Internet explorer/Firefox both redirect

Question

scraddock 0 Newbie Poster

15 Years Ago

I need help with a Toshiba laptop that is having difficulties with IE/Firefox redirecting to advertising sites. I have tried numerous programs to kill this and have had no luck.

Here is the most recent HJT log. Thanks in advance for your help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:59:34 PM, on 11/13/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Utilities\KeNotify.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Toshiba\IVP\ISM\pinger.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Toshiba\IVP\ISM\ivpsvmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\kemmerling\Downloads\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forecast.weather.gov/MapClick.php?CityName=Kill+Devil+Hills&state=NC&site=MHX&textField1=36.016&textField2=-75.6675
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [jswtrayutil] "C:\Program Files\Jumpstart\jswtrayutil.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Update Service (gupdate1c98bd192b2a0a3) (gupdate1c98bd192b2a0a3) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\Jumpstart\jswpsapi.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: pinger - Unknown owner - C:\Toshiba\IVP\ISM\pinger.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: TOSHIBA SMART Log Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 13071 bytes

http-protocol virus-malware windows-virus windows-vista-7-8

6 Contributors
32 Replies
447 Views
1 Month Discussion Span
Latest Post 14 Years Ago Latest Post by jholland1964

jholland1964 650 Posting Expert

15 Years Ago

Hey Judy - You guys need to run GMER & Combofix to sort this problem out.
PP :)

That's what I thought PP.
You heard the man scraddock.
Please download GMER Rootkit Scanner:
http://www.gmer.net/download.php

-- DoubleClick the .exe file and, if asked, allow the gmer.sys driver to load.
-- If you receive a warning about Rootkit Activity and GMER asks if you want to run a scan, Click NO

-- Make sure the Rootkit/Malware Tab is selected (Top Left of GMER GUI)
Along the Right Side of the GMER GUI there will be a number of checked boxes. Please Uncheck the following:
- Sections
- Drives or Partitions other than your Systemdrive (usually C:\)
- Show All (be sure this one remains Unchecked)

-- Then, click the Scan Button
Allow the scan as long as it needs and then save the log to where you can easily find it and post it for us.

***Disconnect from the internet and do not run any other programs while GMER is scanning. Temporarily disable any real-time anti-spyware or anti-virus protection so they do not interfere with the running of GMER.
DO NOT take any action for any found items until PP or I can have a look.
Post the log here when finished.

jbennet 1,618 Most Valuable Poster

15 Years Ago

Its clean. Thanks for posting anyway.

jholland1964 650 Posting Expert

15 Years Ago

Download Combofix and run it:

http://www.bleepingcomputer.com/comb...o-use-combofix

Download it to your Desktop as that and follow the instructions in the link very carefully to run it and then post the combofix log.
Be sure to install Recovery Console if you don't all ready have it on the system and disable any other security programs or Anti-Virus programs as noted in the link before running Combofix!

Post back with that log.
Judy

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

R1pperZ 0 Light Poster · Answer 1 · 2009-11-14T02:52:01+00:00

In most cases MalwareBytes Anti-Malware does the trick with that issue. Download Free Version make sure to update after installation and disable any other running antivirus programs before performing a full scan. Remove all infections and post that log for the other people here to review.

*** EDIT ***
Due to a bug in Malwarebytes, you may see in MBAM's log following entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\atapi (Rootkit)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\atapi (Rootkit)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi (Rootkit)
DO NOT remove those entries!
If you do, your computer will become UN-bootable.
The issue has been fixed in the latest MBAM update, so, please make sure you update MBAM before you run it.
--Crunchie
Well I just found this sticky thread and decided maybe I should do a little more research on the subject before making recomendations, by all means MBa-m is safe and a great tool to rid yourself of viruses but I guess you just need to be a little weary of the "infections" you deleat so just keep your eye out for those entries listed above.

scraddock 0 Newbie Poster · Answer 2 · 2009-11-14T11:01:21+00:00

Thank you r1pperZ,

If you noticed the HJT log, you will see that I have used Malwarebytes, Spyware Doctor, SuperantiSpyware, Ad-aware, CCleaner, Spybot, Bitdefender online and Panda online and AVAST antivirus scans and the infection is still there. The HJT log posted was after I had done all the aforementioned scans.

I appreciate the help all of you can give. I have tried everything I know to remove the infection, whatever it is. Neither of the scans listed above now find anything. I did remove quite a few before this HJT log.

Please help. Thanks.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 3 · 2009-11-14T21:14:39+00:00

Thank you r1pperZ,
If you noticed the HJT log, you will see that I have used Malwarebytes, Spyware Doctor, SuperantiSpyware, Ad-aware, CCleaner, Spybot, Bitdefender online and Panda online and AVAST antivirus scans and the infection is still there. The HJT log posted was after I had done all the aforementioned scans.
I appreciate the help all of you can give. I have tried everything I know to remove the infection, whatever it is. Neither of the scans listed above now find anything. I did remove quite a few before this HJT log.
Please help. Thanks.

Did any of these scans FIND infections? If so what were they and where were they located?
Do you have the logs from the scans you have done, especially MBA-M? We DO need to see the logs when scans have been done.
When you did the online scans did you turn off the onboard security programs? This is generally a requirement for the scans to work correctly.
Judy

scraddock 0 Newbie Poster · Answer 4 · 2009-11-15T09:32:47+00:00

Did any of these scans FIND infections? If so what were they and where were they located?
Do you have the logs from the scans you have done, especially MBA-M? We DO need to see the logs when scans have been done.
When you did the online scans did you turn off the onboard security programs? This is generally a requirement for the scans to work correctly.
Judy

Thank you Judy. Here are the 2 logs from MBA-M where it found infections. The HJT log above was performed after all the scans were done. Let me know what you need further.

1st run
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 6.0.6002 Service Pack 2

11/10/2009 2:36:14 PM
mbam-log-2009-11-10 (14-36-14).txt

Scan type: Quick Scan
Objects scanned: 84119
Time elapsed: 4 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 28
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 7
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Windows\System32\iehelpmod.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\iehelpmod.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

2nd run
Malwarebytes' Anti-Malware 1.41
Database version: 3141
Windows 6.0.6002 Service Pack 2

11/10/2009 6:51:17 PM
mbam-log-2009-11-10 (18-51-17).txt

Scan type: Full Scan (C:\|)
Objects scanned: 225209
Time elapsed: 2 hour(s), 0 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servises (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Common Files\CSUninstall (Rogue.CyberSecurity) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Common Files\CSUninstall\Uninstall.lnk (Rogue.CyberSecurity) -> Quarantined and deleted successfully.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 5 · 2009-11-15T09:57:55+00:00

Think it would be a good idea if you run at least one online scan. You will need to turn off ALL of your security programs, including your Avast and firewall and all the others too, in order for the scan to work properly and you will need to use Internet Explorer to run it.
Run the ESET Online Scanner and attach the ScanLog with your post.
If something is found please allow it to fix.
Once it is finished, reboot, do a new HJT scan and then post back with both logs.
Judy

scraddock 0 Newbie Poster · Answer 6 · 2009-11-15T10:26:40+00:00

jholland1964,

The ESET online scanner will not work. It is asking me if the proxy is configured. This computer is not located behind a proxy server, it is only behind a wireless router. All scanners and protection software is off as you instructed. What shall I do next?

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 7 · 2009-11-15T10:37:32+00:00

I see by your HJT log you have run Panda and Bitdefender at some time, run one of those again.
Also a question, are you running the paid versions of MBA-M and SAS?

scraddock 0 Newbie Poster · Answer 8 · 2009-11-15T10:43:24+00:00

I am running the paid version of MBA-M, not SAS.

PhilliePhan 171 Central Scrutinizer Team Colleague · Answer 9 · 2009-11-15T11:14:34+00:00

I am running the paid version of MBA-M, not SAS.

Hey Judy - You guys need to run GMER & Combofix to sort this problem out.

PP :)

scraddock 0 Newbie Poster · Answer 10 · 2009-11-15T12:08:45+00:00

Ok. Will do. By the way, I just ran the Online Bit Defender and it found no viruses or infections.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 11 · 2009-11-15T12:27:43+00:00

Ok good. Run GMER and post back with the log and we'll have a look

jbennet 1,618 Most Valuable Poster Team Colleague Featured Poster · Answer 12 · 2009-11-15T12:39:08+00:00

jbennet 1,618 Most Valuable Poster

15 Years Ago

Please post the contents of your HOSTS file as well.

scraddock 0 Newbie Poster · Answer 13 · 2009-11-15T12:59:38+00:00

Here is the GMER log.

GMER 1.0.15.15227 - http://www.gmer.net
Rootkit scan 2009-11-15 01:55:28
Windows 6.0.6002 Service Pack 2
Running: 72355ht0.exe; Driver: C:\Users\KEMMER~1\AppData\Local\Temp\kxriikog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x82C4ACDC]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x82C4AECE]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ZwTerminateProcess [0x8CECA0B0]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x82C4B0D6]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\services.exe[684] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 000C0002
IAT C:\Windows\system32\services.exe[684] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 000C0000

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys

AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

scraddock 0 Newbie Poster · Answer 14 · 2009-11-15T13:06:08+00:00

scraddock 0 Newbie Poster

15 Years Ago

Where and which hosts file would you like?

jbennet 1,618 Most Valuable Poster Team Colleague Featured Poster · Answer 15 · 2009-11-16T02:13:25+00:00

from %SystemRoot%\system32\drivers\etc\HOSTS

should have 127.0.0.1 localhost or something similar, thats it.

scraddock 0 Newbie Poster · Answer 16 · 2009-11-16T07:52:50+00:00

scraddock 0 Newbie Poster

15 Years Ago

Attached is the hosts file in .txt format. Thank you.

hosts.txt (343.76 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost
# Start of entries inserted by Spybot - Search & Destroy
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	www.100888290cs.com
127.0.0.1	100888290cs.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	1-2005-search.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com
127.0.0.1	www.123moviedownload.com
127.0.0.1	123simsen.com
127.0.0.1	www.123simsen.com
127.0.0.1	123topsearch.com
127.0.0.1	www.123topsearch.com
127.0.0.1	125sms.co.uk
127.0.0.1	www.125sms.co.uk
127.0.0.1	125sms.com
127.0.0.1	www.125sms.com
127.0.0.1	132.com
127.0.0.1	www.132.com
127.0.0.1	1337crew.info
127.0.0.1	www.1337crew.info
127.0.0.1	www.1337-crew.to
127.0.0.1	1337-crew.to
127.0.0.1	www.136136.net
127.0.0.1	136136.net
127.0.0.1	150freesms.de
127.0.0.1	www.150freesms.de
127.0.0.1	www.163ns.com
127.0.0.1	163ns.com
127.0.0.1	171203.com
127.0.0.1	17concepts.info
127.0.0.1	www.17concepts.info
127.0.0.1	17-plus.com
127.0.0.1	1800searchonline.com
127.0.0.1	www.1800searchonline.com
127.0.0.1	180searchassistant.com
127.0.0.1	www.180searchassistant.com
127.0.0.1	180solutions.com
127.0.0.1	www.180solutions.com
127.0.0.1	181.365soft.info
127.0.0.1	www.181.365soft.info
127.0.0.1	1987324.com
127.0.0.1	www.1987324.com
127.0.0.1	www.1-domains-registrations.com
127.0.0.1	1-domains-registrations.com
127.0.0.1	www.1sexparty.com
127.0.0.1	1sexparty.com
127.0.0.1	www.1sms.de
127.0.0.1	1sms.de
127.0.0.1	www.1spybot.com
127.0.0.1	1spybot.com
127.0.0.1	www.1stantivirus.com
127.0.0.1	1stantivirus.com
127.0.0.1	www.1stpagehere.com
127.0.0.1	1stpagehere.com
127.0.0.1	www.1stsearchportal.com
127.0.0.1	1stsearchportal.com
127.0.0.1	2.82211.net
127.0.0.1	2006ooo.com
127.0.0.1	www.2006ooo.com
127.0.0.1	2007-download.com
127.0.0.1	www.2007-download.com
127.0.0.1	www.2008firefox.com
127.0.0.1	2008firefox.com
127.0.0.1	www.2008search-destroy.com
127.0.0.1	2008search-destroy.com
127.0.0.1	www.2008-search-destroy.com
127.0.0.1	2008-search-destroy.com
127.0.0.1	2008-viewer.com
127.0.0.1	www.2008-viewer.com
127.0.0.1	2009--access.com
127.0.0.1	www.2009--access.com
127.0.0.1	2009antivirpro.com
127.0.0.1	www.2009antivirpro.com
127.0.0.1	www.2009-edition.com
127.0.0.1	2009-edition.com
127.0.0.1	www.2009-phone.com
127.0.0.1	2009-phone.com
127.0.0.1	www.2009search-destroy.com
127.0.0.1	2009search-destroy.com
127.0.0.1	2009-version.info
127.0.0.1	www.2009-version.info
127.0.0.1	2020search.com
127.0.0.1	www.2020search.com
127.0.0.1	20x2p.com
127.0.0.1	21dice.net
127.0.0.1	www.21dice.net
127.0.0.1	2-2005-search.com
127.0.0.1	www.2-2005-search.com
127.0.0.1	24.365soft.info
127.0.0.1	www.24.365soft.info
127.0.0.1	www.24-7pharmacy.info
127.0.0.1	24-7pharmacy.info
127.0.0.1	24-7searching-and-more.com
127.0.0.1	www.24-7searching-and-more.com
127.0.0.1	www.24teen.com
127.0.0.1	24teen.com
127.0.0.1	2ndpower.com
127.0.0.1	www.2search.com
127.0.0.1	2search.com
127.0.0.1	www.2search.org
127.0.0.1	2search.org
127.0.0.1	www.2squared.com
127.0.0.1	2squared.com
127.0.0.1	www.3-2005-search.com
127.0.0.1	3-2005-search.com
127.0.0.1	www.321-gratis-sms.com
127.0.0.1	321-gratis-sms.com
127.0.0.1	www.3322.org
127.0.0.1	3322.org
127.0.0.1	365soft.info
127.0.0.1	www.36site.com
127.0.0.1	36site.com
127.0.0.1	3721.com
127.0.0.1	39-93.com
127.0.0.1	www.3bay.it
127.0.0.1	3bay.it
127.0.0.1	3xclipsonline.com
127.0.0.1	www.3xclipsonline.com
127.0.0.1	3xcurves.com
127.0.0.1	www.3xcurves.com
127.0.0.1	www.3xfestival.com
127.0.0.1	3xfestival.com
127.0.0.1	www.3x-festival.com
127.0.0.1	3x-festival.com
127.0.0.1	www.3x-galls.com
127.0.0.1	3x-galls.com
127.0.0.1	www.3xmiracle.com
127.0.0.1	3xmiracle.com
127.0.0.1	www.3xmoviesblog.com
127.0.0.1	3xmoviesblog.com
127.0.0.1	www.404dns.com
127.0.0.1	404dns.com
127.0.0.1	www.4199.com
127.0.0.1	4199.com
127.0.0.1	www.4-2005-search.com
127.0.0.1	4-2005-search.com
127.0.0.1	4corn.net
127.0.0.1	www.4corn.net
127.0.0.1	4ebay.it
127.0.0.1	www.4ebay.it
127.0.0.1	4klm.com
127.0.0.1	4mpg.com
127.0.0.1	www.4mpg.com
127.0.0.1	www.4-open-davinci.com
127.0.0.1	4-open-davinci.com
127.0.0.1	www.5-2005-search.com
127.0.0.1	5-2005-search.com
127.0.0.1	www.555royalclub.net
127.0.0.1	555royalclub.net
127.0.0.1	www.59cn.cn
127.0.0.1	59cn.cn
127.0.0.1	www.5starsblog.com
127.0.0.1	5starsblog.com
127.0.0.1	www.5zgmu7o20kt5d8yq.com
127.0.0.1	5zgmu7o20kt5d8yq.com
127.0.0.1	www.6000vornamen.de
127.0.0.1	6000vornamen.de
127.0.0.1	www.6700.cn
127.0.0.1	6700.cn
127.0.0.1	www.680180.net
127.0.0.1	680180.net
127.0.0.1	www.69loadz.com
127.0.0.1	69loadz.com
127.0.0.1	www.6sek.com
127.0.0.1	6sek.com
127.0.0.1	www.70-music.com
127.0.0.1	70-music.com
127.0.0.1	www.7322.com
127.0.0.1	7322.com
127.0.0.1	www.745970.com
127.0.0.1	745970.com
127.0.0.1	75tz.com
127.0.0.1	www.777gamecard.net
127.0.0.1	777gamecard.net
127.0.0.1	www.777jackpotgame.net
127.0.0.1	777jackpotgame.net
127.0.0.1	www.777search.com
127.0.0.1	777search.com
127.0.0.1	www.777starsgame.net
127.0.0.1	777starsgame.net
127.0.0.1	www.777top.com
127.0.0.1	777top.com
127.0.0.1	www.7939.com
127.0.0.1	7939.com
127.0.0.1	80gw6ry3i3x3qbrkwhxhw.032439.com
127.0.0.1	www.80-music.com
127.0.0.1	80-music.com
127.0.0.1	82211.net
127.0.0.1	8866.org
127.0.0.1	www.888gamegold.net
127.0.0.1	888gamegold.net
127.0.0.1	www.888gamevip.net
127.0.0.1	888gamevip.net
127.0.0.1	888-lucky.net
127.0.0.1	www.888-lucky.net
127.0.0.1	www.88sms.ch
127.0.0.1	88sms.ch
127.0.0.1	88vcd.com
127.0.0.1	www.88vcd.com
127.0.0.1	8ad.com
127.0.0.1	www.8ad.com
127.0.0.1	www.8-download.com
127.0.0.1	8-download.com
127.0.0.1	www.90-music.com
127.0.0.1	90-music.com
127.0.0.1	www.9505.com
127.0.0.1	9505.com
127.0.0.1	www.971searchbox.com
127.0.0.1	971searchbox.com
127.0.0.1	www.99downloads.de
127.0.0.1	99downloads.de
127.0.0.1	9mmporn.com
127.0.0.1	a.bestmanage.org
127.0.0.1	www.aaabesthomepage.com
127.0.0.1	aaabesthomepage.com
127.0.0.1	aaasexypics.com
127.0.0.1	aaawebfinder.com
127.0.0.1	www.aaawebfinder.com
127.0.0.1	www.aantivir.de
127.0.0.1	aantivir.de
127.0.0.1	www.aaqadarsztriv.com
127.0.0.1	aaqadarsztriv.com
127.0.0.1	www.aaqada-rsztriv.com
127.0.0.1	aaqada-rsztriv.com
127.0.0.1	www.aaqadaueorn.com
127.0.0.1	aaqadaueorn.com
127.0.0.1	www.aaqada-ueorn.com
127.0.0.1	aaqada-ueorn.com
127.0.0.1	www.aaqada-ygco.com
127.0.0.1	aaqada-ygco.com
127.0.0.1	aaqada-ymct.com
127.0.0.1	www.aaqada-ymct.com
127.0.0.1	aaszxy.ru
127.0.0.1	www.aaszxy.ru
127.0.0.1	aav2008.com
127.0.0.1	www.aav2008.com
127.0.0.1	aavc.com
127.0.0.1	www.aavira.de
127.0.0.1	aavira.de
127.0.0.1	www.abccodec.com
127.0.0.1	abccodec.com
127.0.0.1	www.abcdperformance.com
127.0.0.1	abcdperformance.com
127.0.0.1	abc-find.info
127.0.0.1	www.abc-find.info
127.0.0.1	abcload.de
127.0.0.1	www.abcload.de
127.0.0.1	abcsearch.com
127.0.0.1	www.abcsearch.com
127.0.0.1	abcways.com
127.0.0.1	www.abcways.com
127.0.0.1	abetterinternet.com
127.0.0.1	www.abetterinternet.com
127.0.0.1	www.abiword-download.com
127.0.0.1	abiword-download.com
127.0.0.1	abnetsoft.info
127.0.0.1	www.abnetsoft.info
127.0.0.1	abntivir.de
127.0.0.1	www.abntivir.de
127.0.0.1	about-adult.net
127.0.0.1	www.about-adult.net
127.0.0.1	www.aboutclicker.com
127.0.0.1	aboutclicker.com
127.0.0.1	abrp.net
127.0.0.1	www.abrp.net
127.0.0.1	www.absolutee.com
127.0.0.1	absolutee.com
127.0.0.1	abvira.de
127.0.0.1	www.abvira.de
127.0.0.1	ac66.cn
127.0.0.1	www.ac66.cn
127.0.0.1	access.navinetwork.com
127.0.0.1	access.rapid-pass.net
127.0.0.1	www.accessactivexvideo.com
127.0.0.1	accessactivexvideo.com
127.0.0.1	www.accessclips.com
127.0.0.1	accessclips.com
127.0.0.1	www.access-dvd.com
127.0.0.1	access-dvd.com
127.0.0.1	www.accesskeygenerator.com
127.0.0.1	accesskeygenerator.com
127.0.0.1	accessthefuture.net
127.0.0.1	www.accessthefuture.net
127.0.0.1	accessvid.net
127.0.0.1	www.accessvid.net
127.0.0.1	www.acemedic.com
127.0.0.1	acemedic.com
127.0.0.1	www.ace-webmaster.com
127.0.0.1	ace-webmaster.com
127.0.0.1	acjp.com
127.0.0.1	acrobat-2007.com
127.0.0.1	www.acrobat-2007.com
127.0.0.1	www.acrobat-8.com
127.0.0.1	acrobat-8.com
127.0.0.1	acrobat-center.com
127.0.0.1	www.acrobat-center.com
127.0.0.1	acrobat-hq.com
127.0.0.1	www.acrobat-hq.com
127.0.0.1	www.acrobatreader-8.com
127.0.0.1	acrobatreader-8.com
127.0.0.1	www.acrobat-reader-8.de
127.0.0.1	acrobat-reader-8.de
127.0.0.1	www.acrobat-stop.com
127.0.0.1	acrobat-stop.com
127.0.0.1	actionbreastcancer.org
127.0.0.1	www.actionbreastcancer.org
127.0.0.1	www.activesearcher.info
127.0.0.1	activesearcher.info
127.0.0.1	www.activesecurityscaner.org
127.0.0.1	activesecurityscaner.org
127.0.0.1	activexaccessobject.com
127.0.0.1	www.activexaccessobject.com
127.0.0.1	www.activexaccessvideo.com
127.0.0.1	activexaccessvideo.com
127.0.0.1	activexemedia.com
127.0.0.1	www.activexemedia.com
127.0.0.1	activexmediaobject.com
127.0.0.1	www.act

scraddock 0 Newbie Poster · Answer 17 · 2009-11-16T10:36:23+00:00

scraddock 0 Newbie Poster

15 Years Ago

Here is the Combofix log. Thanks.

ComboFix.txt (24.1 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

ComboFix 09-11-16.03 - kemmerling 11/15/2009 22:48..1 - FAT32x86
Microsoft Windows Vista Home Premium   6.0.6002.2.1252.1.1033.18.2038.836 [GMT -5:00]
Running from: c:\users\kemmerling\Desktop\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2579673529-246469682-3012347828-500
c:\$recycle.bin\S-1-5-21-714906321-3272427132-4208662703-500

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected 
Restored copy from - Kitty ate it :p 
.
(((((((((((((((((((((((((   Files Created from 2009-10-16 to 2009-11-16  )))))))))))))))))))))))))))))))
.

2009-11-16 04:02 . 2009-11-16 04:03	--------	d-----w-	c:\users\kemmerling\AppData\Local\temp
2009-11-16 04:02 . 2009-11-16 04:02	--------	d-----w-	c:\users\Default\AppData\Local\temp
2009-11-16 03:43 . 2009-04-11 06:32	27112	----a-w-	c:\windows\system32\drivers\msahci.sys
2009-11-15 04:56 . 2009-11-15 05:00	4096	d-----w-	c:\users\kemmerling\AppData\Roaming\QuickScan
2009-11-15 04:05 . 2009-11-15 04:05	--------	d-----w-	c:\program files\ESET
2009-11-12 06:54 . 2009-06-30 14:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys
2009-11-12 06:54 . 2009-11-12 06:54	--------	d-----w-	c:\program files\Panda Security
2009-11-12 05:16 . 2009-11-15 05:01	8192	d-----w-	c:\windows\BDOSCAN8
2009-11-12 04:23 . 2009-11-12 04:23	160272	----a-w-	c:\windows\system32\drivers\tmcomm.sys
2009-11-12 04:23 . 2009-11-12 04:23	--------	d-----w-	c:\windows\system32\log
2009-11-12 04:21 . 2009-11-12 04:21	--------	d-----w-	c:\users\kemmerling\AppData\Local\Threat Expert
2009-11-12 03:51 . 2009-10-08 16:31	767952	----a-w-	c:\windows\BDTSupport.dll
2009-11-12 03:50 . 2009-10-08 16:31	149456	----a-w-	c:\windows\SGDetectionTool.dll
2009-11-12 03:50 . 2009-10-08 16:31	165840	----a-w-	c:\windows\PCTBDRes.dll
2009-11-12 03:50 . 2009-10-08 16:31	1636304	----a-w-	c:\windows\PCTBDCore.dll
2009-11-12 03:50 . 2009-10-02 19:19	1152470	----a-w-	c:\windows\UDB.zip
2009-11-12 03:50 . 2008-11-26 17:08	131	----a-w-	c:\windows\IDB.zip
2009-11-12 03:48 . 2009-09-24 13:55	97208	----a-w-	c:\windows\system32\drivers\pctwfpfilter.sys
2009-11-12 03:48 . 2009-09-24 13:55	229304	----a-w-	c:\windows\system32\drivers\pctgntdi.sys
2009-11-12 03:48 . 2009-10-06 21:31	87784	----a-w-	c:\windows\system32\drivers\PCTAppEvent.sys
2009-11-12 03:48 . 2009-09-23 21:10	207280	----a-w-	c:\windows\system32\drivers\PCTCore.sys
2009-11-12 03:48 . 2009-09-03 14:45	70408	----a-w-	c:\windows\system32\drivers\pctplsg.sys
2009-11-12 03:47 . 2009-11-12 03:51	--------	d-----w-	c:\program files\Common Files\PC Tools
2009-11-12 03:47 . 2009-11-15 04:01	40960	d-----w-	c:\program files\Spyware Doctor
2009-11-12 03:47 . 2009-11-12 03:47	--------	d-----w-	c:\users\kemmerling\AppData\Roaming\PC Tools
2009-11-12 03:47 . 2009-11-12 03:47	--------	d-----w-	c:\programdata\PC Tools
2009-11-12 03:13 . 2009-11-12 03:13	117760	----a-w-	c:\users\kemmerling\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-12 03:12 . 2009-11-12 03:12	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2009-11-12 03:12 . 2009-11-12 03:12	4096	d-----w-	c:\program files\SUPERAntiSpyware
2009-11-12 03:12 . 2009-11-12 03:12	--------	d-----w-	c:\users\kemmerling\AppData\Roaming\SUPERAntiSpyware.com
2009-11-12 03:11 . 2009-11-12 03:11	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2009-11-11 23:28 . 2009-11-11 22:45	15880	----a-w-	c:\windows\system32\lsdelete.exe
2009-11-11 22:44 . 2009-11-11 22:44	5908024	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2009-11-11 22:44 . 2009-11-11 22:44	87496	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-11-11 22:44 . 2009-11-11 22:44	327000	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-11 22:44 . 2009-11-11 22:44	933120	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-11-11 22:44 . 2009-11-11 22:44	640608	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-11 22:44 . 2009-11-11 22:44	815760	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-11-11 22:44 . 2009-11-11 22:44	822904	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-11-11 22:44 . 2009-11-11 22:44	1638104	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-11-11 22:44 . 2009-11-11 22:44	788368	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-11-11 22:44 . 2009-11-11 22:44	1179232	----a-w-	c:\programdata\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-11-11 22:41 . 2009-11-11 22:41	4096	dc-h--w-	c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-11-11 22:41 . 2009-10-03 08:15	2924848	-c--a-w-	c:\programdata\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
2009-11-11 22:41 . 2009-11-11 22:45	--------	d-----w-	c:\programdata\Lavasoft
2009-11-11 22:41 . 2009-11-11 22:41	--------	d-----w-	c:\program files\Lavasoft
2009-11-11 06:40 . 2009-11-11 06:40	411368	----a-w-	c:\windows\system32\deploytk.dll
2009-11-11 06:35 . 2009-10-10 07:07	38208	----a-w-	c:\users\kemmerling\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-11 06:35 . 2009-10-10 07:07	38208	----a-w-	c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-11-11 06:34 . 2009-11-11 06:34	--------	d-----w-	c:\program files\Common Files\Adobe AIR
2009-11-11 06:33 . 2009-11-11 06:33	86016	----a-w-	c:\programdata\NOS\Adobe_Downloads\arh.exe
2009-11-11 06:33 . 2009-11-11 09:16	4096	d-----w-	c:\programdata\NOS
2009-11-11 06:33 . 2009-11-06 14:20	34112	----a-w-	c:\users\kemmerling\AppData\Roaming\Mozilla\Firefox\Profiles\y9g8uy5i.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg_bootstrap.exe
2009-11-11 06:33 . 2009-11-06 14:20	32448	----a-w-	c:\users\kemmerling\AppData\Roaming\Mozilla\Firefox\Profiles\y9g8uy5i.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
2009-11-11 06:33 . 2009-11-06 14:20	22352	----a-w-	c:\users\kemmerling\AppData\Roaming\Mozilla\Firefox\Profiles\y9g8uy5i.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\chrome\content\getPlusPlus_Adobe_reg.exe
2009-11-11 03:12 . 2009-11-11 03:12	--------	d-----w-	c:\windows\system32\Adobe
2009-11-11 01:54 . 2009-11-11 01:54	--------	d-----w-	c:\program files\Synaptics
2009-11-11 01:53 . 2009-11-11 01:53	--------	d-----w-	c:\program files\Microsoft Silverlight
2009-11-10 20:44 . 2009-11-10 20:44	--------	d-----w-	c:\users\kemmerling\AppData\Local\LogMeIn
2009-11-10 20:44 . 2009-11-10 20:44	--------	d-----w-	c:\programdata\LogMeIn
2009-11-10 20:44 . 2009-09-29 00:34	28984	----a-w-	c:\windows\system32\LMIport.dll
2009-11-10 20:44 . 2009-09-29 00:34	83288	----a-w-	c:\windows\system32\LMIRfsClientNP.dll
2009-11-10 20:44 . 2008-08-11 17:41	47640	----a-w-	c:\windows\system32\drivers\LMIRfsDriver.sys
2009-11-10 20:44 . 2009-09-29 00:34	87352	----a-w-	c:\windows\system32\LMIinit.dll
2009-11-10 20:44 . 2009-11-16 03:41	4096	d-----w-	c:\program files\LogMeIn
2009-11-10 20:29 . 2009-09-15 11:54	23152	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2009-11-10 20:29 . 2009-09-15 11:54	52368	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2009-11-10 20:29 . 2009-09-15 11:53	97480	----a-w-	c:\windows\system32\AvastSS.scr
2009-11-10 20:29 . 2009-09-15 11:55	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys
2009-11-10 20:29 . 2009-09-15 11:55	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2009-11-10 20:29 . 2009-09-15 11:59	1279968	----a-w-	c:\windows\system32\aswBoot.exe
2009-11-10 20:29 . 2009-09-15 11:55	53328	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2009-11-10 20:29 . 2009-11-10 20:29	--------	d-----w-	c:\program files\Alwil Software
2009-11-10 20:24 . 2009-11-10 20:24	4096	d-----w-	c:\program files\CleanUp!
2009-11-10 20:04 . 2009-11-14 06:07	4096	d-----w-	c:\programdata\Spybot - Search & Destroy
2009-11-10 20:04 . 2009-11-11 19:08	8192	d-----w-	c:\program files\Spybot - Search & Destroy
2009-11-10 19:44 . 2009-11-10 19:44	--------	d-----w-	c:\program files\CCleaner
2009-11-10 19:29 . 2009-11-10 19:29	--------	d-----w-	c:\users\kemmerling\AppData\Roaming\Malwarebytes
2009-11-10 19:29 . 2009-09-10 19:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-10 19:29 . 2009-11-10 19:29	4096	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-11-10 19:29 . 2009-11-10 19:29	--------	d-----w-	c:\programdata\Malwarebytes
2009-11-10 19:29 . 2009-09-10 19:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-11-04 10:01 . 2009-11-04 10:01	680	----a-w-	c:\users\kemmerling\AppData\Local\d3d9caps.dat
2009-11-01 11:34 . 2009-11-03 01:42	195456	------w-	c:\windows\system32\MpSigStub.exe
2009-10-27 21:30 . 2009-09-10 14:58	310784	----a-w-	c:\windows\system32\unregmp2.exe
2009-10-27 21:30 . 2009-09-10 14:59	8147456	----a-w-	c:\windows\system32\wmploc.DLL

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-15 12:47 . 2009-02-10 22:46	4096	d-----w-	c:\programdata\Google Updater
2009-11-11 22:47 . 2008-02-19 03:30	4096	d-----w-	c:\program files\Google
2009-11-11 21:36 . 2008-02-19 02:27	12288	d--h--w-	c:\program files\InstallShield Installation Information
2009-11-11 21:32 . 2008-02-19 03:22	4096	d-----w-	c:\program files\TOSHIBA Games
2009-11-11 21:32 . 2008-02-19 03:22	4096	d-----w-	c:\programdata\WildTangent
2009-11-11 20:39 . 2008-07-31 00:47	--------	d-----w-	c:\program files\Yahoo!
2009-11-11 06:40 . 2008-02-19 03:05	--------	d-----w-	c:\program files\Java
2009-11-11 06:38 . 2008-07-23 00:07	--------	d-----w-	c:\program files\Common Files\Adobe
2009-11-11 01:55 . 2006-11-02 11:18	4096	d-----w-	c:\program files\Windows Mail
2009-11-11 01:54 . 2009-11-11 01:54	0	---ha-w-	c:\windows\

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 18 · 2009-11-16T11:00:31+00:00

Update MBA-M and run a Full Scan. Have it remove all items found.
Reboot and post back with that new log.

scraddock 0 Newbie Poster · Answer 19 · 2009-11-16T11:48:30+00:00

scraddock 0 Newbie Poster

15 Years Ago

Here is the latest MBA-M log. Thanks.

mbam-log-2009-11-16_(00-45-20).txt (0.82 KB)

Malwarebytes' Anti-Malware 1.41
Database version: 3177
Windows 6.0.6002 Service Pack 2

11/16/2009 12:45:20 AM
mbam-log-2009-11-16 (00-45-20).txt

Scan type: Full Scan (C:\|)
Objects scanned: 201388
Time elapsed: 41 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 20 · 2009-11-16T12:22:53+00:00

jholland1964 650 Posting Expert

15 Years Ago

Are you still getting the redirects?

scraddock 0 Newbie Poster · Answer 21 · 2009-11-16T12:28:00+00:00

It appears that it is working properly at this time. I believe after Combofix ran it was fixed. Thank you all for your dilligent help.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 22 · 2009-11-16T21:55:15+00:00

Before you stop you have just a couple of steps you should do.
Run one more HJT scan and post the log so I can take a look at that, and if it looks ok then there are just a couple more easy things to do.
Judy

scraddock 0 Newbie Poster · Answer 23 · 2009-11-17T00:38:53+00:00

Ok. I will try to get that posted, possibly this evening. Thank you.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 24 · 2009-11-17T00:42:12+00:00

I'll wait for that final scan then give the final clean up steps. Not hard or time consuming just a couple things that should be done.
Judy

R1pperZ 0 Light Poster · Answer 25 · 2009-11-17T09:08:38+00:00

Thank you r1pperZ,
If you noticed the HJT log, you will see that I have used Malwarebytes, Spyware Doctor, SuperantiSpyware, Ad-aware, CCleaner, Spybot, Bitdefender online and Panda online and AVAST antivirus scans and the infection is still there. The HJT log posted was after I had done all the aforementioned scans.
I appreciate the help all of you can give. I have tried everything I know to remove the infection, whatever it is. Neither of the scans listed above now find anything. I did remove quite a few before this HJT log.
Please help. Thanks.

Yea I noticed that but previous scans are irrelevant if you didn't update MBa-m or ensure all other AV programs were disabled. I noticed the scan you ran yesterday was severely outdated even. But it looks like Judy got you taken care of.

jholland1964 650 Posting Expert Team Colleague Featured Poster · Answer 26 · 2009-11-17T10:27:59+00:00

Yea I noticed that but previous scans are irrelevant if you didn't update MBa-m or ensure all other AV programs were disabled. I noticed the scan you ran yesterday was severely outdated even. But it looks like Judy got you taken care of.

Yes RipperZ things are proceeding well I think. The poster posted that older MBA-M scan because we requested the original log. If you note other scans have now been run and all were up to date. By the way, there is no need to turn off anti-virus programs when running MBA-M if that was what you were talking about when you said the av hadn't been turned off. As for the online scans some require they be turned off and others do not, depends on the scan. If they require they be turned off the user will get a warning to do so and also some scans just won't run if the onboard av is enabled, so they usually know this.

Now I am just waiting for that final HJT scan to be run before giving final instructions.