Jump to content

Help with espeak911.com, colexity777.com and 37.220.36.44

lfiffe

By lfiffe
in Resolved Malware Removal Logs

 Share

Recommended Posts

lfiffe

lfiffe

Posted
Posted

I've read another post about this problem and need help asap! Avast is blocking these hijack attempts:

colexity777.com/x/

espeak911.com/x/

37.220.36.44/x/ I've followed the instructions give in the other post and here they are

DDS. Text:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702

Run by Todays Christian 1 at 15:03:19 on 2013-01-09

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2036.1246 [GMT -6:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ================

.

C:\WINDOWS\System32\wudfhost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe

C:\Documents and Settings\Todays Christian 1\Local Settings\Application Data\CrossLoop\CrossLoopService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdiserv.exe

C:\WINDOWS\system32\lxdicoms.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe

C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Sybase\Shared\Sybase Central 4.3\win32\scjview.exe

C:\Program Files\Sybase\SQL Anywhere 9\win32\dbisqlg.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\All Users\Application Data\WeCareReminder\ReminderHelper.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = iexplore

BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: WeCareReminder Class: {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - c:\documents and settings\all users\application data\wecarereminder\IEHelperv2.5.0.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll

uRun: [sybaseCentral43] "c:\program files\sybase\shared\sybase central 4.3\win32\scjview.exe" -preload

uRun: [DBISQL9] "c:\program files\sybase\sql anywhere 9\win32\dbisqlg.exe" -preload

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [DW7] "c:\program files\the weather channel\the weather channel app\TWCApp.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [lxdimon.exe] "c:\program files\lexmark 3500-4500 series\lxdimon.exe"

mRun: [lxdiamon] "c:\program files\lexmark 3500-4500 series\lxdiamon.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

dRunOnce: [RunNarrator] Narrator.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1348331509270

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} - hxxp://www.worldwinner.com/games/launcher/ie/v2.23.01.0/iewwload.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.2.1

TCP: Interfaces\{B02E1228-4313-495A-ADE5-742695B4AFA3} : DHCPNameServer = 192.168.2.1

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

.

============= SERVICES / DRIVERS ===============

.

R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-10-12 14776]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-1-7 738504]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-1-7 360392]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-1-7 21256]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2013-1-7 44808]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

R2 CrossLoopService;CrossLoop Service;c:\documents and settings\todays christian 1\local settings\application data\crossloop\CrossLoopService.exe [2010-9-6 560848]

R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]

R2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdiserv.exe [2011-2-5 99248]

S1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys --> c:\windows\system32\drivers\sbaphd.sys [?]

S2 LxrSII1d;Secure II Driver;\??\c:\windows\system32\drivers\lxrsii1d.sys --> c:\windows\system32\drivers\LxrSII1d.sys [?]

S2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys --> c:\windows\system32\drivers\sbapifs.sys [?]

S3 ASANYs_blwprod9;Adaptive Server Anywhere - blwprod9;c:\program files\sybase\sql anywhere 9\win32\dbsrv9.exe -hvasanys_blwprod9 --> c:\program files\sybase\sql anywhere 9\win32\dbsrv9.exe -hvASANYs_blwprod9 [?]

S3 PortEmulatorTSP100LAN;Port Emulator (TSP100LAN);c:\program files\starmicronics\tsp100lan\software\20080423\portemu_umdf_tsp100lan.exe [2008-4-7 114688]

S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2008-8-15 551680]

S3 TcpEmulatorTSP100LAN;TCP Port Emulator (TSP100LAN);c:\program files\starmicronics\tsp100lan\software\20080423\tcpemu_tsp100lan.exe [2008-4-10 172032]

S3 tvnserver;TightVNC Server;c:\documents and settings\todays christian 1\local settings\application data\crossloop\tvnserver.exe [2010-9-6 814080]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2013-01-09 20:16:27 -------- d-----w- C:\d3e643401ba335c3c5c11b47

2013-01-09 20:16:18 -------- d-----w- c:\windows\SxsCaPendDel

2013-01-07 22:27:45 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-01-07 21:58:01 116224 -c--a-w- c:\windows\system32\dllcache\OLD10F7.tmp

2013-01-07 21:58:00 23040 -c--a-w- c:\windows\system32\dllcache\OLD10F3.tmp

2013-01-07 21:57:57 18944 -c--a-w- c:\windows\system32\dllcache\OLD10EF.tmp

2013-01-07 21:57:56 27648 -c--a-w- c:\windows\system32\dllcache\OLD10EB.tmp

2013-01-07 21:57:52 4608 -c--a-w- c:\windows\system32\dllcache\OLD10E7.tmp

2013-01-07 21:57:32 99865 -c--a-w- c:\windows\system32\dllcache\OLD10E3.tmp

2013-01-07 21:57:27 16970 -c--a-w- c:\windows\system32\dllcache\OLD10DC.tmp

2013-01-07 21:57:23 19455 -c--a-w- c:\windows\system32\dllcache\OLD10D8.tmp

2013-01-07 21:57:20 19200 -c--a-w- c:\windows\system32\dllcache\OLD10D4.tmp

2013-01-07 21:57:19 12063 -c--a-w- c:\windows\system32\dllcache\OLD10D0.tmp

2013-01-07 21:57:17 8192 -c--a-w- c:\windows\system32\dllcache\OLD10CC.tmp

2013-01-07 21:57:03 8832 -c--a-w- c:\windows\system32\dllcache\OLD10C8.tmp

2013-01-07 21:57:01 154624 -c--a-w- c:\windows\system32\dllcache\OLD10C4.tmp

2013-01-07 21:57:00 34890 -c--a-w- c:\windows\system32\dllcache\OLD10C0.tmp

2013-01-07 21:55:59 64605 -c--a-w- c:\windows\system32\dllcache\OLD1034.tmp

2013-01-07 21:54:59 26112 -c--a-w- c:\windows\system32\dllcache\OLDFE2.tmp

2013-01-07 21:53:59 525568 -c--a-w- c:\windows\system32\dllcache\OLDF8A.tmp

2013-01-07 21:52:59 149376 -c--a-w- c:\windows\system32\dllcache\OLDF38.tmp

2013-01-07 21:51:59 53760 -c--a-w- c:\windows\system32\dllcache\OLDEEF.tmp

2013-01-07 21:50:59 20752 -c--a-w- c:\windows\system32\dllcache\OLDEA0.tmp

2013-01-07 21:49:59 73796 -c--a-w- c:\windows\system32\dllcache\OLDDFC.tmp

2013-01-07 21:48:53 6784 -c--a-w- c:\windows\system32\dllcache\OLDD89.tmp

2013-01-07 21:47:58 210496 -c--a-w- c:\windows\system32\dllcache\OLDD3A.tmp

2013-01-07 21:46:58 23040 -c--a-w- c:\windows\system32\dllcache\OLDCCD.tmp

2013-01-07 21:45:59 159232 -c--a-w- c:\windows\system32\dllcache\OLDC7B.tmp

2013-01-07 21:44:59 169984 -c--a-w- c:\windows\system32\dllcache\OLDBFB.tmp

2013-01-07 21:43:59 43689 -c--a-w- c:\windows\system32\dllcache\OLDB9C.tmp

2013-01-07 21:42:56 39264 -c--a-w- c:\windows\system32\dllcache\OLDB47.tmp

2013-01-07 21:41:59 452736 -c--a-w- c:\windows\system32\dllcache\OLDAF4.tmp

2013-01-07 21:40:55 6528 -c--a-w- c:\windows\system32\dllcache\OLDAA8.tmp

2013-01-07 21:39:59 576746 -c--a-w- c:\windows\system32\dllcache\OLDA4B.tmp

2013-01-07 21:38:57 18688 -c--a-w- c:\windows\system32\dllcache\OLD970.tmp

2013-01-07 21:36:36 811064 -c--a-w- c:\windows\system32\dllcache\imjp81k.dll

2013-01-07 21:35:41 372824 -c--a-w- c:\windows\system32\dllcache\OLD8C7.tmp

2013-01-07 21:34:59 18560 -c--a-w- c:\windows\system32\dllcache\OLD87F.tmp

2013-01-07 21:34:58 8576 -c--a-w- c:\windows\system32\dllcache\OLD87B.tmp

2013-01-07 21:33:51 10129408 -c--a-w- c:\windows\system32\dllcache\hwxkor.dll

2013-01-07 21:31:59 150239 -c--a-w- c:\windows\system32\dllcache\OLD825.tmp

2013-01-07 21:30:57 17408 -c--a-w- c:\windows\system32\dllcache\OLD7B1.tmp

2013-01-07 21:29:59 43520 -c--a-w- c:\windows\system32\dllcache\OLD702.tmp

2013-01-07 21:28:58 283904 -c--a-w- c:\windows\system32\dllcache\OLD677.tmp

2013-01-07 21:27:58 8320 -c--a-w- c:\windows\system32\dllcache\OLD5F6.tmp

2013-01-07 21:26:59 49792 -c--a-w- c:\windows\system32\dllcache\OLD54C.tmp

2013-01-07 21:25:57 15872 -c--a-w- c:\windows\system32\dllcache\OLD487.tmp

2013-01-07 21:24:59 81408 -c--a-w- c:\windows\system32\dllcache\OLD31A.tmp

2013-01-07 21:23:59 327040 -c--a-w- c:\windows\system32\dllcache\OLD201.tmp

2013-01-07 21:22:59 12288 -c--a-w- c:\windows\system32\dllcache\OLDDF.tmp

2013-01-07 16:52:37 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-01-07 16:52:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-01-07 16:51:56 -------- d-----w- c:\program files\Auslogics

2013-01-07 16:51:28 8192 ----a-w- c:\windows\system32\ardnat.exe

2013-01-07 16:51:26 -------- d-----w- c:\program files\Ainvo

2013-01-07 16:48:10 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-01-07 16:47:56 41224 ----a-w- c:\windows\avastSS.scr

2013-01-07 16:47:40 -------- d-----w- c:\program files\AVAST Software

2013-01-07 16:47:40 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software

.

==================== Find3M ====================

.

2013-01-07 22:27:45 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-16 21:37:55 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-11-16 21:37:55 477168 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-11-16 21:37:55 473072 ----a-w- c:\windows\system32\deployJava1.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: WDC_WD2500JS-22NCB1 rev.10.02E02 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x897EA4B1]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x897f193c]; MOV EAX, [0x897f1ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x89DD7AB8]

3 CLASSPNP[0xBA0E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x898236C8]

\Driver\atapi[0x89AF2438] -> IRP_MJ_CREATE -> 0x897EA4B1

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x897EA2E2

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 15:04:26.10 ===============

Attach Text:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 8/6/2008 11:31:42 AM

System Uptime: 1/9/2013 2:18:11 PM (1 hours ago)

.

Motherboard: Intel Corporation | | DG31PR

Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz | J3E1 | 1999/800mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 233 GiB total, 195.224 GiB free.

D: is CDROM ()

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description:

Device ID: ROOT\LEGACY_SASKUTIL\0000

Manufacturer:

Name:

PNP Device ID: ROOT\LEGACY_SASKUTIL\0000

Service:

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

ABBYY FineReader 6.0 Sprint

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.1)

Ainvo Registry Defrag 4.1.7.2010

Auslogics Disk Defrag

Auslogics Registry Cleaner

avast! Free Antivirus

Booklog

CCleaner

Clean Water Action TriMini Reminder by We-Care.com v5.0.2.2

Compatibility Pack for the 2007 Office system

CrossLoop 2.74

DriverBoost

Foxit Reader

Google Toolbar for Internet Explorer

Google Update Helper

GoToMeeting 5.1.0.880

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

Intel® Graphics Media Accelerator Driver

Java Auto Updater

Java 6 Update 37

Lexmark 3500-4500 Series

Lexmark Fax Solutions

Malwarebytes Anti-Malware version 1.70.0.1100

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office File Validation Add-In

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.5

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

neroxml

OGA Notifier 2.0.0048.0

PCCharge Payment Server

RadioShack USB to Serial Driver

REALTEK GbE & FE Ethernet PCI-E NIC Driver

Realtek High Definition Audio Driver

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB2699988)

Security Update for Windows Internet Explorer 8 (KB2722913)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956390)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972260)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Smart Defrag 2

SQL Anywhere Studio 9, Documentation

SQL Anywhere Studio 9, Software

TSP100LAN Setup Version 1.1.0

Uniblue DriverScanner

Unity Web Player

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB978506)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB898461)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VCRedistSetup

WebFldrs XP

Windows Internet Explorer 8

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Yahoo! Software Update

Yahoo! Toolbar

.

==== Event Viewer Messages From Past Week ========

.

1/9/2013 2:16:19 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error message: The referenced assembly is not installed on your system. .

1/9/2013 2:16:19 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll. Reference error message: The operation completed successfully. .

1/9/2013 2:16:19 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.CRT could not be found and Last Error was The referenced assembly is not installed on your system.

1/9/2013 2:16:19 PM, error: Service Control Manager [7034] - The avast! Antivirus service terminated unexpectedly. It has done this 3 time(s).

1/9/2013 2:15:21 PM, error: Service Control Manager [7031] - The avast! Antivirus service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

1/7/2013 4:26:36 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: sbaphd

1/7/2013 4:26:31 PM, error: Service Control Manager [7000] - The sbapifs service failed to start due to the following error: The system cannot find the file specified.

1/7/2013 4:06:58 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the WebClient service to connect.

1/7/2013 4:06:58 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.

1/7/2013 4:06:58 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the CrossLoop Service service to connect.

1/7/2013 4:06:58 PM, error: Service Control Manager [7000] - The WebClient service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 4:06:58 PM, error: Service Control Manager [7000] - The CrossLoop Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 3:03:37 PM, error: Service Control Manager [7034] - The lxdi_device service terminated unexpectedly. It has done this 1 time(s).

1/7/2013 3:03:37 PM, error: Service Control Manager [7034] - The CrossLoop Service service terminated unexpectedly. It has done this 1 time(s).

1/7/2013 2:55:04 PM, error: Service Control Manager [7034] - The Kaspersky PURE service terminated unexpectedly. It has done this 1 time(s).

1/7/2013 11:21:26 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

1/7/2013 11:21:26 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 11:01:47 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdiCATSCustConnectService service to connect.

1/7/2013 11:01:47 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the lxdi_device service to connect.

1/7/2013 11:01:47 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Java Quick Starter service to connect.

1/7/2013 11:01:47 AM, error: Service Control Manager [7000] - The lxdiCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 11:01:47 AM, error: Service Control Manager [7000] - The lxdi_device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 11:01:47 AM, error: Service Control Manager [7000] - The Java Quick Starter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 10:57:45 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

1/7/2013 10:53:52 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

1/7/2013 10:53:32 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

1/7/2013 10:48:05 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

1/7/2013 10:46:13 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

1/7/2013 10:42:07 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: CSVirtualDiskDrv Fips intelppm kl1 KLIF

1/7/2013 1:30:02 PM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

1/7/2013 1:21:47 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the TCP/IP NetBIOS Helper service to connect.

1/7/2013 1:21:47 PM, error: Service Control Manager [7000] - The TCP/IP NetBIOS Helper service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/7/2013 1:21:47 PM, error: Service Control Manager [7000] - The Secure II Driver service failed to start due to the following error: The system cannot find the file specified.

1/7/2013 1:00:51 PM, error: Service Control Manager [7031] - The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

1/5/2013 6:35:23 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Yahoo! Updater service to connect.

1/5/2013 6:35:23 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Image Acquisition (WIA) service to connect.

1/5/2013 6:35:23 PM, error: Service Control Manager [7000] - The Yahoo! Updater service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/5/2013 6:35:23 PM, error: Service Control Manager [7000] - The Windows Image Acquisition (WIA) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/5/2013 6:35:23 PM, error: Service Control Manager [7000] - The Secure II Driver service failed to start due to the following error: Access is denied.

1/5/2013 6:11:00 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.

1/5/2013 6:11:00 PM, error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

1/5/2013 5:54:34 PM, error: Service Control Manager [7022] - The Kaspersky PURE service hung on starting.

1/5/2013 2:54:37 PM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.2.5 with the system having network hardware address 8C:58:77:DA:10:9C. Network operations on this system may be disrupted as a result.

1/5/2013 12:15:02 PM, error: Dhcp [1002] - The IP address lease 192.168.2.5 for the Network Card with network address 001CC0675BE5 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

1/5/2013 11:14:04 AM, error: Dhcp [1002] - The IP address lease 192.168.2.8 for the Network Card with network address 001CC0675BE5 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

.

==== End Of File ===========================

More to follow

Link to post
Share on other sites
lfiffe

lfiffe

Posted
  • Author
Posted

Ran Spybot S&D could not disable Resident TeaTimer, scanned anyway, found 115 level 5 threats - deleted.

Ran Rouge Killer, here are the results:

RogueKiller V8.4.3 [Jan 8 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Todays Christian 1 [Admin rights]

Mode : Scan -- Date : 01/09/2013 16:33:27

¤¤¤ Bad processes : 2 ¤¤¤

[sUSP PATH] CrossLoopService.exe -- C:\Documents and Settings\Todays Christian 1\Local Settings\Application Data\CrossLoop\CrossLoopService.exe -> KILLED [TermProc]

[sUSP PATH] ReminderHelper.exe -- C:\Documents and Settings\All Users\Application Data\WeCareReminder\ReminderHelper.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ] HKLM\[...]\SystemRestore : DisableSR (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

IRP[DriverStartIo] : atapi.sys -> HOOKED ([MAJOR] Unknown @ 0x899C02E2)

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 www.007guard.com

127.0.0.1 007guard.com

127.0.0.1 008i.com

127.0.0.1 www.008k.com

127.0.0.1 008k.com

127.0.0.1 www.00hq.com

127.0.0.1 00hq.com

127.0.0.1 010402.com

127.0.0.1 www.032439.com

127.0.0.1 032439.com

127.0.0.1 www.0scan.com

127.0.0.1 0scan.com

127.0.0.1 1000gratisproben.com

127.0.0.1 www.1000gratisproben.com

127.0.0.1 1001namen.com

127.0.0.1 www.1001namen.com

127.0.0.1 100888290cs.com

127.0.0.1 www.100888290cs.com

127.0.0.1 www.100sexlinks.com

[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++

--- User ---

[MBR] e11d99140a440eb9c88fb9a361b603bb

[bSP] 384433c83e8193dee65003719052906c : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] d3af39ade37c17e4dbc2b516cd528039

[bSP] 384433c83e8193dee65003719052906c : Windows XP MBR Code

Partition table:

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo

Finished : << RKreport[1]_S_01092013_02d1633.txt >>

RKreport[1]_S_01092013_02d1633.txt

Thanks for any help you can provide.

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum....Please use the standard font.

==================

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

Link to post
Share on other sites
lfiffe

lfiffe

Posted
  • Author
Posted

MrCharlie,

I did as instructed (almost). I ran MWAR and it found 4 malware infections cleaned them and reboot. That seemed to take care of the problems, no more notices from Avast about the redirects. I have yet to do the second scan, but I'm sure it will turn out fine. I will post the two text files tomorrow after the second scan. Thank you so much for your clear and concise help - you rock!!!

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Did the scan finally come up clean??

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Next.............

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.