kimian111 Posted July 29, 2009 ID:104050 Share Posted July 29, 2009 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:00:21 PM, on 7/28/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Windows Defender\MsMpEng.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\system32\spoolsv.exeD:\Program Files\Bonjour\mDNSResponder.exeD:\WINDOWS\system32\CTsvcCDA.exeD:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exeD:\WINDOWS\system32\svchost.exeD:\Program Files\Java\jre6\bin\jqs.exeD:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeD:\Program Files\Google\Update\1.2.183.7\GoogleCrashHandler.exeD:\WINDOWS\system32\nvsvc32.exeD:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exeD:\WINDOWS\System32\svchost.exeD:\Program Files\Sandboxie\SbieSvc.exed:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\TUProgSt.exeD:\WINDOWS\system32\MsPMSPSv.exeD:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeD:\Program Files\Canon\CAL\CALMAIN.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\PixArt\PAC7302\Monitor.exeD:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeD:\Program Files\Sandboxie\SbieCtrl.exeD:\WINDOWS\system32\ctfmon.exeD:\WINDOWS\System32\svchost.exeD:\Program Files\Microsoft Office\Office12\WINWORD.EXEC:\Malwarebytes' Anti-Malware\mbam.exeD:\WINDOWS\hh.exeD:\Documents and Settings\Kim Watkins\Local Settings\Application Data\Google\Chrome\Application\chrome.exeD:\Documents and Settings\Kim Watkins\Local Settings\Application Data\Google\Chrome\Application\chrome.exeD:\Documents and Settings\Kim Watkins\Local Settings\Application Data\Google\Chrome\Application\chrome.exeD:\Documents and Settings\Kim Watkins\Local Settings\Application Data\Google\Chrome\Application\chrome.exeD:\Documents and Settings\Kim Watkins\Local Settings\Application Data\Google\Chrome\Application\chrome.exeD:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon OnlineR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dllO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dllO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - D:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentO4 - HKCU\..\Run: [sandboxieControl] "D:\Program Files\Sandboxie\SbieCtrl.exe"O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "D:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "D:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO8 - Extra context menu item: &Links to this page - D:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gbacklinks.htmO8 - Extra context menu item: &Similar pages - D:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gsimilar.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Open in &new window - D:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\tuofinw.htmO8 - Extra context menu item: Search with &Google - D:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gsearch.htmO8 - Extra context menu item: Translate this page with Google - D:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\Web\gtranslate.htmO8 - Extra context menu item: Zoom &in Link to post Share on other sites More sharing options...
sjpritch25 Posted July 31, 2009 ID:104800 Share Posted July 31, 2009 Welcome to Malwarebytes!!!!! We need to see some additional information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pif[*]Double click on the DDS icon, allow it to run.[*]A small box will open, with an explanation about the tool. [*]When done, DDS will open two (2) logs 1. DDS.txt 2. Attach.txt[*] Save both reports to your desktop.[*] The instructions here ask you to attach the Attach.txt.[*]Instead of attaching, please copy/past both logs into your next reply.[*]Close the program window, and delete the program from your desktop.Please note: You may have to disable any script protection running if the scan fails to run.After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE Link to post Share on other sites More sharing options...
Kenny94 Posted July 31, 2009 ID:104812 Share Posted July 31, 2009 Hi sjpritch25.... User is being helped at:http://www.malwarebytes.org/forums/index.p...mp;#entry104655 Link to post Share on other sites More sharing options...
kimian111 Posted July 31, 2009 Author ID:104822 Share Posted July 31, 2009 Hi sjpritch25.... User is being helped at:http://www.malwarebytes.org/forums/index.p...mp;#entry104655Hi, Thank you both... I didn't know how to delete this post. Sorry for the duplicate submission.Kimian111 Link to post Share on other sites More sharing options...
Kenny94 Posted July 31, 2009 ID:104830 Share Posted July 31, 2009 That's OK kimian111With a pretty face like yours.... sjpritch25 is trying to move in on me...... I'll ask a Moderator to close this one. Link to post Share on other sites More sharing options...
Recommended Posts