IE redirects to advertisements

[StarvingLion]

Problem.zipProblem.zipProblem.zipDDS (Ver_10-03-17.01) - NTFSx86

Run by Randy at 13:37:03.93 on 30/06/2010

Internet Explorer: 7.0.5450.4 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.644 [GMT -6:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\dllhost.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

C:\Documents and Settings\Randy\My Documents\My Biotech\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.clusty.com/

uDefault_Page_URL = hxxp://www.dell.com

uInternet Connection Wizard,ShellNext = hxxp://www.dell.com/

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup

uRun: [Zinio DLM] c:\program files\zinio\ZinioDeliveryManager.exe /autostart

uRun: [ProxyWay] c:\program files\proxyway\proxyway.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"

mRun: [NWEReboot]

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

dRun: [winlogon] c:\windows\temp\\winlogon.exe

StartupFolder: c:\docume~1\randy\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

TCP: {B14F6217-5C63-4138-ADC5-F92DD1B36C39} = 209.115.142.9 209.115.142.132

Filter: text/html - {6d58bede-be79-43a3-81e9-514e094c58b2} -

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

STS: IE Component Categories cache daemon: {553858a7-4922-4e7e-b1c1-97140c1c16ef} - c:\windows\system32\ieframe.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\randy\applic~1\mozilla\firefox\profiles\26hhpwsk.default user\

FF - prefs.js: browser.startup.homepage - hxxp://www.clusty.com

FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-6-26 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-6-26 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-6-26 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-6-26 60936]

R2 CA_LIC_CLNT;CA License Client;c:\program files\ca\sharedcomponents\ca_lic\lic98rmt.exe [2003-10-12 143360]

R2 LogWatch;Event Log Watch;c:\program files\ca\sharedcomponents\ca_lic\LogWatNT.exe [2002-9-20 53248]

R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2009-11-20 20480]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

S3 CA_LIC_SRVR;CA License Server;c:\program files\ca\sharedcomponents\ca_lic\lic98rmtd.exe [2003-4-7 151552]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\5.tmp --> c:\windows\system32\5.tmp [?]

=============== Created Last 30 ================

2010-06-30 19:23:18 0 ----a-w- c:\documents and settings\randy\defogger_reenable

2010-06-26 09:12:27 0 d-----w- c:\docume~1\randy\applic~1\Avira

2010-06-26 08:34:54 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-06-26 08:34:53 0 d-----w- c:\program files\Avira

2010-06-26 08:34:53 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-06-26 05:25:00 0 d-----w- c:\program files\SymNetDrv

2010-06-26 01:32:45 0 d-----w- c:\docume~1\randy\applic~1\Symantec

2010-06-26 01:32:32 0 d-----w- c:\program files\Symantec

2010-06-26 01:32:29 0 d-----w- c:\docume~1\alluse~1\applic~1\Symantec

2010-06-25 21:34:57 0 d-----w- c:\program files\Sophos

2010-06-25 20:35:41 3770 --sha-w- c:\windows\system32\drivers\9788.DAT

2010-06-25 20:35:41 3770 --sha-w- c:\windows\system32\drivers\0a07.DAT

2010-06-25 20:35:41 33120 ----a-w- c:\windows\system32\drivers\9788.SYS

2010-06-25 20:35:40 33120 ----a-w- c:\windows\system32\drivers\0a07.SYS

2010-06-25 20:35:40 33120 ----a-w- c:\windows\system32\drivers\0266.SYS

2010-06-25 20:26:43 5120 --sha-w- c:\windows\system32\drivers\75918.DAT

2010-06-25 20:26:43 5120 --sha-w- c:\windows\system32\drivers\62019.DAT

2010-06-25 20:26:43 5120 --sha-w- c:\windows\system32\drivers\02617.DAT

2010-06-25 20:26:43 33120 ----a-w- c:\windows\system32\drivers\62019.SYS

2010-06-25 20:26:42 33120 ----a-w- c:\windows\system32\drivers\75918.SYS

2010-06-25 20:26:42 33120 ----a-w- c:\windows\system32\drivers\02617.SYS

2010-06-25 20:26:24 124 --sha-w- c:\windows\system32\drivers\dd216.DAT

2010-06-25 20:26:24 124 --sha-w- c:\windows\system32\drivers\2cd15.DAT

2010-06-25 20:26:24 124 --sha-w- c:\windows\system32\drivers\02614.DAT

2010-06-25 15:57:31 124 --sha-w- c:\windows\system32\drivers\d56A.DAT

2010-06-25 15:57:31 124 --sha-w- c:\windows\system32\drivers\27bB.DAT

2010-06-25 15:57:31 124 --sha-w- c:\windows\system32\drivers\0269.DAT

2010-06-25 15:57:30 33120 ----a-w- c:\windows\system32\drivers\d56A.SYS

2010-06-25 15:57:30 33120 ----a-w- c:\windows\system32\drivers\27bB.SYS

2010-06-25 15:57:30 33120 ----a-w- c:\windows\system32\drivers\0269.SYS

2010-06-25 15:57:11 3894 --sha-w- c:\windows\system32\drivers\0266.DAT

2010-06-25 15:57:11 124 --sha-w- c:\windows\system32\drivers\c9a8.DAT

2010-06-25 15:57:11 124 --sha-w- c:\windows\system32\drivers\2317.DAT

2010-06-25 15:36:31 5120 --sha-w- c:\windows\system32\drivers\c985E.DAT

2010-06-25 15:36:31 5120 --sha-w- c:\windows\system32\drivers\2305D.DAT

2010-06-25 15:36:31 5120 --sha-w- c:\windows\system32\drivers\0265C.DAT

2010-06-25 15:36:31 33120 ----a-w- c:\windows\system32\drivers\c985E.SYS

2010-06-25 15:36:31 33120 ----a-w- c:\windows\system32\drivers\2305D.SYS

2010-06-25 15:36:30 33120 ----a-w- c:\windows\system32\drivers\0265C.SYS

2010-06-22 17:36:08 0 d-----w- c:\program files\Shared

2010-06-22 00:12:50 0 d-----w- c:\program files\Spybot - Search & Destroy

2010-06-22 00:12:50 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2010-06-19 10:22:39 0 d-----w- c:\windows\system32\NtmsData

2010-06-17 20:33:38 112 ----a-w- c:\docume~1\alluse~1\applic~1\i17B8bn.dat

==================== Find3M ====================

2006-07-07 12:16:23 604 -c-ha-w- c:\program files\STLL Notifier

============= FINISH: 13:38:06.98 ===============

Problem.zip

[StarvingLion]

Tried malwarebytes v1.46 updated database on June 30, doesn't remove the problem.

Tried antivir latest version and updated database as of June 30, doesn't remove the problem.

Only visible problems are:

1) I click on a link from a google search and it usually redirects me to a different site.

2) Occasionally, a new browser window will pop up out of nowhere and again redirect to a different site.

3) Occasional hanging of the machine requiring powering off.

4) I utilize a modem connection (28k) and it seems to throttle now although this could be a policy of the ISP and not malware/rootkit related.

[StarvingLion]

Have undertaken procedures to rectify problem:

1) Cleaned the java crap off the machine

2) Ran mbr.exe and everything okay

3) Ran Combofix.exe, rootkit was detected and both problems (redirection and communication throttling down) appear to be eliminated after testing.

The machine appears to be working perfectly and no further assistance is required. Thank you.

[sjpritch25]

Please post the ComboFix log

Usually located here C:\Combofix.txt.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!