Jump to content

Can't remove a virus

jp504
 Share

Recommended Posts

jp504

jp504

Posted
Posted

Hi there,

I've tried the tools recommended on these forums to remove a persistent redirect virus which my AV can't detect. Log files attached, any help gratefully received.

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 9.0.8112.16421

Run by JP at 12:19:25 on 2011-07-03

.

============== Running Processes ===============

.

C:\PROGRA~1\AVG\AVG10\avgchsvx.exe

C:\PROGRA~1\AVG\AVG10\avgrsx.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\AERTSrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe

C:\Program Files\McAfee\Common Framework\naPrdMgr.exe

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Program Files\AVG\AVG10\avgnsx.exe

C:\Program Files\AVG\AVG10\avgemcx.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\TeamViewer\Version6\TeamViewer.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\Program Files\Trend Micro\RUBotted\RUBottedGUI.exe

C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Users\Jonathan Phillips\Desktop\dds.scr

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.co.uk/

uWindow Title = Internet Explorer provided by Dell

uDefault_Page_URL = hxxp://www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=2080614

uSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRunOnce: [shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103472 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506; .NET CLR 1.1.4322)" -"http://www.miniclip.com/games/jet-ski-racing/en/"

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe

mRun: [Trend Micro RUBotted V2.0 Beta] c:\program files\trend micro\rubotted\RUBottedGUI.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{5263639B-0F36-4DD0-AC1B-626DD9DC21D7} : DhcpNameServer = 192.168.1.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL

.

============= SERVICES / DRIVERS ===============

.

R? 0062951307559397mcinstcleanup;McAfee Application Installer Cleanup (0062951307559397)

R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

R? GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335

R? NUVision;Hauppauge WinTV USB Pro (PAL I)

R? SBSDWSCService;SBSD Security Center Service

R? utmxmzuz;AVZ Kernel Driver

R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0

S? AERTFilters;Andrea RT Filters Service

S? AVGIDSAgent;AVGIDSAgent

S? AVGIDSDriver;AVGIDSDriver

S? AVGIDSEH;AVGIDSEH

S? AVGIDSFilter;AVGIDSFilter

S? AVGIDSShim;AVGIDSShim

S? Avgldx86;AVG AVI Loader Driver

S? Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield

S? Avgrkx86;AVG Anti-Rootkit Driver

S? Avgtdix;AVG TDI Driver

S? avgwd;AVG WatchDog

S? FontCache;Windows Font Cache Service

S? MBAMProtector;MBAMProtector

S? MBAMService;MBAMService

S? McAfeeFramework;McAfee Framework Service

S? MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver

S? NPF;NetGroup Packet Filter Driver

S? RUBotSrv;Trend Micro RUBotted Service

S? TeamViewer6;TeamViewer 6

.

=============== Created Last 30 ================

.

2011-07-02 23:04:18 -------- d-----w- c:\programdata\Trend Micro

2011-07-02 22:54:01 -------- d-----w- c:\program files\WinPcap

2011-07-02 22:45:30 388096 ----a-r- c:\users\jonathan phillips\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-07-02 22:45:28 -------- d-----w- c:\program files\Trend Micro

2011-07-02 22:01:38 -------- d-----w- c:\program files\common files\Symantec Shared

2011-07-02 21:58:57 -------- d-----w- c:\programdata\Symantec

2011-07-02 21:58:48 -------- d-----w- c:\programdata\Norton

2011-07-02 21:58:46 -------- d-----w- c:\programdata\NortonInstaller

2011-07-01 13:13:11 -------- d-----w- c:\users\jonathan phillips\appdata\roaming\AVG

2011-06-30 22:36:13 221568 ----a-w- c:\windows\system32\drivers\netio.sys

2011-06-30 20:18:52 -------- d--h--w- C:\$AVG

2011-06-30 19:41:20 -------- d-----w- c:\users\jonathan phillips\appdata\roaming\AVG10

2011-06-30 19:40:07 -------- d--h--w- c:\programdata\Common Files

2011-06-30 19:36:27 -------- d-----w- c:\windows\system32\drivers\AVG

2011-06-30 19:36:27 -------- d-----w- c:\programdata\AVG10

2011-06-30 19:35:14 -------- d-----w- c:\program files\AVG

2011-06-30 19:34:38 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-30 19:29:57 -------- d-----w- c:\programdata\Kaspersky Lab

2011-06-30 19:25:55 -------- d-----w- c:\programdata\MFAData

2011-06-30 19:23:30 -------- d-----w- c:\program files\Lavasoft

2011-06-29 12:28:29 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-29 12:12:57 276992 ----a-w- c:\windows\system32\schannel.dll

2011-06-23 22:22:44 920088 ----a-w- c:\windows\system32\igxpun.exe

2011-06-23 22:22:44 -------- d-----w- c:\windows\system32\x64

2011-06-23 22:22:42 319456 ----a-w- c:\windows\system32\difxapi.dll

2011-06-23 21:52:31 -------- d-----w- c:\users\jonathan phillips\appdata\roaming\Malwarebytes

2011-06-23 21:52:15 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-23 21:52:14 -------- d-----w- c:\programdata\Malwarebytes

2011-06-23 21:52:08 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-23 21:52:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-23 12:18:24 -------- d-----w- c:\users\jonathan phillips\appdata\roaming\MiKTeX

2011-06-23 12:17:28 -------- d-----w- c:\users\jonathan phillips\appdata\local\MiKTeX

2011-06-23 12:12:31 -------- d-----w- c:\programdata\MiKTeX

2011-06-23 12:07:36 -------- d-----w- c:\program files\MiKTeX 2.9

2011-06-23 12:04:35 -------- d-----w- c:\program files\iPod

2011-06-23 12:04:31 -------- d-----w- c:\program files\iTunes

2011-06-23 11:59:00 -------- d-----w- c:\program files\Bonjour

2011-06-22 23:30:33 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-06-22 23:15:54 876032 ----a-w- c:\windows\system32\XpsPrint.dll

2011-06-22 22:46:00 307200 ----a-w- c:\program files\internet explorer\iediagcmd.exe

2011-06-22 22:46:00 161792 ----a-w- c:\windows\system32\msls31.dll

2011-06-22 22:46:00 141104 ----a-w- c:\program files\internet explorer\sqmapi.dll

2011-06-22 22:46:00 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-06-22 22:46:00 107008 ----a-w- c:\program files\internet explorer\iecleanup.exe

2011-06-22 22:34:17 -------- d-----w- c:\program files\Windows Portable Devices

2011-06-22 20:33:44 469256 ----a-w- c:\program files\common files\windows live\.cache\ad4a56b01cc311b2e\InstallManager_WLE_WLE.exe

2011-06-22 20:33:00 15712 ----a-w- c:\program files\common files\windows live\.cache\9433c3001cc311b21\MeshBetaRemover.exe

2011-06-22 20:32:30 94040 ----a-w- c:\program files\common files\windows live\.cache\813517401cc311b1a\DSETUP.dll

2011-06-22 20:32:30 525656 ----a-w- c:\program files\common files\windows live\.cache\813517401cc311b1a\DXSETUP.exe

2011-06-22 20:32:30 1691480 ----a-w- c:\program files\common files\windows live\.cache\813517401cc311b1a\dsetup32.dll

2011-06-22 20:32:28 94040 ----a-w- c:\program files\common files\windows live\.cache\8048bb701cc311b19\DSETUP.dll

2011-06-22 20:32:28 525656 ----a-w- c:\program files\common files\windows live\.cache\8048bb701cc311b19\DXSETUP.exe

2011-06-22 20:32:28 1691480 ----a-w- c:\program files\common files\windows live\.cache\8048bb701cc311b19\dsetup32.dll

2011-06-22 20:31:39 6260088 ----a-w- c:\program files\common files\windows live\.cache\62bc08f01cc311b0e\Silverlight.4.0.exe

2011-06-22 20:30:42 -------- d-----w- c:\users\jonathan phillips\appdata\local\Windows Live

2011-06-22 20:29:10 754688 ----a-w- c:\windows\system32\webservices.dll

2011-06-22 20:26:36 92672 ----a-w- c:\windows\system32\UIAnimation.dll

2011-06-22 20:26:32 3023360 ----a-w- c:\windows\system32\UIRibbon.dll

2011-06-22 20:26:32 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll

2011-06-22 20:24:47 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2011-06-22 20:24:38 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

2011-06-22 20:24:37 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll

2011-06-22 20:24:37 519680 ----a-w- c:\windows\system32\d3d11.dll

2011-06-22 20:24:37 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll

2011-06-22 20:24:37 252928 ----a-w- c:\windows\system32\dxdiag.exe

2011-06-22 20:24:37 195584 ----a-w- c:\windows\system32\dxdiagn.dll

2011-06-22 20:20:25 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-06-22 20:20:24 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-06-22 20:20:24 234496 ----a-w- c:\windows\system32\oleacc.dll

2011-06-22 20:05:54 98816 ----a-w- c:\windows\system32\mfps.dll

2011-06-22 20:05:54 258048 ----a-w- c:\windows\system32\winspool.drv

2011-06-22 20:05:53 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2011-06-22 20:04:31 683008 ----a-w- c:\windows\system32\d2d1.dll

2011-06-22 20:04:31 160768 ----a-w- c:\windows\system32\d3d10_1.dll

2011-06-22 20:04:31 1172480 ----a-w- c:\windows\system32\d3d10warp.dll

2011-06-22 20:04:30 797696 ----a-w- c:\windows\system32\FntCache.dll

2011-06-22 20:04:30 1068544 ----a-w- c:\windows\system32\DWrite.dll

2011-06-22 20:04:30 1029120 ----a-w- c:\windows\system32\d3d10.dll

2011-06-22 20:04:29 486400 ----a-w- c:\windows\system32\d3d10level9.dll

2011-06-22 20:04:29 219648 ----a-w- c:\windows\system32\d3d10_1core.dll

2011-06-22 20:04:29 189952 ----a-w- c:\windows\system32\d3d10core.dll

2011-06-22 20:04:29 1554432 ----a-w- c:\windows\system32\xpsservices.dll

2011-06-22 20:04:28 847360 ----a-w- c:\windows\system32\OpcServices.dll

2011-06-22 20:04:28 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll

2011-06-22 19:15:48 -------- d-----w- c:\windows\system32\eu-ES

2011-06-22 19:15:48 -------- d-----w- c:\windows\system32\ca-ES

2011-06-22 19:15:45 -------- d-----w- c:\windows\system32\vi-VN

2011-06-22 10:51:20 -------- d-----w- c:\windows\system32\EventProviders

2011-06-22 10:12:03 28672 ----a-w- c:\windows\system32\Apphlpdm.dll

2011-06-22 10:12:02 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll

2011-06-22 01:13:05 7680 ----a-w- c:\program files\internet explorer\iecompat.dll

2011-06-22 01:11:34 355832 ----a-w- c:\program files\internet explorer\pdm.dll

2011-06-22 01:11:34 265720 ----a-w- c:\program files\internet explorer\msdbg2.dll

2011-06-22 00:54:21 18904 ----a-w- c:\windows\system32\StructuredQuerySchemaTrivial.bin

2011-06-22 00:51:58 619864 ----a-w- c:\windows\system32\icardagt.exe

2011-06-22 00:50:59 438784 ----a-w- c:\windows\system32\IKEEXT.DLL

2011-06-22 00:49:59 88576 ----a-w- c:\windows\system32\audiodg.exe

2011-06-22 00:48:54 83968 ----a-w- c:\windows\system32\wbem\wmiutils.dll

2011-06-22 00:48:54 744448 ----a-w- c:\windows\system32\wbem\wbemcore.dll

2011-06-22 00:48:54 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll

2011-06-22 00:48:54 30208 ----a-w- c:\windows\system32\wbem\wbemprox.dll

2011-06-22 00:48:54 265728 ----a-w- c:\windows\system32\wbem\repdrvfs.dll

2011-06-22 00:48:54 265728 ----a-w- c:\windows\system32\wbem\esscli.dll

2011-06-22 00:48:54 189440 ----a-w- c:\windows\system32\wbem\mofd.dll

2011-06-22 00:48:51 705536 ----a-w- c:\windows\system32\SmiEngine.dll

2011-06-22 00:48:45 218624 ----a-w- c:\windows\system32\wdscore.dll

2011-06-22 00:48:45 130560 ----a-w- c:\windows\system32\PkgMgr.exe

2011-06-22 00:48:31 247808 ----a-w- c:\windows\system32\drvstore.dll

2011-06-22 00:45:23 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll

2011-06-22 00:45:23 49472 ----a-w- c:\windows\system32\netfxperf.dll

2011-06-22 00:45:23 297808 ----a-w- c:\windows\system32\mscoree.dll

2011-06-22 00:45:23 295264 ----a-w- c:\windows\system32\PresentationHost.exe

2011-06-22 00:45:23 1130824 ----a-w- c:\windows\system32\dfshim.dll

2011-06-22 00:44:46 413696 ----a-w- c:\windows\system32\odbc32.dll

2011-06-22 00:44:45 708608 ----a-w- c:\program files\common files\system\ado\msado15.dll

2011-06-22 00:44:44 57344 ----a-w- c:\program files\common files\system\msadc\msadcs.dll

2011-06-22 00:44:44 253952 ----a-w- c:\program files\common files\system\ado\msadox.dll

2011-06-22 00:44:44 241664 ----a-w- c:\program files\common files\system\ado\msadomd.dll

2011-06-22 00:44:44 180224 ----a-w- c:\program files\common files\system\msadc\msadco.dll

2011-06-22 00:44:37 305152 ----a-w- c:\windows\system32\drivers\srv.sys

2011-06-22 00:44:31 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-06-22 00:44:25 75264 ----a-w- c:\windows\system32\drivers\dfsc.sys

2011-06-22 00:44:13 2048 ----a-w- c:\windows\system32\tzres.dll

2011-06-22 00:42:33 1696256 ----a-w- c:\windows\system32\gameux.dll

2011-06-22 00:42:20 3602320 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-06-22 00:42:20 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-06-22 00:42:19 1205080 ----a-w- c:\windows\system32\ntdll.dll

2011-06-22 00:42:07 601600 ----a-w- c:\windows\system32\schedsvc.dll

2011-06-22 00:42:07 352768 ----a-w- c:\windows\system32\taskschd.dll

2011-06-22 00:42:05 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll

2011-06-22 00:42:05 270336 ----a-w- c:\windows\system32\taskcomp.dll

2011-06-22 00:42:05 171520 ----a-w- c:\windows\system32\taskeng.exe

2011-06-22 00:41:34 168960 ----a-w- c:\program files\windows media player\wmplayer.exe

2011-06-22 00:41:32 8147456 ----a-w- c:\windows\system32\wmploc.DLL

2011-06-22 00:39:55 125952 ----a-w- c:\windows\system32\srvsvc.dll

2011-06-22 00:39:54 17920 ----a-w- c:\windows\system32\netevent.dll

2011-06-22 00:37:56 502272 ----a-w- c:\windows\system32\usp10.dll

2011-06-22 00:37:51 10926592 ----a-w- c:\program files\movie maker\MOVIEMK.dll

2011-06-22 00:37:49 150016 ----a-w- c:\program files\movie maker\MOVIEMK.exe

2011-06-22 00:37:41 1616384 ----a-w- c:\program files\windows mail\msoe.dll

2011-06-22 00:37:29 1169408 ----a-w- c:\windows\system32\sdclt.exe

2011-06-22 00:37:25 739328 ----a-w- c:\windows\system32\inetcomm.dll

2011-06-22 00:37:13 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL

2011-06-22 00:37:09 86528 ----a-w- c:\windows\system32\dnsrslvr.dll

2011-06-22 00:37:09 25088 ----a-w- c:\windows\system32\dnscacheugc.exe

2011-06-22 00:37:04 515584 ----a-w- c:\program files\windows mail\wab.exe

2011-06-22 00:37:03 66048 ----a-w- c:\program files\windows mail\wabmig.exe

2011-06-22 00:37:03 33280 ----a-w- c:\program files\windows mail\wabfind.dll

2011-06-22 00:35:58 10240 ----a-w- c:\windows\system32\wsmplpxy.dll

2011-06-22 00:14:15 231424 ----a-w- c:\windows\system32\msshsq.dll

2011-06-22 00:14:09 79872 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-06-22 00:14:09 214016 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-06-22 00:14:08 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-06-22 00:13:58 81920 ----a-w- c:\windows\system32\iccvid.dll

2011-06-22 00:13:53 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat

2011-06-22 00:13:48 912776 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-06-22 00:13:47 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2011-06-21 23:56:43 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-06-21 23:56:43 2067968 ----a-w- c:\windows\system32\mstscax.dll

2011-06-21 23:56:42 63488 ----a-w- c:\windows\system32\tscupgrd.exe

2011-06-21 23:56:38 531968 ----a-w- c:\windows\system32\comctl32.dll

2011-06-21 22:15:14 -------- d-----w- C:\PerfLogs

2011-06-20 12:24:53 -------- d-----w- c:\program files\TeamViewer

2011-06-08 19:45:34 -------- d-----w- c:\windows\pss

2011-06-08 19:35:43 -------- d-----w- C:\QUARANTINE

2011-06-08 19:12:50 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2011-06-08 19:12:50 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-08 18:57:57 -------- d-----w- c:\program files\common files\Cisco Systems

.

==================== Find3M ====================

.

2011-06-20 12:41:07 101888 ----a-w- c:\windows\system32\ifxcardm.dll

2011-06-20 12:41:01 82432 ----a-w- c:\windows\system32\axaltocm.dll

2011-06-02 17:53:02 94208 ----a-w- c:\windows\system32\dpl100.dll

2011-05-10 07:06:08 4517664 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-05-10 07:06:08 42496 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2011-05-04 03:52:22 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-04-29 13:25:10 146432 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-04-29 13:25:09 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-04-21 13:58:27 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-04-14 20:28:18 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys

2011-04-06 15:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 15:20:16 197920 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 15:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe

2011-04-04 23:59:56 297168 ----a-w- c:\windows\system32\drivers\avgtdix.sys

.

============= FINISH: 12:22:47.74 ===============

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

  1. Tick the box next to YES, I accept the Terms of Use.
  2. Click Start
  3. When asked, allow the ActiveX control to install
  4. Click Start
  5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  6. Click Scan
    Wait for the scan to finish
  7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  8. Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

Link to post
Share on other sites
  • 2 weeks later...
jp504

jp504

Posted
  • Author
Posted

Hi there,

I think everything is sorted now, there doesn't seen to be any more redirecting. The logs are below.

Many thanks for all your help.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=839aa1ae6881ca43b304ff1977d0a3dc

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-07-19 10:24:32

# local_time=2011-07-19 11:24:32 (+0000, GMT Daylight Time)

# country="United Kingdom"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 1458663 1458663 0 0

# compatibility_mode=1024 16777215 100 0 0 0 0 0

# compatibility_mode=5121 16776573 33 3 2799150 2799150 0 0

# compatibility_mode=5892 16776573 100 100 0 148638608 0 0

# compatibility_mode=8192 67108863 100 0 511713 511713 0 0

# scanned=167610

# found=0

# cleaned=0

# scan_time=8391

Results of screen317's Security Check version 0.99.17

Windows Vista Service Pack 2 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

McAfee VirusScan Enterprise

McAfee Agent

Trend Micro RUBotted 2.0 Beta

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

AML Free Registry Cleaner 4.22

Java 6 Update 26

Java SE Runtime Environment 6

Adobe Flash Player

````````````````````````````````

Process Check:

objlist.exe by Laurent

Malwarebytes' Anti-Malware mbamservice.exe

Malwarebytes' Anti-Malware mbamgui.exe

McAfee VirusScan Enterprise shstat.exe

Trend Micro RUBotted RUBottedGUI.exe

``````````End of Log````````````

Link to post
Share on other sites
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Great!

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

ESET Online Scanner v3

Java™ SE Runtime Environment 6

Adobe Flash Player

Restart your computer.

Get the latest version of Adobe Flash Player.

Let me know what issues remain.

-screen317

Link to post
Share on other sites
  • 3 weeks later...
  • Staff
screen317

screen317

Posted
  • Staff
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.