Jump to content

Google Redirect virus and Malwarebytes doesn't find it

lpales

By lpales
in Resolved Malware Removal Logs

 Share

Recommended Posts

lpales

lpales

Posted
Posted

I've got a Google redirect virus. Initially I couldn't run Malwarebytes. I renamed the executable file "winlogin.exe" and did a complete scan. Malwarebytes didn't detect anything. I've also run numerous other programs but Emsisoft Anti-Malware is the only thing that found anything malicious. Here's the quarantine log from Emsisoft:

Emsisoft Anti-Malware - Version 5.0

quarantine log

Date Source Event Behavior/Infection

10/12/2010 7:43:20 PM C:\WINDOWS\Temp\TMP2E9.tmp Moved To Quarantine Virus.Win32.Enistery!IK

10/12/2010 7:43:19 PM C:\WINDOWS\Temp\TMP174.tmp Moved To Quarantine Trojan.Crypt!IK

10/12/2010 7:43:18 PM C:\WINDOWS\Temp\TMP170.tmp Moved To Quarantine Trojan.Crypt!IK

10/12/2010 7:49:04 AM C:\Documents and Settings\Laura\Cookies\laura@doubleclick[2].txt Moved To Quarantine Trace.TrackingCookie.doubleclick!A2

10/12/2010 7:49:03 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286880125593001 Moved To Quarantine Trace.TrackingCookie.ar.atwola.com!A2

10/12/2010 7:49:02 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286880214875000 Moved To Quarantine Trace.TrackingCookie.ad.yieldmanager.com!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194331093008 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194333515002 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/12/2010 5:48:39 AM c:\program files\RegistryFix7 Removed From Quarantine Trace.Directory.RegistryFix 7 .1!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286628083250003 Removed From Quarantine Trace.TrackingCookie.media!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Cookies\laura@specificclick[2].txt Removed From Quarantine Trace.TrackingCookie.specificclick!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286230408515000 Removed From Quarantine Trace.TrackingCookie.optimize.indieclick.com!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286462778953000 Removed From Quarantine Trace.TrackingCookie.www.adfusion.com!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406006 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:39 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187002 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406005 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709849937008 Removed From Quarantine Trace.TrackingCookie.ar.atwola.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286195710734000 Removed From Quarantine Trace.TrackingCookie.doubleclick.net!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286445401984001 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286628083250000 Removed From Quarantine Trace.TrackingCookie.media!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286664192500001 Removed From Quarantine Trace.TrackingCookie.ads.pubmatic.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194331093009 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286371022921000 Removed From Quarantine Trace.TrackingCookie.googleads.g.doubleclick.net!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406003 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187001 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286570459140001 Removed From Quarantine Trace.TrackingCookie.eas.apm.emediate.eu!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187000 Removed From Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Sun\Java\Deployment\cache\6.0\39\6fca95e7-6ed17acd Removed From Quarantine JAVA.Agent!IK

10/12/2010 5:48:35 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286155775484000 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/12/2010 5:48:02 AM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286155774281001 Removed From Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM c:\program files\RegistryFix7 Moved To Quarantine Trace.Directory.RegistryFix 7 .1!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Cookies\laura@specificclick[2].txt Moved To Quarantine Trace.TrackingCookie.specificclick!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286445401984001 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194333515002 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194331093009 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286194331093008 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286155775484000 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286155774281001 Moved To Quarantine Trace.TrackingCookie.aol.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286195710734000 Moved To Quarantine Trace.TrackingCookie.doubleclick.net!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286230408515000 Moved To Quarantine Trace.TrackingCookie.optimize.indieclick.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286371022921000 Moved To Quarantine Trace.TrackingCookie.googleads.g.doubleclick.net!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286462778953000 Moved To Quarantine Trace.TrackingCookie.www.adfusion.com!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286570459140001 Moved To Quarantine Trace.TrackingCookie.eas.apm.emediate.eu!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286628083250003 Moved To Quarantine Trace.TrackingCookie.media!A2

10/10/2010 12:07:03 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286628083250000 Moved To Quarantine Trace.TrackingCookie.media!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286664192500001 Moved To Quarantine Trace.TrackingCookie.ads.pubmatic.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709849937008 Moved To Quarantine Trace.TrackingCookie.ar.atwola.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406006 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406005 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851406003 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187002 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187001 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Mozilla\Firefox\Profiles\strk25st.default\cookies.sqlite:1286709851187000 Moved To Quarantine Trace.TrackingCookie.casalemedia.com!A2

10/10/2010 12:07:02 PM C:\Documents and Settings\Laura\Application Data\Sun\Java\Deployment\cache\6.0\39\6fca95e7-6ed17acd Moved To Quarantine JAVA.Agent!IK

I also ran HiJack This and here's the report:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:59:47 PM, on 10/12/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\Program Files\Emsisoft Anti-Malware\a2service.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\idt\wdm\STacSV.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Virtual-Protect\MyFolder2.5\mfservice.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe

C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Clearly Superior Technologies\Superior-X Button Control\Superior-XButtonControl.exe

C:\WINDOWS\system32\taskswitch.exe

C:\PROGRA~1\BLOCKB~1\BLOCKB~1\MovielinkCore.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Discover\SOAN\DISCOV~1.EXE

C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe

C:\Program Files\HP\HP UT\bin\hppusg.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\dcmsvc\dcmsvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\PSIService.exe

C:\WINDOWS\system32\OBroker.exe

C:\Program Files\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Virtual-Protect\MyFolder2.5\mfmanager.exe

C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\CPSHelpRunner10.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Spyware Doctor\TFEngine\TFService.exe

C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2guard.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files\HP\Digital Imaging\bin\hpqusgl.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.screenname.aol.com/_cqr/login/lo...c&locale=us

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pctools.com/mrc/fix_homepage/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Secure Online Account Numbers Helper - {435EAA86-D32B-484F-869C-53745FCB1642} - C:\Program Files\Discover\SOAN\DiscoverSOANHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Discover deskshop Browser Helper Object - {8DB3D69D-DA5E-4165-B781-72A761790672} - C:\Program Files\Discover\SOAN\DiscoverSOANBHO.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Secure Online Account Numbers - {A8C7C2CA-6DFD-4E16-8458-592361564D38} - C:\Program Files\Discover\SOAN\DiscoverSOANToolbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe"

O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe"

O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [superior-X Button Control] C:\Program Files\Clearly Superior Technologies\Superior-X Button Control\Superior-XButtonControl.exe /notportable

O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [secure Online Account Numbers] C:\PROGRA~1\Discover\SOAN\DISCOV~1.EXE /dontopenmycards

O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on

O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [dcmsvc] C:\Program Files\dcmsvc\dcmsvc.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LoadMSvcmm] "C:\Program Files\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [mfmanager] C:\Program Files\Virtual-Protect\MyFolder2.5\mfmanager.exe

O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Startup: Warner Bros.lnk = C:\Program Files\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: McAfee Security Scan Plus.lnk = ?

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase6770.cab

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Emsisoft Anti-Malware 5.0 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe

O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: BroadCam Video Streaming Server (BroadCamService) - Apple Inc. - (no file)

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: mfservice - Unknown owner - C:\Program Files\Virtual-Protect\MyFolder2.5\mfservice.exe

O23 - Service: Movielink Core Service - Blockbuster - C:\PROGRA~1\BLOCKB~1\BLOCKB~1\MovielinkCore.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe

O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe

O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe

O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe

O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\STacSV.exe

O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe

--

End of file - 16410 bytes

After all of this I still have the redirect virus. I sure would appreciate any help. Thanks so much for your time,

Laura

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.