Malware Defense and redirecting of IE plus some...

View previous topic View next topic Go down

Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 19th January 2010, 3:02 pm

Hello,

I have been reading through these forums for a few days now since my husband's pc was infected with the Malware Defense virus/trojan. I was finally able to remove it (I thought) through add/remove programs in safe mode. He never did install any anti-virus software, i.e. AVG (which is what I use on mine), hardheaded man 'sighs' but I bet if we can fix this he won't disagree anymore lol.

Once I removed the mal-def. trojan (or so I thought) I tried to d/l AVG to his computer it d/l'ed fine but when I began to install it, the software gave the error message of Malware Defense is detected on your system..please remove blah blah...and I don't know where it's hiding so wasn't able to get AVG installed on there. Also, there were many pop up's going on advising of trojans/system at risk/etc..etc... Those have not popped up anymore since I got mal-def. off through add/remove prog.

I also d/l'ed Dr.Web-cureit to flash drive from my pc and installed on his and ran it, it found about 12 diff things said it deleted them but yet we're still having the same problem as far as not being able to d/l AVG or run MBAM, which I d/l'ed to flash as well but when I tried to install it in safe mode it would not even open up. Also, his pc is still constantly re-directing to other sites when I try to come to this forum on it...so I'm having to work with flash drive and whatnot from mine to his.

There is something else I've noticed as well, this is constantly popping up in task manager even when killed: iexplore.exe it pops up even in safe mode without networking, if I happen to be regularly logged in on there and leave it idle for a bit IE opens with the notification of internet explorer cannot display.....

Anyway, sorry for the long post but that is the jist of the situation as I know it. I was able to get Hijack this on his pc in safe mode and ran it, here is the log-file...ran it in safe mode could someone let me know if it is better to be regularly logged in and not in safe mode when running it?? Thank you for any help, it is much appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:46 AM, on 1/19/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.heavygames.com/downhilljam/playiframe.asp"
O8 - Extra context menu item: Google Sidewiki... - [You must be registered and logged in to see this link.] Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [You must be registered and logged in to see this link.]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\intelxpv_v103\wdm\STacSV.exe

--
End of file - 6179 bytes

*EDIT*

His platform is Windows XP pro SP3, I went ahead and logged in normally and ran HJT again here is the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:54:56 AM, on 1/19/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\intelxpv_v103\wdm\STacSV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.3; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://www.heavygames.com/downhilljam/playiframe.asp"
O8 - Extra context menu item: Google Sidewiki... - [You must be registered and logged in to see this link.] Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - [You must be registered and logged in to see this link.]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\intelxpv_v103\wdm\STacSV.exe

--
End of file - 6573 bytes

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 19th January 2010, 4:41 pm

Please visit this webpage for instructions for downloading and running ComboFix:

[You must be registered and logged in to see this link.]

Post the log from ComboFix when you've accomplished that.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 19th January 2010, 5:20 pm

Ok ran it and boy did it do some stuff lol, had me worried whatever is on the machine was messing with it. Here is the logfile:

ComboFix 10-01-18.03 - Tim 01/19/2010 11:03:01.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1712 [GMT -6:00]
Running from: G:\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Tim\Application Data\inst.exe
c:\windows\system32\drivers\H8SRTyfwlxeqiap.sys
c:\windows\system32\H8SRTdyhktprqvq.dll
c:\windows\system32\H8SRThhabwjjkwn.dll
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\H8SRTmlqgotprkv.dat
c:\windows\system32\H8SRTryvymxewqv.dll
c:\windows\system32\H8SRTsboettbidl.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-12-19 to 2010-01-19 )))))))))))))))))))))))))))))))
.

2010-01-19 16:48 . 2010-01-19 16:51 -------- d-----w- C:\Combo-Fix
2010-01-19 14:40 . 2010-01-19 14:40 -------- d-----w- c:\program files\Trend Micro
2010-01-16 18:14 . 2010-01-16 18:14 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2010-01-14 15:36 . 2010-01-15 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-14 15:36 . 2010-01-14 15:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-14 15:26 . 2010-01-14 15:26 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-01-14 15:23 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Tim\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-01-14 15:23 . 2009-11-20 11:08 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2010-01-14 15:23 . 2010-01-14 15:23 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-14 15:22 . 2010-01-14 15:22 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-01-14 15:13 . 2010-01-14 15:13 152576 ----a-w- c:\documents and settings\Tim\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-14 15:13 . 2010-01-14 15:13 79488 ----a-w- c:\documents and settings\Tim\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-14 14:24 . 2010-01-14 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-14 14:10 . 2010-01-14 14:10 -------- d-----w- c:\documents and settings\Tim\Application Data\AVG8
2010-01-14 06:21 . 2010-01-14 06:21 -------- d-----w- c:\documents and settings\Tim\DoctorWeb
2010-01-14 03:07 . 2010-01-14 03:07 -------- d-----w- c:\documents and settings\Tim\Local Settings\Application Data\Threat Expert
2010-01-14 03:00 . 2010-01-17 01:28 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-07 00:34 . 2010-01-14 05:01 -------- d-----w- c:\program files\Microsoft Silverlight
2009-12-28 19:26 . 2010-01-08 05:41 -------- d-----w- c:\windows\SxsCaPendDel
2009-12-28 19:05 . 2009-12-28 19:06 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-12-27 18:16 . 2009-12-27 18:31 -------- d-----w- c:\documents and settings\Tim\Application Data\Apple Computer
2009-12-27 18:16 . 2009-12-27 18:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-12-27 18:15 . 2009-12-27 18:15 -------- d-----w- c:\program files\Bonjour
2009-12-27 18:15 . 2009-12-27 18:15 -------- d-----w- c:\program files\QuickTime
2009-12-27 18:15 . 2009-12-27 18:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-27 18:15 . 2009-12-27 18:15 -------- d-----w- c:\documents and settings\Tim\Local Settings\Application Data\Apple
2009-12-27 18:14 . 2010-01-11 19:58 -------- d-----w- c:\program files\Common Files\Apple
2009-12-27 18:14 . 2009-12-27 18:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-12-27 18:14 . 2009-12-28 19:18 -------- d-----w- c:\documents and settings\Tim\Local Settings\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 23:11 . 2009-09-28 04:26 -------- d-----w- c:\program files\PokerStars
2010-01-14 16:16 . 2009-11-01 19:24 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-01-14 15:26 . 2009-10-08 19:07 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-14 15:14 . 2009-09-30 19:32 -------- d-----w- c:\program files\Java
2010-01-13 18:28 . 2009-09-28 01:18 138384 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-01-13 18:26 . 2009-09-27 22:58 215128 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-01-11 18:02 . 2009-10-10 02:29 -------- d-----w- c:\documents and settings\Tim\Application Data\Vso
2010-01-03 04:39 . 2009-10-18 20:50 -------- d-----w- c:\program files\PokerStars.NET
2009-12-28 19:05 . 2009-09-28 00:58 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-12-28 19:05 . 2009-09-28 00:46 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-12-28 19:05 . 2009-09-28 00:59 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-11-21 15:51 . 2004-08-03 23:56 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-06 02:14 . 2009-11-06 02:14 41872 ----a-w- c:\windows\system32\xfcodec.dll
2009-11-01 19:24 . 2009-11-01 19:24 1962544 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player_ax.exe
2009-10-29 07:45 . 2004-08-03 23:56 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-27 15:58 . 2009-09-27 15:57 13688 ----a-w- c:\documents and settings\Tim\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-30 39408]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe" [2009-07-31 468408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 21:57 948672 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 07:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 05:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-01-26 21:31 2144088 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-08-14 02:24 98304 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-11 10:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-09-30 19:05 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTrayApp]
2009-03-12 17:53 483422 ----a-w- c:\program files\IDT\WDM\sttray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP4\\RpcAgentSrv.exe"=
"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP4\\WNt500x86\\RpcSandraSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [9/27/2009 6:26 PM 5248]
S3 NDISKIO;NDISKIO;\??\c:\docume~1\Tim\LOCALS~1\Temp\00000cfd.nmc\nse\bin\ndiskio.sys --> c:\docume~1\Tim\LOCALS~1\Temp\00000cfd.nmc\nse\bin\ndiskio.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 pbfilter;pbfilter;c:\documents and settings\Tim\Desktop\PeerBlock_r181__Win32_Release\pbfilter.sys [9/28/2009 2:02 AM 14424]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe [9/27/2009 12:24 PM 99176]
S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [9/27/2009 6:26 PM 160640]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/27/2009 6:46 PM 691696]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
SafeBoot-dwshd.sys



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2010-01-19 11:08
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(4064)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\idt\intelxpv_v103\wdm\STacSV.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-01-19 11:09:57 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-19 17:09

Pre-Run: 163,348,353,024 bytes free
Post-Run: 163,330,154,496 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 916B7730EA419E6950A9124D1309BADF

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 19th January 2010, 5:45 pm

Please visit this webpage for instructions for downloading and running SUPERAntiSpyware to scan and remove malware from your computer:

[You must be registered and logged in to see this link.]

Post the log from SUPERAntiSpyware when you've accomplished that.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 19th January 2010, 5:57 pm

Ok doing that. Thank you so much for your time Smile.

I just wanted to state that when ComboFix ran and did it's process I noticed a new IE icon was placed on the desktop. After I posted the log from CF here I checked his task manager and there is no sign of that iexplore.exe on there anymore.

Also, was able to finally run Spybot S&D and get it updated and immunized although I haven't ran the scan yet with it, at least it actually booted up and worked this time.

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 19th January 2010, 7:05 pm

Ok, apologies, I had to go take care of some things...here is the log:

SUPERAntiSpyware Scan Log
[You must be registered and logged in to see this link.]

Generated 01/19/2010 at 12:31 PM

Application Version : 4.33.1000

Core Rules Database Version : 4493
Trace Rules Database Version: 2308

Scan type : Complete Scan
Total Scan Time : 00:16:50

Memory items scanned : 401
Memory threats detected : 0
Registry items scanned : 4652
Registry threats detected : 0
File items scanned : 18735
File threats detected : 0

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 19th January 2010, 7:29 pm

Seeing as how his pc seems to be using the internet normally now w/o the redirecting crap going on, I went ahead and d/l'ed AVG and got it updated and all that good stuff. Should I go ahead and try again to d/l MBAM, I had tried it before on here and because of whatever virus/trojan was there it was not allowing me to access it once I got it d/l'ed.

Thanks again in advance.

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 20th January 2010, 3:15 am

Sure. Let's try MBAM again. Smile


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 20th January 2010, 3:30 am

Ok, d/l'ed it... I have a quick question; Should I disable SAS and AVG before installing and running MBAM?

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 20th January 2010, 3:32 am

No need to,


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 20th January 2010, 3:36 am

Alright, also something I just remembered from earlier today after getting AVG on here...the resident shield has popped up a couple of times up with this:

Virus found Win32/Cryptor and also Trojan Horse Crypt.MRA

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 20th January 2010, 3:50 am

Here is the MBAM log...nothing found, so that is good? lol I'm assuming?

Database version: 3601
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/19/2010 9:47:02 PM
mbam-log-2010-01-19 (21-47-02).txt

Scan type: Quick Scan
Objects scanned: 110817
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 20th January 2010, 5:32 am

Ok, so AVG resident shield popped up again a little while after that scan with the same thing that I posted earlier so I went ahead and ran a full system scan with MbAM:

Malwarebytes' Anti-Malware 1.44
Database version: 3601
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/19/2010 11:19:37 PM
mbam-log-2010-01-19 (23-19-37).txt

Scan type: Full Scan (C:\|H:\|)
Objects scanned: 204307
Time elapsed: 26 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\H8SRTsboettbidl.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2D31AEB8-7BDC-49CC-9600-390B7E21D8A9}\RP145\A0065523.sys (Malware.Trace) -> Quarantined and deleted successfully.


I really want to say thank you for taking the time and volunteering here to help people out like myself who really have no clue as to what a lot of these entries even mean or pertain to. I have at least been able to get his pc in a stable running condition since the hijack this scan or rather the ComboFix scan...and would not have had a clue as to what to do without this site. Smile

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 21st January 2010, 12:33 am

Good.

Please download Security Check by screen317 from [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 21st January 2010, 2:34 am

Alright

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 3
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
AVG Free 9.0
Antivirus up to date!
``````````````````````````````
Anti-malware/Other Utilities Check:

Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
HijackThis 2.0.2
CCleaner (remove only)
Java(TM) 6 Update 17
Adobe Reader 9.3
``````````````````````````````
Process Check:
objlist.exe by Laurent

AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
AVG avgemc.exe
``````````````````````````````
DNS Vulnerability Check:

Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

`````````End of Log```````````

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 21st January 2010, 11:10 pm

Please read the following information that I have provided, which will help you prevent malicious software in the future. Please keep in mind, malware is a continuous danger on the Internet. It is highly important to stay safe while browsing, to prevent re-infection.

Software recommendations

AntiSpyware

  • [You must be registered and logged in to see this link.]
    SpywareBlaster is a program that prevents spyware from installing on your computer. A tutorial on using SpywareBlaster may be found [You must be registered and logged in to see this link.].
  • [You must be registered and logged in to see this link.].
    Spybot - Search & Destroy is a spyware and adware removal program. It also has realtime protection, TeaTimer to help safeguard your computer against spyware. (The link for Spybot - Search & Destroy contains a tutorial that will help you download, install, and begin using Spybot).


NOTE: Please keep ALL of these programs up-to-date and run them whenever you suspect a problem to prevent malware problems.

Resident Protection help
A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall, and scanning anti-spyware program at a time. Passive protectors such as SpywareBlaster can be run with any of them.

Rogue programs help
There are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you can find out if it is a rogue here:
[You must be registered and logged in to see this link.]

Securing your computer

  • [You must be registered and logged in to see this link.] - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
  • [You must be registered and logged in to see this link.] replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites by redirecting them to 127.0.0.1, which is your local computer's loopback address, meaning it will be difficult to infect your computer in the future.


Please consider using an alternate browser
Mozilla's Firefox browser is a very good alternative. In addition to being generally more secure than Internet Explorer, it has a very good built-in popup blocker and add-ons, like NoScript, can make it even more secure. Opera is another good option.

If you are interested:


Thank you for choosing GeekPolice. Please see [You must be registered and logged in to see this link.] if you would like to leave feedback or contribute to our site. Do you have any more questions?


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 23rd January 2010, 2:19 am

Thank you so very much for all of your help and instruction. I will say that I really do believe that the initial virus/trojan (s) came from a file that he downloaded from utorrent (you really never know what you're getting with those things).

He likes to get the UFC fights every now and then and has a gotten a few before, from there, with no problems...but this file (once I looked at it) just looked like it was in a weird format in my opinion, and when it finished d/l'ing and he tried to open it that was when all the issues started happening. I initially got rid of the file and took utorrent off his pc.

At any rate, I agree with what I have read from you all here about p2p programs/sites. We won't be messing around with those any more lol.

I just had a couple of questions now; the tea timer that comes along with Spybot S&D, can it be utilized and run concurrent along with the AVG resident shield protection w/o any issues when performing scans?

Also, I noticed in one of your other threads that you suggest some different firewall programs other than the windows firewall....are there better advantages from any of those than what windows firewall itself does?? If he decides to get one of those others, does windows firewall need to be disabled or uninstalled or what?

Thank you again for your time and dedication DM Jay Smile.

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 23rd January 2010, 3:08 am

AVG should not be run with Spybot.

All the firewalls are so different from each other, so experimenting or choosing one is best. And yes, turn off Windows Firewall if you decide to get a new firewall.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Butterfly275 on 23rd January 2010, 3:19 am

Alrighty, thanks for your response. Smile

Butterfly275
Novice
Novice

Posts Posts : 12
Joined Joined : 2010-01-14
Gender Gender : Female
OS OS : windows xp
Points Points : 25378
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Malware Defense and redirecting of IE plus some...

Post by Dr Jay on 23rd January 2010, 3:26 am

You're welcome Smile


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Posts Posts : 14309
Joined Joined : 2009-09-06
Gender Gender : Male
OS OS : Windows 10 Home & Pro
Arch. Arch. : x64 (64-bit)
Protection Protection : Bitdefender Total Security
Points Points : 302960
# Likes # Likes : 10

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum