[Resolved] Prbrowser redirects, problems shutting down & starting up

[aaronski]

K27,

OK I updated Java first by accident so when I went to add/remove programs I didn't see any older versions to remove. Hopefully that isn't a problem.

I am on the step of running the ESET online scan. However, I keep getting this message on step 2 of 4 - "Cannot get update - is proxy configured". Please advise.

- aaronski

[aaronski]

When I first hit start and the scan started it said that the task of completing the updates was 100% done but there was an error message. So I hit the back button it provides and started the process again. Therefore it now says a note below: "ESET Online Scanner has already been run on this computer in the past. Only files necessary to update to the current version will be downloaded."

[K27]

Hi,

I have had this issue with ESET online before and it was the resident AV interfering.

Rather than wasting time trying to work around with the online version, please update and run a full scan with your own ESET AV and let me know if it finds anything.

If it does, please save the results and post them back with a fresh set of DDS logs and a status report on how the system is running.

Thanks.

[aaronski]

OK will try that and post log results here shortly.

[aaronski]

here's the log from my resident ESET program. Just FYI there were 8 warnings and I told it to ignore per your instructions for the online version of this scan. I had a copy of registry booster on this machine before but removed it a few weeks ago. I tried pasting but it said I exceeded 5K char. limit so I've attached as a zip file instead.

[aaronski]

here is the DDS log:

.
DDS (Ver_11-03-05.01) - NTFSx86 
Run by Home at 23:09:41.76 on Wed 05/11/2011
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2047.1350 [GMT -7:00]
.
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\a la mode\Sched\eSched.exe
C:\Program Files\Seagate\Seagate Dashboard\MemeoDashboard.exe
C:\Program Files\Memeo\Memeo Send\MemeoSend.exe
C:\Program Files\Memeo\AutoBackup\InstantBackup.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Seagate\Seagate Dashboard\SeagateDashboardService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Home\Desktop\Virus Stuff\dds.com
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
BHO: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\tbZone.dll
TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [The Assistant] c:\program files\a la mode\sched\eSched.exe
mRun: [Memeo Instant Backup] c:\program files\memeo\autobackup\MemeoLauncher2.exe --silent --no_ui
mRun: [Memeo Send] c:\program files\memeo\memeo send\MemeoLauncher.exe --silent
mRun: [Seagate Dashboard] c:\program files\seagate\seagate dashboard\MemeoLauncher.exe --silent --no_ui
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\home\startm~1\programs\startup\seagat~1.lnk - c:\documents and settings\home\application data\leadertech\powerregister\Seagate Product Registration.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D1E1F7ED622A0E5D.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: AuGen - hxxp://alchemyweb.city.newport-beach.ca.us/alchemyweb/Components/AuGen.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {22D4879A-92DB-470D-8A83-E158797D8176} - file:///D:/components/Liquid.ocx
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CD27EEF6-55B8-4F24-99C5-E1191D814445} - file:///C:/a%20la%20mode/WinTOTAL/Content/cabs/alaWeb5.CAB
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F375116A-793C-11D2-BFE1-444553540001} - hxxp://realist2.firstamres.com/mapviewer/mapviewer.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-8-3 95896]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-4-27 532224]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-11-4 810144]
R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2011-2-15 26872]
R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2011-2-15 488952]
R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\memeo\autobackup\MemeoBackgroundService.exe [2011-1-24 25824]
R2 MSSQL$ALAMODE;MSSQL$ALAMODE;c:\program files\microsoft sql server\mssql$alamode\binn\sqlservr.exe [2005-5-4 9150464]
R2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\seagate\seagate dashboard\SeagateDashboardService.exe [2010-4-30 14088]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-3-21 136176]
S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-3-21 136176]
S3 Rsiot0uadhww;Rsiot0uadhww;

S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;c:\program files\microsoft sql server\mssql$alamode\binn\sqlagent.EXE [2005-5-3 323584]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S3 Wpastubkdh;Wpastubkdh;

UnknownUnknown Atmss$a;Atmss$a;

.
=============== Created Last 30 ================
.
2011-04-30 06:30:53   --------   d-sha-r-   C:\cmdcons
2011-04-30 06:28:01   98816   ----a-w-   c:\windows\sed.exe
2011-04-30 06:28:01   89088   ----a-w-   c:\windows\MBR.exe
2011-04-30 06:28:01   256512   ----a-w-   c:\windows\PEV.exe
2011-04-30 06:28:01   161792   ----a-w-   c:\windows\SWREG.exe
2011-04-28 18:50:06   --------   d-----w-   c:\docume~1\home\locals~1\applic~1\ESET
2011-04-28 16:34:17   388096   ----a-r-   c:\docume~1\home\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-28 16:34:16   --------   d-----w-   c:\program files\Trend Micro
2011-04-28 16:09:15   --------   dc-h--w-   c:\windows\ie8
2011-04-28 15:32:27   --------   d-----w-   c:\docume~1\home\applic~1\RegistryKeys
2011-04-28 05:43:00   --------   d-----w-   c:\program files\InCode Solutions
2011-04-27 22:07:31   --------   d-----w-   c:\windows\Internet Logs
2011-04-27 21:45:09   --------   d--h--w-   c:\windows\msdownld.tmp
2011-04-27 21:33:12   --------   d-----w-   c:\program files\ESET
2011-04-27 21:09:28   --------   d-----w-   c:\program files\CCleaner
2011-04-27 07:23:48   --------   d-----w-   c:\windows\system32\NtmsData
2011-04-27 05:49:44   --------   d-----w-   c:\program files\Avira
2011-04-27 05:49:44   --------   d-----w-   c:\docume~1\alluse~1\applic~1\Avira
2011-04-27 02:41:27   --------   d-----w-   c:\program files\iPod
2011-04-27 02:41:23   --------   d-----w-   c:\program files\iTunes
2011-04-27 02:38:00   --------   d-----w-   c:\program files\Bonjour
2011-04-14 00:19:13   --------   d-----w-   c:\program files\Watchtower
.
==================== Find3M  ====================
.
2011-04-14 12:07:59   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2011-04-14 09:40:22   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2011-04-06 23:20:16   91424   ----a-w-   c:\windows\system32\dnssd.dll
2011-04-06 23:20:16   75040   ----a-w-   c:\windows\system32\jdns_sd.dll
2011-04-06 23:20:16   197920   ----a-w-   c:\windows\system32\dnssdX.dll
2011-04-06 23:20:16   107808   ----a-w-   c:\windows\system32\dns-sd.exe
2011-03-07 05:33:50   692736   ----a-w-   c:\windows\system32\inetcomm.dll
2011-03-04 06:37:06   420864   ----a-w-   c:\windows\system32\vbscript.dll
2011-03-03 13:21:11   1857920   ----a-w-   c:\windows\system32\win32k.sys
2011-02-24 21:08:22   3735552   ----a-w-   c:\windows\system32\alarpt5.ocx
2011-02-22 23:06:29   916480   ----a-w-   c:\windows\system32\wininet.dll
2011-02-22 23:06:29   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2011-02-22 23:06:29   1469440   ----a-w-   c:\windows\system32\inetcpl.cpl
2011-02-22 11:41:59   385024   ----a-w-   c:\windows\system32\html.iec
2011-02-19 00:28:28   1238528   ----a-w-   c:\windows\system32\zpeng25.dll
2011-02-17 12:32:12   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
2011-02-15 12:56:39   290432   ----a-w-   c:\windows\system32\atmfd.dll
.
============= FINISH: 23:15:30.09 ===============

[aaronski]

K27,

Trying to attach the "ATTACH" dds text file but keeps denying me...says i've posted to from this ip less than 45 seconds ago which makes no sense.

[K27]

Hi,

Close all browsers and then run CCLeaner to clear the cookies and then please copy/paste the attach log.

Also, how is the system running now?

Thanks.

[aaronski]

Hello,

System appears to be running good/like normal. Ran CCleaner but still can't past that Attach Log.

[K27]

Hi,

What message do you get when you try to post the log.

Please send it to me in a personal message.

Thanks

[aaronski]

K27,

Was out of town for a week...sorry for not informing you of that beforehand. Here's the Attach log.

[K27]

Hi,

How is the system running now?

Thanks.

[aaronski]

K27,

All seems good and normal. I would conclude whatever was there is now gone.

[K27]

Hi,


Your logs now appear to be clean and your system is running to a satisfactory standard. We have some housekeeping to do which I will post the instructions for now. This will be follow by some general advice for how to maintain the system and how to minimize the chances of this happening in the future.   


The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall
Note the space between Combofix and /





Please uninstall the other programs we used as without proper guidance they can seriously harm the workings of Windows and your PC

• HiJackThis via Add/Remove Programs in control Panel
• The ARK tool we used by right clicking the folder you created to run the ARK tool from and then clicking delete
• TDSSKiller by right clicking it folder and clicking delete
• aswMBR by right clicking its desktop icon and clicking delete
• You may also delete any logs that you have saved from the above tools

You can also then delete the non invasive DDS program and the two logs it created on your desktop by right click each file and then click delete.




Now some advice on how to surf safe in the future.

ALWAYS keep all programs on your PC up to date and this especially means your Anti-Virus/Anti-Spyware/Firewall/Java and Adobe programs.
They can all be found via the "All Programs" feature in the start menu and if opened will 100% have a update feature somewhere.
NEVER use more than ONE Anti-Virus program,
NEVER use more than ONE resident Full time Anti-Spyware program,
NEVER use more than ONE Software Firewall,(and never use the Windows built in Firewall as it will not keep you protected)

As more than one of each of these will conflict with each other and leave you just as vunrable as not having them.
You can get some VERY GOOD FREE ones from  HERE

Its always a good idea to back these up with SpywareBlaster as this will run in the background and not conflict with any of your other Security.

Also give WinPatrol a try as it is a very good program that will inform you of any changes being made to your system in the same way that User Account Control does but better, (DO NOT switch off UAC if you install WinPatrol, it is still very much needed)

Research and consider using a HARDWARE Firewall as this will provide a very good extra layer of protection.

Scan with each piece of your security Daily and at the very least two daily.
Always keep a few on-demand scanners on your machine and use them every other day, such as,

• Malwarebytes Anti-Malware
  
• Emisoft Anti-Malware
  
• SUPERAntiSpyware
  

If you use IE then consider using a more secure browser such as FireFox or Opera


Install all the latest Windows updates from HERE
or by clicking start>all programs>Windows update, and keep going back and doing these until you have all the available updates until none are showing.
Its a good idea to set Windows Update to automatic so as not to miss any Important updates.


Always you a site advisor such as WOT to confirm the sites you are using are really the sites they say they are.
There is a version of WOT available for both IE and Firefox.


Downloading and installing Secunia PSI will keep the system fully updated.
It runs quietly in the background and will give a balloon pop-up from the task bar each time a program needs updating. Just click the Secunia task bar icon and the program will open. You will then see a list of the program(s) that needs updating, click the blue circle under the "Solution" heading, and you will be taken directly to the download for the exploited program.



And please read these links for advice on Computer Security:
Infection Prevention
Do's and Don't's of Security Programs

You can also find many other good articles relating to various computing practices by clicking the "SpywareHammer - Knowlwdgebase" link in my sig.


If you have any other questions then please fill free to post back,
I will mark this thread as solved tomorrow,

Safe Surfing,
K27.

[K27]

This Topic is Resolved......

If you are the originator of this Topic and would like it reopened please send Me, a Moderator or Admin a personal message and we will move it back.

The fixes in this topic were written specifically for this user, following them may cause harm to your machine and render it a brick (useless), Any one else needing help please go to this board http://spywarehammer.com/simplemachinesforum/index.php?board=10.0 and read all the pinned topic's and please follow the instructions in this topic http://spywarehammer.com/simplemachinesforum/index.php?topic=88.0