redirect virus?

[chuggy]

hi,

new and frustrated member here! ..hope you guys can help

I'm running Vista on my lappy

all was good till:

a couple of days ago when I managed to upgrade to SP1 (previously my system wouldnt 'see' that I didnt have it and wouldnt upgrade to it, despite auto update)

then I started to get redirects on Google

then I got the Blue Screen of Death

I'm running AVG, Spybot with tea-time), Spyware doctor

Ive scanned a million times with each of them

Ive scanned with malwarebytes a couple of times - it did find something the first time I ran it and 'dispensed' with it, but now shows nothing found (hence no file attached to this post)

I now get occasional BSoD AND occasional redirects

please help!

Hijack This log as follows:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 09:38:56, on 28/02/2011

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18385)

Boot mode: Normal

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Advent\AIO\Center\ADAIOHostService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\CPUCooL\CooLSrv.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\spool\drivers\w32x86\3\ADAiO2MUI.exe

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Windows\system32\svchost.exe

C:\Program Files\FSC\Wireless Utility\WirelessSelector.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\sdclt.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Garmin\MapSource.exe

C:\Windows\system32\Taskmgr.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\chuggy\Downloads\HijackThis.exe

C:\Users\chuggy\AppData\Local\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fujitsu-siemens.com/index2

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)

O3 - Toolbar: IsoBuster Toolbar - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [TouchPadHotKey] C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe

O4 - HKLM\..\Run: [ADAiO2StatusMonitor] C:\Windows\system32\spool\DRIVERS\W32X86\3\ADAiO2MUI.exe

O4 - HKLM\..\Run: [HTC Sync Loader] "C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\chuggy\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: WirelessSelector.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: Advent AIO Network Discovery Service - DSGi - C:\Program Files\Advent\AIO\Center\ADAIOHostService.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate1c9c1f2f136328) (gupdate1c9c1f2f136328) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: SlingAgentService - Sling Media Inc. - C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

--

End of file - 10577 bytes

Ive run your 'what to do now' but DDS.scr wouldnt run - I only get a notepad screen with gibberish

ark.rar

[Maniac]

Hello chuggy! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  
• Post all of your log files, don't attach them.

What about DDS.pif ?

Download DDS and save it to your desktop from here or here .

Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
     
  2. Attach.txt
     

  [*]Save both reports to your desktop. Post them back to your topic.

[chuggy]

hi Maniac: thanks for coming to my aid - much appreciated!

I eventually realised that I just had to change the file extension to pif to get it t run!

this is the result

DDS (Ver_10-12-12.02) - NTFSx86

Run by chuggy at 18:42:12.33 on 01/03/2011

Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Advent\AIO\Center\ADAIOHostService.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\BullGuard Ltd\BullGuard\BullGuardBhvScanner.exe

C:\Program Files\CPUCooL\CooLSrv.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Sling Media\SlingAgent\SlingAgentService.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\AVG\AVG8\avgtray.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\System32\spool\drivers\w32x86\3\ADAiO2MUI.exe

C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\FSC\Wireless Utility\WirelessSelector.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\wbem\unsecapp.exe

G:\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\wermgr.exe

C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe

C:\Windows\system32\Taskmgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\chuggy\Downloads\dds.pif

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\SvcHost.exe -k BullGuard_Main

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\System32\SvcHost.exe -k BullGuard_LowPriv

C:\Windows\System32\SvcHost.exe -k BullGuard

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Windows\system32\svchost.exe -k netsvcs

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.fujitsu-siemens.com/index2

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:8074

uURLSearchHooks: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\tbIsoB.dll

mURLSearchHooks: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\tbIsoB.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\tbIsoB.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: {E3215F20-3212-11D6-9F8B-00D0B743919D} - No File

BHO: BullGuard Safe Browsing: {fc872b94-35e3-4b94-b028-184a2a1c7cce} - c:\program files\bullguard ltd\bullguard\antiphishing\ie\BGAntiphishingIEBHO.dll

TB: IsoBuster Toolbar: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - c:\program files\isobuster\tbIsoB.dll

TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [Google Update] "c:\users\chuggy\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [TouchPadHotKey] c:\program files\fsc\touchpad hotkey utility\TouchPad_HotKey.exe

mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [Conime] %windir%\system32\conime.exe

mRun: [ADAiO2StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\ADAiO2MUI.exe

mRun: [HTC Sync Loader] "c:\program files\htc\htc sync 3.0\htcUPCTLoader.exe" -startup

mRun: [iSTray] "c:\program files\spyware doctor\pctsTray.exe"

mRun: [bullGuard] "c:\program files\bullguard ltd\bullguard\BullGuard.exe" -boot

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000

IE: {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - {27FD17FB-CF63-486b-B2BE-8D8781CBEA01} - c:\program files\bullguard ltd\bullguard\antiphishing\ie\BGAntiphishingIE.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: c:\windows\system32\BGLsp.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: bglink - {FC872B94-35E3-4B94-B028-184A2A1C7CCE} - c:\program files\bullguard ltd\bullguard\antiphishing\ie\BGAntiphishingIEBHO.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: cryptnet32 - cryptnet32.dll

AppInit_DLLs: avgrsstx.dll

mASetup: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\windows\system32\rundll32.exe c:\windows\system32\mscoriesvirus.dll,Install

================= FIREFOX ===================

FF - ProfilePath - c:\users\chuggy\appdata\roaming\mozilla\firefox\profiles\lci5jp4n.default\

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 49657

FF - prefs.js: network.proxy.type - 4

FF - component: c:\program files\bullguard ltd\bullguard\antiphishing\ff\antiphishing@bullguard\components\BGFFComponent.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: BullGuard Safe Browsing Toolbar: antiphishing@bullguard - c:\program files\bullguard ltd\bullguard\antiphishing\ff\antiphishing@bullguard

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

R? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0

R? BgRaSvc;BgRaSvc

R? BsScanner;BullGuard scanning service

R? BTCAMDRV;Mobiola Web Camera driver

R? gupdate1c9c1f2f136328;Google Update Service (gupdate1c9c1f2f136328)

R? HTCAND32;HTC Device Driver

R? htcnprot;HTC NDIS Protocol Driver

R? NovaShieldTDIDriver;NovaShieldTDIDriver

R? SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver

S? Advent AIO Network Discovery Service;Advent AIO Network Discovery Service

S? AFW;Agnitum Firewall Driver

S? afwcore;afwcore

S? avg8wd;AVG Free8 WatchDog

S? AvgLdx86;AVG Free AVI Loader Driver x86

S? AvgMfx86;AVG Minifilter x86 Resident Driver

S? BdSpy;BdSpy

S? BsBhvScan;BullGuard behavioural detection service

S? BsBrowser;BullGuard antiphishing service

S? BsFileScan;BullGuard on-access service

S? BsFire;BullGuard firewall service

S? BsMailProxy;BullGuard e-mail monitoring service

S? BsMain;BullGuard main service

S? BsUpdate;BullGuard update service

S? IKFileSec;File Security Driver

S? IKSysFlt;System Filter Driver

S? IKSysSec;System Security Driver

S? MicroGuard;MicroGuard Copy Protection

S? NovaShieldFilterDriver;NovaShieldFilterDriver

S? ntiomin;ntiomin

S? PassThru Service;Internet Pass-Through Service

S? SASDIFSV;SASDIFSV

S? SASKUTIL;SASKUTIL

S? sdAuxService;PC Tools Auxiliary Service

S? sdCoreService;PC Tools Security Service

S? SiS6350;SiS6350

S? SlingAgentService;SlingAgentService

S? WSDPrintDevice;WSD Print Support via UMB

=============== File Associations ===============

.scr=AutoCADScriptFile

=============== Created Last 30 ================

2011-03-01 18:30:16 -------- d-----w- c:\program files\Script Engine

2011-03-01 09:49:10 -------- d-----w- c:\users\chuggy\appdata\roaming\BullGuard

2011-03-01 09:07:51 -------- d-----w- c:\progra~2\BullGuard

2011-03-01 09:07:17 -------- d-----w- c:\program files\BullGuard Ltd

2011-02-28 10:49:53 -------- d-----w- c:\users\chuggy\appdata\roaming\SUPERAntiSpyware.com

2011-02-28 10:49:53 -------- d-----w- c:\progra~2\SUPERAntiSpyware.com

2011-02-28 10:49:09 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-02-26 02:21:45 47560 ----a-w- c:\windows\system32\SPReview.exe

2011-02-26 02:21:45 152576 ----a-w- c:\windows\system32\SPWizUI.dll

2011-02-26 01:57:07 193024 ----a-w- c:\windows\system32\recdisc.exe

2011-02-26 01:57:05 6656 ----a-w- c:\windows\system32\sdspres.dll

2011-02-26 01:55:59 87552 ----a-w- c:\windows\system32\msoert2.dll

2011-02-26 01:54:59 93184 ----a-w- c:\windows\system32\esentutl.exe

2011-02-26 01:53:59 8139264 ----a-w- c:\windows\system32\ssBranded.scr

2011-02-26 01:51:15 44032 ----a-w- c:\windows\system32\cbsra.exe

2011-02-25 23:00:10 -------- d-----w- c:\progra~2\Sling Media

2011-02-25 22:55:44 -------- d-----w- c:\windows\Downloaded Installations

2011-02-25 22:25:15 -------- d-----w- c:\users\chuggy\appdata\roaming\Sling Media

2011-02-25 22:21:24 -------- d-----w- c:\program files\Sling Media

2011-02-25 18:57:21 295053 ----a-w- c:\windows\system32\shimg.dll

2011-02-22 09:44:25 5890896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{76aff82e-e313-40fd-9459-576ff79ca31d}\mpengine.dll

2011-02-15 19:53:33 -------- d-----w- c:\program files\YouTube Downloader

2011-02-12 22:48:34 -------- d-----w- C:\office1

2011-02-10 22:05:21 -------- d-----w- c:\progra~2\GARMIN

==================== Find3M ====================

2011-02-26 02:36:10 101888 ----a-w- c:\windows\system32\ifxcardm.dll

2011-02-26 02:35:44 82432 ----a-w- c:\windows\system32\axaltocm.dll

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 6.0.6001 Disk: WDC_WD1200BEVS-22UST0 rev.01.01A01 -> Harddisk0\DR0 -> \Device\Ide\IdePort1 P1T0L0-1

device: opened successfully

user: MBR read successfully

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x85DAE439]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x85db47b8]; MOV EAX, [0x85db4834]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x8230D05F] -> \Device\Harddisk0\DR0[0x85812AC8]

3 CLASSPNP[0x879CB745] -> ntkrnlpa!IofCallDriver[0x8230D05F] -> [0x8500F918]

5 acpi[0x8069A6A0] -> ntkrnlpa!IofCallDriver[0x8230D05F] -> [0x84298828]

\Driver\atapi[0x85B1B938] -> IRP_MJ_CREATE -> 0x85DAE439

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x132; MOV BP, 0x62a; ROR BYTE [bP+0x0], CL; INC BP; }

detected disk devices:

\Device\Ide\IdeDeviceP1T0L0-1 -> \??\IDE#DiskWDC_WD1200BEVS-22UST0___________________01.01A01#5&18c0e30f&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

detected hooks:

user != kernel MBR !!!

sectors 234441646 (+255): user != kernel

Warning: possible TDL4 rootkit infection !

TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

============= FINISH: 18:45:01.48 ===============

==== Installed Programs ======================

Abdio Free 3GP Player (Free)

Activation Assistant for the 2007 Microsoft Office suites

Ad-Aware SE Personal

AdC4USelfUpdater

Adobe AIR

Adobe Anchor Service CS3

Adobe Asset Services CS3

Adobe Bridge CS3

Adobe Bridge Start Meeting

Adobe Camera Raw 4.0

Adobe CMaps

Adobe Color - Photoshop Specific

Adobe Color Common Settings

Adobe Color EU Extra Settings

Adobe Color JA Extra Settings

Adobe Color NA Recommended Settings

Adobe Default Language CS3

Adobe Device Central CS3

Adobe ExtendScript Toolkit 2

Adobe Flash Player 10 Plugin

Adobe Fonts All

Adobe Help Viewer CS3

Adobe Linguistics CS3

Adobe PDF Library Files

Adobe Photoshop CS3

Adobe Reader 8.1.2

Adobe Setup

Adobe Stock Photos CS3

Adobe Type Support

Adobe Update Manager CS3

Adobe Version Cue CS3 Client

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS3

Advent AIO Printer

Advent Essentials

aioscnnr

AoA DVD Ripper

Apple Application Support

Apple Software Update

[chuggy]

sorry, I guess I should add that I normally run Google Chrome, but changed back to firefox thinking (naively) that Google was to blame. Also Bullguard is unused though installed ...just done that whilst trying to resolve the problem myself

thanks

[Maniac]

Why? You just can download this one:

http://www.forospyware.com/sUBs/dds/

It's a DDS.pif

Now:

Step 1

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Step 2

You should not have more than one anti-virus program installed as they will conflict and cause problems. You have two so you need to uninstall one of them. Of the two, I would recommend keeping AVG 8.5, so please uninstall BullGard.

Step 3

Please, uninstall the following applications:

1. IsoBuster Toolbar
   

You can read, how to do this here:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 4

Going over your logs I noticed that you have

[chuggy]

lots of restarts later!

DDS .txt =

DDS (Ver_10-12-12.02) - NTFSx86

Run by chuggy at 20:13:49.33 on 01/03/2011

Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13

Microsoft

[Maniac]

Looks better!

• Launch Malwarebytes' Anti-Malware
  
• Go to Update" tab and select Check for Updates.
  
• Go to Scanner tab and select Perform Quick Scan, then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

In your next reply, please post the following logs:

1. Malwarebytes' Anti-Malware log
   
2. a new fresh DDS log only
   

[chuggy]

many thanks Borislav,

....no BSoD's for 24hrs + now ...and no redirects ....so progresss is definitely being made!

files copied below

mbam log:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5940

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

03/03/2011 09:00:29

mbam-log-2011-03-03 (09-00-29).txt

Scan type: Quick scan

Objects scanned: 170937

Time elapsed: 22 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

and the DDS log:

DDS (Ver_10-12-12.02) - NTFSx86

Run by chuggy at 9:05:43.58 on 03/03/2011

Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13

Microsoft

[chuggy]

update:

I just had a BSoD.

I was shutting Spyware Doctor down whilst running my laptop as normal (my intentionwas to try and updae it)...during this shutdown, I got the BSoD

laptop restarted OK after the DOS prompt on startup

[Maniac]

I would prefer to run Google Chrome than Firefox ...thoughts?

Oh, Chrome is the best, so much better than Firefox. In the fourth version we expect better results, however, Chrome is very forward than the other browsers.

...and would you suggest any anti-viral/malware products, OTHER than that which are already on my laptop?

Nope, but I suggest you to get rid of Spyware Doctor. You have MBAM which is much better than Spyware Doctor.

I think your system is still infected, so let's continue:

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  ----------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

• Double click on Combo-Fix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the C:\Combo-Fix.txt for further review.
  

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[chuggy]

thanks for the info

...when (if?!) we're done here, I'll download Chrome again

.....I'm also down to AVG8 as I had to uninstall 8.5 to get Combofix to run

...should I update AVG now, or when you advise?

combofix log:

ComboFix 11-03-01.03 - chuggy 03/03/2011 15:43:24.1.1 - x86

Microsoft

[Maniac]

Sounds good, but wait for now. Please visit www.virustotal.com and upload the following file:

c:\windows\system32\SPReview.exe

Post the results in your next reply.

[chuggy]

there was a 'warning' that this file had previously been submitted .....I asked it to analyse again anyway (Ive never been to that site, so deffo not uploaded by me)

is this all the info you need from virustotal?

File name:

SPReview.exe

Submission date:

2011-03-03 16:56:13 (UTC)

Current status:

queued queued (#2) analysing finished

Result:

0/ 43 (0.0%)

[Maniac]

Thanks!

Open Notepad and copy and paste the text in the code box below into it:

DDS::
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 49657
FF - prefs.js: network.proxy.type - 4

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

[chuggy]

uninstalled AVG again!...

ComboFix 11-03-01.03 - chuggy 03/03/2011 17:27:13.2.1 - x86

Microsoft

[Maniac]

It's not working, but is not your mistake.

Internet Explorer (Windows)

1. Click "Tools", then click "Internet Options". This will bring up the Internet Options window.

2. Click the "Connections" tab, then click the "LAN Settings" button.

3. Uncheck the box labeled "Use a proxy server for your LAN". Click "OK", and click "OK" in the previous window. This will remove the proxy server settings in Internet Explorer.

Firefox (Windows)

1. Click "Tools", then click "Options" to bring up the Options window.

2. Click the "Advanced" button, then click the "Network" tab.

3. Click the "Settings" button, located next to "Configure how Firefox connects to the Internet".

4. Click the radio button labeled "No proxy". Click "OK" twice. This will remove the proxy server settings in Firefox.

Then update MBAM and perform a quick scan. Post the result in your next reply.

[chuggy]

nothing found this time - but when I checked the internet connection options - the LAN option was already unchecked.

mbam log:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5940

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

03/03/2011 20:25:40

mbam-log-2011-03-03 (20-25-40).txt

Scan type: Quick scan

Objects scanned: 153995

Time elapsed: 9 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[chuggy]

sorry...I'm a fool - I forgot to update mbam before use .....in progress now

[chuggy]

OK, results were the same - no problems detected

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5947

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

03/03/2011 20:36:27

mbam-log-2011-03-03 (20-36-27).txt

Scan type: Quick scan

Objects scanned: 154389

Time elapsed: 5 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Maniac]

Good!

How are things now?

[chuggy]

well.... all seems good!

no BSoD since that one off this morning.

no redirects

Sir, I think I owe you for your great work here

Many many thanks!

Ive downloaded the latest AVG and am back to Chrome again.

very very happy

fantastic work you guys are doing ....now if we could just stop the viruses being produced in the FIRST place - you guys would have an easy(ier) life and us numptys wouldnt go getting upset!

Mnogo blagodarya

[Maniac]

fantastic work you guys are doing ....now if we could just stop the viruses being produced in the FIRST place - you guys would have an easy(ier) life and us numptys wouldnt go getting upset!

We have suggestions about that. Check in my last step for you.

Mnogo blagodarya

Molq!

Last steps for you:

Step 1

Go to Start => Run... and copy & paste next command in the field:

ComboFix /uninstall

Then hit Enter button.

This procedure will do the following:

• Uninstall ComboFix
  
• Delete its related folders and files
  
• Reset your clock settings
  
• Hide file extensions
  
• Hide the system/hidden files
  
• Resets System Restore again
  

Note: Make sure there's a space between ComboFix and /uninstall

Step 2

Please manually delete HiJackThis, DDS and TDSSKiller.

Step 3

Keep your software up-to-date:

www.bleepingcomputer.com/tutorials/tutorial174.html

Some malware preventions:

http://forums.malwarebytes.org/index.php?showtopic=9365

Safe surfing!

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!