Jump to content

browser hijacked when searching via google

atlanta678
 Share

Recommended Posts

LDTate

LDTate

Posted
Posted

:welcome:

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs from these scans, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
  • 2 weeks later...
atlanta678

atlanta678

Posted
  • Author
Posted

Here is the TDSKILLER log...

2011/06/04 19:15:02.0623 4848 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24

2011/06/04 19:15:03.0316 4848 ================================================================================

2011/06/04 19:15:03.0316 4848 SystemInfo:

2011/06/04 19:15:03.0316 4848

2011/06/04 19:15:03.0316 4848 OS Version: 6.0.6002 ServicePack: 2.0

2011/06/04 19:15:03.0316 4848 Product type: Workstation

2011/06/04 19:15:03.0316 4848 ComputerName: OFFICE-PC

2011/06/04 19:15:03.0317 4848 UserName: Darrell

2011/06/04 19:15:03.0317 4848 Windows directory: C:\Windows

2011/06/04 19:15:03.0317 4848 System windows directory: C:\Windows

2011/06/04 19:15:03.0317 4848 Processor architecture: Intel x86

2011/06/04 19:15:03.0317 4848 Number of processors: 2

2011/06/04 19:15:03.0317 4848 Page size: 0x1000

2011/06/04 19:15:03.0317 4848 Boot type: Normal boot

2011/06/04 19:15:03.0317 4848 ================================================================================

2011/06/04 19:15:03.0786 4848 Initialize success

2011/06/04 19:16:00.0300 8592 ================================================================================

2011/06/04 19:16:00.0300 8592 Scan started

2011/06/04 19:16:00.0300 8592 Mode: Manual;

2011/06/04 19:16:00.0300 8592 ================================================================================

2011/06/04 19:16:01.0232 8592 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

2011/06/04 19:16:01.0303 8592 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys

2011/06/04 19:16:01.0368 8592 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys

2011/06/04 19:16:01.0414 8592 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys

2011/06/04 19:16:01.0458 8592 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys

2011/06/04 19:16:01.0620 8592 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys

2011/06/04 19:16:01.0699 8592 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys

2011/06/04 19:16:01.0789 8592 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

2011/06/04 19:16:01.0831 8592 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys

2011/06/04 19:16:01.0876 8592 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys

2011/06/04 19:16:01.0970 8592 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys

2011/06/04 19:16:02.0007 8592 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys

2011/06/04 19:16:02.0051 8592 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys

2011/06/04 19:16:02.0117 8592 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys

2011/06/04 19:16:02.0167 8592 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys

2011/06/04 19:16:02.0275 8592 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

2011/06/04 19:16:02.0309 8592 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

2011/06/04 19:16:02.0394 8592 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

2011/06/04 19:16:02.0466 8592 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

2011/06/04 19:16:02.0587 8592 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

2011/06/04 19:16:02.0623 8592 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

2011/06/04 19:16:02.0666 8592 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\DRIVERS\BrSerId.sys

2011/06/04 19:16:02.0700 8592 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

2011/06/04 19:16:02.0734 8592 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

2011/06/04 19:16:02.0761 8592 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\DRIVERS\BrUsbSer.sys

2011/06/04 19:16:02.0870 8592 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

2011/06/04 19:16:02.0974 8592 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

2011/06/04 19:16:03.0036 8592 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

2011/06/04 19:16:03.0147 8592 cfwids (7fd604cd7a7a0ff8975af61bdf64c577) C:\Windows\system32\drivers\cfwids.sys

2011/06/04 19:16:03.0182 8592 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys

2011/06/04 19:16:03.0236 8592 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

2011/06/04 19:16:03.0299 8592 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys

2011/06/04 19:16:03.0345 8592 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

2011/06/04 19:16:03.0447 8592 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys

2011/06/04 19:16:03.0480 8592 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys

2011/06/04 19:16:03.0549 8592 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys

2011/06/04 19:16:03.0630 8592 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

2011/06/04 19:16:03.0721 8592 DLABMFSM (f334299a3ba04206825aa9fcddb93906) C:\Windows\system32\Drivers\DLABMFSM.SYS

2011/06/04 19:16:03.0760 8592 DLABOIOM (9df7fd7a31aa4444b20dd8a93c185c0a) C:\Windows\system32\Drivers\DLABOIOM.SYS

2011/06/04 19:16:03.0783 8592 DLACDBHM (7c7b0ebb364e016735b3aaad3347de81) C:\Windows\system32\Drivers\DLACDBHM.SYS

2011/06/04 19:16:03.0818 8592 DLADResM (706350858342059c9ea81f06e37f4e72) C:\Windows\system32\Drivers\DLADResM.SYS

2011/06/04 19:16:03.0860 8592 DLAIFS_M (3aa7958756330169881c3f47eea37bcc) C:\Windows\system32\Drivers\DLAIFS_M.SYS

2011/06/04 19:16:03.0890 8592 DLAOPIOM (5a2b563fc4e10639ecb0569e48b942c0) C:\Windows\system32\Drivers\DLAOPIOM.SYS

2011/06/04 19:16:03.0917 8592 DLAPoolM (15a737af1dad3af3d202350da5d820c0) C:\Windows\system32\Drivers\DLAPoolM.SYS

2011/06/04 19:16:03.0943 8592 DLARTL_M (4c1f0e1aa60d4ce1d508c118b16866df) C:\Windows\system32\Drivers\DLARTL_M.SYS

2011/06/04 19:16:03.0971 8592 DLAUDFAM (df4e0c57e52f5e4d91609e5bdbd50863) C:\Windows\system32\Drivers\DLAUDFAM.SYS

2011/06/04 19:16:03.0994 8592 DLAUDF_M (02c51b8a38b50a0da4af7c1eb7484270) C:\Windows\system32\Drivers\DLAUDF_M.SYS

2011/06/04 19:16:04.0090 8592 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

2011/06/04 19:16:04.0128 8592 DRVMCDB (99b8d4fda8db7f61eeac6170355f7d6e) C:\Windows\system32\Drivers\DRVMCDB.SYS

2011/06/04 19:16:04.0197 8592 DRVNDDM (5446f12f7157a1944cfd417085ebb62a) C:\Windows\system32\Drivers\DRVNDDM.SYS

2011/06/04 19:16:04.0251 8592 dsNcAdpt (b2c3f71b86e25c3df78339ddb40a7562) C:\Windows\system32\DRIVERS\dsNcAdpt.sys

2011/06/04 19:16:04.0341 8592 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

2011/06/04 19:16:04.0390 8592 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys

2011/06/04 19:16:04.0481 8592 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

2011/06/04 19:16:04.0534 8592 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys

2011/06/04 19:16:04.0649 8592 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

2011/06/04 19:16:04.0696 8592 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

2011/06/04 19:16:04.0753 8592 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

2011/06/04 19:16:04.0845 8592 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

2011/06/04 19:16:04.0896 8592 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

2011/06/04 19:16:05.0029 8592 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys

2011/06/04 19:16:05.0114 8592 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

2011/06/04 19:16:05.0237 8592 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

2011/06/04 19:16:05.0288 8592 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys

2011/06/04 19:16:05.0401 8592 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

2011/06/04 19:16:05.0460 8592 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

2011/06/04 19:16:05.0548 8592 HidBatt (1eea61828eb0263b97252842c07e5a1c) C:\Windows\system32\DRIVERS\HidBatt.sys

2011/06/04 19:16:05.0611 8592 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

2011/06/04 19:16:05.0640 8592 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

2011/06/04 19:16:05.0708 8592 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

2011/06/04 19:16:05.0744 8592 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys

2011/06/04 19:16:05.0845 8592 HSF_DP (88749fbf8beb18c90e7d6626c8c1910b) C:\Windows\system32\DRIVERS\HSX_DP.sys

2011/06/04 19:16:05.0909 8592 HSXHWBS2 (fe440536bd98af772130dc3a6fe1915f) C:\Windows\system32\DRIVERS\HSXHWBS2.sys

2011/06/04 19:16:05.0980 8592 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

2011/06/04 19:16:06.0022 8592 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys

2011/06/04 19:16:06.0106 8592 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

2011/06/04 19:16:06.0159 8592 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys

2011/06/04 19:16:06.0231 8592 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

2011/06/04 19:16:06.0390 8592 IntcAzAudAddService (3914ea9111dbeffaf1c68200817768ad) C:\Windows\system32\drivers\RTKVHDA.sys

2011/06/04 19:16:06.0463 8592 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys

2011/06/04 19:16:06.0507 8592 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys

2011/06/04 19:16:06.0625 8592 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

2011/06/04 19:16:06.0688 8592 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys

2011/06/04 19:16:06.0751 8592 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

2011/06/04 19:16:06.0820 8592 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

2011/06/04 19:16:06.0889 8592 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys

2011/06/04 19:16:07.0012 8592 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

2011/06/04 19:16:07.0055 8592 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

2011/06/04 19:16:07.0113 8592 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

2011/06/04 19:16:07.0164 8592 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

2011/06/04 19:16:07.0203 8592 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

2011/06/04 19:16:07.0275 8592 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

2011/06/04 19:16:07.0430 8592 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

2011/06/04 19:16:07.0559 8592 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys

2011/06/04 19:16:07.0635 8592 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys

2011/06/04 19:16:07.0693 8592 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys

2011/06/04 19:16:07.0768 8592 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

2011/06/04 19:16:07.0823 8592 MBAMProtector (836e0e09ca9869be7eb39ef2cf3602c7) C:\Windows\system32\drivers\mbam.sys

2011/06/04 19:16:07.0939 8592 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

2011/06/04 19:16:07.0984 8592 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys

2011/06/04 19:16:08.0048 8592 mfeapfk (113445fc6a858ef453cded5b0a0df665) C:\Windows\system32\drivers\mfeapfk.sys

2011/06/04 19:16:08.0087 8592 mfeavfk (dbf6e1b388d5c070d438c61adb990c30) C:\Windows\system32\drivers\mfeavfk.sys

2011/06/04 19:16:08.0160 8592 mfebopk (a528b15e330edb83ea649be318d841d5) C:\Windows\system32\drivers\mfebopk.sys

2011/06/04 19:16:08.0212 8592 mfefirek (c7da1b8003c89acedaa13768f7a1c622) C:\Windows\system32\drivers\mfefirek.sys

2011/06/04 19:16:08.0299 8592 mfehidk (5e9679bb2fc4fa38ec8ca906c47acd46) C:\Windows\system32\drivers\mfehidk.sys

2011/06/04 19:16:08.0344 8592 mfenlfk (3a1aa28066785449da570462e0532d0c) C:\Windows\system32\DRIVERS\mfenlfk.sys

2011/06/04 19:16:08.0388 8592 mferkdet (ce1711f7c3f72f6762abd241dcfd5ee1) C:\Windows\system32\drivers\mferkdet.sys

2011/06/04 19:16:08.0443 8592 mfewfpk (b2baac6bbedda3e26e82db13fa0e5bee) C:\Windows\system32\drivers\mfewfpk.sys

2011/06/04 19:16:08.0493 8592 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

2011/06/04 19:16:08.0531 8592 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

2011/06/04 19:16:08.0594 8592 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

2011/06/04 19:16:08.0641 8592 mouhid (a3a6dff7e9e757db3df51a833bc28885) C:\Windows\system32\drivers\mouhid.sys

2011/06/04 19:16:08.0689 8592 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

2011/06/04 19:16:08.0742 8592 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys

2011/06/04 19:16:08.0807 8592 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

2011/06/04 19:16:08.0875 8592 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

2011/06/04 19:16:08.0914 8592 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

2011/06/04 19:16:08.0957 8592 mrxsmb (5fe5cf325f5b02ebc60832d3440cb414) C:\Windows\system32\DRIVERS\mrxsmb.sys

2011/06/04 19:16:08.0997 8592 mrxsmb10 (30b9c769446af379a2afb72b0392604d) C:\Windows\system32\DRIVERS\mrxsmb10.sys

2011/06/04 19:16:09.0036 8592 mrxsmb20 (fea239b3ec4877e2b7e23204af589ddf) C:\Windows\system32\DRIVERS\mrxsmb20.sys

2011/06/04 19:16:09.0089 8592 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys

2011/06/04 19:16:09.0150 8592 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys

2011/06/04 19:16:09.0214 8592 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

2011/06/04 19:16:09.0266 8592 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

2011/06/04 19:16:09.0311 8592 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

2011/06/04 19:16:09.0350 8592 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

2011/06/04 19:16:09.0400 8592 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

2011/06/04 19:16:09.0473 8592 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

2011/06/04 19:16:09.0511 8592 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

2011/06/04 19:16:09.0548 8592 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

2011/06/04 19:16:09.0584 8592 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

2011/06/04 19:16:09.0631 8592 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

2011/06/04 19:16:09.0691 8592 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

2011/06/04 19:16:09.0769 8592 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

2011/06/04 19:16:09.0813 8592 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

2011/06/04 19:16:09.0857 8592 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

2011/06/04 19:16:09.0907 8592 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

2011/06/04 19:16:09.0941 8592 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

2011/06/04 19:16:10.0000 8592 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

2011/06/04 19:16:10.0116 8592 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

2011/06/04 19:16:10.0195 8592 NPF (b15e0180c43d8b5219196d76878cc2dd) C:\Windows\system32\drivers\npf.sys

2011/06/04 19:16:10.0239 8592 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

2011/06/04 19:16:10.0299 8592 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

2011/06/04 19:16:10.0379 8592 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

2011/06/04 19:16:10.0469 8592 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

2011/06/04 19:16:10.0510 8592 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

2011/06/04 19:16:10.0589 8592 NVENETFD (d958a2b5f6ad5c3b8ccdc4d7da62466c) C:\Windows\system32\DRIVERS\nvmfdx32.sys

2011/06/04 19:16:10.0932 8592 nvlddmkm (e0434dccf91a47d9d8a785af83865d7d) C:\Windows\system32\DRIVERS\nvlddmkm.sys

2011/06/04 19:16:11.0122 8592 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys

2011/06/04 19:16:11.0157 8592 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys

2011/06/04 19:16:11.0205 8592 nvstor32 (7eba6c9a0a295b1559efb9062e701218) C:\Windows\system32\drivers\nvstor32.sys

2011/06/04 19:16:11.0251 8592 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys

2011/06/04 19:16:11.0345 8592 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

2011/06/04 19:16:11.0477 8592 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

2011/06/04 19:16:11.0539 8592 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

2011/06/04 19:16:11.0571 8592 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

2011/06/04 19:16:11.0633 8592 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

2011/06/04 19:16:11.0660 8592 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

2011/06/04 19:16:11.0696 8592 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

2011/06/04 19:16:11.0827 8592 PD0620VID (4431f2fa27f56f4bc654b0af5810cc91) C:\Windows\system32\DRIVERS\P0620Vid.sys

2011/06/04 19:16:11.0924 8592 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

2011/06/04 19:16:12.0286 8592 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

2011/06/04 19:16:12.0375 8592 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys

2011/06/04 19:16:12.0497 8592 Ps2 (390c204ced3785609ab24e9c52054a84) C:\Windows\system32\DRIVERS\PS2.sys

2011/06/04 19:16:12.0787 8592 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

2011/06/04 19:16:13.0001 8592 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\Windows\system32\Drivers\PxHelp20.sys

2011/06/04 19:16:13.0366 8592 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys

2011/06/04 19:16:13.0605 8592 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

2011/06/04 19:16:13.0719 8592 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

2011/06/04 19:16:13.0761 8592 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

2011/06/04 19:16:13.0826 8592 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

2011/06/04 19:16:13.0903 8592 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

2011/06/04 19:16:13.0973 8592 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

2011/06/04 19:16:14.0253 8592 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

2011/06/04 19:16:14.0453 8592 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

2011/06/04 19:16:14.0553 8592 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys

2011/06/04 19:16:14.0577 8592 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

2011/06/04 19:16:14.0637 8592 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

2011/06/04 19:16:14.0756 8592 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

2011/06/04 19:16:14.0831 8592 s616bus (ef4b5a8d53f15cb269469dd4e4bb0109) C:\Windows\system32\DRIVERS\s616bus.sys

2011/06/04 19:16:14.0887 8592 s616mdfl (96187731eefcf83e844bc1ce6617aaeb) C:\Windows\system32\DRIVERS\s616mdfl.sys

2011/06/04 19:16:14.0976 8592 s616mdm (d2dd87368bfecfa099e50dc120f3f513) C:\Windows\system32\DRIVERS\s616mdm.sys

2011/06/04 19:16:15.0051 8592 s616mgmt (5f0be24e4d4fa134b0b2fef35d3a9d90) C:\Windows\system32\DRIVERS\s616mgmt.sys

2011/06/04 19:16:15.0095 8592 s616nd5 (b9b507fcc67e204ef38e05ffd4176345) C:\Windows\system32\DRIVERS\s616nd5.sys

2011/06/04 19:16:15.0159 8592 s616obex (f123a1f2a04a0e8dba80b64f0072475a) C:\Windows\system32\DRIVERS\s616obex.sys

2011/06/04 19:16:15.0192 8592 s616unic (e7e55048ebd5c17bfa791b4a6ec3d54b) C:\Windows\system32\DRIVERS\s616unic.sys

2011/06/04 19:16:15.0267 8592 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

2011/06/04 19:16:15.0324 8592 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

2011/06/04 19:16:15.0379 8592 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

2011/06/04 19:16:15.0421 8592 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

2011/06/04 19:16:15.0470 8592 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

2011/06/04 19:16:15.0552 8592 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys

2011/06/04 19:16:15.0577 8592 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys

2011/06/04 19:16:15.0631 8592 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys

2011/06/04 19:16:15.0655 8592 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

2011/06/04 19:16:15.0719 8592 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys

2011/06/04 19:16:15.0759 8592 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys

2011/06/04 19:16:15.0795 8592 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys

2011/06/04 19:16:15.0889 8592 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

2011/06/04 19:16:15.0975 8592 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

2011/06/04 19:16:16.0046 8592 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

2011/06/04 19:16:16.0097 8592 srv2 (a5940ca32ed206f90be9fabdf6e92de4) C:\Windows\system32\DRIVERS\srv2.sys

2011/06/04 19:16:16.0126 8592 srvnet (37aa1d560d5fa486c4b11c2f276ada61) C:\Windows\system32\DRIVERS\srvnet.sys

2011/06/04 19:16:16.0211 8592 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys

2011/06/04 19:16:16.0249 8592 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

2011/06/04 19:16:16.0322 8592 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

2011/06/04 19:16:16.0351 8592 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

2011/06/04 19:16:16.0381 8592 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

2011/06/04 19:16:16.0475 8592 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys

2011/06/04 19:16:16.0557 8592 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys

2011/06/04 19:16:16.0608 8592 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

2011/06/04 19:16:16.0668 8592 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

2011/06/04 19:16:16.0706 8592 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

2011/06/04 19:16:16.0751 8592 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

2011/06/04 19:16:16.0783 8592 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

2011/06/04 19:16:16.0861 8592 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

2011/06/04 19:16:16.0903 8592 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

2011/06/04 19:16:16.0968 8592 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

2011/06/04 19:16:17.0060 8592 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys

2011/06/04 19:16:17.0167 8592 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

2011/06/04 19:16:17.0231 8592 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys

2011/06/04 19:16:17.0276 8592 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys

2011/06/04 19:16:17.0351 8592 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

2011/06/04 19:16:17.0397 8592 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

2011/06/04 19:16:17.0460 8592 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

2011/06/04 19:16:17.0532 8592 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

2011/06/04 19:16:17.0581 8592 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

2011/06/04 19:16:17.0635 8592 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

2011/06/04 19:16:17.0697 8592 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

2011/06/04 19:16:17.0736 8592 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys

2011/06/04 19:16:17.0800 8592 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

2011/06/04 19:16:17.0839 8592 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys

2011/06/04 19:16:17.0884 8592 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

2011/06/04 19:16:17.0919 8592 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys

2011/06/04 19:16:18.0009 8592 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys

2011/06/04 19:16:18.0080 8592 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

2011/06/04 19:16:18.0126 8592 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys

2011/06/04 19:16:18.0162 8592 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys

2011/06/04 19:16:18.0196 8592 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys

2011/06/04 19:16:18.0236 8592 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

2011/06/04 19:16:18.0281 8592 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

2011/06/04 19:16:18.0359 8592 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

2011/06/04 19:16:18.0422 8592 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys

2011/06/04 19:16:18.0483 8592 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

2011/06/04 19:16:18.0521 8592 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/06/04 19:16:18.0538 8592 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

2011/06/04 19:16:18.0593 8592 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys

2011/06/04 19:16:18.0652 8592 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

2011/06/04 19:16:18.0782 8592 winachsf (72cc6a8ca7891031d6380db5025c773c) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

2011/06/04 19:16:18.0979 8592 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys

2011/06/04 19:16:19.0099 8592 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

2011/06/04 19:16:19.0170 8592 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

2011/06/04 19:16:19.0271 8592 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

2011/06/04 19:16:19.0325 8592 XAudio (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys

2011/06/04 19:16:19.0379 8592 MBR (0x1B8) (8913823ff508ccf109db74b636c301da) \Device\Harddisk0\DR0

2011/06/04 19:16:19.0411 8592 ================================================================================

2011/06/04 19:16:19.0411 8592 Scan finished

2011/06/04 19:16:19.0411 8592 ================================================================================

2011/06/04 19:16:19.0429 9940 Detected object count: 0

2011/06/04 19:16:19.0429 9940 Actual detected object count: 0

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

I don't see anything back there.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  • Double click on ComboFix.exe & follow the prompts.
    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
    Note: If you have XP SP3, use the XP SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites
atlanta678

atlanta678

Posted
  • Author
Posted

I did uninstall mcafee but the log still shows it installed...

My machine is behaving normally really. It just shows the malware prevention message when I try to do a google search - this is the only abnormality that I can see.

ComboFix 11-06-06.02 - Darrell 06/06/2011 18:57:01.1.2 - x86

Microsoft

Link to post
Share on other sites
atlanta678

atlanta678

Posted
  • Author
Posted

malware prevention message when I try to do a google search

I haven't seen that before.

Can you discribe that better?

Here is the anti-malware log from a few days ago. With each of these comes the message saying that anti-malware has blocked an attempt to reach IP.....

08:51:39 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58171, Process: rundll32.exe)

08:51:39 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58178, Process: rundll32.exe)

08:51:39 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58179, Process: rundll32.exe)

08:51:39 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58180, Process: rundll32.exe)

08:56:59 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 58356, Process: rundll32.exe)

08:57:07 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 58358, Process: rundll32.exe)

09:02:27 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 58539, Process: rundll32.exe)

09:02:27 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 58540, Process: rundll32.exe)

09:02:27 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 58541, Process: rundll32.exe)

09:06:28 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58682, Process: rundll32.exe)

09:06:36 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58683, Process: rundll32.exe)

09:06:36 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58684, Process: rundll32.exe)

09:06:36 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58685, Process: rundll32.exe)

09:12:04 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 58863, Process: rundll32.exe)

09:16:12 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59000, Process: rundll32.exe)

09:16:12 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59002, Process: rundll32.exe)

09:21:41 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59180, Process: rundll32.exe)

09:21:41 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59181, Process: rundll32.exe)

09:21:41 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59183, Process: rundll32.exe)

09:27:25 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 59365, Process: rundll32.exe)

09:33:41 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59572, Process: rundll32.exe)

09:33:41 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59573, Process: rundll32.exe)

09:37:34 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59695, Process: rundll32.exe)

09:37:34 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 59697, Process: rundll32.exe)

09:55:51 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60294, Process: rundll32.exe)

09:55:51 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60295, Process: rundll32.exe)

10:07:29 Darrell MESSAGE Scheduled update executed successfully

10:07:30 Darrell MESSAGE IP Protection stopped

10:07:33 Darrell MESSAGE Database updated successfully

10:07:36 Darrell MESSAGE IP Protection started successfully

10:15:01 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60886, Process: rundll32.exe)

10:15:01 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60887, Process: rundll32.exe)

10:15:01 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60888, Process: rundll32.exe)

10:15:01 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 60889, Process: rundll32.exe)

10:31:34 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 61374, Process: rundll32.exe)

10:31:34 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 61379, Process: rundll32.exe)

10:31:34 Darrell IP-BLOCK 94.75.207.72 (Type: outgoing, Port: 61381, Process: rundll32.exe)

10:42:23 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 61672, Process: rundll32.exe)

10:42:23 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 61673, Process: rundll32.exe)

10:42:23 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 61674, Process: rundll32.exe)

10:42:23 Darrell IP-BLOCK 94.75.207.73 (Type: outgoing, Port: 61675, Process: rundll32.exe)

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

KillAll::

RegLock:: 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

CFScriptB-4.gif

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites
atlanta678

atlanta678

Posted
  • Author
Posted

Yes If you are still being redirected

The redirect messages have stopped and my browser is running faster then ever. I think all is good. Thank you so much for your help!!!

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Good job thumbup.gif

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7

  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good :D

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
    13. Next press the Apply button and then the OK to exit the Internet Properties page.

    [*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week

    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    [*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.

    Without a firewall your computer is succeptible to being hacked and taken over.

    I am very serious about this and see it happen almost every day with my clients.

    Simply using a Firewall in its default configuration can lower your risk greatly.

    [*]Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.