Common Problem - Google redirects

MSG77 · March 22, 2013

MB caught and deleted 2 Exploit.Drop.9 files on Sat, but noticed on Mon that I'm getting redirects from Google.

Read thru some threads and seems to be similar to what a50a50 and Tigerhawk247 have posted just this week. Probably going to give me similar corrective measures.

Downloaded DDS.com but it won't let me "run as admin" when I right click it. Do I just double click it? Do I need to shut everything else down?

Also, when it says "back up files that can't be replaced", are we talking about all personal files? Like my entire documents? That is gonna take a while I think.

Any help is appreciated.

gringo_pr · March 22, 2013

Hello MSG77

Welcome to The Forums!!

Around here they call me Gringo and I'll be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I need to get some reports to get a base to start from so I need you to run these programs first.

-DeFogger-

Please download

DeFogger to your desktop.
Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

Please download DDS from one of the links below and save it to your desktop:

Download DDS and save it to your desktop

Link1
Link2
Link3

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
[*]A window will open instructing you save & post the logs
[*]Save the logs to a convenient place such as your desktop
[*]Copy the contents of both logs & post in your next reply

information and logs

In your next post I need the following

both reports from DDS
report from security check
let me know of any problems you may have had

Gringo

MSG77 · March 25, 2013

Thanks.

I was away for the weekend so couldn't get on this. Working on it now. Backing up some files and downloading files/programs per instructions.

There are a couple of users on the computer so I want to make sure they get anything they need backed up as well.

Will post logs ASAP.

gringo_pr · March 26, 2013

no problem and thank you for letting me know

gringo

MSG77 · March 26, 2013

OK, here are the logs

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16470

Run by Matthew at 16:33:14 on 2013-03-26

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2046.661 [GMT -4:00]

.

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\SLsvc.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\hp\support\hpsysdrv.exe

C:\Program Files\Symantec\Norton Online Backup\NOBuClient.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\regsvr32.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\Program Files\Southwest Airlines\Ding\Ding.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

c:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Norton Internet Security\Engine\20.3.0.36\ccSvcHst.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Norton Internet Security\Engine\20.3.0.36\ccSvcHst.exe

C:\Windows\system32\DllHost.exe

C:\hp\kbd\kbd.exe

c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://espn.go.com/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop

BHO: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll

BHO: Yahoo! Toolbar Helper: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton internet security\engine\20.3.0.36\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton internet security\engine\20.3.0.36\ips\ipsbho.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: SnagIt: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton internet security\engine\20.3.0.36\coieplg.dll

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [Temp] rundll32 "c:\users\matthew\appdata\local\apple\temp\epbrsu.dll",DiagnosisW

uRun: [Azureus] regsvr32.exe c:\users\matthew\appdata\local\azureus\mtofqpws.dll

mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide

mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe

mRun: [KBD] c:\hp\kbd\KbdStub.EXE

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [NWEReboot] <no file>

StartupFolder: c:\users\matthew\appdata\roaming\micros~1\windows\startm~1\programs\startup\ding!.lnk - c:\program files\southwest airlines\ding\Ding.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM

IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Lookup on Merriam Webster - c:\program files\iespell\Merriam Webster.HTM

IE: Lookup on Wikipedia - c:\program files\iespell\wikipedia.HTM

IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM

IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {A91DEB0D-AD0D-453E-9AC8-60178EC24212} - hxxp://video.vividas.com/media/4190_Auskick/web/player/vivid_ocx.jpeg

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{9E1E8ABE-28E1-4DC7-9745-5D6DED15B3F0} : DHCPNameServer = 192.168.1.1 192.168.1.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1403000.024\symds.sys [2013-3-13 367704]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1403000.024\symefa.sys [2013-3-13 934488]

R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_20.2.0.19\definitions\bashdefs\20130301.001\BHDrvx86.sys [2013-3-5 997464]

R1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\nis\1403000.024\ccsetx86.sys [2013-3-13 134304]

R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_20.2.0.19\definitions\ipsdefs\20130323.001\IDSvix86.sys [2013-3-25 386720]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1403000.024\ironx86.sys [2013-3-13 175264]

R1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\system32\drivers\nis\1403000.024\symtdiv.sys [2013-3-13 350368]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-17 21504]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-11 398184]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-2-12 682344]

R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\20.3.0.36\ccsvchst.exe [2013-3-13 144520]

R2 NOBU;Norton Online Backup;c:\program files\symantec\norton online backup\NOBuAgent.exe [2010-6-8 2057560]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2013-3-12 106656]

R3 hcw18bda;Hauppauge WinTV 418 Driver;c:\windows\system32\drivers\hcw18bda.sys [2009-3-19 391168]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-2-12 21104]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2013-03-26 18:08:50 7108640 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{bf5dccc1-5b1a-49f2-804b-5acdf674c5f4}\mpengine.dll

2013-03-15 20:55:38 -------- d-----w- c:\users\matthew\appdata\local\Azureus

2013-03-14 15:22:03 28600 ----a-w- c:\windows\system32\nvhdap32.dll

2013-03-14 15:22:03 154040 ----a-w- c:\windows\system32\drivers\nvhda32v.sys

2013-03-14 15:22:01 8944416 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2013-03-14 15:22:01 7964680 ----a-w- c:\windows\system32\nvcuda.dll

2013-03-14 15:22:01 6267240 ----a-w- c:\windows\system32\nvopencl.dll

2013-03-14 15:22:01 2726176 ----a-w- c:\windows\system32\nvcuvid.dll

2013-03-14 15:22:01 20534560 ----a-w- c:\windows\system32\nvoglv32.dll

2013-03-14 15:22:01 1990944 ----a-w- c:\windows\system32\nvcuvenc.dll

2013-03-14 15:22:01 17560352 ----a-w- c:\windows\system32\nvcompiler.dll

2013-03-14 15:22:01 15038296 ----a-w- c:\windows\system32\nvd3dum.dll

2013-03-14 15:22:01 12862400 ----a-w- c:\windows\system32\nvwgf2um.dll

2013-03-14 14:09:57 892704 ----a-w- c:\windows\system32\nvdispgenco3220162.dll

2013-03-14 14:09:57 1012512 ----a-w- c:\windows\system32\nvdispco3220294.dll

2013-03-13 17:41:35 350368 ----a-w- c:\windows\system32\drivers\nis\1403000.024\symtdiv.sys

2013-03-13 17:41:34 934488 ----a-w- c:\windows\system32\drivers\nis\1403000.024\symefa.sys

2013-03-13 17:41:34 367704 ----a-w- c:\windows\system32\drivers\nis\1403000.024\symds.sys

2013-03-13 17:41:34 338592 ----a-w- c:\windows\system32\drivers\nis\1403000.024\symnets.sys

2013-03-13 17:41:34 32344 ----a-w- c:\windows\system32\drivers\nis\1403000.024\srtspx.sys

2013-03-13 17:41:34 21400 ----a-r- c:\windows\system32\drivers\nis\1403000.024\symelam.sys

2013-03-13 17:41:33 602712 ----a-w- c:\windows\system32\drivers\nis\1403000.024\srtsp.sys

2013-03-13 17:41:33 175264 ----a-w- c:\windows\system32\drivers\nis\1403000.024\ironx86.sys

2013-03-13 17:41:33 134304 ----a-w- c:\windows\system32\drivers\nis\1403000.024\ccsetx86.sys

2013-03-13 17:40:59 14818 ----a-w- c:\windows\system32\drivers\nis\1403000.024\symvtcer.dat

2013-03-13 17:40:59 -------- d-----w- c:\windows\system32\drivers\nis\1403000.024

2013-03-13 17:29:45 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-02-25 01:19:10 -------- d-----w- c:\program files\iPod

2013-02-25 01:19:07 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

.

==================== Find3M ====================

.

2013-03-12 19:48:16 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-12 19:48:16 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-26 04:22:36 1017120 ----a-w- c:\windows\system32\nvdispco32.dll

2013-02-26 04:22:32 892704 ----a-w- c:\windows\system32\nvdispgenco32.dll

2013-02-10 03:20:39 2528840 ----a-w- c:\windows\system32\nvapi.dll

2013-02-10 00:35:07 4115232 ----a-w- c:\windows\system32\nvcpl.dll

2013-02-10 00:35:07 3010336 ----a-w- c:\windows\system32\nvsvc.dll

2013-02-10 00:35:03 634144 ----a-w- c:\windows\system32\nvvsvc.exe

2013-02-10 00:35:02 62752 ----a-w- c:\windows\system32\nvshext.dll

2013-02-10 00:35:02 223008 ----a-w- c:\windows\system32\nvmctray.dll

2013-02-02 03:38:35 1800704 ----a-w- c:\windows\system32\jscript9.dll

2013-02-02 03:30:32 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2013-02-02 03:30:21 1129472 ----a-w- c:\windows\system32\wininet.dll

2013-02-02 03:26:47 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2013-02-02 03:26:21 420864 ----a-w- c:\windows\system32\vbscript.dll

2013-02-02 03:23:28 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2013-01-18 14:20:08 2557728 ----a-w- c:\windows\system32\nvsvcr.dll

2013-01-17 05:28:58 232336 ------w- c:\windows\system32\MpSigStub.exe

2013-01-05 05:26:01 3602808 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-01-05 05:26:01 3550072 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-01-04 11:28:18 905576 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-01-04 01:38:50 2048512 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 16:33:53.24 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 6/4/2007 5:22:23 PM

System Uptime: 3/26/2013 4:22:36 PM (0 hours ago)

.

Motherboard: ASUSTek Computer INC. | | Basswood3G

Processor: Intel® Core2 CPU 6420 @ 2.13GHz | Socket 775 | 2133/266mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 290 GiB total, 46.613 GiB free.

D: is FIXED (NTFS) - 8 GiB total, 0.877 GiB free.

E: is CDROM ()

F: is CDROM ()

H: is Removable

I: is Removable

J: is Removable

K: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

32 Bit HP CIO Components Installer

888casino

Activation Assistant for the 2007 Microsoft Office suites

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.6)

Adobe Shockwave Player 11.6

Adobe® Photoshop® Album Starter Edition 3.2

AIO_CDB_ProductContext

AIO_CDB_Software

AIO_Scan

Apple Application Support

Apple Mobile Device Support

Apple Software Update

AutoUpdate

Bonjour

BufferChm

Copy

CustomerResearchQFolder

Destinations

DeviceManagementQFolder

DING!

DivX

DocProc

DocProcQFolder

Enhanced Multimedia Keyboard Solution

eSupportQFolder

F300

F300_Help

F300Trb

Fax

ffdshow [rev 1288] [2007-06-15]

Gmail POP Troubleshooter

Google Earth

Google Update Helper

Google Updater

Hardware Diagnostic Tools

Hewlett-Packard ACLM.NET v1.1.0.0

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HP Active Support Library

HP Active Support Library 32 bit components

HP Advisor

HP Connections (remove only)

HP Customer Experience Enhancements

HP Customer Feedback

HP Customer Participation Program 8.0

HP Easy Setup - Core

HP Easy Setup - Frontend

HP Imaging Device Functions 8.0

HP OCR Software 8.0

HP On-Screen Cap/Num/Scroll Lock Indicator

HP Photosmart Essential

HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B

HP Picasso Media Center Add-In

HP Product Detection

HP Solution Center 8.0

HPProductAssistant

HPSSupply

iCloud

ieSpell

Intel® Matrix Storage Manager

iTunes

Java Auto Updater

Java 6 Update 24

LightScribe 1.4.142.1

Malwarebytes Anti-Malware version 1.70.0.1100

MarketResearch

McAfee Security Scan Plus

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Works

MobileMe Control Panel

Move Media Player

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

muvee autoProducer 5.0

My HP Games

Nero 7 Ultra Edition

Norton Internet Security

Norton Online Backup

NVIDIA 3D Vision Controller Driver 314.07

NVIDIA Control Panel 314.07

NVIDIA Graphics Driver 314.07

NVIDIA HD Audio Driver 1.3.23.1

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX System Software 9.12.0213

NVIDIA Update 1.11.3

NVIDIA Update Components

OGA Notifier 2.0.0048.0

PetraPro

PokerStove version 1.21

Python 2.4.3

QuickTime

Realtek High Definition Audio Driver

Rhapsody Player Engine

Roxio Activation Module

Roxio Creator Audio

Roxio Creator Basic v9

Roxio Creator Copy

Roxio Creator Data

Roxio Creator EasyArchive

Roxio Creator Tools

Roxio Express Labeler 3

Roxio MyDVD Basic v9

Scan

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Shop for HP Supplies

SnagIt 8

SolutionCenter

SopCast 3.0.3

Spelling Dictionaries Support For Adobe Reader 8

Status

swMSM

Toolbox

TrayApp

TVAnts 1.0

UnloadSupport

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768024) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Veetle TV 0.9.18

VLC media player 2.0.5

VoiceOver Kit

WebReg

Winamp (remove only)

Yahoo! Toolbar

Yahoo! Toolbar for Internet Explorer

.

==== End Of File ===========================

Results of screen317's Security Check version 0.99.61

Windows Vista Service Pack 2 x86 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Norton Internet Security

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.70.0.1100

Java 6 Update 24

Java version out of Date!

Adobe Flash Player 11.6.602.180

Adobe Reader 8 Adobe Reader out of Date!

Adobe Reader 10.1.6 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

Norton ccSvcHst.exe

Windows Defender MSASCui.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

Windows Defender MSASCui.exe

Symantec Norton Online Backup NOBuClient.exe

Symantec Norton Online Backup NOBuAgent.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0 %

````````````````````End of Log``````````````````````

Computer loaded up much quicker than usual (not having to load disabled drivers?) but still getting Google redirects (because I didn't actually fix anything, just get status logs?).

gringo_pr · March 26, 2013

Hello MSG77

These are the programs I would like you to run next, if you have any problems with these just skip it and move on to the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

MSG77 · March 27, 2013

OK,

Ran AdwCleaner - no problems - here is the log

# AdwCleaner v2.115 - Logfile created 03/26/2013 at 21:11:01

# Updated 17/03/2013 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)

# User : Matthew - GAROFALO-PC

# Boot Mode : Normal

# Running from : C:\Users\Matthew\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

File Deleted : C:\Users\Public\Desktop\eBay.lnk

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Classes\S

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Key Deleted : HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Key Deleted : HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16470

[OK] Registry is clean.

*************************

AdwCleaner[s1].txt - [2489 octets] - [26/03/2013 21:11:01]

########## EOF - C:\AdwCleaner[s1].txt - [2549 octets] ##########

Ran RogueKiler, it actually generated 2 reports. Here is the 1st one -

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Matthew [Admin rights]

Mode : Scan -- Date : 03/26/2013 21:20:34

| ARK || FAK || MBR |

¤¤¤ Bad processes : 4 ¤¤¤

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll [x] -> UNLOADED

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll [x] -> UNLOADED

[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll [x] -> KILLED [TermProc]

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll [x] -> UNLOADED

¤¤¤ Registry Entries : 13 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Temp (rundll32 "C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll",DiagnosisW) [-] -> FOUND

[RUN][sUSP PATH] HKCU\[...]\Run : Azureus (regsvr32.exe C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll) [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2019752364-3093643521-3082652746-1000[...]\Run : Temp (rundll32 "C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll",DiagnosisW) [-] -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2019752364-3093643521-3082652746-1000[...]\Run : Azureus (regsvr32.exe C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll) [-] -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\f0a633f4 (C:\Windows\TEMP\4913.tmp) [x] -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\f0a633f4 (C:\Windows\TEMP\4913.tmp) [x] -> FOUND

[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> FOUND

[HJ] HKCU\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> FOUND

[HJ] HKLM\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\@ [-] --> FOUND

[ZeroAccess][FOLDER] U : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\L --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[13] : NtAlertResumeThread @ 0x832D5591 -> HOOKED (Unknown @ 0x88B37268)

SSDT[14] : NtAlertThread @ 0x8324E1F5 -> HOOKED (Unknown @ 0x88B37348)

SSDT[18] : NtAllocateVirtualMemory @ 0x8328A47D -> HOOKED (Unknown @ 0x88AB07B0)

SSDT[21] : NtAlpcConnectPort @ 0x8322C824 -> HOOKED (Unknown @ 0x88A91FB0)

SSDT[42] : NtAssignProcessToJobObject @ 0x831FFB08 -> HOOKED (Unknown @ 0x88B38558)

SSDT[67] : NtCreateMutant @ 0x832627A2 -> HOOKED (Unknown @ 0x88AFE3D0)

SSDT[77] : NtCreateSymbolicLinkObject @ 0x8320231F -> HOOKED (Unknown @ 0x88B38278)

SSDT[78] : NtCreateThread @ 0x832D3BA4 -> HOOKED (Unknown @ 0x88AB1E80)

SSDT[116] : NtDebugActiveProcess @ 0x832A6CA0 -> HOOKED (Unknown @ 0x88B38638)

SSDT[129] : NtDuplicateObject @ 0x8323A4E1 -> HOOKED (Unknown @ 0x88B21EC8)

SSDT[147] : NtFreeVirtualMemory @ 0x830C6F1D -> HOOKED (Unknown @ 0x88AAF228)

SSDT[156] : NtImpersonateAnonymousToken @ 0x831FCF15 -> HOOKED (Unknown @ 0x88B370A8)

SSDT[158] : NtImpersonateThread @ 0x8321250F -> HOOKED (Unknown @ 0x88B37188)

SSDT[165] : NtLoadDriver @ 0x831ADDEE -> HOOKED (Unknown @ 0x889C8D00)

SSDT[177] : NtMapViewOfSection @ 0x8325283A -> HOOKED (Unknown @ 0x88AAF128)

SSDT[184] : NtOpenEvent @ 0x8323BD5F -> HOOKED (Unknown @ 0x88AFE2F0)

SSDT[194] : NtOpenProcess @ 0x83262F3E -> HOOKED (Unknown @ 0x88AB1260)

SSDT[195] : NtOpenProcessToken @ 0x832439C0 -> HOOKED (Unknown @ 0x88B21E28)

SSDT[197] : NtOpenSection @ 0x8325360D -> HOOKED (Unknown @ 0x88AFE130)

SSDT[201] : NtOpenThread @ 0x8325E48F -> HOOKED (Unknown @ 0x88AAED38)

SSDT[210] : NtProtectVirtualMemory @ 0x8325C272 -> HOOKED (Unknown @ 0x88B38468)

SSDT[282] : NtResumeThread @ 0x8325DADA -> HOOKED (Unknown @ 0x88B37408)

SSDT[289] : NtSetContextThread @ 0x832D503F -> HOOKED (Unknown @ 0x88B3C288)

SSDT[305] : NtSetInformationProcess @ 0x83256868 -> HOOKED (Unknown @ 0x88B3C368)

SSDT[317] : NtSetSystemInformation @ 0x83228E9B -> HOOKED (Unknown @ 0x88AFE028)

SSDT[330] : NtSuspendProcess @ 0x832D54CB -> HOOKED (Unknown @ 0x88AFE210)

SSDT[331] : NtSuspendThread @ 0x831DC921 -> HOOKED (Unknown @ 0x88B3C0C8)

SSDT[334] : NtTerminateProcess @ 0x832330D3 -> HOOKED (Unknown @ 0x88AAE058)

SSDT[335] : unknown @ 0x8325E4C4 -> HOOKED (Unknown @ 0x88B3C1A8)

SSDT[348] : NtUnmapViewOfSection @ 0x83252AFD -> HOOKED (Unknown @ 0x88B3C008)

SSDT[358] : NtWriteVirtualMemory @ 0x8324F8CD -> HOOKED (Unknown @ 0x88AAF318)

SSDT[382] : NtCreateThreadEx @ 0x8325DF79 -> HOOKED (Unknown @ 0x88B38368)

S_SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x88FC0108)

S_SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x9A3A9F70)

S_SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x9A3A9E90)

S_SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x9A60F240)

S_SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x9A60F320)

S_SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x88B50340)

S_SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x9A3A9DA0)

S_SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x9A3A9CB0)

S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x9A3A9860)

S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x88B05180)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3320820AS +++++

--- User ---

[MBR] 45ba97c18415c4f8c58e04affb341b91

[bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : MBR Code unknown

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 297288 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 608847435 | Size: 7954 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_03262013_02d2120.txt >>

RKreport[1]_S_03262013_02d2120.txt

and here is the 2nd one -

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Matthew [Admin rights]

Mode : Remove -- Date : 03/26/2013 21:23:16

| ARK || FAK || MBR |

¤¤¤ Bad processes : 5 ¤¤¤

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll [x] -> UNLOADED

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll [x] -> UNLOADED

[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll [x] -> KILLED [TermProc]

[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll [x] -> UNLOADED

¤¤¤ Registry Entries : 11 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Temp (rundll32 "C:\Users\Matthew\AppData\Local\Apple\Temp\epbrsu.dll",DiagnosisW) [-] -> DELETED

[RUN][sUSP PATH] HKCU\[...]\Run : Azureus (regsvr32.exe C:\Users\Matthew\AppData\Local\Azureus\mtofqpws.dll) [-] -> DELETED

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\f0a633f4 (C:\Windows\TEMP\4913.tmp) [x] -> DELETED

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\f0a633f4 (C:\Windows\TEMP\4913.tmp) [x] -> DELETED

[PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX

[HJ] HKCU\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> REPLACED (1)

[HJ] HKLM\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> REPLACED (1)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\@ [-] --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\U --> REMOVED

[ZeroAccess][FOLDER] ROOT : C:\Users\Matthew\AppData\Local\{c20bfef5-181c-742d-33af-d2ea2088916f}\L --> REMOVED