Buy Malwarebytes antimalware
Google
The Spykiller
  Home Help Search Calendar Login Register   *
Board Language: Deutsch English
Advertise on this site

Welcome to The Spykiller

You only need to register to  get help with malware cleaning on your computer or take part in the general discussion forums You DO NOT need to register to upload suspicious files for examination or download any of the tools or use any other part of this site.
It takes a very long time and a lot of hard work on our part to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare so a large part of our time is spent helping you

 INSTRUCTIONS - Read This Before Posting For Malware Removal Help

Digg This!
Pages: 1 2 [3]   Go Down
  Print  
Author Topic: Explorer opens all sort of ads  (Read 1449 times)
0 Members and 1 Guest are viewing this topic.
jam80s
Guest
« Reply #20 on: November 21, 2007, 19:58:18 »

Winpfind log attached

[attachment deleted by admin]
Report to moderator   Logged
Derek
Administrator
*****
Offline Offline

Posts: 11352


« Reply #21 on: November 21, 2007, 21:04:27 »

first

go to add/remove programs & uninstall anything taht says Noreton or symantec

reboot to safe mode &
Start WinPFind3U. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

Code:
[Unregister Dlls]
[Processes - Non-Microsoft Only]
YY -> symlcsvc.exe -> %CommonProgramFiles%\Symantec Shared\CCPD-LC\symlcsvc.exe
[Win32 Services - Non-Microsoft Only]
YY -> (ccEvtMgr) Symantec Event Manager [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe
YY -> (ccProxy) Symantec Network Proxy [Win32_Own | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\CCPROXY.EXE
YY -> (ccSetMgr) Symantec Settings Manager [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe
YY -> (CLTNetCnService) Symantec Lic NetConnect service [Win32_Shared | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\ccSvcHst.exe
YY -> (comHost) COM Host [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Symantec Shared\VAScanner\comHost.exe
YY -> (Symantec Core LC) Symantec Core LC [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Symantec Shared\CCPD-LC\symlcsvc.exe
YY -> (SymAppCore) Symantec AppCore Service [Win32_Own | Auto | Stopped] -> %CommonProgramFiles%\Symantec Shared\AppCore\AppSvc32.exe
[Driver Services - Non-Microsoft Only]
YY -> (NAVENG) NAVENG [Kernel | On_Demand | Stopped] -> %CommonProgramFiles%\Symantec Shared\VirusDefs\20071009.017\NAVENG.SYS
YY -> (NAVEX15) NAVEX15 [Kernel | On_Demand | Stopped] -> %CommonProgramFiles%\Symantec Shared\VirusDefs\20071009.017\NAVEX15.SYS
YY -> (SPBBCDrv) SPBBCDrv [Kernel | On_Demand | Stopped] -> %CommonProgramFiles%\Symantec Shared\SPBBC\SPBBCDrv.sys
YY -> (SRTSP) SRTSP [File_System | On_Demand | Stopped] -> %System32%\drivers\srtsp.sys
YY -> (SRTSPL) SRTSPL [Kernel | On_Demand | Stopped] -> %System32%\drivers\srtspl.sys
YY -> (SRTSPX) SRTSPX [Kernel | System | Running] -> %System32%\drivers\srtspx.sys
YY -> (SYMDNS) SYMDNS [Kernel | On_Demand | Stopped] -> %System32%\drivers\symdns.sys
YY -> (SymEvent) SymEvent [Kernel | On_Demand | Running] -> %System32%\drivers\SYMEVENT.SYS
YY -> (SYMFW) SYMFW [Kernel | On_Demand | Stopped] -> %System32%\drivers\symfw.sys
YY -> (SYMIDS) SYMIDS [Kernel | On_Demand | Stopped] -> %System32%\drivers\symids.sys
YY -> (SYMIDSCO) SYMIDSCO [Kernel | On_Demand | Stopped] -> %CommonProgramFiles%\Symantec Shared\SymcData\idsdefs\20071002.003\SymIDSCo.sys
YY -> (symlcbrd) symlcbrd [Kernel | Auto | Running] -> %System32%\drivers\symlcbrd.sys
YY -> (SYMNDIS) SYMNDIS [Kernel | On_Demand | Stopped] -> %System32%\drivers\symndis.sys
YY -> (SYMREDRV) SYMREDRV [Kernel | On_Demand | Stopped] -> %System32%\drivers\symredrv.sys
YY -> (SYMTDI) SYMTDI [Kernel | System | Running] -> %System32%\drivers\symtdi.sys
[Registry - All]
< Internet Explorer Bars [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {4528BBE0-4E08-11D5-AD55-00010333D0AD} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
< Internet Explorer Bars [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\
YN -> {32683183-48a0-441b-a342-7c2a440a9478} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> {4528BBE0-4E08-11D5-AD55-00010333D0AD} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{2B9BAC64-7156-B2BD-35BB-675A90F03BC5} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKLM] -> Reg Data - Key not found [Yahoo! Toolbar]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {01010E00-5E80-11D8-9E86-0007E96C65AE} -> - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
YN -> {01012101-5E80-11D8-9E86-0007E96C65AE} -> - CodeBase = http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
YN -> {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -> LSSupCtl Class - CodeBase = https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
YN -> {644E432F-49D3-41A1-8DD5-E099162EEEC5} -> Symantec RuFSI Utility Class - CodeBase = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
[Registry - Additional Scans - All]
< ContextMenuHandlers - * [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\
YY -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} [HKLM] -> %ProgramFiles%\Symantec\Norton AntiVirus\NavShExt.dll [Symantec.Norton.Antivirus.IEContextMenu]
< ContextMenuHandlers - Folder [HKLM] > -> HKEY_LOCAL_MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\
YY -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} [HKLM] -> %ProgramFiles%\Symantec\Norton AntiVirus\NavShExt.dll [Symantec.Norton.Antivirus.IEContextMenu]
[ Extra Files ]
%CommonProgramFiles%\Symantec Shared\
%ProgramFiles%\Symantec\
[Empty Temp Folders]
[Reboot]


The fix should only take a very short time and then you will be asked if you want to reboot. Choose Yes.

when it reboots


Post the following back here:

 the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Report to moderator   Logged

Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
 I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

jam80s
Guest
« Reply #22 on: November 22, 2007, 17:12:49 »

Derek,

Attasched is the latest log, the popping up of IE seems to have stopped now so a big thank you for that.

Mike

[attachment deleted by admin]
Report to moderator   Logged
Derek
Administrator
*****
Offline Offline

Posts: 11352


« Reply #23 on: November 22, 2007, 17:35:10 »

OK scan with

download Sunbelt Counterspy Free trial

Save the install file to desktop and double click it to install counterspy

Once it has installed, follow the set up wizard which will automatically start, allow it to update itself 

It will take a few minutes to update to the latest definitions file versions

run a full scan & when it finishes a window will open with all items found

They should all be marked as quarantine or delete  by default so scroll down & check that nothing you know to be good or want to keep is detected. Then just press the take action button & follow any prompts ( set anything you want to keep as ignore)

post back with it's report ( on the scan page, press view details & copy that report & paste it back here )
Report to moderator   Logged

Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
 I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

jam80s
Guest
« Reply #24 on: November 23, 2007, 16:48:10 »

Here's Counterspy log

Scan History Details
Start Date: 22/11/2007 21:51:03
End Date: 23/11/2007 02:25:01
Total Time: 273 Min 58 Sec
Detected security risks

Cookie: Com.com Cookie (General)  more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count unique visitors to web pages; and to allow web surfers to use virtual "shopping carts." Online advertising networks use cookies to track users across web sites and to measure ad impressions and click-throughs.
Status: Deleted

Cookies detected
c:\documents and settings\md\cookies\md@com[1].txt


Cookie: PriceGrabber Cookie (General)  more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count unique visitors to web pages; and to allow web surfers to use virtual "shopping carts." Online advertising networks use cookies to track users across web sites and to measure ad impressions and click-throughs.
Status: Deleted

Cookies detected
c:\documents and settings\md\cookies\md@pricegrabber[2].txt


Cookie: Radar Spy Cookie (General)  more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count unique visitors to web pages; and to allow web surfers to use virtual "shopping carts." Online advertising networks use cookies to track users across web sites and to measure ad impressions and click-throughs.
Status: Deleted

Cookies detected
c:\documents and settings\md\cookies\md@yourmedia[1].txt


Dialer.FastVideoPlayer Porn Dialer  more information...
Status: Quarantined

Registry entries detected
HKEY_USERS\S-1-5-21-3848448594-951796526-1614765859-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B5DD9A64-5C4B-4A48-BE56-97C1A8F85708}
HKEY_USERS\S-1-5-21-3848448594-951796526-1614765859-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B5DD9A64-5C4B-4A48-BE56-97C1A8F85708}\iexplore
HKEY_USERS\S-1-5-21-3848448594-951796526-1614765859-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B5DD9A64-5C4B-4A48-BE56-97C1A8F85708}\iexplore
Report to moderator   Logged
Derek
Administrator
*****
Offline Offline

Posts: 11352


« Reply #25 on: November 23, 2007, 21:25:09 »

that looks ok now

Turn off system restore by following instructions here
http://www.thespykiller.co.uk/index.php?page=8
That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable sytem restore & create a new restore point. Now Empty Recycle bin on desktop

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

Then pay an urgent visit to windows update & make sure you are fully updated & get the bunch of new updates that are alleged to plug the security holes that let these pests on in the first place
Report to moderator   Logged

Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
 I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.

Pages: 1 2 [3]   Go Up
  Print  
 
Jump to:  

Donations

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts


.

Useful Advice and Programs
  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog
Kaspersky online scanner
Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser
Stop killing hedgehogs with strimmers
Welcome, Guest. Please login or register.
Did you miss your activation email?
September 06, 2010, 23:15:10

Login with username, password and session length
secunia Software inspector

Google ads
RoboForm: Learn more...

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you.
In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

I run this site to help raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the PayPal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
TinyPortal v0.9.8 © Bloc
Valid XHTML 1.0! Valid CSS!
Page created in 0.114 seconds with 32 queries.

Google visited last this page July 20, 2010, 19:37:32