Systemfix/Browser Hijack Issue

[Juddy]

Yesterday I discovered that I was infected with 'SystemFix' which through the use of Malware Bytes I have been, mostly I believe, able to clean. I am, however, still experiencing browser hijacking issues from google search results.

Any help that anyone can provide would be greatly appreciated.

Attach.txt

DDS.txt

[D-FRED-BROWN]

Hello Juddy and welcome to Malwarebytes!

I apologize for the delay.

I am D-FRED-BROWN and I will be helping you.

Please print or save this topic: it will make it easier for you to follow the instructions and complete all of the necessary steps.

-------------

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:

1) Run Spybot-S&D

2) Go to the Mode menu, and make sure Advanced Mode is selected

3) On the left hand side, choose Tools -> Resident

4) Uncheck Resident TeaTimer and OK any prompts

You can re-enable TeaTimer once your system is clean.

-------------

Please download to your Desktop:

• TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

• Click on the Start Scan button and wait for the scan and disinfection process to be over.
  
• If an infected file is detected, the default action will be Cure, click on Continue
  
• If a suspicious file is detected, the default action will be Skip, click on Continue
  
• If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
  
• If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.
  

In your next reply, please include the following (you may need to use two posts to get it all in):

• TDSSKiller_log.txt

how the PC is running now?
-------------
Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
***IMPORTANT: save ComboFix to your Desktop***
* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Please go here to see a list of programs that should be disabled.
**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**
Please include the C:\ComboFix.txt in your next reply for further review.
Also, please let me know if any problems still remain.
-------------
Please download Security Check by screen317 from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-------------

In your next reply, please include:

• TDSSKiller report
  
• C:\ComboFix.txt
  
• checkup.txt

How is your computer running now?

[Juddy]

I ran, or attempted to run all of those programs. I was unable, however, to run TDSSKiller - it would appear in my process list and then immediately disappear. This happened in safe mode, 'normal' mode, when i changed the name of the file and when I attempted to start it through the cmd prompt.

The other two programs ran without issue, as far as how my computer is running I'd say it is running more or less as normal save for the google redirects. I have noticed my internet has timed out a few times when I've attempted google searches - not sure if this would be related.

Thank you for the help

checkup.txt

log.txt

[D-FRED-BROWN]

We have some more to do.

First,

Please do the following:

• Please download aswMBR.exe from here and save it to your Desktop.
  
• Double click aswMBR.exe to start the tool. (Vista - Win 7 Rt click to run as Administrator)
  
• Click Scan
  
• Upon completion of the scan, click Save log and save it to your Desktop, and post that log in your next reply. Do NOT attempt any Fix at this time!
  
• This will also create a file on your Desktop named MBR.dat. Right click that file and select Send To->Compressed (zipped) folder. Attach that zipped folder in your next reply as well.

NOTE: The AVAST! scan is not necessary.

------

Please do the following:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KILLALL::

Driver::

X6va005

File::

c:\users\George\AppData\Local\Temp\0056788.tmp

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I shall require in your next reply.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please include the newly-created C:\ComboFix.txt in your next reply, and let me know how things are running now

[Juddy]

aswMBR.exe would not run, the same issue as with TDSSKiller it would appear in the task list then immediately vanish.. My computer is running much in the same manner as it as previously - google redirects still happening.

[D-FRED-BROWN]

Please continue with the ComboFix script procedure.

[Juddy]

Please continue with the ComboFix script procedure.

My apologies the upload of the text file failed, and continues to do so.

ComboFix 11-12-04.04 - George 05/12/2011 1:28.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.4085.2961 [GMT 0:00]

Running from: c:\users\George\Desktop\combofix.com

Command switches used :: c:\users\George\Desktop\CFscript.txt

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

FILE ::

"c:\users\George\AppData\Local\Temp\0056788.tmp"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_X6VA005

-------\Service_X6va005

.

.

((((((((((((((((((((((((( Files Created from 2011-11-05 to 2011-12-05 )))))))))))))))))))))))))))))))

.

.

2011-12-05 01:56 . 2011-12-05 01:56 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-03 15:12 . 2011-12-03 15:12 -------- d-----w- c:\program files (x86)\Bazooka Scanner

2011-12-03 15:03 . 2011-12-03 15:03 -------- d-----w- c:\program files (x86)\Common Files\iS3

2011-12-02 18:35 . 2011-12-02 20:29 -------- d-----w- c:\programdata\PC Tools

2011-12-02 16:18 . 2011-12-02 16:18 12872 ----a-w- c:\windows\system32\bootdelete.exe

2011-12-02 16:07 . 2011-12-02 16:07 25160 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-12-02 16:05 . 2011-12-02 16:18 -------- d-----w- c:\programdata\Hitman Pro

2011-12-02 14:10 . 2011-12-02 14:10 -------- d-----w- c:\users\George\AppData\Roaming\Malwarebytes

2011-12-02 14:09 . 2011-12-02 14:09 -------- d-----w- c:\programdata\Malwarebytes

2011-12-02 14:09 . 2011-12-02 14:09 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2011-12-02 13:53 . 2011-12-02 13:53 -------- d-----w- c:\program files\New folder (2)

2011-12-02 13:53 . 2011-12-02 13:53 -------- d-----w- c:\program files\New folder

2011-11-19 19:08 . 2011-11-19 19:08 -------- d-----w- c:\programdata\SplitMediaLabs

2011-11-19 19:08 . 2011-11-19 19:08 -------- d-----w- c:\program files (x86)\SplitMediaLabs

2011-11-19 19:08 . 2011-11-19 19:08 -------- d-----w- c:\users\George\AppData\Roaming\SplitMediaLabs

2011-11-15 01:34 . 2011-11-15 01:34 -------- d-----w- c:\programdata\Sling Media

2011-11-15 01:34 . 2011-11-15 01:34 -------- d-----w- c:\program files (x86)\Sling Media

2011-11-15 01:33 . 2011-11-15 01:33 -------- d-----w- c:\windows\Downloaded Installations

2011-11-13 14:49 . 2011-11-13 15:05 -------- d-----w- c:\users\George\AppData\Roaming\Mumble

2011-11-13 14:49 . 2011-11-13 14:49 -------- d-----w- c:\users\George\AppData\Local\Mumble

2011-11-13 14:49 . 2011-11-13 14:49 -------- d-----w- c:\program files (x86)\Mumble

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

((((((((((((((((((((((((((((( SnapShot@2011-12-04_04.38.05 )))))))))))))))))))))))))))))))))))))))))

.

- 2011-07-06 07:09 . 2011-12-03 16:28 37802 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2011-07-06 07:09 . 2011-12-04 17:59 37802 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin

- 2011-07-05 21:20 . 2011-12-03 23:14 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-07-05 21:20 . 2011-12-05 01:58 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2011-12-02 13:39 . 2011-12-05 01:59 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

- 2011-12-02 13:39 . 2011-12-03 23:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat

- 2011-12-02 13:39 . 2011-12-03 23:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat

+ 2011-12-02 13:39 . 2011-12-05 01:59 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat

- 2011-12-02 13:39 . 2011-12-03 23:13 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat

+ 2011-12-02 13:39 . 2011-12-05 01:59 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat

+ 2011-07-05 21:20 . 2011-12-05 01:59 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

- 2011-07-05 21:20 . 2011-12-03 23:13 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2011-07-05 21:20 . 2011-12-05 01:58 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-07-05 21:20 . 2011-12-03 23:14 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2011-07-05 21:20 . 2011-12-05 01:59 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-07-05 21:20 . 2011-12-04 04:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2011-07-05 21:20 . 2011-12-04 04:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2011-07-05 21:20 . 2011-12-05 01:59 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2011-12-03 16:26 . 2011-12-03 23:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-12-05 01:58 . 2011-12-05 01:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2011-12-03 16:26 . 2011-12-03 23:13 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2011-12-05 01:58 . 2011-12-05 01:58 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2009-07-14 02:36 . 2011-12-04 18:03 622546 c:\windows\system32\perfh009.dat

- 2009-07-14 02:36 . 2011-12-03 23:19 622546 c:\windows\system32\perfh009.dat

+ 2009-07-14 02:36 . 2011-12-04 18:03 108636 c:\windows\system32\perfc009.dat

- 2009-07-14 02:36 . 2011-12-03 23:19 108636 c:\windows\system32\perfc009.dat

- 2011-07-05 23:28 . 2011-12-03 01:35 227400 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

+ 2011-07-05 23:28 . 2011-12-05 01:57 227400 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat

- 2009-07-14 05:01 . 2011-12-03 01:35 390244 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2011-12-05 01:57 390244 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2011-07-05 23:28 . 2011-12-05 01:57 25082976 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-882173175-4276709039-3924744135-1001-12288.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]

"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2011-07-09 3077528]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-24 336384]

"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-01 190808]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-06-07 421160]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux4"=wdmaud.drv

.

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

R3 atillk64;atillk64;c:\program files (x86)\AMD GPU Clock Tool\atillk64.sys [x]

R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys [x]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x64.sys [x]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 SlingAgentService;SlingAgentService;c:\program files (x86)\Sling Media\SlingAgent\SlingAgentService.exe [2010-11-03 94024]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AmdTools64;AMD Special Tools Driver;c:\windows\system32\DRIVERS\AmdTools64.sys [x]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]

S3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-882173175-4276709039-3924744135-1001Core.job

- c:\users\George\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 19:22]

.

2011-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-882173175-4276709039-3924744135-1001UA.job

- c:\users\George\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-05 19:22]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"combofix"="c:\combofix\CF24054.3XE" [2009-07-14 344576]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 194.74.65.69 62.6.40.178

FF - ProfilePath - c:\users\George\AppData\Roaming\Mozilla\Firefox\Profiles\11pj71iv.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=

FF - prefs.js: network.proxy.ftp - 127.0.0.1

FF - prefs.js: network.proxy.ftp_port - 3128

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 3128

FF - prefs.js: network.proxy.socks - 127.0.0.1

FF - prefs.js: network.proxy.socks_port - 3128

FF - prefs.js: network.proxy.ssl - 127.0.0.1

FF - prefs.js: network.proxy.ssl_port - 3128

FF - prefs.js: network.proxy.type - 0

FF - user.js: network.protocol-handler.warn-external.dnupdate - false

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

c:\program files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe

c:\program files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe

.

**************************************************************************

.

Completion time: 2011-12-05 02:17:51 - machine was rebooted

ComboFix-quarantined-files.txt 2011-12-05 02:17

ComboFix2.txt 2011-12-04 04:55

.

Pre-Run: 154,626,174,976 bytes free

Post-Run: 154,282,500,096 bytes free

.

- - End Of File - - 6B842A703A329DAF4052EB9F95FC56DF

[D-FRED-BROWN]

Please try the following. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer

• Insert your USB drive
  
• Press Start > My Computer > right click your USB drive > choose Format > Quick format
  
• Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  
• Press Run then OK
  
• It will install a little bootable OS on your USB
  
• After it has completed do not choose to reboot the clean computer simply close the installer
  
• Remove the USB and insert it in the sick computer
  
• Boot the Sick computer
  
• Press F12 and choose to boot from the USB
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type in: dd if=/dev/sda of=MBRbackup.zip bs=512 count=1 and hit Enter.
  

MBRbackup.zip should be created on your flash drive, please attach it to your next reply.

[Juddy]

Please try the following. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer

• Insert your USB drive
  
• Press Start > My Computer > right click your USB drive > choose Format > Quick format
  
• Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  
• Press Run then OK
  
• It will install a little bootable OS on your USB
  
• After it has completed do not choose to reboot the clean computer simply close the installer
  
• Remove the USB and insert it in the sick computer
  
• Boot the Sick computer
  
• Press F12 and choose to boot from the USB
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type in: dd if=/dev/sda of=MBRbackup.zip bs=512 count=1 and hit Enter.
  

MBRbackup.zip should be created on your flash drive, please attach it to your next reply.

k

I lack a flash drive, is there any alternative step?

[D-FRED-BROWN]

No worries, let's try this:

Please print out these instructions or copy them to a Notepad file for an easier reading and download MBRCheck by a_d_13 to your Desktop from one of these locations:

http://ad13.geekstogo.com/MBRCheck.exe

http://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe

http://www.kernelmode.info/MBRCheck.exe

Close all opened programs/ windows and double-click on MBRCheck.exe.

It will produce a log file saved automatically on your Desktop as "MBRCheck_[Date]_[Time].txt".

Press the "Enter" key to close the MBRCheck window and post the contents of the log file.

[Juddy]

As requested the MBRCheck text file. Thank you for your continued assistance.

[Juddy]

I fail

MBRCheck_12.06.11_23.33.06.txt

[D-FRED-BROWN]

I fail

Happens to all of us

Let's try the following :

Step 1

Run MBRCheck.exe once again.

You will be presented with the following dialog:

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Enter Y and press Enter.

The following dialog will be presented:

Options:

[1] Dump the MBR of a physical disk to file.

[2] Restore the MBR of a physical disk with a standard boot code.

[3] Exit.

Enter your choice:

Enter 1 and press Enter

The following dialog will be presented:

Enter the physical disk number to fix (0-99, -1 to cancel):

Enter 0 (zero) and press Enter

The following dialog will be presented:

Enter filename to dump to:

Type mbr-dump.dat and press Enter

The following dialog will be presented:

Dumped successfully!

Enter the physical disk to dump (0-99, -1 to exit):

Enter -1 and press Enter

And last the following dialog will be presented:

Done! Press ENTER to exit...

Press Enter.

A file mbr-dump.dat will be produced on the desktop. Now you have to compress this file:

• Right click on it
  
• Navigate and select Send to
  
• Then navigate and select Compressed (zipped) Folder
  
• A file mbr-dump.zip will be produced on the desktop

Please attach this file (mbr-dump.zip) in your next reply.

[Juddy]

Attached first time, what a surprise.

mbr-dump.zip

[D-FRED-BROWN]

Please download GetPartitions from the link bellow. You must right click on the link and choose Save as.... Save it as GetPartitions.bat on your desktop

getpartitions.bat

Right-click + Run as Administrator it to run it.

It will produce DiskReport.txt log please post results from that log here to me.(Should be located at C:\DiskReport.txt)

[Juddy]

Please download GetPartitions from the link bellow. You must right click on the link and choose Save as.... Save it as GetPartitions.bat on your desktop

getpartitions.bat

Right-click + Run as Administrator it to run it.

It will produce DiskReport.txt log please post results from that log here to me.(Should be located at C:\DiskReport.txt)

That's done and uploaded. I have to go to sleep now thanks again. Hopefully we can make more progress over the coming days!!

DiskReport.txt

[D-FRED-BROWN]

That's done and uploaded. I have to go to sleep now thanks again. Hopefully we can make more progress over the coming days!!

Cheers. I wish you a good night I will post my next instructions below.

[D-FRED-BROWN]

If possible, please try to get a flash drive from a friend or family member... we may need it at some point.

Please do the following:

1. Please download the following files. They need to be saved to the C:\ drive (ex: C:\newMBR.bin)

• MBRFix64.exe http://www.sendspace.com/file/wyfnpl
  
• newMBR.bin http://www.sendspace.com/file/0kyb3d

2. Please create a new restore point:

http://windows.microsoft.com/en-US/windows7/Create-a-restore-point

3. Now let's move on to the third part:

On Vista or Windows 7: Now please enter System Recovery Options.

This time, select Command Prompt.

In the Command Prompt window, please type the following (in bold):

MbrFix64 /drive 0 restorembr newMBR.bin

Then, press Enter.

Next, type exit and press Enter.

Reboot the computer. Let me know how things go.

[Juddy]

If possible, please try to get a flash drive from a friend or family member... we may need it at some point.

Please do the following:

1. Please download the following files. They need to be saved to the C:\ drive (ex: C:\newMBR.bin)

• MBRFix64.exe http://www.sendspace.com/file/wyfnpl
  
• newMBR.bin http://www.sendspace.com/file/0kyb3d

2. Please create a new restore point:

http://windows.microsoft.com/en-US/windows7/Create-a-restore-point

3. Now let's move on to the third part:

On Vista or Windows 7: Now please enter System Recovery Options.

This time, select Command Prompt.

In the Command Prompt window, please type the following (in bold):

MbrFix64 /drive 0 restorembr newMBR.bin

Then, press Enter.

Next, type exit and press Enter.

Reboot the computer. Let me know how things go.

I'm geting a 1117 error - Failure due to I/O device error. I don't have a flash drive yet but I'm working on getting one, is there anything else that can be tried in the mean time?

[D-FRED-BROWN]

When exactly are you getting the error during the procedure?

[Juddy]

When exactly are you getting the error during the procedure?

After entering the string into the cmd prompt when asked Y/N - if I type Y. If I was not meant to do this however I did type exit in a secondary attempt without typing Y or N and rebooted. I haven't experienced a redirect since this although my sample size is still quite small.

[D-FRED-BROWN]

The fact that you are no longer getting redirects is a sign of great progress. Let's run some tests to confirm that progress :

Please refer to my instructions for running MBRCheck in this post: http://forums.malwarebytes.org/index.php?showtopic=101122&view=findpost&p=502061

After that, please follow these instructions for creating and uploading and MBR dump http://forums.malwarebytes.org/index.php?showtopic=101122&view=findpost&p=502066

Please include both the new MBRcheck log & the new MBR dump in your next post. Let me know how everything goes.

[Juddy]

I've attached the new results from those two steps.

mbr-dump.zip

MBRCheck_12.08.11_00.22.46.txt

[D-FRED-BROWN]

See if you can run aswMBR:

Please do the following:

• Please download aswMBR.exe from here and save it to your Desktop.
  
• Double click aswMBR.exe to start the tool. (Vista - Win 7 Rt click to run as Administrator)
  
• Click Scan
  
• Upon completion of the scan, click Save log and save it to your Desktop, and post that log in your next reply. Do NOT attempt any Fix at this time!
  
• This will also create a file on your Desktop named MBR.dat. Right click that file and select Send To->Compressed (zipped) folder. Attach that zipped folder in your next reply as well.

[Juddy]

See if you can run aswMBR:

Please do the following:

• Please download aswMBR.exe from here and save it to your Desktop.
  
• Double click aswMBR.exe to start the tool. (Vista - Win 7 Rt click to run as Administrator)
  
• Click Scan
  
• Upon completion of the scan, click Save log and save it to your Desktop, and post that log in your next reply. Do NOT attempt any Fix at this time!
  
• This will also create a file on your Desktop named MBR.dat. Right click that file and select Send To->Compressed (zipped) folder. Attach that zipped folder in your next reply as well.

That program still won't run