IE gets redirected elsewhere

[yuppicide]

Guy in my warehouse got a some spyware/trojan today.

Antimalware Doctor popped up. So, since I'm the most tech savvy one in the office I do the work of trying to fix it.

Also had some crap called simcore070700 or something and some kind of framework program that popped up next to the clock as well, and when rebooted something popped up trying to send a crapload of emails advertising a service for sale!

We have Norton Antirivus Coroporate running off our server and that stopped the emails since they were being sent too fast.

As I stand now here's what I did:

- Ran Notron Antivirus Corporate. It didn't find anything.

- Ran Malwarebytes and it found 13 items. Some were just tracking cookies, but I removed them all.

- I manually went through and deleted some files as well that I found off Bleeping Computer's website related to this and also cleaned up some entries in the registry related to these programs to get them out and to get them removed from that Startup List in MSCONFIG.

- I also ran Spyware Blaster, as well as Spybot Search & Search and Destro. Spybot came up clean.

- I removed a few entries in HiJackThis and I think everything in there is fine.. I can identify what belongs to what I think.

I only have one problem, and the fact that it's still there bothers or worries me.

The computer starts up fine, I don't get the Antimalware Doctor popup anymore, I don't get that framework thing.

My only problem (as far as I can see) is Internet Explorer searches are slower than before and some of my searches are being redirected to various websites. I can't search for "spyware forum" or "malwarebytes" or "bleepingcomputer" from that computer.. the searches get redirected. Typing something like "ebay.com" or "yahoo.com" works, though.

Any ideas what to try now?

I'll be happy to post a new HiJackThis log if wanted and anything else suggested.

[MrCharlie]

Is this a business/Coroporate computer? MrC

[yuppicide]

By you asking that I just went and looked around this website.. I see use in a corporate environment requires an annual license. I'm guessing nothing is free. I was just following instructions from Bleeping Computer. Guess I'll uninstall the program and go ask for help elsewhere. Thanks.

[MrCharlie]

I didn't say I wouldn't help you, I just asked if this was a business computer or a personal computer.

No one charges for help here, as you stated the "Use of Malwarebytes in a corporate environment requires a license".

MrC

[yuppicide]

Understood. I didn't see the notice. I've used the program at home in the past, but getting the office to pay for anything is like pulling teeth. I'm on some ancient almost 10 year old computer doing graphic editing among other things.

Anyway, I'll run just about whatever you need as long as it's free. I have HiJack This already, have administrator rights too.

[MrCharlie]

So this computer has important files on it?

Do you have everything backed up in case something goes wrong?

----------------------

Please do this:

Download TDSSKiller to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Start Scan.

Don't Change These Settings:

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

You may be asked you to reboot the computer to complete the process. Click on Reboot Now

To view the report:

Click the Report button and copy/paste the contents of it into your next reply.

Note:It will also create a log in the C:\ directory.

MrC

[yuppicide]

I will run that shortly.. I do not believe the computer has anything important.. our emails are saved on the server.

I was just trying to avoid a full format and reinstall because with updates, then installing Office, UPS, Stamps.com, etc, it'll take hours.

[yuppicide]

Hi there... nothing suspicious found, but here's the log file anyway.

2010/10/07 09:05:40.0336 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59

2010/10/07 09:05:40.0336 ================================================================================

2010/10/07 09:05:40.0336 SystemInfo:

2010/10/07 09:05:40.0336

2010/10/07 09:05:40.0336 OS Version: 5.1.2600 ServicePack: 3.0

2010/10/07 09:05:40.0336 Product type: Workstation

2010/10/07 09:05:40.0336 ComputerName: ASIMUKAI-9YTGV4

2010/10/07 09:05:40.0336 UserName: asimukaitis

2010/10/07 09:05:40.0336 Windows directory: C:\WINDOWS

2010/10/07 09:05:40.0336 System windows directory: C:\WINDOWS

2010/10/07 09:05:40.0336 Processor architecture: Intel x86

2010/10/07 09:05:40.0336 Number of processors: 1

2010/10/07 09:05:40.0336 Page size: 0x1000

2010/10/07 09:05:40.0336 Boot type: Normal boot

2010/10/07 09:05:40.0336 ================================================================================

2010/10/07 09:05:40.0544 Initialize success

2010/10/07 09:05:42.0099 ================================================================================

2010/10/07 09:05:42.0099 Scan started

2010/10/07 09:05:42.0099 Mode: Manual;

2010/10/07 09:05:42.0099 ================================================================================

2010/10/07 09:05:43.0211 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2010/10/07 09:05:43.0299 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2010/10/07 09:05:43.0418 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2010/10/07 09:05:43.0462 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

2010/10/07 09:05:43.0922 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2010/10/07 09:05:43.0966 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2010/10/07 09:05:44.0099 ati2mpaa (9027ae586ef5f0e6a40175e92917b44c) C:\WINDOWS\system32\DRIVERS\ati2mpaa.sys

2010/10/07 09:05:44.0174 ati2mtaa (075e091eebb450eedae9da74f5b46494) C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys

2010/10/07 09:05:44.0218 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2010/10/07 09:05:44.0307 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2010/10/07 09:05:44.0366 basic2 (1b9c81ab9a456eabd9f8335f04b5f495) C:\WINDOWS\system32\DRIVERS\HSF_BSC2.sys

2010/10/07 09:05:44.0455 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2010/10/07 09:05:44.0559 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2010/10/07 09:05:44.0707 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2010/10/07 09:05:44.0796 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2010/10/07 09:05:44.0855 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2010/10/07 09:05:45.0388 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2010/10/07 09:05:45.0522 DM9102 (51ef6ca3d57055fed6ab99021d562443) C:\WINDOWS\system32\DRIVERS\DM9PCI5.SYS

2010/10/07 09:05:45.0611 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2010/10/07 09:05:45.0670 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2010/10/07 09:05:45.0729 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2010/10/07 09:05:45.0937 eeCtrl (089296aedb9b72b4916ac959752bdc89) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys

2010/10/07 09:05:45.0996 EraserUtilRebootDrv (850259334652d392e33ee3412562e583) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

2010/10/07 09:05:46.0114 Fallback (c823debe2548656549f84a875d65237b) C:\WINDOWS\system32\DRIVERS\HSF_FALL.sys

2010/10/07 09:05:46.0174 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2010/10/07 09:05:46.0248 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

2010/10/07 09:05:46.0292 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2010/10/07 09:05:46.0352 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2010/10/07 09:05:46.0440 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2010/10/07 09:05:46.0500 Fsks (6483414841d4cab6c3b4db2ac6edd70b) C:\WINDOWS\system32\DRIVERS\HSF_FSKS.sys

2010/10/07 09:05:46.0574 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2010/10/07 09:05:46.0618 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2010/10/07 09:05:46.0677 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2010/10/07 09:05:46.0752 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2010/10/07 09:05:46.0915 HSFHWBS2 (970178e8e003eb1481293830069624b9) C:\WINDOWS\system32\DRIVERS\HSFBS2S2.sys

2010/10/07 09:05:47.0018 HSF_DP (ebb354438a4c5a3327fb97306260714a) C:\WINDOWS\system32\DRIVERS\HSFDPSP2.sys

2010/10/07 09:05:47.0152 hsf_msft (74e379857d4c0dfb56de2d19b8f4c434) C:\WINDOWS\system32\DRIVERS\HSF_MSFT.sys

2010/10/07 09:05:47.0240 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2010/10/07 09:05:47.0389 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2010/10/07 09:05:47.0448 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2010/10/07 09:05:47.0655 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2010/10/07 09:05:47.0715 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2010/10/07 09:05:47.0774 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2010/10/07 09:05:47.0818 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2010/10/07 09:05:47.0907 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2010/10/07 09:05:47.0952 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2010/10/07 09:05:47.0996 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2010/10/07 09:05:48.0070 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2010/10/07 09:05:48.0174 K56 (9c5e3fdbfcc30cf71a49ca178b9ad442) C:\WINDOWS\system32\DRIVERS\HSF_K56K.sys

2010/10/07 09:05:48.0233 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2010/10/07 09:05:48.0292 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2010/10/07 09:05:48.0352 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2010/10/07 09:05:48.0515 mdmxsdk (195741aee20369980796b557358cd774) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

2010/10/07 09:05:48.0589 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2010/10/07 09:05:48.0663 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2010/10/07 09:05:48.0707 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2010/10/07 09:05:48.0737 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2010/10/07 09:05:48.0781 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2010/10/07 09:05:48.0870 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2010/10/07 09:05:48.0944 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2010/10/07 09:05:49.0048 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2010/10/07 09:05:49.0107 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2010/10/07 09:05:49.0181 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2010/10/07 09:05:49.0330 NAVENG (49d802531e5984cf1fe028c6c129b9d8) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101001.002\naveng.sys

2010/10/07 09:05:49.0404 NAVEX15 (158676a5758c1fa519563b3e72fbf256) C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101001.002\navex15.sys

2010/10/07 09:05:49.0478 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2010/10/07 09:05:49.0522 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2010/10/07 09:05:49.0581 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2010/10/07 09:05:49.0611 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2010/10/07 09:05:49.0685 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2010/10/07 09:05:49.0744 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2010/10/07 09:05:49.0804 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2010/10/07 09:05:49.0907 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2010/10/07 09:05:49.0996 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2010/10/07 09:05:50.0100 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2010/10/07 09:05:50.0189 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2010/10/07 09:05:50.0233 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2010/10/07 09:05:50.0337 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2010/10/07 09:05:50.0381 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2010/10/07 09:05:50.0441 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2010/10/07 09:05:50.0500 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2010/10/07 09:05:50.0604 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2010/10/07 09:05:50.0648 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2010/10/07 09:05:51.0048 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2010/10/07 09:05:51.0122 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

2010/10/07 09:05:51.0181 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2010/10/07 09:05:51.0241 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2010/10/07 09:05:51.0493 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2010/10/07 09:05:51.0567 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2010/10/07 09:05:51.0611 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2010/10/07 09:05:51.0685 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2010/10/07 09:05:51.0745 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2010/10/07 09:05:51.0804 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2010/10/07 09:05:51.0878 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2010/10/07 09:05:51.0952 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2010/10/07 09:05:52.0011 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2010/10/07 09:05:52.0100 Rksample (bb7549bd94d1aac3599c7606c50c48a0) C:\WINDOWS\system32\DRIVERS\HSF_SAMP.sys

2010/10/07 09:05:52.0278 SAVRT (cdb565c093b0105086cc630b32f9e6e6) C:\Program Files\Symantec AntiVirus\savrt.sys

2010/10/07 09:05:52.0322 SAVRTPEL (1042cb5a003f9aed8d6cec56a0fc6c49) C:\Program Files\Symantec AntiVirus\Savrtpel.sys

2010/10/07 09:05:52.0426 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2010/10/07 09:05:52.0500 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2010/10/07 09:05:52.0559 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2010/10/07 09:05:52.0663 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2010/10/07 09:05:52.0856 SoftFax (d9e8e0ce154a2f6430d9efabdf730867) C:\WINDOWS\system32\DRIVERS\HSF_FAXX.sys

2010/10/07 09:05:52.0959 SPBBCDrv (cc22bf5631c4837abcd81d75de8fb1aa) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys

2010/10/07 09:05:53.0063 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2010/10/07 09:05:53.0152 Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys

2010/10/07 09:05:53.0226 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2010/10/07 09:05:53.0404 SymEvent (5156f63e684e8c864ff40e40d5309f41) C:\Program Files\Symantec\SYMEVENT.SYS

2010/10/07 09:05:53.0478 SYMREDRV (5314e345dfc068504cfb2676d3b2ca39) C:\WINDOWS\System32\Drivers\SYMREDRV.SYS

2010/10/07 09:05:53.0537 SYMTDI (8cd0a1478256240249b8ee88e6f25e94) C:\WINDOWS\System32\Drivers\SYMTDI.SYS

2010/10/07 09:05:53.0759 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2010/10/07 09:05:53.0819 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2010/10/07 09:05:53.0878 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2010/10/07 09:05:53.0937 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2010/10/07 09:05:54.0056 Tones (8021a499db46b2961c285168671cb9af) C:\WINDOWS\system32\DRIVERS\HSF_TONE.sys

2010/10/07 09:05:54.0174 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2010/10/07 09:05:54.0293 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2010/10/07 09:05:54.0367 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2010/10/07 09:05:54.0441 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2010/10/07 09:05:54.0500 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2010/10/07 09:05:54.0560 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2010/10/07 09:05:54.0619 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2010/10/07 09:05:54.0678 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2010/10/07 09:05:54.0782 V124 (269c0ade94b90029b12497747be408cb) C:\WINDOWS\system32\DRIVERS\HSF_V124.sys

2010/10/07 09:05:54.0826 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2010/10/07 09:05:54.0930 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2010/10/07 09:05:55.0019 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2010/10/07 09:05:55.0182 winachsf (1225ebea76aac3c84df6c54fe5e5d8be) C:\WINDOWS\system32\DRIVERS\HSFCXTS2.sys

2010/10/07 09:05:55.0434 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2010/10/07 09:05:55.0493 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2010/10/07 09:05:55.0760 ================================================================================

2010/10/07 09:05:55.0760 Scan finished

2010/10/07 09:05:55.0760 ================================================================================

2010/10/07 09:06:10.0042 Deinitialize success

[yuppicide]

What's interesting, is I ran it on my computer up front in the office.. I have no issues that I am aware of it and it found 1 suspicious file:

2010/10/07 09:01:39.0985 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys

2010/10/07 09:01:39.0985 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

2010/10/07 09:01:40.0016 sptd - detected Locked file (1)

[yuppicide]

Nevermind that last post.. I Googled it.. seems I had some CD emulator installed or something.

[MrCharlie]

If you're on a router, please do this:

Reset your router:

There should be a little hole in the back of the router to reset it, you would use something like a paper clip. If not just disconnect the power from it for about 2 minutes then plug it back in and let it reset.

Clear cache:

Go to Start > Run > copy and paste this in:

ipconfig /flushdns

Enter

See if that makes any difference, MrC

[yuppicide]

Hi.. Thanks again for your help. I'm going to close this topic, as I found a Trojan Bamital!inf in winlogin.exe and explore.exe.

I might reformat and reinstall *sigh*.

Things were fine for days except what I mentioned to you (the redirect). Today we went to lunch and came back and Norton had blocked the problems. It was able to quarantine some, but not others.

I started to follow Norton's advice to disable system restore and go into the registry and remove some stuff, but what they said to remove is not there.

I think think I'll go bark on their forums now.. thanks again.

[MrCharlie]

OK, Good Luck......... MrC

[Maurice Naggar]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.