Bullguard Antivirus Forum Download A Free Copy Of Bullguard Antivirus Software
Free Antivirus Forum - Learn about antivirus, firewalls and personal security Free Antivirus Forum - Learn about antivirus, firewalls and personal security
 HomeLog InRegisterCommunity CalendarSearch the ForumView The Member ListHelp
Computer is infected but Norton Internet Security can't find anything -- Help
   
BullGuard Antivirus Forum > Virus > Virus Questions > Computer is infected but Norton Internet Security can't find anything -- Help  
Forum Quick Jump
 
New Topic Locked Topic Printable version of : Computer is infected but Norton Internet Security can't find anything -- Help
[ << Previous Thread | Next Thread >> ]

Lindsey316
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-21-2008 8:23 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
I'm almost certain my computer is infected with something, but I don't know how to find it and get rid of it.  A full scan with NIS shows nothing wrong. 
 
Earlier tonight, suddenly when I opened Internet Explorer, IE opened over and over and over again -- I'd say at least 50 times before I shut down my computer.  I restarted and tried to open IE again and the same thing happened.  Restarted a third time, same thing.  Fourth time, I disconnected my modem from the computer and restarted.  I could then open IE (got message saying not connected to the Internet) without 50 windows opening in succession.  A few hours later, I reconnected to the Internet and my computer is working normally again.
 
There was another time a couple of weeks ago when suddenly my computer started acting strangely.  Windows started opening that I didn't open.  That time the computer shut itself down by itself.
 
And, last there is this strange sound every time I start up the computer coming from my speakers.  It sounds like some funny sound effect you'd hear on TV.  A revving sound followed by a popping noise.
 
Like I said, NIS shows nothing wrong, but I feel sure something is.  I don't know what to do to fix this.  Please give me some advice.  Thanks!
 
---------------------------------------------------------------------------------------------------------
 
I downloaded Malwarebytes' Anti-Malware and performed a full scan.  Here are the results:
 
 
Malwarebytes' Anti-Malware 1.22
Database version: 972
Windows 6.0.6000
 
12:58:17 AM 7/21/2008
mbam-log-7-21-2008 (00-58-17).txt
 
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 153257
Time elapsed: 1 hour(s), 10 minute(s), 45 second(s)
 
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
 
Memory Processes Infected:
(No malicious items detected)
 
Memory Modules Infected:
(No malicious items detected)
 
Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully.
 
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
 
Registry Data Items Infected:
(No malicious items detected)
 
Folders Infected:
(No malicious items detected)
 
Files Infected:
C:\Windows\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.
 
 
 
 
 
 
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13081
  		   Posted 7-21-2008 2:50 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
Hello smile
 
 
Click here - ->>  http://www.bullguard.com/forum/14/Before-posting-a-log_43561.html 
 
 
After You have run the scan tools -
 
Reboot normally
 
Post Hijackthis log along with SuperAntiSpyware log, C: combofix TXT  in this topic
 
Please copy and paste your log. DO NOT add it as an attachment
Kindly do not annotate or format the log with color or font changes.
 
NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.
 

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

Lindsey316
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-28-2008 12:05 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
Thanks for your help! smile


HiJack This Log:
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:47:38 PM, on 7/27/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal
 
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\aol\1191632592\ee\aolsoftware.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exe
C:\Program Files\Zinio\ZinioDeliveryManager.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineTrayIcon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Users\Lisa\Desktop\HiJackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\Windows\System32\TwcToolbarBho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\Windows\System32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1191632592\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Dell DataSafe Scheduler] "C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exe"
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioDeliveryManager.exe /autostart
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {7E9522CF-6B95-46D6-8E2F-7638F507313F} (BLS_SpeedOP.systemcheck) - http://www.fastaccess.drivers.bellsouth.net/software/DSLspeedtool/bls_speedop.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Windows\system32\AERTSrv.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
 
--
End of file - 12018 bytes
 
 
SuperAntiSpyware Log:

Generated 07/27/2008 at 03:04 PM
 
Application Version : 4.15.1000
 
Core Rules Database Version : 3519
Trace Rules Database Version: 1509
 
Scan type       : Custom Scan
Total Scan Time : 00:36:07
 
Memory items scanned      : 694
Memory threats detected   : 0
Registry items scanned    : 8117
Registry threats detected : 0
File items scanned        : 26807
File threats detected     : 7
 
Adware.Tracking Cookie
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@indextools[2].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@atdmt[2].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@burstnet[2].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@doubleclick[1].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@msnbc.112.2o7[1].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@tribalfusion[2].txt
 C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\Low\lisa@www.burstnet[2].txt

 

ComboFix Log
  
ComboFix 08-07-27.3 - Lisa 2008-07-27 16:27:01.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.1.1033.18.1225 [GMT -5:00]
Running from: C:\Users\Lisa\Desktop\ComboFix.exe
 * Created a new restore point
.
 
(((((((((((((((((((((((((   Files Created from 2008-06-27 to 2008-07-27  )))))))))))))))))))))))))))))))
.
 
2008-07-27 14:24 . 2008-07-27 14:24 <DIR> d-------- C:\Users\All Users\SUPERAntiSpyware.com
2008-07-27 14:24 . 2008-07-27 14:24 <DIR> d-------- C:\ProgramData\SUPERAntiSpyware.com
2008-07-27 14:23 . 2008-07-27 15:22 <DIR> d-------- C:\Users\Lisa\AppData\Roaming\SUPERAntiSpyware.com
2008-07-27 14:23 . 2008-07-27 15:22 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-07-27 14:17 . 2008-07-27 14:17 <DIR> d-------- C:\Program Files\CCleaner
2008-07-24 05:30 . 2008-07-24 05:31 <DIR> d-------- C:\Windows\System32\Adobe
2008-07-24 04:58 . 2008-07-24 04:58 <DIR> d-------- C:\Program Files\Safari
2008-07-24 04:56 . 2008-07-24 04:57 <DIR> d-------- C:\Program Files\QuickTime
2008-07-23 00:07 . 2008-06-25 19:33 1,808,896 --a------ C:\Windows\System32\NlsLexicons0046.dll
2008-07-23 00:07 . 2008-06-25 19:34 1,793,536 --a------ C:\Windows\System32\NlsLexicons0045.dll
2008-07-23 00:07 . 2008-06-25 19:33 1,782,272 --a------ C:\Windows\System32\NlsLexicons0039.dll
2008-07-23 00:07 . 2008-06-25 19:33 1,722,368 --a------ C:\Windows\System32\NlsLexicons000d.dll
2008-07-23 00:07 . 2008-06-25 19:34 1,558,016 --a------ C:\Windows\System32\NlsLexicons0049.dll
2008-07-23 00:07 . 2008-06-25 19:33 1,452,544 --a------ C:\Windows\System32\NlsLexicons0003.dll
2008-07-23 00:07 . 2008-06-25 19:33 1,411,072 --a------ C:\Windows\System32\NlsLexicons0047.dll
2008-07-23 00:07 . 2008-06-25 19:34 1,236,992 --a------ C:\Windows\System32\NlsLexicons0020.dll
2008-07-23 00:07 . 2008-06-25 19:34 4,096 --a------ C:\Windows\System32\NlsLexicons002a.dll
2008-07-20 23:36 . 2008-07-20 23:36 <DIR> d-------- C:\Users\Lisa\AppData\Roaming\Malwarebytes
2008-07-20 23:36 . 2008-07-20 23:36 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-07-20 23:36 . 2008-07-20 23:36 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-07-20 23:36 . 2008-07-20 23:36 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-20 23:36 . 2008-07-20 20:21 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-07-20 23:36 . 2008-07-20 20:21 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-07-04 09:12 . 2008-07-04 09:12 56 --ah----- C:\Users\All Users\ezsidmv.dat
2008-07-04 09:12 . 2008-07-04 09:12 56 --ah----- C:\ProgramData\ezsidmv.dat
2008-07-04 09:09 . 2008-07-27 16:22 <DIR> d-------- C:\Users\Lisa\AppData\Roaming\Skype
2008-07-04 09:06 . 2008-07-04 09:06 <DIR> d-------- C:\Program Files\Skype
2008-07-04 09:06 . 2008-07-04 09:06 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-29 04:24 . 2008-06-29 04:26 <DIR> d-------- C:\Users\All Users\eBay
2008-06-29 04:24 . 2008-06-29 04:26 <DIR> d-------- C:\ProgramData\eBay
2008-06-29 04:24 . 2008-06-29 04:24 <DIR> d-------- C:\Program Files\eBay
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 21:09 --------- d-----w C:\Users\Lisa\AppData\Roaming\skypePM
2008-07-27 20:23 --------- d-----w C:\ProgramData\Symantec
2008-07-24 09:59 --------- d-----w C:\Users\Lisa\AppData\Roaming\Apple Computer
2008-07-22 08:13 --------- d-----w C:\Program Files\Coupons
2008-07-09 11:17 174 --sha-w C:\Program Files\desktop.ini
2008-07-04 14:06 --------- d-----w C:\ProgramData\Skype
2008-06-29 09:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-06-24 17:07 49,152 ----a-r C:\Windows\System32\inetwh32.dll
2008-06-24 17:07 1,044,480 ----a-r C:\Windows\System32\roboex32.dll
2008-06-06 04:01 --------- d-----w C:\Program Files\The Weather Channel FW
2008-05-27 23:44 --------- d-----w C:\Program Files\iTunes
2008-05-27 23:44 --------- d-----w C:\Program Files\iPod
2008-05-27 23:37 --------- d-----w C:\Program Files\Apple Software Update
2008-05-10 03:30 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-02-28 00:36 32 ----a-w C:\Users\All Users\ezsid.dat
2008-02-28 00:36 32 ----a-w C:\ProgramData\ezsid.dat
2008-04-02 01:52 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-04-02 01:52 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-04-02 01:52 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 07:36 201728]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 07:35 125440]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544]
"Dell DataSafe Scheduler"="C:\Program Files\Dell DataSafe Online\Bin\DataSafeOnlineScheduler.exe" [2007-12-02 17:30 308464]
"Zinio DLM"="C:\Program Files\Zinio\ZinioDeliveryManager.exe" [2006-12-14 12:47 1003590]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-05-14 13:41 785520]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-05-30 15:54 21718312]
"AOL Fast Start"="C:\Program Files\AOL 9.0\AOL.EXE" [2007-04-18 01:49 50736]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 20:51 583048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-12-03 18:23 22696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-17 08:07 86016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-17 08:07 81920]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-17 08:07 8497696]
"HostManager"="C:\Program Files\Common Files\AOL\1191632592\ee\AOLSoftware.exe" [2006-09-25 19:52 50736]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-09-14 06:28 1862144]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 05:20 17920]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-12-03 18:25 107112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-21 04:51 185896]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 07:22 4907008 C:\Windows\RtHDVCpl.exe]
 
C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-09 01:00:00 111376]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
 
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\Windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
 
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\Windows\pss\Kodak EasyShare software.lnk.CommonStartup
backupExtension=.CommonStartup
 
[HKLM\~\startupfolder\C:^Users^Lisa^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Office Startup.lnk]
path=C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Startup.lnk
backup=C:\Windows\pss\Office Startup.lnk.Startup
backupExtension=.Startup
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
--a------ 2006-03-20 18:34 213936 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2006-03-20 18:34 213936 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2006-03-20 18:34 86960 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zinio DLM]
--a------ 2006-12-14 12:47 1003590 C:\Program Files\Zinio\ZinioDeliveryManager.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6076E64E-0256-4E6F-BD01-9CA1A8819B3A}"= UDP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{19B67C1B-6CAE-4999-A41A-CD7B9262703B}"= TCP:C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:Yahoo! Music Jukebox
"{5D693810-E466-4507-9033-BC3EF8DBF188}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{EA725BAE-EB93-4D3D-AA61-572AB5761CBD}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialer
"{9E25CCC7-9BD2-4B88-A093-D8B894AC5DB2}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{104F73E0-29E7-4875-902E-D5CDAF0BBA59}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Service
"{46632CB8-6AE7-46BF-A475-7B78AADEA709}"= UDP:C:\Program Files\Common Files\aol\1191632592\ee\aolsoftware.exe:AOL Shared Components
"{C0C2E4A0-AE27-4416-A81F-1F1C7A9323A2}"= TCP:C:\Program Files\Common Files\aol\1191632592\ee\aolsoftware.exe:AOL Shared Components
"{736765A2-04B1-4793-A2C9-92AABF5FA397}"= UDP:C:\Program Files\AOL 9.0\waol.exe:AOL
"{8E013334-E7F9-4FF4-B5E4-016F3D68D0C9}"= TCP:C:\Program Files\AOL 9.0\waol.exe:AOL
"{379D2CDC-135A-441C-842E-2E08BA5270E7}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{1E5B9217-E0B3-4B12-914B-6626708324DD}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{A6842C97-2594-4B1D-ADF3-8ECE6D8C120C}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{A6BE3155-6568-4005-A6EF-492605A5B941}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{9BFE9EA1-BED1-4B13-A442-C66D08A1C9BA}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{274668F6-9F0B-4EA1-AA05-8E4F27B79FD3}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{BE5BE341-E983-4F4E-8AF6-41DE113D0052}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{390F632A-EDCB-4293-BB20-F61C69DB9FA0}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8AAD33F2-1B2F-447A-80B1-4C044E2B1284}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C049439C-2D01-4C21-9D53-1E86636066F1}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7FADF9AB-92EC-4774-AE53-D8EBF6D9E175}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D30C0695-DA36-4C29-9C22-9EAC165A9EC2}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{7E2374BE-EF11-4862-9D73-80190500D229}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{000938DF-49F2-4C3B-B5B7-04B1AB135FAD}"= C:\Program Files\Skype\Phone\Skype.exe:Skype
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
 
R1 DLARTL_M;DLARTL_M;C:\Windows\system32\Drivers\DLARTL_M.SYS [2007-02-08 20:05]
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080724.001\IDSvix86.sys [2008-02-13 11:18]
R2 AERTFilters;Andrea RT Filters Service;C:\Windows\system32\AERTSrv.exe [2007-12-05 06:17]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-12-03 18:26]
S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-03-23 06:09]
 
*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
 
2008-07-17 C:\Windows\Tasks\EasyShare Registration Task.job
- C:\Windows\system32\rundll32.exe [2006-11-02 04:45]
 
2008-07-27 C:\Windows\Tasks\User_Feed_Synchronization-{6485543A-412F-4174-B3AB-4B62D279FD69}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 04:45]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.msnbc.com/
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
 
O16 -: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
C:\Windows\Downloaded Program Files\SearchEngineQuery.dll
 

**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-27 16:30:00
Windows 6.0.6000  NTFS
 
scanning hidden processes ...
 
scanning hidden autostart entries ...
 
scanning hidden files ...
 

C:\Users\Lisa\AppData\Local\Temp\~DF77D3.tmp 16384 bytes
C:\Users\Lisa\AppData\Local\Temp\~DF7B30.tmp 512 bytes
 

**************************************************************************
.
Completion time: 2008-07-27 16:33:01
ComboFix-quarantined-files.txt  2008-07-27 21:31:56
 
Pre-Run: 101,010,915,328 bytes free
Post-Run: 100,996,083,712 bytes free
 
201 --- E O F --- 2008-07-24 22:23:16
 
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13081
  		   Posted 7-28-2008 8:17 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
Looks clean. How are things running now ?

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

Lindsey316
New Member


Date Joined Jun 2008
Total Posts : 4
  		   Posted 7-28-2008 9:19 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
 I'm glad it looks clean.  After running the scans, the strange sound effect at start-up that I was concerned about is gone.  I'm not having any problems currently with my computer.  Thanks again for your help.
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13081
  		   Posted 7-28-2008 9:20 (GMT +2)    Quote: Computer is infected but Norton Internet Security can't find anything -- HelpAlert an admin about: Computer is infected but Norton Internet Security can't find anything -- Help
My pleasure smile
 
 
Please  read Tony Klein's excellent article  about how to prevent against  spyware/hijackers in the future
http://www.castlecops.com/t7736-So_how_did_I_get_infected_in_the_first_place.html   
                                  
Since your problem appears to be resolved, this thread will now be closed.
If you need this topic reopened, please PM a Moderator and we will reopen it for you

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 
New Topic Locked Topic Printable version of : Computer is infected but Norton Internet Security can't find anything -- Help
 
Forum Information
Currently it is Tuesday, October 07, 2008 5:46 PM (GMT +2)
There are a total of 62.565 posts in 15.604 threads.
In the last 3 days there were 19 new threads and 52 reply posts. View Active Threads
Who's Online
This forum has 26666 registered members. Please welcome our newest member, beingwatched.
44 Guest(s), 1 Registered Member(s) are currently online.  Details
Owen
5 Latest Threads
DCOM Server Process Launcher error (2)07-10-2008 15:25:29 (Owen)
Probable. Worm.Win32.NetBooster infection (1)07-10-2008 15:07:16 (Touch)
Cannot launch Yahoo Messenger (1)07-10-2008 14:00:22 (beingwatched)
Jerseys and jordans sneakers shoes (0)07-10-2008 12:57:54 (nike588)
Possible Trojan/virus making my internet slow? (6)07-10-2008 12:20:40 (PhilippaBuckley)


Need Support? Write to: | Forum Help Manual

Download free trial version of Bullguard