also make the Ask toolbar. I believe to remove that one you need to uninstall the entire AVG program and reinstall a new version remembering to uncheck the box where they offer this "security" toolbar. Some people want it .... some do not. I'm just letting you know because I see you have a lot of toolbars there and you don't necessarily need all of those. ........ Whew! Keep reading..... Some final cleanup and prevention recommendations follow. This step will uninstall the ComboFix tool, delete any remaining quarantined files, and reset your Windows Folder options to default (to rehide operating system files, etc), since it isn't needed anymore: Click Start, then click Run. Enter into the command box that opens: combofix /u and then click OK. Do a disk cleanup. Go to Start > Run and type in the box: Cleanmgr Wait while Windows scans your system for files to delete. Make sure these 3 are checkmarked and press ok to delete them. Temporary Files Temporary Internet Files Recycle Bin Now that your PC is clean, make sure all programs are running properly and then you'll need to reset your restore point in Windows XP.......why? One of the best features of Windows ME or XP is the System Restore option, however if a malware infects a computer with this operating system it can be backed up in the System Restore folder. Therefore, clearing the restore points is necessary after malware removal. To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account. (winXP) 1. Turn off System Restore. Go to Start and right-click on My Computer. Click Properties. Click the System Restore tab. Put a Checkmark in the box next to "Turn off System Restore". Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. Go to Start and right-click on My Computer. Click Properties. Click the System Restore tab. Remove the checkmark next to "Turn off System Restore". Click Apply, and then click OK. How to Turn On and Turn Off System Restore in Windows XP »support.microsoft.com/default.as···s;310405 ...................... Also, I can't stress enough the importance of having your Windows critical Security Updates. Most malware today uses exploits on unpatched systems to creep onto your system without your even doing anything but visiting an infected webpage!! Make sure that you keep your Operating System and IE updated with the latest Critical Security Updates from Microsoft...they usually come out once a month, on the 2nd Tuesday of each month. This is the first step in malware prevention, as many nasties now take advantage of new exploits and if not patched, you are vulnerable! Windows Update »update.microsoft.com/microsoftupdate/ Watch what you download, be careful where you surf, and don't trust attachments or even links in email and Instant messages. Even if they come from a buddy, that buddy could be the one infected and it is the virus sending that link from his account. You click on it thinking he is trusted, and boom you're infected. Many "Phishing" attempts are made by cleverly crafted email to look like it is coming from an "official" source (like Microsoft, or your bank, or some other provider). Don't click on links in those. Go directly to the site instead and navigate the menus - don't trust email you think came from a "safe source" unless you are expecting it! There is more in the link I will provide below, but those are the choice avenues of infection these days. Stay far AWAY from cracks and warez sites - you're sure to get infected files there, and the same can be said for files downloaded from p2p (more than half are usually infected and probably not detectable by your current security software - the newest nasties are always released in those venues). A word about shared computers and networks. Share Your PC »www.microsoft.com/windowsxp/usin···tro.mspx Not all users need to have Admin Accounts. It is much safer to have most of your users on a shared system running as Limited User accounts. That way, if there is "an accident", it will only affect one user's account and not the entire system. I also highly recommend to get the free tool, Microsoft Baseline Security Analyzer (MBSA) from Microsoft to analyze your PC security for prevention purposes. MBSA Version 2.1 will scan for common system misconfigurations on Windows 2000, Windows XP, and Windows Server 2003 systems. This program will identify the system security weaknesses in your browser and operating system and provides easy instructions to correct them. This includes any missing critical Windows security updates, system vulnerabilities and your IE Browser security settings. Get the download here: Microsoft Baseline Security Analyzer »www.microsoft.com/technet/securi···ome.mspx Choose MBSAsetup-EN.msi = (English Version) or the language appropriate for you. -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2009 Proud Member of ASAP (Alliance of Security Analysis Professionals)
	to forum · permalink · · 2009-04-02 08:35:33 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman here it is: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:56:15 PM, on 4/1/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18372) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Sony\VAIO Event Service\VESMgr.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\WINDOWS\system32\ICO.EXE C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Documents and Settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = »www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = »go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = »go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = »us.rd.yahoo.com/customize/ie/def···rch.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = »go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = »go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = »us.rd.yahoo.com/customize/ie/def···ahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = »www.sony.com/vaiopeople R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0983.0\msneshellx.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe" O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - »esupport.sony.com/VaioInfo.CAB O16 - DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} (Image Uploader Control) - »www.ritzpix.com/net/Uploader/LPU···er45.cab O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - »upload.facebook.com/controls/200···der5.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - »www2.snapfish.com/SnapfishActivia.cab O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - »www.linkedin.com/cab/LinkedInCon···trol.cab O16 - DPF: {4EFA317A-8569-4788-B175-5BAF9731A549} (Microsoft Virtual Server VMRC Advanced Control) - »www.windowsvistatestdrive.com/Ac···ent1.cab O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - »www.kodakgallery.com/downloads/B···upld.cab O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - »www.kodakgallery.com/downloads/B···upld.cab O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - »download.eset.com/special/eos-be···nner.cab O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - »www.benchmarkclicks.com/TSWEB/msrdp.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - »floridakeysmedia.tv/axiscam/Code···trol.ocx O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - »fpdownload2.macromedia.com/get/s···lash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{AACEF84C-0840-408B-B642-DEC1A900BD75}: NameServer = 4.2.2.2,4.2.2.4 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SonicStageMonitoring - Sony Corporation - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe -- End of file - 14894 bytes
	to forum · permalink · · 2009-04-01 21:57:07 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman That's good news If you could scan and post one last HijackThis log for review and then I'll have some final cleanup recommendations after that, but I think we got it
	to forum · permalink · · 2009-04-01 17:19:37 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman Ok so the online EST scanner worked and found nothing! Is there anything else that needs to be done? thanks so much for all your help! Dave
	to forum · permalink · · 2009-04-01 17:03:46 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman There was nothing new really on the MBAM log but thank you for running it. The first 2 items had already been quarantined and the last 2 are in your system restore points which we will purge and set a fresh new one once we are sure we've gotten your machine clean. Those online scanners may take awhile but ensure we've scanned the entire system with a not-on-board Antivirus (since a resident antivirus can be damaged or affected by this type of rootkit). -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2009 Proud Member of ASAP (Alliance of Security Analysis Professionals)
	to forum · permalink · · 2009-03-31 18:06:08 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman Please try this version instead. »beta.eset.com/eos If still no joy, try this one: »www.kaspersky.com/virusscanner
	to forum · permalink · · 2009-03-31 17:56:03 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman when I try the online scan and allow the active x controls i get a pop up that says windows will not allow it to install becuase it doesn't know the publisher
	to forum · permalink · · 2009-03-31 14:59:24 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman I ran malware and here is my log I am going to do the online scan now Malwarebytes' Anti-Malware 1.35 Database version: 1922 Windows 5.1.2600 Service Pack 3 3/30/2009 10:50:20 PM mbam-log-2009-03-30 (22-50-20).txt Scan type: Full Scan (C:\\|) Objects scanned: 164727 Time elapsed: 48 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkancxohm.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\UACxipcwabw.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{ECE42D92-315C-418E-8F32-95DC4FF2BBEF}\RP467\A0059097.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{ECE42D92-315C-418E-8F32-95DC4FF2BBEF}\RP467\A0059099.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
	to forum · permalink · · 2009-03-31 14:43:00 · (locked)
CalamityJane Premium,VIP,MVM join:2002-08-27 Eustis, FL	reply to dkappaman said by dkappaman : ok so my mst123.dll was in my servicepacks folder and not in the sysytem32 folder. I found it and deleted it mst123.dll is a legitmate file in Service Packs. The bad one was only in the System32 directory, if still present. Many times malware masquerades with a file name identical to legitimate files but in a different location. If that file is still in your recycle bin, please put it back. (The legit mst123.dll belongs to the program NetMeeting - so in that directory if you see that is fine). If it is still present in the system32 folder it should NOT be there and that is the only one to delete. ComboFix got rid of the lion's share. At this point, could see if MBAM works and run scan with it and post the log back here. After posting that log - go here to get an online av scan: * Go here: »www.eset.eu/online-scanner to run an online scannner from ESET. []Note:* You will need to use Internet explorer for this scan []Tick the box next to YES, I accept the Terms of Use.* []Click Start* []When asked, allow the activex control to install []Click Start []Make sure that the option Remove found threats* is ticked, and the option Scan unwanted applications is checked []Click Scan* []Wait for the scan to finish []Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt [*]Copy and paste that log as a reply to this topic, along with a new HijackThis log & a description of any remaining problems -- It takes a disaster to make a woman out of a female Microsoft MVP/Windows Security 2003-2009 Proud Member of ASAP (Alliance of Security Analysis Professionals)
	to forum · permalink · · 2009-03-31 11:23:39 · (locked)
dkappaman join:2008-12-29 Naugatuck, CT	reply to dkappaman ok so my mst123.dll was in my servicepacks folder and not in the sysytem32 folder. I found it and deleted it along with the other file which was in the tasks folder. I downloaded and renamed combo fix and it worked thanks for all your help so far here is my log: ComboFix 09-03-29.04 - Dave 2009-03-30 16:06:32.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1522 [GMT -4:00] Running from: c:\documents and settings\Dave\Desktop\Combo-Fix.exe AV: AVG Anti-Virus Free On-access scanning enabled (Updated) . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\Dave\LOCALS~1\Temp\tmp1.tmp c:\docume~1\Dave\LOCALS~1\Temp\tmp2.tmp c:\windows\system32\drivers\UACseypuhrr.sys c:\windows\system32\UACfuifghuk.log c:\windows\system32\UACgoppwmys.log c:\windows\system32\UACguhxancs.log c:\windows\system32\uacinit.dll c:\windows\system32\UACjxjxfmuw.dll c:\windows\system32\UACkancxohm.dll c:\windows\system32\UACktytqrbi.dll c:\windows\system32\UACmqskwsrq.dll c:\windows\system32\UACnilpkbgk.db c:\windows\system32\UACotimrrni.dat c:\windows\system32\UACvtbqvdlt.dll c:\windows\system32\UACxipcwabw.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_UACd.sys ((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-30 ))))))))))))))))))))))))))))))) . 2009-03-29 22:21 . 2009-03-29 22:22 d-------- C:\rsit 2009-03-28 11:49 . 2009-03-28 11:49 d--hs---- c:\documents and settings\Administrator\PrivacIE 2009-03-28 11:49 . 2009-03-28 11:49 d--hs---- c:\documents and settings\Administrator\IETldCache 2009-03-28 10:33 . 2009-03-28 10:33 0 --a------ c:\windows\system32\uactmp.db 2009-03-22 21:21 . 2009-03-22 21:21 d--h----- c:\windows\PIF 2009-03-06 00:23 . 2009-03-06 00:23 d--hs---- c:\documents and settings\Dave\IECompatCache 2009-02-26 23:27 . 2009-02-26 23:27 d-------- c:\program files\Opera 2009-02-02 17:09 . 2009-02-02 17:09 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-10 15:00 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-03-10 15:00 --------- d-----w c:\program files\Java 2009-02-09 11:13 1,846,784 ----a-w c:\windows\system32\win32k.sys 2009-02-02 21:09 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-02-02 21:06 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-01-15 07:05 911,872 ----a-w c:\windows\system32\wininet.dll 2009-01-15 07:05 43,008 ----a-w c:\windows\system32\licmgr10.dll 2009-01-15 07:04 18,944 ----a-w c:\windows\system32\corpol.dll 2009-01-15 07:03 72,704 ----a-w c:\windows\system32\admparse.dll 2009-01-15 07:03 71,680 ----a-w c:\windows\system32\iesetup.dll 2009-01-15 07:03 420,352 ----a-w c:\windows\system32\vbscript.dll 2009-01-15 07:01 34,304 ----a-w c:\windows\system32\imgutil.dll 2009-01-15 07:00 48,128 ----a-w c:\windows\system32\mshtmler.dll 2009-01-15 07:00 45,568 ----a-w c:\windows\system32\mshta.exe 2009-01-15 06:50 156,160 ----a-w c:\windows\system32\msls31.dll 2008-12-05 06:54 144,896 ----a-w c:\windows\system32\schannel.dll 2008-08-19 20:13 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008081920080820\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-28 68856] "Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856] "Google Update"="c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-07 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-04-05 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-04-05 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-04-05 118784] "VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672] "SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768] "VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-08 7561216] "Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128] "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632] "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-02 1601304] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 148888] "Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 c:\windows\system32\ico.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-02-02 17:09 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.dvsd"= c:\progra~1\COMMON~1\SONYSH~1\VideoLib\sonydv.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1453:UDP"= 1453:UDP:Windows Media Format SDK (iexplore.exe) "1452:UDP"= 1452:UDP:Windows Media Format SDK (iexplore.exe) "1457:UDP"= 1457:UDP:Windows Media Format SDK (iexplore.exe) R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-07-02 325128] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-02 298264] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\drivers\SonyImgF.sys [2006-07-24 30080] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-07-24 226304] S3 pelmouse;Mouse Suite Driver;c:\windows\system32\drivers\PELMOUSE.SYS [2006-07-24 17251] S3 pelusblf;USB Mouse Low Filter Driver;c:\windows\system32\drivers\pelusblf.sys [2006-07-24 7520] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3524d52-2057-11dc-8fe8-0018de09e1f9}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d8435c48-225e-11db-b383-806d6172696f}] \Shell\AutoRun\command - e:\sony\Autorun.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-03-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-938186184-1345688478-2283354153-1005.job - c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-07 14:56] 2009-03-30 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20] 2009-03-30 c:\windows\Tasks\User_Feed_Synchronization-{B254CC60-A497-4146-B867-E71682F7E766}.job - c:\windows\system32\msfeedssync.exe [2009-01-15 03:01] . - - - - ORPHANS REMOVED - - - - WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) Notify-VESWinlogon - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople uInternet Settings,ProxyOverride = .local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/http://www.yahoo.com IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm Trusted Zone: aol.com\free TCP: {AACEF84C-0840-408B-B642-DEC1A900BD75} = 4.2.2.2,4.2.2.4 DPF: {0C92900E-4D5A-4F04-ACC9-729E1767BBAE} - hxxp://www.ritzpix.com/net/Uploader/LPUploader45.cab FF - ProfilePath - c:\documents and settings\Dave\Application Data\Mozilla\Firefox\Profiles\nn3j669k.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p= FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p= FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll FF - plugin: c:\documents and settings\Dave\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . *********************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, »www.gmer.net Rootkit scan 2009-03-30 16:12:30 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2009-03-30 16:15:11 ComboFix-quarantined-files.txt 2009-03-30 20:14:28 Pre-Run: 119,659,356,160 bytes free Post-Run: 120,264,245,248 bytes free 179 --- E O F --- 2009-03-30 19:26:49
	to forum · permalink · · 2009-03-30 21:59:03 · (locked)


Sunday, 29-Nov 00:58:13	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com.republican-creole page compression OFF