Infected with search result redirect/hijack virus

kbritz · March 16, 2013

My computer is infected with some sort of web browser search result redirect/hijack virus or malware. I used Malwarebytes and Norton AV, neither have solved the problem. At first, it only effected IE when using Google search. Now it also has effected Chrome with either Google or Bing search.

In following your instructions (http://forums.malwar...?showtopic=9573), I have attached two files for your review. Please let me know if you need additional information.

attach.txt

dds.txt

gringo_pr · March 16, 2013

Hello kbritz

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

kbritz · March 16, 2013

Security Check results:

Results of screen317's Security Check version 0.99.61

Windows Vista Service Pack 2 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Norton Security Suite

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.70.0.1100

JavaFX 2.1.1

Java 7 Update 5

Java version out of Date!

Adobe Reader 10.1.6 Adobe Reader out of Date!

Google Chrome 25.0.1364.152

Google Chrome 25.0.1364.172

Google Chrome CommonDotNET.dll..

Google Chrome IdVaultCore.dll..

Google Chrome IdVaultCore.XmlSerializers.dll.

Google Chrome Microsoft.mshtml.dll.

````````Process Check: objlist.exe by Laurent````````

Norton ccSvcHst.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 2 % Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

gringo_pr · March 16, 2013

go ahead and run the other two reports and send me them at the same time

gringo

kbritz · March 16, 2013

Completed AdwCleaner - here are the results:

# AdwCleaner v2.114 - Logfile created 03/16/2013 at 12:47:59

# Updated 05/03/2013 by Xplode

# Operating system : Windows Vista Business Service Pack 2 (64 bits)

# User : <<MYNAME>>

# Boot Mode : Normal

# Running from : C:\Users\<<MYNAME>>\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\GamesBar

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16470

[OK] Registry is clean.

-\\ Google Chrome v25.0.1364.172

File : C:\Users\<<MYNAME>>\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [834 octets] - [16/03/2013 12:47:59]

########## EOF - C:\AdwCleaner[s1].txt - [893 octets] ##########

RogueKiller

I couldn't download RogueKiller because my DNS settings were screwed up and neither browser could access internet/web sites. So I downloaded RogueKiller from another PC, transferred it to the infected computer via USB drive. Ran the program and it fails repeatedly during the scan:

"Microsoft Windows: RogueKiller.exe has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available."

It stops/fails after it has found the following things on the Registry tab of the software (this is all I can see that I can type):

Status | Type | Key Type | Global

Found | SUSP PATH | RUN | HKCU

Found | SUSP PATH | RUN | KHUS

Found | | HJ SMENU | HKCU

Found | | HJ DESK | HKLM

Found | SUSP PATH | HJ INPR... | HKCR

Here are the (partial?) results from RogueKiller txt file created:

RogueKiller V8.5.3 [Mar 16 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version

Started in : Normal mode

User : <<MY NAME>>

Mode : DNSFix -- Date : 03/16/2013 13:15:07

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

Finished : << RKreport[1]_DN_03162013_02d1315.txt >>

RKreport[1]_DN_03162013_02d1315.txt

kbritz · March 16, 2013

Note also that before RogueKiller crashes, it does create a folder: RK_Quarantine.

In the folder are three files: debug, QuarantineReport, and Eula.

In the debug file, the last entries are:

[MBR] Legit : Yes -> Windows Vista MBR Code

[MBR] trying to get SPTI MBR...

There are date/time stamps in the QuarantineReport file, but no notations for files being identified/quarantined.

gringo_pr · March 16, 2013

Hello kbritz

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

kbritz · March 18, 2013

Hi there, I'm back and have had some time to work on this.

MalwareBytes

I realized there was a TXT file from MalwareBytes on my desktop, here it is:

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.03.14.04

Windows Vista Service Pack 2 x64 NTFS

Internet Explorer 9.0.8112.16421

<<MYNAME>> :: <<MYPCNAME>> [administrator]

3/13/2013 11:03:17 PM

mbam-log-2013-03-13 (23-03-17).txt

Scan type: Full scan (C:\|)

Scan options disabled: P2P

Objects scanned: 370998

Time elapsed: 45 minute(s), 5 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 9

C:\ProgramData\Microsoft\Windows\DRM\1336.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\DRM\1336.tmp.dat (Trojan.Agent.MRGGen) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\DRM\1346.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\DRM\6F1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\DRM\6F1C.tmp.dat (Trojan.Agent.MRGGen) -> Quarantined and deleted successfully.

C:\ProgramData\Microsoft\Windows\DRM\6F2C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Users\<<MYNAME>>\AppData\Local\Temp\1367.tmp (Trojan.Agent.MRGGen) -> Quarantined and deleted successfully.

C:\Users\<<MYNAME>>\AppData\Local\Temp\6F6C.tmp (Trojan.Agent.MRGGen) -> Quarantined and deleted successfully.

C:\Users\<<MYNAME>>\AppData\Local\Temp\0.9838851291753425 (Exploit.Drop.9) -> Quarantined and deleted successfully.

(end)

Combofix

WIll run this now.

kbritz · March 18, 2013

ComboFix

Ran this, and it showed that it deleted 2-3 files and a file folder. Then it rebooted my computer. I waited 20 minutes after the computer rebooted and nothing happened and no TXT file was created on my desktop. After waiting for a long time, I ran Task Manager and no applications were running, and no processes were running that aren't typically running. I tried re-running ComboFix and it just provided a message saying it was preparing to run, but nothing happened after 20 min or so. So I rebooted computer again. Still no text file or report.

Current Situation

My computer seems slower to boot up. I still have the browser search redirect problem. That has not gone away.

gringo_pr · March 18, 2013

Hello kbritz

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
If the forum still complains about it being to long send me everything that is at the end of the report after where it says
==================
Scan finished
==================

and I will see if I want to see the whole report

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit

2.Unzip the contents to a folder in a convenient location.

3.Open the folder where the contents were unzipped and run mbar.exe

4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6.Wait while the system shuts down and the cleanup process is performed.

7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

•Internet access
•Windows Update
•Windows Firewall

9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.

10.Verify that your system is now functioning normally.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and MBAR

Gringo

kbritz · March 18, 2013

TDSSKiller

See attached for full file.

20:46:59.0021 5932 ============================================================

20:46:59.0021 5932 Scan finished

20:46:59.0021 5932 ============================================================

20:46:59.0037 5100 Detected object count: 8

20:46:59.0037 5100 Actual detected object count: 8

20:48:31.0000 5100 ADMonitor ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 ADMonitor ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 DMAgent ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 DMAgent ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 dtsvc ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 dtsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 SUService ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 TVT Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 TVT Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 USBAAPL64 ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 USBAAPL64 ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:48:31.0000 5100 WiMAXAppSrv ( UnsignedFile.Multi.Generic ) - skipped by user

20:48:31.0000 5100 WiMAXAppSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

TDSSKiller.txt

kbritz · March 18, 2013

working on mbar now...

kbritz · March 18, 2013

mbar: "No Malware Threats Found"

kbritz · March 18, 2013

Confirmed that I'm still getting redirects.

gringo_pr · March 18, 2013

Hello kbritz,

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

kbritz · March 18, 2013

One other thing... where before I was getting redirects first with IE and then later with Chrome, now I'm not getting redirects with IE, but still getting them with Chrome. Confirmed with multiple search engines on both browsers.

Thank you for the additional information/request. I'll start working on that.

kbritz · March 18, 2013

Oh, forgot to tell you this one. As soon as I started up MBAR, the following message was instantly displayed. See attached.

gringo_pr · March 18, 2013

OK I would like to see if we can get Combofix to run as it will give me more info on that error - I do not see anything about it in the other reports yet

gringo

kbritz · March 18, 2013

Combofix

Note that in safe mode it mentioned a number of procedures it could not complete without administrator rights. Also, the computer did not reboot during the full operation.

ComboFix 13-03-17.01 - <<MyName>> 03/17/2013 22:11:05.2.2 - x64 MINIMAL

Microsoft® Windows Vista™ Business 6.0.6002.2.1252.1.1033.18.3991.3341 [GMT -7:00]

Running from: c:\users\<<MyName>>\Desktop\ComboFix.exe

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\programdata\Roaming

c:\users\KERRIC~1\AppData\Local\Temp\Farmington Tales\llgzq.dll

c:\users\<<MyName>>\AppData\Local\Temp\Farmington Tales\llgzq.dll

.

((((((((((((((((((((((((( Files Created from 2013-02-18 to 2013-03-18 )))))))))))))))))))))))))))))))

.

2013-03-18 05:20 . 2013-03-18 05:20 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-03-18 01:05 . 2013-03-18 01:05 -------- d-----w- c:\program files\mbar

2013-03-16 20:13 . 2013-03-16 20:32 -------- d-----w- c:\users\<<MyName>>\AppData\Local\CrashDumps

2013-03-16 19:48 . 2013-03-16 19:48 99 ----a-w- c:\windows\DeleteOnReboot.bat

2013-03-14 15:44 . 2013-03-14 15:44 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

2013-03-14 14:42 . 2012-08-09 01:50 43680 ----a-r- c:\windows\system32\drivers\SymIMV.sys

2013-03-14 14:26 . 2013-03-14 14:26 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2013-03-14 14:26 . 2013-03-14 14:26 -------- d-----w- c:\program files\Symantec

2013-03-14 14:26 . 2013-03-14 14:26 -------- d-----w- c:\program files\Common Files\Symantec Shared

2013-03-14 14:25 . 2013-03-14 14:54 -------- d-----w- c:\windows\system32\drivers\N360x64

2013-03-14 14:25 . 2013-03-14 14:25 -------- d-----w- c:\program files (x86)\Norton Security Suite

2013-03-14 14:23 . 2013-03-14 14:23 -------- d-----w- c:\program files (x86)\NortonInstaller

2013-03-14 07:27 . 2013-03-14 14:27 -------- d-----w- c:\programdata\Norton

2013-03-14 07:19 . 2013-03-14 07:19 -------- d-----w- c:\programdata\IsolatedStorage

2013-03-14 07:19 . 2013-03-14 14:52 -------- d-----w- c:\users\<<MyName>>\AppData\Local\ID Vault

2013-03-14 07:19 . 2013-03-14 07:19 -------- d-----w- c:\users\<<MyName>>\AppData\Local\White_Sky,_Inc

2013-03-14 07:18 . 2013-03-18 04:30 -------- d-----w- c:\users\<<MyName>>\AppData\Roaming\ID Vault

2013-03-14 07:18 . 2013-03-14 07:18 -------- d-----w- c:\program files (x86)\KeyCryptSDK

2013-03-14 07:18 . 2013-02-14 00:05 25784 ----a-w- c:\windows\system32\drivers\KeyCrypt64.sys

2013-03-14 07:18 . 2013-03-14 07:18 -------- d-----w- c:\windows\SysWow64\ZALSDK_uninst

2013-03-14 07:18 . 2013-03-14 07:18 45968 ----a-w- c:\windows\system32\drivers\AntiLog64.sys

2013-03-14 07:18 . 2013-02-14 00:05 7520056 ----a-w- c:\windows\SysWow64\ZALSDKCore.dll

2013-03-14 07:18 . 2013-03-14 07:18 -------- d-----w- c:\users\<<MyName>>\AppData\Local\Zemana

2013-03-14 07:18 . 2013-03-14 07:19 -------- d-----w- c:\program files (x86)\Constant Guard Protection Suite

2013-03-14 07:17 . 2013-03-14 07:17 -------- d-----w- c:\programdata\White Sky, Inc

2013-03-14 07:01 . 2013-03-14 07:01 -------- d-----w- c:\users\<<MyName>>\Favorites - Copy

2013-03-14 06:02 . 2013-03-14 06:02 -------- d-----w- c:\users\<<MyName>>\AppData\Roaming\Malwarebytes

2013-03-14 06:02 . 2013-03-14 06:02 -------- d-----w- c:\programdata\Malwarebytes

2013-03-14 06:02 . 2013-03-14 06:02 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-03-14 06:02 . 2012-12-14 23:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-13 22:26 . 2013-02-12 02:18 19456 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-03-13 01:55 . 2013-03-13 01:55 -------- d-----w- c:\program files\iPod

2013-03-13 01:55 . 2013-03-13 01:55 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-03-13 01:55 . 2013-03-13 01:55 -------- d-----w- c:\program files\iTunes

2013-03-09 03:38 . 2013-03-13 10:23 -------- d-----w- c:\program files (x86)\Microsoft Silverlight

2013-03-05 03:24 . 2013-03-05 03:25 -------- d-----w- c:\program files (x86)\Grim Facade Cost of Jealousy Collectors Edition

2013-02-20 03:19 . 2013-02-20 03:21 -------- d-----w- c:\program files (x86)\Grim Tales - The Stone Queen

2013-02-19 21:50 . 2013-02-19 21:50 -------- d-----w- c:\program files (x86)\GamesBar

2013-02-19 21:49 . 2013-02-19 21:49 -------- d-----w- c:\programdata\Oberon Media

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-13 10:04 . 2006-11-02 12:35 72013344 ----a-w- c:\windows\system32\mrt.exe

2013-03-12 23:04 . 2012-07-12 02:36 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-03-12 23:04 . 2012-07-12 02:36 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-01-22 13:12 . 2013-02-13 16:14 4681592 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-01-04 11:31 . 2013-02-13 16:14 1423720 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-01-04 01:59 . 2013-02-13 16:14 2773504 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"TVT Scheduler Proxy"="c:\program files (x86)\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]

"EZEJMNAP"="c:\progra~2\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2009-12-01 256576]

"RotateImage"="c:\program files (x86)\RotateImage\RCIMGDIR.exe" [2008-10-30 55808]

"EEventManager"="c:\progra~2\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

.

c:\users\<<MyName>>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2013-1-8 228448]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2011-1-24 1090848]

Constant Guard.lnk - c:\program files (x86)\Constant Guard Protection Suite\IDVault.exe [2013-2-21 3991080]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"DisableCAD"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~2\KEYCRY~1\KEYCRY~3.DLL

.

R3 5U875UVC;Integrated Camera;c:\windows\system32\DRIVERS\RCUVCMNP.sys [2009-10-23 220032]

R3 ADMonitor;AD Monitor;c:\windows\system32\ADMonitor.exe [2010-02-05 130048]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - ECACHE

.

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

Themes

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-14 10:02 1629648 ----a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.172\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-18 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 23:04]

.

2013-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-14 03:42]

.

2013-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-14 03:42]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]

@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"

[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]

2013-01-24 07:48 482144 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]

@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"

[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]

2013-01-24 07:48 482144 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]

@="{A759AFF6-5851-457D-A540-F4ECED148351}"

[HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]

2013-01-24 07:48 482144 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]

@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"

[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]

2013-01-24 07:48 482144 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"FingerPrintSoftware"="c:\program files\Lenovo Fingerprint Software\fpapp.exe \s" [X]

"FingerPrintSoftwareSplashScreen"="c:\program files\Lenovo Fingerprint Software\SplashScreen.exe \s" [X]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-04-01 153624]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-04-01 225816]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-04-01 200216]

"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]

"IaNvSrv"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2009-10-06 33304]

"TpShocks"="TpShocks.exe" [2012-02-25 382528]

"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-04-28 307768]

"picon"="c:\program files (x86)\Common Files\Intel\Privacy Icon\PIconStartup.exe" [2010-02-04 111640]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.seattletimes.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Send image to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-70289207.sys

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]

@Denied: (A 2) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]

@="Shockwave Flash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]

@Denied: (A 2) (Everyone)

@=""

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

@="FlashBroker"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]

"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2013-03-17 22:22:59

ComboFix-quarantined-files.txt 2013-03-18 05:22

.

Pre-Run: 70,613,409,792 bytes free

Post-Run: 70,459,510,784 bytes free

.

- - End Of File - - 0090E9AFC3864FB7A8A5A10BC646020B

kbritz · March 18, 2013

Update on how computer is working: IE searches work fine, but Chrome searches still have redirects.

gringo_pr · March 18, 2013

Hello kbritz

We need to reset Chrome back to defaults to completely clear out what is going on.

We can keep the bookmarks by exporting them - Export Bookmarks

Then I need you to go Google Sync and sign into your account

scroll down untill you see the "Stop and Clear" button and click on button

At the prompt click on "Ok"

Now we need to uninstall chrome

I want you to uninstall Chrome and if asked about user data or settings then remove this also

restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome

After you have Chrome reinstalled please check things out and let me know how it is doing.

Gringo

kbritz · March 18, 2013

Thank you Gringo. I haven't started this yet. Question: I don't believe I have bookmarks or sign in to Google Sync through Chrome. I use Chrome only as a backup browser. I assume it's okay to skip those steps?

gringo_pr · March 19, 2013

if you do not use it then skip it

kbritz · March 19, 2013

I reinstalled Chrome and it now seems to be working correctly. Thanks, I really appreciate your help. I will make a donation now!

gringo_pr · March 19, 2013

Hello

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)

Programs to remove
- Adobe Reader X (10.1.6)
  Java 7 Update 5
  Java 7 Update 5 (64-bit)
  JavaFX 2.1.1

Please download and install

Revo Uninstaller FreeDouble click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Update Adobe reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.
You can download it from

http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from

here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, be careful not to install anything to do with AskBar.

Clean Out Temp Files

This small application you may want to keep and use once a week to keep the computer clean.
Download CCleaner from here http://www.ccleaner.com/
- Run the installer to install the application.
- When it gives you the option to install Yahoo toolbar uncheck the box next to it.
- Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
- Click Run Cleaner.
- Close CCleaner.

: Malwarebytes' Anti-Malware :

I see You have MBAM installed on the computer - that is great!! it is a very good program! I would like you to run a quick scan for me now

Double-click mbam icon
go to the update tab at the top
click on check for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidentally close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

Click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

Go Here to download HijackThis program
Save HijackThis to your desktop.
Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
copy and paste hijackthis report into the topic

"information and logs"

In your next post I need the following

Log From MBAM
report from Hijackthis
let me know of any problems you may have had
How is the computer doing now?

Gringo

Infected with search result redirect/hijack virus

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information