also @ TechSpot: Asus' new lineup of Z87 Haswell motherboards revealed

Another one suffering from Google redirecting malware

Discussion in 'Virus and Malware Removal' started by AuroraR, Apr 16, 2012.

Page 2 of 2

  1. AuroraR Newcomer, in training Posts: 21

    No... unfortunately it is still happening. :(
    AuroraR, Apr 24, 2012
    #21

  2. Broni Malware Annihilator Posts: 39,231   +175

    Let's try to reset your router.

    Go Start>Run (Start search in Vista), type in:
    cmd
    Click OK (Vista and Windows 7 users: while holding CTRL, and SHIFT, press Enter).

    In Command Prompt window, type in following commands, and hit Enter after each one:
    ipconfig /flushdns
    ipconfig /registerdns
    ipconfig /release
    ipconfig /renew
    net stop "dns client"
    net start "dns client"


    Turn the computer off.

    On your router, you'll find a pinhole marked "Reset".
    Keep pushing the hole, using a pencil, or a paperclip until all lights briefly come off and on.
    NOTE. Simple router disconnecting from a power source will NOT do.
    Restart computer and check for redirections.

    NOTE. You may need to re-check your router security settings, as described HERE
    Broni, Apr 24, 2012
    #22

  3. AuroraR Newcomer, in training Posts: 21

    I hate sounding like a broken record, but no go! A few things to note was: 1. when I tried to enter the command prompt for the registerdns, I got a "requires elevation" msg when I hit enter. 2. With stop dns client, the response was system error 5 has occurred. Access denied. Subsequent to that with the start dns client, I got the required service has already been started message.

    Not sure if that helps any, but I thought it was worth mentioning.
    AuroraR, Apr 25, 2012
    #23

  4. Broni Malware Annihilator Posts: 39,231   +175

    That's because you didn't read my instructions carefully enough:
    Broni, Apr 25, 2012
    #24

  5. AuroraR Newcomer, in training Posts: 21

    OK... that seemed to do the trick for the most part. However occasionally I still get pop-up notifications from Malwarebytes about blocking access. (same message I got when i would click a link in google and it would try and redirect me to a different site) Any idea what might be causing that? (has only happened 2 or 3 times versus 20-30 times)
    AuroraR, Apr 27, 2012
    #25

  6. Broni Malware Annihilator Posts: 39,231   +175

    Delete your Combofix file, download fresh one and post new log.
    Broni, Apr 27, 2012
    #26
     

  7. AuroraR Newcomer, in training Posts: 21

    I am thinking this might have helped since it deleted a folder that looked suspicious....

    ComboFix 12-04-29.02 - Christina 04/29/2012 16:39:05.2.8 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8174.6664 [GMT -4:00]
    Running from: c:\users\Christina\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\q24z16fw.default\weave\toFetch
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-28 to 2012-04-29 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-29 20:44 . 2012-04-29 20:44 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-04-28 00:40 . 2012-04-28 00:40 -------- d-----w- c:\program files (x86)\Common Files\Java
    2012-04-27 12:31 . 2012-04-13 08:46 8917360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{6F4A3081-26B8-4225-BB7F-AE6CF6B77898}\mpengine.dll
    2012-04-16 23:29 . 2012-02-23 14:18 279656 ------w- c:\windows\system32\MpSigStub.exe
    2012-04-15 17:56 . 2012-04-15 17:56 -------- d-----w- c:\users\Christina\AppData\Roaming\Malwarebytes
    2012-04-15 17:56 . 2012-04-15 17:56 -------- d-----w- c:\programdata\Malwarebytes
    2012-04-15 17:40 . 2012-04-15 17:40 883616 ----a-w- C:\FixExec.com
    2012-04-15 16:58 . 2012-04-15 16:58 -------- d-----w- c:\users\Christina\AppData\Local\{29E9A60D-871C-11E1-826D-B8AC6F996F26}
    2012-04-15 16:57 . 2012-04-15 19:25 -------- d-----w- c:\programdata\99058D9B006C6AFB034E112BA60145BE
    2012-04-12 07:00 . 2012-03-01 06:54 22896 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2012-04-12 07:00 . 2012-03-01 06:40 80896 ----a-w- c:\windows\system32\imagehlp.dll
    2012-04-12 07:00 . 2012-03-01 05:45 158720 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2012-04-12 07:00 . 2012-03-01 06:45 220672 ----a-w- c:\windows\system32\wintrust.dll
    2012-04-12 07:00 . 2012-03-01 06:35 5120 ----a-w- c:\windows\system32\wmi.dll
    2012-04-12 07:00 . 2012-03-01 05:49 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
    2012-04-12 07:00 . 2012-03-01 05:40 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2012-04-07 12:32 . 2011-02-19 06:37 1135104 ----a-w- c:\windows\system32\FntCache.dll
    2012-03-31 19:36 . 2012-03-31 19:36 -------- d-----w- c:\users\Christina\AppData\Local\IsolatedStorage
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-04-28 00:40 . 2011-03-14 13:58 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-03-08 08:04 . 2012-03-08 08:04 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
    2012-03-08 08:04 . 2012-03-08 08:04 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
    2012-03-08 08:04 . 2012-03-08 08:04 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
    2012-03-08 08:04 . 2012-03-08 08:04 85504 ----a-w- c:\windows\system32\iesetup.dll
    2012-03-08 08:04 . 2012-03-08 08:04 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
    2012-03-08 08:04 . 2012-03-08 08:04 76800 ----a-w- c:\windows\system32\tdc.ocx
    2012-03-08 08:04 . 2012-03-08 08:04 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
    2012-03-08 08:04 . 2012-03-08 08:04 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
    2012-03-08 08:04 . 2012-03-08 08:04 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
    2012-03-08 08:04 . 2012-03-08 08:04 603648 ----a-w- c:\windows\system32\vbscript.dll
    2012-03-08 08:04 . 2012-03-08 08:04 49664 ----a-w- c:\windows\system32\imgutil.dll
    2012-03-08 08:04 . 2012-03-08 08:04 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
    2012-03-08 08:04 . 2012-03-08 08:04 48640 ----a-w- c:\windows\system32\mshtmler.dll
    2012-03-08 08:04 . 2012-03-08 08:04 448512 ----a-w- c:\windows\system32\html.iec
    2012-03-08 08:04 . 2012-03-08 08:04 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
    2012-03-08 08:04 . 2012-03-08 08:04 367104 ----a-w- c:\windows\SysWow64\html.iec
    2012-03-08 08:04 . 2012-03-08 08:04 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
    2012-03-08 08:04 . 2012-03-08 08:04 30720 ----a-w- c:\windows\system32\licmgr10.dll
    2012-03-08 08:04 . 2012-03-08 08:04 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
    2012-03-08 08:04 . 2012-03-08 08:04 222208 ----a-w- c:\windows\system32\msls31.dll
    2012-03-08 08:04 . 2012-03-08 08:04 173056 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-03-08 08:04 . 2012-03-08 08:04 165888 ----a-w- c:\windows\system32\iexpress.exe
    2012-03-08 08:04 . 2012-03-08 08:04 161792 ----a-w- c:\windows\SysWow64\msls31.dll
    2012-03-08 08:04 . 2012-03-08 08:04 160256 ----a-w- c:\windows\system32\wextract.exe
    2012-03-08 08:04 . 2012-03-08 08:04 152064 ----a-w- c:\windows\SysWow64\wextract.exe
    2012-03-08 08:04 . 2012-03-08 08:04 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
    2012-03-08 08:04 . 2012-03-08 08:04 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
    2012-03-08 08:04 . 2012-03-08 08:04 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
    2012-03-08 08:04 . 2012-03-08 08:04 12288 ----a-w- c:\windows\system32\mshta.exe
    2012-03-08 08:04 . 2012-03-08 08:04 11776 ----a-w- c:\windows\SysWow64\mshta.exe
    2012-03-08 08:04 . 2012-03-08 08:04 114176 ----a-w- c:\windows\system32\admparse.dll
    2012-03-08 08:04 . 2012-03-08 08:04 111616 ----a-w- c:\windows\system32\iesysprep.dll
    2012-03-08 08:04 . 2012-03-08 08:04 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
    2012-03-08 08:04 . 2012-03-08 08:04 101888 ----a-w- c:\windows\SysWow64\admparse.dll
    2012-02-15 06:27 . 2012-03-14 00:56 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2012-02-15 05:44 . 2012-03-14 00:56 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2012-02-15 04:47 . 2012-03-14 00:56 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-02-15 04:46 . 2012-03-14 00:56 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2012-02-12 14:21 . 2011-06-06 22:36 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-02-10 06:18 . 2012-03-14 00:56 1541120 ----a-w- c:\windows\system32\DWrite.dll
    2012-02-10 06:17 . 2012-03-14 00:56 1837568 ----a-w- c:\windows\system32\d3d10warp.dll
    2012-02-10 06:17 . 2012-03-14 00:56 902656 ----a-w- c:\windows\system32\d2d1.dll
    2012-02-10 06:17 . 2012-03-14 00:56 320512 ----a-w- c:\windows\system32\d3d10_1core.dll
    2012-02-10 06:17 . 2012-03-14 00:56 197120 ----a-w- c:\windows\system32\d3d10_1.dll
    2012-02-10 05:41 . 2012-03-14 00:56 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
    2012-02-10 05:41 . 2012-03-14 00:56 218624 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
    2012-02-10 05:41 . 2012-03-14 00:56 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
    2012-02-10 05:41 . 2012-03-14 00:56 1170944 ----a-w- c:\windows\SysWow64\d3d10warp.dll
    2012-02-10 05:41 . 2012-03-14 00:56 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
    2012-02-03 04:16 . 2012-03-14 00:56 3143168 ----a-w- c:\windows\system32\win32k.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-04-19_18.31.30 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2012-04-29 20:44 . 2012-04-29 20:44 13360 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
    - 2012-04-19 18:30 . 2012-04-19 18:30 13360 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
    - 2009-07-14 04:54 . 2012-03-06 23:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:54 . 2012-04-29 20:35 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2012-03-06 23:01 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2012-04-29 20:35 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2012-03-06 23:01 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2012-04-29 20:35 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-03-14 13:58 . 2012-04-29 20:37 44666 c:\windows\system64\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-04-29 20:37 25764 c:\windows\system64\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2011-05-15 23:23 . 2012-04-29 20:37 12406 c:\windows\system64\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-459595811-3807195349-2799752395-1001_UserData.bin
    + 2011-05-15 21:51 . 2012-04-26 02:17 49152 c:\windows\system64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2011-05-15 21:51 . 2012-04-19 00:11 49152 c:\windows\system64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2011-05-15 21:51 . 2012-04-26 02:17 32768 c:\windows\system64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2011-05-15 21:51 . 2012-04-19 00:11 32768 c:\windows\system64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2012-04-26 02:17 16384 c:\windows\system64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-07-14 04:54 . 2012-04-19 00:11 16384 c:\windows\system64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-03-14 13:58 . 2012-04-29 20:37 44666 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-04-29 20:37 25764 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2011-05-15 23:23 . 2012-04-29 20:37 12406 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-459595811-3807195349-2799752395-1001_UserData.bin
    + 2011-05-15 21:51 . 2012-04-26 02:17 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2011-05-15 21:51 . 2012-04-19 00:11 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2011-05-15 21:51 . 2012-04-19 00:11 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2011-05-15 21:51 . 2012-04-26 02:17 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2012-04-19 00:11 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2012-04-26 02:17 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2012-04-24 10:21 . 2012-04-24 10:21 9560 c:\windows\system64\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_48.bin
    + 2012-04-24 10:21 . 2012-04-24 10:21 4280 c:\windows\system64\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_32.bin
    + 2012-04-24 10:21 . 2012-04-24 10:21 2456 c:\windows\system64\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_24.bin
    + 2012-04-24 10:21 . 2012-04-24 10:21 9560 c:\windows\system32\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_48.bin
    + 2012-04-24 10:21 . 2012-04-24 10:21 4280 c:\windows\system32\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_32.bin
    + 2012-04-24 10:21 . 2012-04-24 10:21 2456 c:\windows\system32\NetworkList\Icons\{2CBF8208-0C65-495B-BF03-5E12AE8B2979}_24.bin
    + 2012-04-29 20:44 . 2012-04-29 20:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2012-04-19 18:31 . 2012-04-19 18:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-04-29 20:44 . 2012-04-29 20:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-04-19 18:31 . 2012-04-19 18:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2011-12-11 03:07 . 2011-10-03 10:06 157472 c:\windows\SysWOW64\javaws.exe
    + 2012-04-28 00:40 . 2012-04-28 00:40 157472 c:\windows\SysWOW64\javaws.exe
    + 2012-04-28 00:40 . 2012-04-28 00:40 149280 c:\windows\SysWOW64\javaw.exe
    + 2012-04-28 00:40 . 2012-04-28 00:40 149280 c:\windows\SysWOW64\java.exe
    + 2011-05-16 22:59 . 2012-04-29 00:03 313798 c:\windows\system64\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
    + 2009-07-14 02:36 . 2012-04-29 20:41 660732 c:\windows\system64\perfh009.dat
    - 2009-07-14 02:36 . 2012-04-16 23:15 660732 c:\windows\system64\perfh009.dat
    - 2009-07-14 02:36 . 2012-04-16 23:15 121402 c:\windows\system64\perfc009.dat
    + 2009-07-14 02:36 . 2012-04-29 20:41 121402 c:\windows\system64\perfc009.dat
    + 2011-05-16 22:59 . 2012-04-29 00:03 313798 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
    + 2009-07-14 02:36 . 2012-04-29 20:41 660732 c:\windows\system32\perfh009.dat
    - 2009-07-14 02:36 . 2012-04-16 23:15 660732 c:\windows\system32\perfh009.dat
    + 2009-07-14 02:36 . 2012-04-29 20:41 121402 c:\windows\system32\perfc009.dat
    - 2009-07-14 02:36 . 2012-04-16 23:15 121402 c:\windows\system32\perfc009.dat
    + 2011-05-16 03:10 . 2012-04-29 04:39 918736 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    - 2011-05-16 03:10 . 2012-04-19 18:30 918736 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    - 2009-07-14 05:01 . 2012-04-19 18:30 354596 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2012-04-29 20:44 354596 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2012-04-28 00:40 . 2012-04-28 00:40 207360 c:\windows\Installer\29ef87f.msi
    + 2012-02-10 15:38 . 2012-02-10 15:38 475136 c:\windows\Installer\10c19.msi
    + 2012-01-26 02:55 . 2012-04-29 20:44 13503864 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-459595811-3807195349-2799752395-1001-8192.dat
    + 2012-04-28 00:39 . 2012-04-28 00:39 12938752 c:\windows\Installer\29ef86f.msi
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\progra~2\Yahoo!\Companion\Installs\cpn0\yt.dll" [2011-10-06 2015544]
    .
    [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
    [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
    [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
    [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Xvid"="c:\program files (x86)\Xvid\CheckUpdate.exe" [2011-01-17 8192]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
    "Aim"="c:\program files (x86)\AIM\aim.exe" [2011-05-03 4321112]
    "Messenger (Yahoo!)"="c:\progra~2\Yahoo!\Messenger\YahooMessenger.exe" [2011-08-22 6276408]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-14 98304]
    "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160]
    "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-03-10 237568]
    "THX Audio Control Panel"="c:\program files (x86)\Creative\THX TruStudio PC\THXAudioCP\THXAudio.exe" [2009-12-01 963584]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-11-10 4144448]
    "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
    "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-05-31 421888]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-10-09 421736]
    "WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-10-26 74752]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    .
    c:\users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Best Buy pc app.lnk - c:\programdata\Best Buy pc app\ClickOnceSetup.exe [2010-10-13 9216]
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux3"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
    R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]
    R3 CompFilter64;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbflt64.sys [x]
    R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
    R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
    R3 LVUVC64;Logitech HD Webcam C525(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
    R3 MAUSBMOBILEPRE;Service for M-Audio MobilePre;c:\windows\system32\DRIVERS\MAudioMobilePre.sys [x]
    R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2010-07-30 25072]
    R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
    R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]
    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-13 13336]
    S2 LVPrcS64;Process Monitor;c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe [2010-05-07 197976]
    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
    S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [x]
    S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
    S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
    S3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]
    S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - IPNAT
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-04-15 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
    - c:\program files\Dell Support Center\uaclauncher.exe [2010-08-05 23:47]
    .
    2012-04-28 c:\windows\Tasks\SystemToolsDailyTest.job
    - c:\program files\Dell Support Center\pcdrcui.exe [2010-08-05 23:47]
    AuroraR, Apr 30, 2012
    #27

  8. AuroraR Newcomer, in training Posts: 21

    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-23 10920552]
    "RunDLLEntry_THXCfg"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
    "RunDLLEntry_EptMon"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
    "M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-09-02 798216]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.yahoo.com/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    TCP: DhcpNameServer = 65.32.5.111 65.32.5.112
    FF - ProfilePath - c:\users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\q24z16fw.default\
    FF - prefs.js: browser.startup.homepage - www.yahoo.com
    FF - prefs.js: network.proxy.type - 0
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
    "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-459595811-3807195349-2799752395-1001\Software\SecuROM\License information*]
    "datasecu"=hex:ec,18,3c,4c,a7,71,db,8a,55,1a,1f,aa,7a,d3,cf,f5,1d,ae,73,c5,fc,
    f2,8b,bb,8d,47,67,47,43,f4,47,cc,e5,b5,f0,ce,66,cc,bf,74,79,c0,f3,6c,1d,24,\
    "rkeysecu"=hex:8c,fa,54,48,96,9c,69,53,d1,16,bb,5a,05,db,83,00
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
    c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
    c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
    .
    **************************************************************************
    .
    Completion time: 2012-04-29 16:48:56 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-04-29 20:48
    .
    Pre-Run: 1,326,087,946,240 bytes free
    Post-Run: 1,326,231,986,176 bytes free
    .
    - - End Of File - - 735759ECDF17AFF0AA2247C017719017
    AuroraR, Apr 30, 2012
    #28

  9. Broni Malware Annihilator Posts: 39,231   +175

    How is redirection?
    Broni, Apr 30, 2012
    #29

  10. AuroraR Newcomer, in training Posts: 21

    Looks to be fixed now, thank you!

    I will make a small donation when I get paid on Friday for your help...
    AuroraR, May 1, 2012
    #30

  11. Broni Malware Annihilator Posts: 39,231   +175

    Good news :)

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2011/12/10 21:40:31 | 000,013,084 | -HS- | C] () -- C:\Users\Christina\AppData\Local\238265v6n322a423v050j2plu8g0
[2011/12/10 21:40:31 | 000,013,084 | -HS- | C] () -- C:\ProgramData\238265v6n322a423v050j2plu8g0

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =============================================================

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it.
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Do NOT post JavaRa log.

    =================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
    Broni, May 1, 2012
    #31

  12. AuroraR Newcomer, in training Posts: 21

    Hm... might have spoke too soon.... while definitely not as frequent, there have been isolated incidents of being redirected again. Here are the reports:

    OTL:

    All processes killed
    ========== OTL ==========
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdReg deleted successfully.
    C:\Windows\Updreg.EXE moved successfully.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\Windows\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    C:\Users\Christina\AppData\Local\238265v6n322a423v050j2plu8g0 moved successfully.
    C:\ProgramData\238265v6n322a423v050j2plu8g0 moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Christina
    ->Temp folder emptied: 2036093 bytes
    ->Temporary Internet Files folder emptied: 411908009 bytes
    ->Java cache emptied: 23771094 bytes
    ->FireFox cache emptied: 1099850843 bytes
    ->Flash cache emptied: 63757 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 56502 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 10618 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36068846 bytes
    RecycleBin emptied: 104915077 bytes

    Total Files Cleaned = 1,601.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Christina
    ->Java cache emptied: 0 bytes

    User: Default

    User: Default User

    User: Public

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Christina
    ->Flash cache emptied: 0 bytes

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.40.0 log created on 05022012_195716

    Files\Folders moved on Reboot...
    File\Folder C:\Users\Christina\AppData\Local\Temp\CVHLauncher(20120430194921948).log not found!
    C:\Users\Christina\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

    Registry entries deleted on Reboot...

    Security Check:

    Results of screen317's Security Check version 0.99.24
    Windows 7 x64 (UAC is enabled)
    Internet Explorer 9
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Java(TM) 6 Update 32
    Adobe Flash Player 11.1.102.55
    Mozilla Firefox (x86 en-US..)
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    ``````````End of Log````````````
    AuroraR, May 3, 2012
    #32

  13. AuroraR Newcomer, in training Posts: 21

    FSS:

    Farbar Service Scanner Version: 30-04-2012 01
    Ran by Christina (administrator) on 02-05-2012 at 20:15:06
    Running from "C:\Users\Christina\Downloads"
    Microsoft Windows 7 Home Premium (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys
    [2012-02-16 20:16] - [2011-12-27 23:59] - 0499200 ____A (Microsoft Corporation) DB9D6C6B2CD95A9CA414D045B627422E

    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll
    [2009-07-13 20:09] - [2009-07-13 21:41] - 0824832 ____A (Microsoft Corporation) AECAB449567D1846DAD63ECE49E893E3

    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll
    [2009-07-13 19:36] - [2009-07-13 21:41] - 0170496 ____A (Microsoft Corporation) 765A27C3279CE11D14CB9E4F5869FCA5

    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll
    [2009-07-13 20:36] - [2009-07-13 21:41] - 2418176 ____A (Microsoft Corporation) 38340204A2D0228F1E87740FC5E554A7

    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit


    **** End of log ****

    ESET:

    C:\Qoobox\Quarantine\C\Users\CHRIST~1\AppData\Local\Temp\npaut.dll.vir a variant of Win32/Medfos.L trojan
    C:\Users\Christina\Downloads\cnet2_avc-free_exe.exe a variant of Win32/InstallCore.D application
    AuroraR, May 3, 2012
    #33

  14. Broni Malware Annihilator Posts: 39,231   +175

    Which browser is affected?

    What happened to McAfee?
    Broni, May 3, 2012
    #34

  15. AuroraR Newcomer, in training Posts: 21

    Firefox. I don't know if it does the same thing with IE since I really don't like to use it.

    I don't think I ever had McAfee. I know the computer had a free trial of Norton that has long since expired.
    AuroraR, May 7, 2012
    #35

  16. Broni Malware Annihilator Posts: 39,231   +175

    Broni, May 7, 2012
    #36

  17. AuroraR Newcomer, in training Posts: 21

    OK I download the free Cornodo antivirus and this was the closest thing to a log I could get with what it found:

    DateLocationMalware NameActionStatus
    2012-05-12 08:42:43 C:\Users\Christina\Desktop\aswMBR.exe Suspicious@o9qn3ikrl1en Detect Success
    2012-05-12 08:42:44 C:\Users\Christina\Desktop\aswMBR.exe Suspicious@#o9qn3ikrl1en Quarantine Success
    2012-05-12 09:06:13 C:\Users\Christina\AppData\Local\Temp\wpbt0.dll Malware@39dirwp1sowwc Detect Success
    2012-05-12 09:06:45 C:\Users\Christina\AppData\Roaming\comsrvr.exe Malware@125j68jq6tl8m Detect Success
    2012-05-12 09:08:26 C:\Users\Christina\Desktop\tdsskiller.zip|TDSSKiller.exe Packed.Win32.MUPX.Gen@129019204 Detect Success
    2012-05-12 09:09:55 C:\Users\Christina\Downloads\dds.scr Suspicious@u9phuzvzboiw Detect Success
    2012-05-12 10:44:50 C:\Users\Christina\AppData\Roaming\comsrvr.exe Malware@125j68jq6tl8m Detect Success
    2012-05-12 10:44:51 C:\Users\Christina\Downloads\dds.scr Suspicious@u9phuzvzboiw Detect Success
    2012-05-12 10:44:51 C:\Users\Christina\AppData\Roaming\comsrvr.exe Malware@#125j68jq6tl8m Quarantine Success
    2012-05-12 10:44:52 C:\Users\Christina\Downloads\dds.scr Suspicious@#u9phuzvzboiw Quarantine Success
    End of The Report

    Also I tried to get the same thing happening in IE, and wasn't able to do so. So it seems to be a Firefox-exclusive event now.
    AuroraR, May 12, 2012
    #37

  18. Broni Malware Annihilator Posts: 39,231   +175

    Please download GooredFix from one of the locations below and save it to your Desktop
    Download Mirror #1
    Download Mirror #2
    • Ensure all Firefox windows are closed.
    • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
    • When prompted to run the scan, click Yes.
    • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
    Broni, May 12, 2012
    #38
Page 2 of 2
Topic Status:
Not open for further replies.

Add New Comment

Social Login & Guest Posting

TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.