Multiple browsers opening by themselves?

aliEnRIK

run it anyways

oliveoyl

ComboFix 09-06-16.05 - oliveoyl 17/06/2009 18:37.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.394 [GMT 1:00]
Running from: c:\documents and settings\oliveoyl\My Documents\qwerty.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((( Files Created from 2009-05-17 to 2009-06-17 )))))))))))))))))))))))))))))))
.

2009-06-17 09:04 . 2009-06-17 09:04

---

d

---

w- c:\program files\Trend Micro
2009-06-17 07:43 . 2009-06-17 09:09 117760 ----a-w- c:\documents and settings\oliveoyl\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-16 23:14 . 2009-06-16 23:14

---

d

---

w- c:\program files\Common Files\Wise Installation Wizard
2009-06-16 23:02 . 2009-06-16 23:02

---

d

---

w- c:\documents and settings\oliveoyl\Application Data\Malwarebytes
2009-06-16 23:01 . 2009-05-26 12:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-16 23:01 . 2009-06-16 23:01

---

d

---

w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-16 23:01 . 2009-05-26 12:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 23:01 . 2009-06-16 23:02

---

d

---

w- c:\program files\Malwarebytes' Anti-Malware

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 17:40 . 2007-11-21 17:17

---

d

---

w- c:\documents and settings\All Users\Application Data\Kontiki
2009-06-17 16:51 . 2007-01-11 16:08

---

d

---

w- c:\program files\CCleaner
2009-06-17 07:42 . 2007-10-30 00:30

---

d

---

w- c:\program files\SUPERAntiSpyware
2009-06-17 07:42 . 2007-10-30 00:30

---

d

---

w- c:\documents and settings\oliveoyl\Application Data\SUPERAntiSpyware.com
2009-05-07 15:32 . 2002-08-29 04:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-02 07:12 . 2008-07-05 08:13 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-02 07:12 . 2008-07-05 08:13 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-05-02 07:12 . 2007-03-05 00:16 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-05-02 07:12 . 2008-07-05 08:13 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-29 04:56 . 2004-02-06 17:05 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 07:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-17 12:26 . 2002-08-29 04:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-03-05 20:16 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-03-20 09:43 . 2004-09-14 22:30 28880 ----a-w- c:\documents and settings\oliveoyl\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-21 00:28 . 2009-02-21 00:28 1501376 ----a-w- c:\program files\ArtistScope_IE_42.exe
2007-11-21 17:20 . 2007-11-21 17:20 25755448 ----a-w- c:\program files\wmp11-windowsxp-x86-enu.exe
2004-11-09 16:59 . 2004-11-09 15:58 16706160 ----a-w- c:\program files\AdbeRdr60_enu_full.exe
2004-09-15 13:27 . 2004-09-15 13:27 5245352 ----a-w- c:\program files\SetupDl.exe
2004-09-15 10:56 . 2004-09-15 10:56 5316176 ----a-w- c:\program files\msjavx86.exe
2008-12-03 11:48 . 2006-09-07 14:37 67696 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-12-03 11:48 . 2006-09-07 14:37 54376 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-03 11:48 . 2008-09-04 23:25 34952 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-12-03 11:48 . 2008-09-04 23:25 46720 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-12-03 11:48 . 2006-09-07 14:37 172144 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-10-19 126976]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2004-09-09 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"LocalCooling"="c:\program files\LocalCooling\localcooling.exe" [2006-11-28 1900575]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-02 1947928]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-02 07:12 11952 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [05/07/2008 09:13 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [05/07/2008 09:13 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [26/05/2009 10:05 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [26/05/2009 10:05 72944]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [07/07/2008 08:49 908568]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [07/07/2008 08:49 298776]
R2 CSHelper;CopySafe Helper Service;c:\windows\SYSTEM32\CSHelper.exe [21/02/2009 01:30 266240]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [26/05/2009 10:05 7408]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = <local>
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\program files\PartyGaming\PartyCasino\RunApp.exe
IE: {{C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - c:\microgaming\Poker\UnibetpokerMPP\MPPoker.exe
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-17 18:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(152)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-17 18:43
ComboFix-quarantined-files.txt 2009-06-17 17:43

Pre-Run: 61,436,063,744 bytes free
Post-Run: 61,430,353,920 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

136 --- E O F --- 2009-06-10 02:07

aliEnRIK

Looks clean to me

oliveoyl

Well that's good news... wonder why it happened... oh well, as long as it doesn't make a habit of it.

Thanks again

aliEnRIK

Dont go trusting AVG with your life. Id also suggest updating and scanning with malwarebytes regularly

oliveoyl

Righty-ho... can I set it up to do an auto update and scan, or do I have to manually do it each time?

Is AVG a bit sh*t then?

P.S. Your avatar is really quite disturbing lol.

advent1122

Money_Grabber13579 wrote: »

Really?! That's a first!:cool:

My browser would open lots of different windows. Programmes would close as if by magic and it would scroll pages for the hell of it.

Changed the mouse and it was all rosy again.

oliveoyl

I haven't had any of the other things happen... only the numerous browser windows once... if it happens again or if any of those other things happen I'll change the mouse.

macman

Ditch AVG and install Kasperky or Avira before it happens again.

aliEnRIK

oliveoyl wrote: »

Righty-ho... can I set it up to do an auto update and scan, or do I have to manually do it each time?

Is AVG a bit sh*t then?

P.S. Your avatar is really quite disturbing lol.

Need to manually update

AVG isnt very good no. I would also recommend AVIRA
Make sure you use the AVG REMOVAL TOOL if you do remove it