brianh654 Posted October 2, 2009 ID:136606 Share Posted October 2, 2009 I believe my pc has a virus. Using IE Google bagan automatically redirecting to google.de about 2 weeks ago. Now my homepage tells me I have no internet connection, when in fact I do. If you manually type a website it works but any search yields the same internet connection issue. I have tried running anitmalware with no luck. I ran combo fix and here are the results. Thanks for your help in adavance. ComboFix 09-10-01.01 - Administrator 10/01/2009 19:19.3.2 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2018.1497 [GMT -4:00]Running from: c:\combo-fix\Combo-Fix.exe.((((((((((((((((((((((((( Files Created from 2009-09-01 to 2009-10-01 ))))))))))))))))))))))))))))))).2009-09-25 21:10 . 2009-09-25 21:10 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache2009-09-23 21:09 . 2009-09-23 21:10 -------- dc-h--w- c:\windows\ie82009-09-23 21:08 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll2009-09-23 21:08 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll2009-09-23 19:32 . 2009-09-23 19:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Yahoo!2009-09-09 19:47 . 2009-09-09 19:47 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes2009-09-09 19:47 . 2009-09-09 19:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2009-09-09 18:12 . 2009-10-01 22:32 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP2009-09-09 16:07 . 2009-09-09 19:54 -------- d-sh--w- c:\documents and settings\All Users\Application Data\6f621ba2009-09-08 19:13 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll2009-09-05 22:09 . 2009-09-12 21:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\HpUpdate2009-09-05 22:08 . 2009-09-05 22:08 -------- d-----w- c:\windows\Hewlett-Packard.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-09-27 13:08 . 2008-10-14 21:37 -------- d-----w- c:\program files\Spybot - Search & Destroy2009-09-27 13:08 . 2008-10-14 21:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-09-23 20:49 . 2008-11-03 19:56 -------- d-----w- c:\program files\Google2009-09-23 20:48 . 2008-04-08 23:32 -------- d-----w- c:\program files\Yahoo!2009-09-23 20:46 . 2009-03-25 11:45 -------- d-----w- c:\documents and settings\All Users\Application Data\avg82009-09-10 20:26 . 2009-02-09 18:34 -------- d-----w- c:\program files\Coupons2009-09-09 17:22 . 2009-08-09 23:20 -------- d-----w- c:\program files\Microsoft Silverlight2009-08-05 09:01 . 2006-02-28 02:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll2009-07-17 19:01 . 2006-02-28 02:00 58880 ----a-w- c:\windows\system32\atl.dll2009-07-14 03:43 . 2006-02-28 02:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll2009-07-07 21:53 . 2008-11-27 15:50 256 ----a-w- c:\windows\system32\pool.bin.((((((((((((((((((((((((((((( SnapShot@2009-10-01_22.44.34 ))))))))))))))))))))))))))))))))))))))))).- 2006-04-25 17:43 . 2009-10-01 22:38 72108 c:\windows\system32\perfc009.dat+ 2006-04-25 17:43 . 2009-10-01 23:09 72108 c:\windows\system32\perfc009.dat+ 2006-04-25 17:43 . 2009-10-01 23:09 444358 c:\windows\system32\perfh009.dat- 2006-04-25 17:43 . 2009-10-01 22:38 444358 c:\windows\system32\perfh009.dat.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 142104]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 162584]"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 138008]"atchk"="c:\program files\Intel\AMT\atchk.exe" [2007-06-07 408344]"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-04-26 1015808]"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-19 615696]"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]HP Digital Imaging Monitor.lnk - c:\program files\Hp\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-4 1503232][HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\WINDOWS\\SMINST\\Scheduler.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\LimeWire\\LimeWire.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposfx08.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqscnvw.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"="c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"="c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"="c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqnrs08.exe"="c:\\Program Files\\iTunes\\iTunes.exe"=R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [1/11/2008 1:59 AM 2521880]R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [1/23/2007 4:13 PM 41216]S1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS --> c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [?]S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS --> c:\program files\SUPERAntiSpyware\SASENUM.SYS [?][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP.Contents of the 'Scheduled Tasks' folder2009-09-25 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]..------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=smb&pf=desktopIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000DPF: {26B2A5DA-BFD6-422F-A89A-28A54C74B12B} - hxxp://www.costcophotocenter.com/upload/activex/v3_0_0_4/PhotoCenter_ActiveX_Control.cabDPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cabDPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://www.costcophotocenter.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab?.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-10-01 19:21Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-2505836837-47728274-3880406320-500\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (Administrator)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5e,2e,1e,fd,40,15,4c,48,8c,00,8a,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,5e,2e,1e,fd,40,15,4c,48,8c,00,8a,\.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(1964)c:\windows\system32\WININET.dllc:\windows\system32\ieframe.dllc:\windows\system32\webcheck.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.Completion time: 2009-10-01 19:23ComboFix-quarantined-files.txt 2009-10-01 23:23ComboFix2.txt 2009-10-01 23:01ComboFix3.txt 2009-10-01 22:45Pre-Run: 53,437,886,464 bytes freePost-Run: 53,402,992,640 bytes free141 --- E O F --- 2009-09-25 07:00 Link to post Share on other sites More sharing options...
mountaintree16 Posted October 2, 2009 ID:136607 Share Posted October 2, 2009 @ brianh654Please post your logs here:http://www.malwarebytes.org/forums/index.php?showforum=7As logs are not worked on in the General forum, only the HijackThis forum. Someone will be along to help you as soon as possible. Just so you know, they are currently swamped with requests for help, so it could be a while, possibly up to five days or so, before someone will be able to take a look at your log. If no one replies within 48 hours, however, feel free to reply to your post with a request for review. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted October 2, 2009 Root Admin ID:136687 Share Posted October 2, 2009 Scan and post logs - read note at bottom in greenIf you're having Malware related issues with your computer that you're unable to resolve.Please read and follow the instructions provided here: I'm infected - What do I do now?If needed please post your logs in a NEW topic here: Malware Removal - HijackThis LogsWhen posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.Using these other tools often makes the cleanup task more difficult and time consuming.If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for reviewNOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can. Link to post Share on other sites More sharing options...
Recommended Posts