Help with spyware/viruses and a slow computer in general

Zorinas-WorldZorinas-World
edited October 2011 in Science & Tech
I would greatly appreciate some help with an overall slow computer and virus/spyware help!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:26:24 PM, on 9/30/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenUpdate.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\Launcher.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbrmon.exe
C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbrmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.netzero.net/search?action=minisearch&source=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.netzero.net/search?action=minisearch&source=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZKxdm567YYus&ptb=2AA77F72-FD8B-43F4-9ACE-1148DC6A1F30
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.netzero.net/search?action=minisearch&source=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {432cad96-6aa6-407a-ab37-6cfdcd73f377} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwSrcAs.dll
R3 - URLSearchHook: (no name) - {d664042c-ca70-48b6-afc9-24a4212d5e43} - C:\Program Files\WebfettiIE\bar\1.bin\ybSrcAs.dll
F3 - REG:win.ini: load=load=load=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ADC PlugIn - {19090308-636D-4e9b-A1CE-A647B6F794BF} - C:\Documents and Settings\Guest\Application Data\wF3pmGaQJdKfZhX\sysl32.dll
O2 - BHO: Winster - {196252dc-bf6d-4aa2-bb39-038d9495b561} - C:\Program Files\Winster\prxtbWin0.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll
O2 - BHO: Search Assistant BHO - {a504d73b-32d5-4b53-9dfc-0891be7653f0} - C:\Program Files\WebfettiIE\bar\1.bin\ybSrcAs.dll
O2 - BHO: Search Assistant BHO - {be5bab39-39b5-45c1-83f2-10ee5ae55587} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwSrcAs.dll
O2 - BHO: Toolbar BHO - {c335fe0b-1418-42fb-942f-2c1e13259052} - C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbar.dll
O2 - BHO: Toolbar BHO - {d826715f-a629-4613-a641-5ca18e8b2f7a} - C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbar.dll
O2 - BHO: LivingPlay - {D9291F9E-7010-4D7A-8DF6-455DEEF8EF51} - C:\Program Files\LivingPlay Games\lplaytl.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll
O3 - Toolbar: Winster Toolbar - {196252dc-bf6d-4aa2-bb39-038d9495b561} - C:\Program Files\Winster\prxtbWin0.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O3 - Toolbar: Webfetti - {94fc3fb2-3e5c-4b8f-aaee-17090ce800bc} - C:\Program Files\WebfettiIE\bar\1.bin\ybbar.dll
O3 - Toolbar: MyOwnSuperhero - {3bcf580a-adca-4b91-86e0-3898010003e6} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwbar.dll
O4 - HKLM\..\Run: [DDCM] "C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\system32\Launcher.exe
O4 - HKLM\..\Run: [NI.UWFX6_0001_N69M0903] "C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\05ABSTUN\WinFixer2006FreeInstall[1].exe" -nag
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NielsenOnline] C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
O4 - HKLM\..\Run: [WebfettiIE Browser Plugin Loader] C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbrmon.exe
O4 - HKLM\..\Run: [MyOwnSuperheroIE Browser Plugin Loader] C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbrmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [jIBBttzP0y8234A] C:\WINDOWS\system32\IAAA1uvD2.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?
O8 - Extra context menu item: &Search - http://tbedits.webfetti.com/one-toolbaredits/menusearch.jhtml?s=100000418&p=ZKxdm567YYus&si=&a=2AA77F72-FD8B-43F4-9ACE-1148DC6A1F30&n=2011011421
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/IWONBarInitialSetup1.0.1.1.cab
O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} (SpiderSolitaire Control) - http://www.worldwinner.com/games/v56/spidersolitaire/spidersolitaire.cab
O16 - DPF: {64CD313F-F079-4D93-959F-4D28B5519449} (Jeopardy Control) - http://www.worldwinner.com/games/v56/jeopardy/jeopardy.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} (WorldWinner ActiveX Launcher Control) - http://www.worldwinner.com/games/launcher/ie/v2.23.01.0/iewwload.cab
O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} (WoF Control) - http://www.worldwinner.com/games/v57/wof/wof.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinner.com/games/v41/hangman/hangman.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MyOwnSuperhero Service (MyOwnSuperheroIEService) - MyOwnSuperhero - C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbarsvc.exe
O23 - Service: Nielsen Update (NielsenUpdate) - The Nielsen Company - C:\Program Files\NetRatingsNetSight\NetSight\NielsenUpdate.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webfetti Service (WebfettiIEService) - Webfetti - C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbarsvc.exe
O24 - Desktop Component 0: (no name) - http://www.nufsoft.com/gallery/20031201Small.jpg
O24 - Desktop Component 1: (no name) - http://ak.imgfarm.com/images/funwebproducts/pss/CB051584.jpg
O24 - Desktop Component 2: (no name) - http://ak.scr.imgfarm.com/natu/md/CB009369.jpg
O24 - Desktop Component 3: (no name) - http://www.nufsoft.com/gallery/20031202Small.jpg
O24 - Desktop Component 4: (no name) - http://www.nufsoft.com/gallery/20020704Small.jpg
O24 - Desktop Component 5: (no name) - http://ak.scr.imgfarm.com/holi/tn/BXP56730.jpg

--
End of file - 11674 bytes

Comments

  • TushonTushon I'm scared, Coach Alexandria, VA Icrontian
    edited October 2011
    Follow the instructions here, and your problem lines look like:
    O4 - HKLM\..\Run: [NI.UWFX6_0001_N69M0903] "C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\05ABSTUN\WinFixer2006FreeInstall[1].exe" -nag 

O4 - HKLM\..\Run: [jIBBttzP0y8234A] C:\WINDOWS\system32\IAAA1uvD2.exe

    After that, make sure you run windows updates and get completely up to date and keep one AV program (like AVIRA or Avast) running and up to date.
  • Zorinas-WorldZorinas-World
    edited October 2011
    this is the logfile between steps 1 and 2
    (windows is still running very bogged down) fyi and thank you for your help!

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 10:28:51 AM, on 10/19/2011
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\NetRatingsNetSight\NetSight\NielsenUpdate.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe
    C:\windows\system\hpsysdrv.exe
    C:\WINDOWS\system32\Launcher.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
    C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbrmon.exe
    C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbrmon.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\NetRatingsNetSight\NetSight\NielsenOnline.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\NETGEAR\WG111v2\WG111v2.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.netzero.net/search?action=minisearch&source=minisearch
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.netzero.net/search?action=minisearch&source=minisearch
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZKxdm567YYus&ptb=2AA77F72-FD8B-43F4-9ACE-1148DC6A1F30
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4.hpwis.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.netzero.net/search?action=minisearch&source=minisearch
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer, optimized for Bing and MSN
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: (no name) - {432cad96-6aa6-407a-ab37-6cfdcd73f377} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwSrcAs.dll
    R3 - URLSearchHook: (no name) - {d664042c-ca70-48b6-afc9-24a4212d5e43} - C:\Program Files\WebfettiIE\bar\1.bin\ybSrcAs.dll
    F3 - REG:win.ini: load=load=load=
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll
    O2 - BHO: Search Assistant BHO - {a504d73b-32d5-4b53-9dfc-0891be7653f0} - C:\Program Files\WebfettiIE\bar\1.bin\ybSrcAs.dll
    O2 - BHO: Search Assistant BHO - {be5bab39-39b5-45c1-83f2-10ee5ae55587} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwSrcAs.dll
    O2 - BHO: Toolbar BHO - {c335fe0b-1418-42fb-942f-2c1e13259052} - C:\PROGRA~1\MYOWNS~2\bar\1.bin\cwbar.dll
    O2 - BHO: Toolbar BHO - {d826715f-a629-4613-a641-5ca18e8b2f7a} - C:\PROGRA~1\WEBFET~2\bar\1.bin\ybbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files\Search Toolbar\SearchToolbar.dll
    O3 - Toolbar: Webfetti - {94fc3fb2-3e5c-4b8f-aaee-17090ce800bc} - C:\Program Files\WebfettiIE\bar\1.bin\ybbar.dll
    O3 - Toolbar: MyOwnSuperhero - {3bcf580a-adca-4b91-86e0-3898010003e6} - C:\Program Files\MyOwnSuperheroIE\bar\1.bin\cwbar.dll
    O4 - HKLM\..\Run: [DDCM] "C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
    O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [PrimaLauncher] C:\WINDOWS\system32\Launcher.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
  • TushonTushon I'm scared, Coach Alexandria, VA Icrontian
    edited October 2011
    Okay, report back after finishing all instructions. You may also want to run (from run box, windows key + r) "sfc /scannow" (no quotes) after going through the removals to verify key windows files. You may also want to uninstall the search toolbars that you don't use (and probably shouldn't be using) and "Nielson" stuff listed. For future reference, please attached the log files rather than posting the text. It is an option in the "go advanced" section of the post.
  • Zorinas-WorldZorinas-World
    edited October 2011
    ComboFix 11-10-19.03 - Owner 10/19/2011 11:43:12.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.224.56 [GMT -4:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe
    c:\progra~1\MYOWNS~2\bar\1.bin\cwBAr.dll
    c:\progra~1\WEBFET~2\bar\1.bin\ybBAr.dll
    c:\program files\MyOwnSuperheroIE\bar\1.bin\cwBAr.dll
    c:\program files\MyOwnSuperheroIE\bar\1.bin\cwSRcas.dll
    c:\program files\WebfettiIE\bar\1.bin\ybBAr.dll
    c:\program files\WebfettiIE\bar\1.bin\ybSRcas.dll
    c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
    c:\windows\system\oeminfo.ini
    c:\windows\system32\d3d9caps.dat
    c:\windows\system32\FF05DA0D.dll
    c:\windows\system32\launcher.exe
    c:\windows\system32\regobj.dll
    c:\windows\system32\rnaph.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-09-19 to 2011-10-19 )))))))))))))))))))))))))))))))
    .
    .
    2011-10-19 14:22 . 2011-10-19 14:22 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-10-11 06:26 . 2011-10-11 06:26
    d
    w- c:\documents and settings\Owner\Application Data\Avira
    2011-10-11 06:21 . 2011-09-18 12:39 134344 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-10-11 06:21 . 2011-09-16 03:55 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
    2011-10-11 06:21 . 2011-09-16 03:55 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-10-11 06:21 . 2011-10-11 06:21
    d
    w- c:\program files\Avira
    2011-10-11 06:21 . 2011-10-11 06:21
    d
    w- c:\documents and settings\All Users\Application Data\Avira
    2011-10-08 22:10 . 2011-10-08 22:46
    d
    w- c:\program files\ARO 2011
    2011-10-08 20:51 . 2011-10-08 21:03
    d
    w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
    2011-10-08 20:48 . 2011-10-08 20:48
    d
    w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
    2011-10-08 20:47 . 2011-10-08 20:49
    d
    w- c:\program files\CCleaner
    2011-10-08 20:45 . 2011-10-08 21:09
    d
    w- c:\program files\Google
    2011-10-08 20:45 . 2011-10-08 21:07
    d
    w- c:\documents and settings\Owner\Local Settings\Application Data\Google
    2011-10-04 19:42 . 2011-10-04 19:42
    d
    w- c:\documents and settings\Owner\Application Data\Malwarebytes
    2011-10-04 19:41 . 2011-10-04 19:41
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-10-04 19:40 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-10-04 19:40 . 2011-10-04 19:41
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2011-10-04 19:25 . 2011-10-08 22:13
    d
    w- c:\documents and settings\Owner\Application Data\Sammsoft
    2011-10-01 01:51 . 2011-10-01 01:51
    d
    w- c:\program files\Common Files\iS3
    2011-10-01 01:50 . 2011-10-02 03:55
    d
    w- c:\documents and settings\All Users\Application Data\STOPzilla!
    2011-09-30 13:02 . 2011-09-30 13:02 19416 ----a-w- c:\program files\Mozilla Firefox\AccessibleMarshal.dll
    2011-09-30 13:02 . 2011-09-30 13:02 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
    2011-09-30 13:02 . 2011-09-30 13:02 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
    2011-09-30 13:02 . 2011-09-30 13:02 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
    2011-09-30 13:02 . 2011-09-30 13:02 125912 ----a-w- c:\program files\Mozilla Firefox\crashreporter.exe
    2011-09-30 13:02 . 2011-09-30 13:02 924632 ----a-w- c:\program files\Mozilla Firefox\firefox.exe
    2011-09-30 13:02 . 2011-09-30 13:02 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
    2011-09-30 13:02 . 2011-09-30 13:02 478168 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
    2011-09-30 13:02 . 2011-09-30 13:02 269272 ----a-w- c:\program files\Mozilla Firefox\freebl3.dll
    2011-09-30 13:02 . 2011-09-30 13:02 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
    2011-09-30 13:02 . 2011-09-30 13:02 715736 ----a-w- c:\program files\Mozilla Firefox\mozcrt19.dll
    2011-09-30 13:02 . 2011-09-30 13:02 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
    2011-09-30 01:20 . 2011-09-30 01:20
    d
    w- c:\documents and settings\Guest\Application Data\SUPERAntiSpyware.com
    2011-09-30 00:56 . 2011-09-30 00:56
    d
    w- c:\documents and settings\Guest\Local Settings\Application Data\Mozilla
    2011-09-19 23:44 . 2011-09-28 18:13
    d
    w- c:\documents and settings\All Users\Application Data\Big Fish Games
    2011-09-19 23:36 . 2011-09-28 18:13
    d
    w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
    2011-09-19 23:34 . 2011-09-19 23:35
    d
    w- c:\program files\LivingPlay Games
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-26 15:41 . 2008-07-30 00:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 15:41 . 2004-09-20 19:26 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 15:41 . 2004-09-20 19:26 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-09-09 09:12 . 2002-09-23 19:10 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-06 13:20 . 2004-09-20 19:27 1858944 ----a-w- c:\windows\system32\win32k.sys
    2011-09-03 17:42 . 2011-08-04 02:52 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-08-22 23:48 . 2004-09-20 19:27 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-08-22 23:48 . 2004-09-20 19:26 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-08-22 23:48 . 2004-09-20 19:26 1469440
    w- c:\windows\system32\inetcpl.cpl
    2011-08-22 11:56 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
    2011-08-17 13:49 . 2004-09-20 19:26 138496 ----a-w- c:\windows\system32\drivers\afd.sys
    2011-09-30 13:02 . 2011-09-30 13:02 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    1998-04-02 21:51 77312 -csha-r- c:\windows\ic.exe
    1998-04-02 21:55 80384 -csha-r- c:\windows\icfire.exe
    1997-07-23 16:03 11338 -csha-r- c:\windows\ts.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="NvQTwk" [X]
    "DDCM"="c:\program files\WildTangent\DDC\DDCManager\DDCMan.exe" [2001-10-03 155648]
    "DDCActiveMenu"="c:\program files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [2001-10-03 94208]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-16 212992]
    "IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-08 143360]
    "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-08 90112]
    "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]
    "PCTVOICE"="pctspk.exe" [2002-03-14 163840]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "NielsenOnline"="c:\program files\NetRatingsNetSight\NetSight\NielsenOnline.exe" [2009-10-30 47456]
    "WebfettiIE Browser Plugin Loader"="c:\progra~1\WEBFET~2\bar\1.bin\ybbrmon.exe" [2011-01-15 20480]
    "MyOwnSuperheroIE Browser Plugin Loader"="c:\progra~1\MYOWNS~2\bar\1.bin\cwbrmon.exe" [2011-01-15 20480]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-09-23 258512]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
    NETGEAR WG111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v2\WG111v2.exe [2011-3-31 1261568]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    .
    R0 nielprt;Nielsen Patch Service;c:\windows\SYSTEM32\drivers\nielprt.sys [12/25/2010 5:56 PM 24192]
    R1 avkmgr;avkmgr;c:\windows\SYSTEM32\drivers\avkmgr.sys [10/11/2011 2:21 AM 36000]
    R1 nnrnstdi;nnrnstdi;c:\windows\SYSTEM32\drivers\nnrnstdi.sys [12/25/2010 5:59 PM 15360]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
    R2 ppsio2;PPDevice;c:\windows\SYSTEM32\drivers\PPSIO2.SYS [2/17/2005 4:13 PM 22400]
    R3 km_filter;km_filter;c:\windows\SYSTEM32\drivers\km_filter.sys [12/25/2010 5:59 PM 10368]
    R3 MBAMProtector;MBAMProtector;c:\windows\SYSTEM32\drivers\mbam.sys [10/4/2011 3:40 PM 22216]
    R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\SYSTEM32\drivers\wg111v2.sys [3/31/2011 11:04 AM 194304]
    R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\SYSTEM32\drivers\sis7012.sys [11/16/2001 2:14 AM 164864]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
    S3 NielGfx;Nielsen USB GFX;c:\windows\SYSTEM32\drivers\nielgfx.sys [12/25/2010 5:56 PM 9088]
    S3 trid3d;trid3d;c:\windows\SYSTEM32\drivers\trid3dm.sys [7/31/2001 8:27 PM 130332]
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-10-19 c:\windows\Tasks\User_Feed_Synchronization-{1119D3EF-5830-4AEB-8BEE-D385AF3FB25C}.job
    - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
    .
    2011-10-18 c:\windows\Tasks\{C1EF4A30-9E55-4566-85C0-BD8FBF315DD4}_YOUR-W92P4BHLZG_Owner.job
    - c:\windows\system32\mobsync.exe [2004-09-20 00:12]
    .
    .
    Supplementary Scan
    .
    uDefault_Search_URL = hxxp://srch-us4.hpwis.com/
    uStart Page = hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZKxdm567YYus&ptb=2AA77F72-FD8B-43F4-9ACE-1148DC6A1F30
    mSearch Bar = hxxp://srch-us4.hpwis.com/
    uInternet Settings,ProxyOverride = localhost
    uSearchURL,(Default) = hxxp://search.netzero.net/search?action=minisearch&source=minisearch
    TCP: DhcpNameServer = 192.168.1.1
    DPF: Microsoft XML Parser for Java
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\0uyt72r5.default\
    FF - prefs.js: browser.search.selectedEngine - Pandora Music and Artists
    FF - prefs.js: browser.startup.homepage - hxxp://home.mywebsearch.com/index.jhtml?n=77C09F4F&ptnrS=ZKxdm567YYus&ptb=2AA77F72-FD8B-43F4-9ACE-1148DC6A1F30
    FF - prefs.js: network.proxy.http - 127.0.0.1
    FF - prefs.js: network.proxy.http_port - 7900
    FF - prefs.js: network.proxy.type - 0
    .
    - - - - ORPHANS REMOVED - - - -
    .
    WebBrowser-{A057A204-BACC-4D26-CEC4-75A487FD6484} - (no file)
    HKLM-Run-PrimaLauncher - c:\windows\system32\Launcher.exe
    Notify-TPSvc - TPSvc.dll
    AddRemove-SiS7012 - c:\progra~1\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-10-19 12:03
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    LOCKED REGISTRY KEYS
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{57e34c13-33fd-415c-84c9-7e41ba096fe4}]
    @Denied: (Full) (Everyone)
    "Model"=dword:0000012b
    "Therad"=dword:0000001d
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
    @Denied: (Full) (Everyone)
    "scansk"=hex(0):32,47,c3,38,cb,4c,8d,21,d1,b7,18,6d,20,7c,0d,2f,81,71,95,36,ab,
    b3,19,8f,ff,ad,6b,49,42,34,7d,8c,c6,bc,76,1c,ee,93,6f,d2,00,00,00,00,00,00,\
    .
    DLLs Loaded Under Running Processes
    .
    - - - - - - - > 'winlogon.exe'(672)
    c:\windows\system32\RtlGina2.dll
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\windows\System32\l3codeca.acm
    c:\windows\system32\midimap.dll
    .
    Completion time: 2011-10-19 12:14:14
    ComboFix-quarantined-files.txt 2011-10-19 16:14
    .
    Pre-Run: 20,093,923,328 bytes free
    Post-Run: 20,121,628,672 bytes free
    .
    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn
    .
    - - End Of File - - 7B63BF1D02424056AA0F54BB6E7FEE59
  • TushonTushon I'm scared, Coach Alexandria, VA Icrontian
    edited October 2011
    That is looking better. How is the computer running now? You may also want to check your Internet Settings for a proxy setting.
Sign In or Register to comment.