search redirect nothing detected

devinjc · March 31, 2011

Wits end, probably have done a lot of things I shouldn't have... was going to just reimage, but thought I'd try this as I'm really curious at this point. Nothing bad is showing up on any scans that I see. Thanks in advance.

DDS.txt

.

DDS (Ver_11-03-05.01) - FAT32x86

Run by james at 8:39:10.21 on Thu 03/31/2011

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3071.2110 [GMT -7:00]

.

AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\rundll32.exe

C:\Windows\system32\svchost.exe -k apphost

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Windows\system32\PnkBstrA.exe

C:\Windows\system32\PnkBstrB.exe

F:\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k iissvcs

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

f:\UnHackMe\hackmon.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\dvd43\DVD43_Tray.exe

F:\iTunes7\iTunesHelper.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

F:\Free Download Manager\fdm.exe

F:\MagicDisc\MagicDisc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\sppsvc.exe

C:\Users\james\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - f:\free download manager\iefdm2.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [steam] "f:\steam\Steam.exe" -silent

uRun: [Free Download Manager] f:\free download manager\fdm.exe -autorun

mRun: [Google Quick Search Box] "c:\program files\google\quick search box\GoogleQuickSearchBox.exe" /autorun

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe

mRun: [dvd43] c:\program files\dvd43\dvd43_tray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [iTunesHelper] "f:\itunes7\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware (reboot)] "f:\malwarebytes\mbam.exe" /runcleanupscript

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

StartupFolder: c:\users\james\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - f:\magicdisc\MagicDisc.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\squeez~1.lnk - f:\squeezebox\SqueezeTray.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Download all with Free Download Manager - file://f:\free download manager\dlall.htm

IE: Download selected with Free Download Manager - file://f:\free download manager\dlselected.htm

IE: Download video with Free Download Manager - file://f:\free download manager\dlfvideo.htm

IE: Download with Free Download Manager - file://f:\free download manager\dllink.htm

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://ssl.water.ca.gov/dana-cached/sc/JuniperSetupClient.cab

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\james\appdata\roaming\mozilla\firefox\profiles\wf24yb9q.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - component: f:\free download manager\firefox\extension\components\vmsfdmff.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\users\james\appdata\roaming\move networks\plugins\npqmp071701000002.dll

FF - plugin: c:\users\james\appdata\roaming\move networks\plugins\npqmp071705000014.dll

FF - plugin: f:\itunes7\mozilla plugins\npitunes.dll

FF - plugin: f:\picasa3\npPicasa3.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\james\appdata\roaming\Move Networks

FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\avast software\avast\webrep\FF

.

============= SERVICES / DRIVERS ===============

.

R0 SscRdBus;Virtual bus device (SuperSpeed LLC);c:\windows\system32\drivers\SscRdBus.sys [2009-6-18 67608]

R0 SscRdCls;RAM Disk (SuperSpeed LLC);c:\windows\system32\drivers\SscRdCls.sys [2007-12-19 40984]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-3-28 371544]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-3-28 301528]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-3-28 19544]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-3-28 53592]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-3-28 42184]

R2 SqueezeMySQL;SqueezeMySQL;f:\squeez~1\server\bin\mswin3~1\mysqld.exe --defaults-file=c:\progra~2\squeez~1\cache\my.cnf squeezemysql --> f:\squeez~1\server\bin\mswin3~1\mysqld.exe --defaults-file=c:\progra~2\squeez~1\cache\my.cnf SqueezeMySQL [?]

S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys [2011-3-27 35816]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-29 136176]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2011-3-27 24416]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;f:\sandra benchmark\sisoftware sandra lite 2010.sp2\RpcAgentSrv.exe [2010-8-1 93848]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-6 1343400]

.

=============== Created Last 30 ================

.

==================== Find3M ====================

.

2011-03-28 05:29:09 39192 ----a-w- c:\windows\system32\Partizan.exe

2011-03-28 05:29:07 2 --shatr- c:\windows\winstart.bat

2011-03-26 23:22:21 149504 --sha-r- c:\windows\system32\KBDBENEY.dll

2011-03-03 02:56:50 37943240 ----a-w- c:\windows\system32\MRT.exe

2011-02-23 14:04:21 40648 ----a-w- c:\windows\avastSS.scr

2011-02-23 14:04:17 190016 ----a-w- c:\windows\system32\aswBoot.exe

2011-02-19 00:36:58 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-01-07 07:31:10 442880 ----a-w- c:\windows\system32\XpsPrint.dll

2011-01-07 07:31:10 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-01-07 07:27:11 34304 ----a-w- c:\windows\system32\atmlib.dll

2011-01-07 05:33:11 294400 ----a-w- c:\windows\system32\atmfd.dll

2011-01-05 05:37:33 428032 ----a-w- c:\windows\system32\vbscript.dll

2011-01-05 05:34:32 716800 ----a-w- c:\windows\system32\jscript.dll

2011-01-05 03:37:38 2329088 ----a-w- c:\windows\system32\win32k.sys

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 6.1.7600 Disk: STT_FTM6 rev.1571 -> Harddisk3\DR3 -> \Device\00000068

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor.sys

c:\windows\system32\drivers\nvstor.sys NVIDIA Corporation NVIDIA nForce SATA Driver

1 ntkrnlpa!IofCallDriver[0x83476448] -> \Device\Harddisk3\DR3[0x873B9AC8]

3 CLASSPNP[0x8BE5E59E] -> ntkrnlpa!IofCallDriver[0x83476448] -> [0x85FE2B50]

5 ACPI[0x840CC3B2] -> ntkrnlpa!IofCallDriver[0x83476448] -> \Device\00000066[0x86DCB030]

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [bP+0x0], 0x0; }

user != kernel MBR !!!

error: Read Insufficient system resources exist to complete the requested service.

.

============= FINISH: 8:40:02.36 ===============

Attach.zip

ark.zip

Maniac · March 31, 2011

Hello devinjc! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.
Post all of your log files, don't attach them.

Let's start from somewhere.

Step 1

I see the Ask Toolbar in your log.

I strongly recommend you remove Ask Toolbar from your computer because:

It promotes its toolbars on sites targeted at kids.
It promotes its toolbars through ads that appear to be part of other companies' sites.
It promotes its toolbars through other companies' spyware.
It is Installed without any disclosure whatsoever and without any consent from the user whatsoever.
It Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.
It makes confusing changes to user's browsers -- increasing Ask's revenues while taking users to pages they didn't intend to visit.

You can read more about Ask.com here

To remove it:

Click Start-->-Control Panel-->Programs and Features

Click on the program name AskBarDis to highlight it

From the menu at the top, select Uninstall or Remove.

Please reboot the computer.

Step 2

You have some leftovers from AVG. Use their uninstaller to clean them:

http://download.avg.com/filedir/util/support/avg_remover_stf_x86_2011_1184.exe

Step 3

* Go to start > run... and type: wbemtest > hit enter

* There, click connect

* In the field on top, where it says "root\default", type root\SecurityCenter instead, then click the connect button.

* Below, click the "Query... " button

* In the query box, type: Select * From AntivirusProduct and hit apply.

* In there, select the entry with the guid {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} and hit delete below. Then close that window.

Finally, post a new fresh DDS log file.

devinjc · March 31, 2011

Hello Borislav, thank you very much for the help.

Step 1: No AskBarDis in programs to remove, however search for "ask" revealed Foxit toolbar with ask.com association, removed that.

Step 2: Done

Step 3: Opened webemtest, clicked connect, replaced "root\cimv2" with "root\SecurityCenter" clicked connect. Query, entered "Select * From AntivirusProduct" returned no entries to delete.

New DDS just in case.

.

DDS (Ver_11-03-05.01) - FAT32x86

Run by james at 11:32:57.48 on Thu 03/31/2011

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3071.2293 [GMT -7:00]

.

AV: AVG Anti-Virus Free *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\rundll32.exe

C:\Windows\system32\svchost.exe -k apphost

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\Windows\system32\PnkBstrA.exe

C:\Windows\system32\PnkBstrB.exe

F:\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe

C:\Windows\system32\svchost.exe -k iissvcs

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

f:\UnHackMe\hackmon.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\dvd43\DVD43_Tray.exe

F:\iTunes7\iTunesHelper.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

F:\Free Download Manager\fdm.exe

F:\MagicDisc\MagicDisc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe

C:\Windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\ctfmon.exe

C:\Windows\system32\DllHost.exe