What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Redirect virus also

37 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have a redirect problem also and have tried a lot of things. Your help is greatly appreciated. Thanks. Mike

I have

Combofix
GMER
Malwarebytes
Hijack This
AVG
AdAware


HJT log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:32:52 PM, on 8/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aimtoday.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 64.86.17.32 google.ae
O1 - Hosts: 64.86.17.32 google.as
O1 - Hosts: 64.86.17.32 google.at
O1 - Hosts: 64.86.17.32 google.az
O1 - Hosts: 64.86.17.32 google.ba
O1 - Hosts: 64.86.17.32 google.be
O1 - Hosts: 64.86.17.32 google.bg
O1 - Hosts: 64.86.17.32 google.bs
O1 - Hosts: 64.86.17.32 google.ca
O1 - Hosts: 64.86.17.32 google.cd
O1 - Hosts: 64.86.17.32 google.com.gh
O1 - Hosts: 64.86.17.32 google.com.hk
O1 - Hosts: 64.86.17.32 google.com.jm
O1 - Hosts: 64.86.17.32 google.com.mx
O1 - Hosts: 64.86.17.32 google.com.my
O1 - Hosts: 64.86.17.32 google.com.na
O1 - Hosts: 64.86.17.32 google.com.nf
O1 - Hosts: 64.86.17.32 google.com.ng
O1 - Hosts: 64.86.17.32 google.ch
O1 - Hosts: 64.86.17.32 google.com.np
O1 - Hosts: 64.86.17.32 google.com.pr
O1 - Hosts: 64.86.17.32 google.com.qa
O1 - Hosts: 64.86.17.32 google.com.sg
O1 - Hosts: 64.86.17.32 google.com.tj
O1 - Hosts: 64.86.17.32 google.com.tw
O1 - Hosts: 64.86.17.32 google.dj
O1 - Hosts: 64.86.17.32 google.de
O1 - Hosts: 64.86.17.32 google.dk
O1 - Hosts: 64.86.17.32 google.dm
O1 - Hosts: 64.86.17.32 google.ee
O1 - Hosts: 64.86.17.32 google.fi
O1 - Hosts: 64.86.17.32 google.fm
O1 - Hosts: 64.86.17.32 google.fr
O1 - Hosts: 64.86.17.32 google.ge
O1 - Hosts: 64.86.17.32 google.gg
O1 - Hosts: 64.86.17.32 google.gm
O1 - Hosts: 64.86.17.32 google.gr
O1 - Hosts: 64.86.17.32 google.ht
O1 - Hosts: 64.86.17.32 google.ie
O1 - Hosts: 64.86.17.32 google.im
O1 - Hosts: 64.86.17.32 google.in
O1 - Hosts: 64.86.17.32 google.it
O1 - Hosts: 64.86.17.32 google.ki
O1 - Hosts: 64.86.17.32 google.la
O1 - Hosts: 64.86.17.32 google.li
O1 - Hosts: 64.86.17.32 google.lv
O1 - Hosts: 64.86.17.32 google.ma
O1 - Hosts: 64.86.17.32 google.ms
O1 - Hosts: 64.86.17.32 google.mu
O1 - Hosts: 64.86.17.32 google.mw
O1 - Hosts: 64.86.17.32 google.nl
O1 - Hosts: 64.86.17.32 google.no
O1 - Hosts: 64.86.17.32 google.nr
O1 - Hosts: 64.86.17.32 google.nu
O1 - Hosts: 64.86.17.32 google.pl
O1 - Hosts: 64.86.17.32 google.pn
O1 - Hosts: 64.86.17.32 google.pt
O1 - Hosts: 64.86.17.32 google.ro
O1 - Hosts: 64.86.17.32 google.ru
O1 - Hosts: 64.86.17.32 google.rw
O1 - Hosts: 64.86.17.32 google.sc
O1 - Hosts: 64.86.17.32 google.se
O1 - Hosts: 64.86.17.32 google.sh
O1 - Hosts: 64.86.17.32 google.si
O1 - Hosts: 64.86.17.32 google.sm
O1 - Hosts: 64.86.17.32 google.sn
O1 - Hosts: 64.86.17.32 google.st
O1 - Hosts: 64.86.17.32 google.tl
O1 - Hosts: 64.86.17.32 google.tm
O1 - Hosts: 64.86.17.32 google.tt
O1 - Hosts: 64.86.17.32 google.us
O1 - Hosts: 64.86.17.32 google.vu
O1 - Hosts: 64.86.17.32 google.ws
O1 - Hosts: 64.86.17.32 google.co.ck
O1 - Hosts: 64.86.17.32 google.co.id
O1 - Hosts: 64.86.17.32 google.co.il
O1 - Hosts: 64.86.17.32 google.co.in
O1 - Hosts: 64.86.17.32 google.co.jp
O1 - Hosts: 64.86.17.32 google.co.kr
O1 - Hosts: 64.86.17.32 google.co.ls
O1 - Hosts: 64.86.17.32 google.co.ma
O1 - Hosts: 64.86.17.32 google.co.nz
O1 - Hosts: 64.86.17.32 google.co.tz
O1 - Hosts: 64.86.17.32 google.co.ug
O1 - Hosts: 64.86.17.32 google.co.uk
O1 - Hosts: 64.86.17.32 google.co.za
O1 - Hosts: 64.86.17.32 google.co.zm
O1 - Hosts: 64.86.17.32 google.com
O1 - Hosts: 64.86.17.32 google.com.af
O1 - Hosts: 64.86.17.32 google.com.ag
O1 - Hosts: 64.86.17.32 google.com.ar
O1 - Hosts: 64.86.17.32 google.com.au
O1 - Hosts: 64.86.17.32 google.com.bn
O1 - Hosts: 64.86.17.32 google.com.br
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Sharon')
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Sharon')
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Sharon')
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" (User 'Sharon')
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler (User 'Sharon')
O4 - HKUS\S-1-5-21-839522115-1336601894-2147053123-1004\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem (User 'Sharon')
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c1/v16.628/qboax10.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 12065 bytes
Post #2
Due, in part, to the large numbers of HJT logs being posted, there are four things that you need to be aware of.

1) If you have already posted this log at another forum, you need to post here that you have done so and this topic will be closed.
Multiple posting not only ties up valuable resources, but could also result is some unpleasant side-effects for your system if you follow two sets of instructions at the same time.
If, during research, an identical log is identified at another forum, this thread will be closed.

2) If you don't post a meaningful reply to any of my posts within five days, this thread will be closed. Due to limited free time I can only have so many open threads at any one time and if yours isn't active, somebody else's will be.
If, by omission, the thread hasn't be closed after five days and you post, it will just serve as a reminder to me to close it.
Please note that "I just dropped in to say Hi!" isn't a meaningful reply!

3) Malware removal is a tricky business, and malware writers don't tend to worry about the damage their creations do, so it is advisable to back-up all important files BEFORE we start. Although most cases have a successful conclusion, on occasion things don't go according to plan and it is better to be prepared for the worst.

4) Back-ups can get lost or damaged, so make two if the files are that important to you!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pay a visit to the Kaspersky Online Scanner 7 - I.E. is preferred for this scan.
  • Read the Information panel and then click Accept.
  • Allow the ActiveX download if necessary.
  • Both the anti-virus engine and database will need to be downloaded, which may take a little time.
  • Once this has been completed, select My Computer from the Scan section on the left hand side.
  • Put the kettle on!
  • Although it is recommended by Kaspersky that you should disable your anti-virus scanner before starting this scan, it should work OK with it still active - it does on my PC.
    Although you may find the scan speed increases if you carry out this step, I never like to disable my resident scanner while online, so I don't.
  • When the scan has completed, click View scan report at the bottom.
  • Click Save Report As…
  • Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
  • Click Save and pick a location for the file - the Desktop is always handy.
Copy and paste the report into your next reply along with a fresh HJT log, run in Normal Mode, and a description of how your PC is behaving.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Sec-Info2.zip from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a file in it - double click Sec-info2.vbs to run it.
Once you have been informed that the script has completed, a text file called Sec-Info.txt should be created in the same folder - you may need to wait a couple of seconds for it to appear..
Please copy and paste the contents of the text file into your next reply and then you can delete both of the folders and their contents.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run HJT and click on Open the Misc Tools section.
  • Click Open Uninstall Manager…
  • Click Save list… and save it to your Desktop.
  • Copy and paste the file uninstall_list.txt into your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Rooter.exe from here and save it to your Desktop.
  • Double-click it to start the tool.
  • Click the Scan button to… well… scan - obvious really!
  • Once complete, a Notepad file containing the report will open; a copy of which can be found at C:\Rooter$\Rooter.txt - assuming your main drive is C: of course.
  • Please post the contents of Rooter.txt in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download RootRepeal from one of the locations below and save it to your Desktop:
Location 1
Location 2
Location 4
(Location 3 is taking a fortnight off in Teneriffe but did send a postcard!)

You will need to unzip it before you run it.

To do this: Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish
  • Double click RootRepeal.exe to fire up the tool and OK any Windows confirmation if necessary.
  • Ensure that the Report Tab is selected at the bottom.
  • Click the Scan button, check all the boxes in the window that appears and then click OK.
  • Check the box next to your main hard drive - usually C: and click OK
  • Put the kettle on and perhaps open a packet of biscuits - the scan will take some time.
  • Once the scan has completed a Notepad window will open with the results in.
  • These results will also be saved to the root of your main drive as \RootRepeal report date time.txt
Let me have a copy of the contents in your next reply.
Post #3
I am having a Google redirect problem and have not posted anywhere else. I really appreciate your help here.

The Kaspersky Online Scanner failed during update multiple times.

I have attached everything else though.

Thanks,
Mike



Kaspersky Online Scanner issue
_______________________________________________________________________
Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program.

You must be online to update the Kaspersky Online Scanner 7 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7. [ERROR: Key is expired]

________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:56:41 PM, on 8/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 64.86.17.32 google.ae
O1 - Hosts: 64.86.17.32 google.as
O1 - Hosts: 64.86.17.32 google.at
O1 - Hosts: 64.86.17.32 google.az
O1 - Hosts: 64.86.17.32 google.ba
O1 - Hosts: 64.86.17.32 google.be
O1 - Hosts: 64.86.17.32 google.bg
O1 - Hosts: 64.86.17.32 google.bs
O1 - Hosts: 64.86.17.32 google.ca
O1 - Hosts: 64.86.17.32 google.cd
O1 - Hosts: 64.86.17.32 google.com.gh
O1 - Hosts: 64.86.17.32 google.com.hk
O1 - Hosts: 64.86.17.32 google.com.jm
O1 - Hosts: 64.86.17.32 google.com.mx
O1 - Hosts: 64.86.17.32 google.com.my
O1 - Hosts: 64.86.17.32 google.com.na
O1 - Hosts: 64.86.17.32 google.com.nf
O1 - Hosts: 64.86.17.32 google.com.ng
O1 - Hosts: 64.86.17.32 google.ch
O1 - Hosts: 64.86.17.32 google.com.np
O1 - Hosts: 64.86.17.32 google.com.pr
O1 - Hosts: 64.86.17.32 google.com.qa
O1 - Hosts: 64.86.17.32 google.com.sg
O1 - Hosts: 64.86.17.32 google.com.tj
O1 - Hosts: 64.86.17.32 google.com.tw
O1 - Hosts: 64.86.17.32 google.dj
O1 - Hosts: 64.86.17.32 google.de
O1 - Hosts: 64.86.17.32 google.dk
O1 - Hosts: 64.86.17.32 google.dm
O1 - Hosts: 64.86.17.32 google.ee
O1 - Hosts: 64.86.17.32 google.fi
O1 - Hosts: 64.86.17.32 google.fm
O1 - Hosts: 64.86.17.32 google.fr
O1 - Hosts: 64.86.17.32 google.ge
O1 - Hosts: 64.86.17.32 google.gg
O1 - Hosts: 64.86.17.32 google.gm
O1 - Hosts: 64.86.17.32 google.gr
O1 - Hosts: 64.86.17.32 google.ht
O1 - Hosts: 64.86.17.32 google.ie
O1 - Hosts: 64.86.17.32 google.im
O1 - Hosts: 64.86.17.32 google.in
O1 - Hosts: 64.86.17.32 google.it
O1 - Hosts: 64.86.17.32 google.ki
O1 - Hosts: 64.86.17.32 google.la
O1 - Hosts: 64.86.17.32 google.li
O1 - Hosts: 64.86.17.32 google.lv
O1 - Hosts: 64.86.17.32 google.ma
O1 - Hosts: 64.86.17.32 google.ms
O1 - Hosts: 64.86.17.32 google.mu
O1 - Hosts: 64.86.17.32 google.mw
O1 - Hosts: 64.86.17.32 google.nl
O1 - Hosts: 64.86.17.32 google.no
O1 - Hosts: 64.86.17.32 google.nr
O1 - Hosts: 64.86.17.32 google.nu
O1 - Hosts: 64.86.17.32 google.pl
O1 - Hosts: 64.86.17.32 google.pn
O1 - Hosts: 64.86.17.32 google.pt
O1 - Hosts: 64.86.17.32 google.ro
O1 - Hosts: 64.86.17.32 google.ru
O1 - Hosts: 64.86.17.32 google.rw
O1 - Hosts: 64.86.17.32 google.sc
O1 - Hosts: 64.86.17.32 google.se
O1 - Hosts: 64.86.17.32 google.sh
O1 - Hosts: 64.86.17.32 google.si
O1 - Hosts: 64.86.17.32 google.sm
O1 - Hosts: 64.86.17.32 google.sn
O1 - Hosts: 64.86.17.32 google.st
O1 - Hosts: 64.86.17.32 google.tl
O1 - Hosts: 64.86.17.32 google.tm
O1 - Hosts: 64.86.17.32 google.tt
O1 - Hosts: 64.86.17.32 google.us
O1 - Hosts: 64.86.17.32 google.vu
O1 - Hosts: 64.86.17.32 google.ws
O1 - Hosts: 64.86.17.32 google.co.ck
O1 - Hosts: 64.86.17.32 google.co.id
O1 - Hosts: 64.86.17.32 google.co.il
O1 - Hosts: 64.86.17.32 google.co.in
O1 - Hosts: 64.86.17.32 google.co.jp
O1 - Hosts: 64.86.17.32 google.co.kr
O1 - Hosts: 64.86.17.32 google.co.ls
O1 - Hosts: 64.86.17.32 google.co.ma
O1 - Hosts: 64.86.17.32 google.co.nz
O1 - Hosts: 64.86.17.32 google.co.tz
O1 - Hosts: 64.86.17.32 google.co.ug
O1 - Hosts: 64.86.17.32 google.co.uk
O1 - Hosts: 64.86.17.32 google.co.za
O1 - Hosts: 64.86.17.32 google.co.zm
O1 - Hosts: 64.86.17.32 google.com
O1 - Hosts: 64.86.17.32 google.com.af
O1 - Hosts: 64.86.17.32 google.com.ag
O1 - Hosts: 64.86.17.32 google.com.ar
O1 - Hosts: 64.86.17.32 google.com.au
O1 - Hosts: 64.86.17.32 google.com.bn
O1 - Hosts: 64.86.17.32 google.com.br
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 5195 bytes


Script run: 8/18/2009 10:01:29 PM

~~~~~~~~~~~~~~~~~~~~~~~~

The Windows Firewall is enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

The Security Center Anti-Virus Alerts are enabled.
The Security Center Firewall Alerts are enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

Number of Restore Points found: 4

HJT uninstall_list.txt

Acrobat.com
Adobe AIR
Adobe AIR
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Creative Suite 2
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Help Center 1.0
Adobe Reader 9.1
Adobe Reader Japanese Fonts
Adobe Shockwave Player
Adobe Stock Photos 1.0
Adobe SVG Viewer 3.0
aiofw
aioocr
aioprnt
aioscnnr
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 5
Big Fish Games Client
BlackBerry Desktop Software 4.5
BlackBerry Desktop Software 4.5
Bonjour
BookWorm Deluxe 1.03
CCleaner (remove only)
CCScore
center
Compatibility Pack for the 2007 Office system
eDrawings 2008
EPSON Printer Software
EPSON TWAIN 5
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSSONIC
ESSTOOLS
essvatgt
Finale NotePad 2008
Google Desktop
Google SketchUp 6
Google SketchUp 6 Exporters
Google SketchUp LayOut 6
Google SketchUp Pro 6
Google Toolbar for Firefox
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Help_CTR
helptut
helpug
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB961118)
Insaniquarium Deluxe 1.1
Intel® PRO Ethernet Adapter and Software
InterVideo WinDVD 8
iTunes
Java™ 6 Update 14
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
KODAK All-in-One Printer Software
ksdip
LimeWire 4.18.3
Malwarebytes' Anti-Malware
Maxtor Manager
McAfee VirusScan Enterprise
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Small Business Edition 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Monopoly Here & Now Edition
Mozilla Firefox (3.0.13)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nero 8 Essentials
neroxml
netbrdg
Nokia Connectivity Adapter Cable DKU-5
NVIDIA Drivers
OfotoXMI
Pajama Sam Life is Rough When You Lose Your Stuff
PDFCreator
Power Tab Editor 1.7
QuickTime
RealPlayer Basic
Safari
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SFR
SHASTA
skin0001
SKINXSDK
staticcr
Suite Specific
TAO Image Transfer 4.4
tooltips
TypingMaster Pro
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB973815)
VCRedistSetup
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VPRINTOL
WebEx
Windows Driver Package - (mr7910) Image (08/08/2006 1.4.0.0)
Windows Genuine Advantage v1.3.0254.0
Windows Installer Clean Up
Windows Media Format Runtime
Windows XP Service Pack 3
WinPcap 3.1
WIRELESS

Rooter_1.txt

Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully …
.
Windows XP . (5.1.2600) Service Pack 3
[32_bits] - x86 Family 15 Model 2 Stepping 7, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Enabled
.
Internet Explorer 7.0.5730.11
.
A:\ [Removable]
C:\ [Fixed-NTFS] .. ( Total:37 Go - Free:5 Go )
D:\ [CD_Rom]
E:\ [Fixed-NTFS] .. ( Total:931 Go - Free:926 Go )
.
Scan : 22:07.44
Path : C:\Documents and Settings\Mike Sullivan\Local Settings\Temporary Internet Files\Content.IE5\L6WUJTTC\Rooter[1].exe
User : Mike Sullivan ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \SystemRoot\System32\smss.exe (384)
______ \??\C:\WINDOWS\system32\csrss.exe (432)
______ \??\C:\WINDOWS\system32\winlogon.exe (456)
______ C:\WINDOWS\system32\services.exe (500)
______ C:\WINDOWS\system32\lsass.exe (512)
______ C:\WINDOWS\system32\svchost.exe (668)
______ C:\WINDOWS\system32\svchost.exe (724)
______ C:\WINDOWS\System32\svchost.exe (788)
______ C:\WINDOWS\system32\svchost.exe (836)
______ C:\WINDOWS\system32\svchost.exe (892)
______ C:\WINDOWS\system32\spoolsv.exe (1104)
______ C:\WINDOWS\system32\svchost.exe (1216)
______ C:\WINDOWS\Explorer.EXE (1404)
______ C:\WINDOWS\system32\nvsvc32.exe (1568)
______ C:\WINDOWS\system32\svchost.exe (1640)
______ C:\WINDOWS\system32\wdfmgr.exe (1744)
______ C:\WINDOWS\system32\ctfmon.exe (216)
______ C:\WINDOWS\System32\alg.exe (1300)
______ C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE (1788)
______ C:\Program Files\Internet Explorer\iexplore.exe (2844)
______ C:\Program Files\Trend Micro\HijackThis\HijackThis.exe (2068)
______ C:\WINDOWS\system32\notepad.exe (1992)
______ C:\Documents and Settings\Mike Sullivan\Local Settings\Temporary Internet Files\Content.IE5\L6WUJTTC\Rooter[1].exe (2752)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:40007729664)
.
———————-\\ Scheduled Tasks
.
C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
C:\WINDOWS\Tasks\desktop.ini
C:\WINDOWS\Tasks\SA.DAT
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
———————-\\ Scan completed at 22:07.54
.
C:\Rooter$\Rooter_1.txt - (18/08/2009 | 22:07.54)

I ran RootRepeal and got this error message.

RootRepeal Error

Error – Invalid PE image found!

Clicked OK and got the report file

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/18 22:21
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF42D8000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7A31000 Size: 8192 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB9F06000 Size: 49152 File Visible: No Signed: -
Status: -

SSDT
——————-
#: 041 Function Name: NtCreateKey
Status: Hooked by "Lbd.sys" at address 0xf74f187e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "Lbd.sys" at address 0xf74f1c10

==EOF==
Post #4
Here are a few things I did since my last post. I followed a similar post that had the same HJT log file as mine. I think he is Mattskelly on this forum.

I deleted all AV software I had. I downloaded the 30 day Kaspersky AV and ran it last night. viruses were found and removed but I can't find a way to post the report.

I deleted my hosts file and ran HostXpert to get a new clean host file.

My redirecting problem is gone for now, but I still need your help to make sure it's clean. Sorry to jump ahead.

I new I had to get rid of the O1's in the host file.

Thanks,

Mike

Here's the new HJT log file




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:54:10 AM, on 8/19/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 2147 bytes
Post #5
If you compare your first HJT log with the others, you will see that a large portion is missing. What did you do to lose this - manual delete items or let scanners loose?
Post #7
It's not just the what, but the why. I don't see why this much legitimate stuff should be removed, so i'm a little worried. The reason that the online scanner is used is because it doesn't remove anything, just identify it. This enables us to spot false positives before they get removed.

Download the following file, unzip it and run it. It will create a text file called SysResInfo.txt when it is run, dropped alongside the .vbs file you unzip. Let me have a copy of the contents: Linky
Post #8
Number of Restore Points found: 8 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP1 Name: System Checkpoint Information: Unknown. Date/Time: 2009/08/17 13-24 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP2 Name: Restore Operation Information: Unknown. Date/Time: 2009/08/17 22-36 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP3 Name: System Checkpoint Information: Unknown. Date/Time: 2009/08/19 00-16 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP4 Name: Software Distribution Service 3.0 Information: An application has been installed or the default interval between points has elapsed. Date/Time: 2009/08/19 01-40 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP5 Name: Removed McAfee VirusScan Enterprise Information: An application has been uninstalled. Date/Time: 2009/08/19 02-58 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP6 Name: Installed Kaspersky Anti-Virus 2010. Information: An application has been installed or the default interval between points has elapsed. Date/Time: 2009/08/19 02-59 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP7 Name: Installed Maxtor Manager Information: An application needs to delete the restore point it created - a user may have cancelled an installation. Date/Time: 2009/08/19 19-52 ~~~~~~~~~~~~~~~~~~~~~~~~ Number: RP8 Name: Software Distribution Service 3.0 Information: An application has been installed or the default interval between points has elapsed. Date/Time: 2009/08/19 20-18 ~~~~~~~~~~~~~~~~~~~~~~~~
Post #9
OK, we can run System Restore and see if that undoes the damage if we need to. Can you tell me what Kaspersky has in it's Quarantine section, as it may well be easier to just replace everything from there.
Post #11
Here is a running log of Kaspersky since I installed last night. Seems like that Trojan in Mikaela's temp file is still active. Date: Yesterday (events: 16) 8/18/2009 11:05:42 PM My Protection Databases are obsolete Kaspersky Anti-Virus 8/18/2009 11:05:42 PM File Anti-Virus Task started Kaspersky Anti-Virus File Anti-Virus 8/18/2009 11:05:42 PM IM Anti-Virus Task started Kaspersky Anti-Virus IM Anti-Virus 8/18/2009 11:05:42 PM Mail Anti-Virus Task started Kaspersky Anti-Virus Mail Anti-Virus 8/18/2009 11:05:42 PM Proactive Defense Task started Kaspersky Anti-Virus Proactive Defense 8/18/2009 11:05:49 PM Web Anti-Virus Task started Kaspersky Anti-Virus Web Anti-Virus 8/18/2009 11:06:26 PM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/18/2009 11:08:26 PM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/18/2009 11:09:17 PM Objects Scan Task started Kaspersky Anti-Virus Objects Scan 8/18/2009 11:09:40 PM Objects Scan Task stopped Kaspersky Anti-Virus Objects Scan 8/18/2009 11:09:43 PM Objects Scan Task started Kaspersky Anti-Virus Full Scan 8/18/2009 11:29:12 PM My Protection Threats have been detected Kaspersky Anti-Virus 8/18/2009 11:35:58 PM Objects Scan Task started Kaspersky Anti-Virus Rootkit Scan 8/18/2009 11:40:20 PM Objects Scan Task completed Kaspersky Anti-Virus Rootkit Scan 8/18/2009 11:41:37 PM My Protection Threats have been detected Kaspersky Anti-Virus 8/18/2009 11:46:08 PM My Protection Threats have been detected Kaspersky Anti-Virus Date: Today (events: 51) 8/19/2009 12:33:18 AM Objects Scan Task completed Kaspersky Anti-Virus Full Scan 8/19/2009 1:21:38 AM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 1:23:12 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 1:23:12 AM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 3:41:40 AM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 3:42:49 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 3:42:50 AM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 6:01:40 AM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 6:02:51 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 6:02:51 AM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 7:10:21 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 7:10:35 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 7:50:11 AM My Protection Protection is not running Kaspersky Anti-Virus 8/19/2009 8:07:03 AM File Anti-Virus Task started Kaspersky Anti-Virus File Anti-Virus 8/19/2009 8:07:03 AM IM Anti-Virus Task started Kaspersky Anti-Virus IM Anti-Virus 8/19/2009 8:07:03 AM Mail Anti-Virus Task started Kaspersky Anti-Virus Mail Anti-Virus 8/19/2009 8:07:04 AM Proactive Defense Task started Kaspersky Anti-Virus Proactive Defense 8/19/2009 8:07:04 AM Web Anti-Virus Task started Kaspersky Anti-Virus Web Anti-Virus 8/19/2009 8:22:24 AM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 8:23:36 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 8:23:36 AM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 8:37:10 AM Objects Scan Task started Kaspersky Anti-Virus Rootkit Scan 8/19/2009 8:38:57 AM Objects Scan Task completed Kaspersky Anti-Virus Rootkit Scan 8/19/2009 8:48:13 AM My Protection Some components are disabled Kaspersky Anti-Virus 8/19/2009 8:48:13 AM My Protection Protection is disabled Kaspersky Anti-Virus 8/19/2009 8:48:13 AM Mail Anti-Virus Task stopped Kaspersky Anti-Virus Mail Anti-Virus 8/19/2009 8:48:13 AM IM Anti-Virus Task stopped Kaspersky Anti-Virus IM Anti-Virus 8/19/2009 8:48:14 AM Web Anti-Virus Task stopped Kaspersky Anti-Virus Web Anti-Virus 8/19/2009 8:48:14 AM Proactive Defense Task stopped Kaspersky Anti-Virus Proactive Defense 8/19/2009 8:48:15 AM File Anti-Virus Task stopped Kaspersky Anti-Virus File Anti-Virus 8/19/2009 9:20:37 AM My Protection Protection is disabled Kaspersky Anti-Virus 8/19/2009 9:35:50 AM File Anti-Virus Task started Kaspersky Anti-Virus File Anti-Virus 8/19/2009 9:35:50 AM IM Anti-Virus Task started Kaspersky Anti-Virus IM Anti-Virus 8/19/2009 9:35:50 AM Mail Anti-Virus Task started Kaspersky Anti-Virus Mail Anti-Virus 8/19/2009 9:35:50 AM Proactive Defense Task started Kaspersky Anti-Virus Proactive Defense 8/19/2009 9:35:51 AM Web Anti-Virus Task started Kaspersky Anti-Virus Web Anti-Virus 8/19/2009 9:50:46 AM Objects Scan Task started Kaspersky Anti-Virus Rootkit Scan 8/19/2009 9:51:31 AM Objects Scan Task completed Kaspersky Anti-Virus Rootkit Scan 8/19/2009 10:36:00 AM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 10:37:09 AM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 10:37:09 AM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 12:56:01 PM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 12:57:07 PM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 12:57:07 PM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 3:16:08 PM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 3:21:46 PM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 3:21:46 PM My Update Center Task completed Kaspersky Anti-Virus My Update Center 8/19/2009 5:36:30 PM My Update Center Task started Kaspersky Anti-Virus My Update Center 8/19/2009 5:37:19 PM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 5:38:22 PM My Protection Detected: HEUR:Trojan.Script.Iframer Kaspersky Anti-Virus C:\Documents and Settings\Mikaela\Local Settings\Temporary Internet Files\Content.IE5\PBEF36UU\trafficregenerator[1].js 8/19/2009 5:38:23 PM My Update Center Task completed Kaspersky Anti-Virus My Update Center
Post #12
Sorry, I forgot a few details. After I ran Kaspersky, I needed to run ComboFix to be able to delete the Host files and then rebuild with HostsXpert. This is what I got from Mattskelly's post here in this forum. Here's the recipe I followed. Thanks, Mike ________________________________________________________________________________ ____________ Right after Combofix, we are going to run HostsXpert so make sure you still have it handy. Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File:: CODE File:: c:\windows\system32\drivers\etc\hosts c:\windows\system32\drivers\etc\hosts.new Save this as CFScript to your desktop. Then drag the CFScript into ComboFix.exe as you see in the screenshot below. This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. Download the HostsXpert 4.2.0.0. - Hosts File Manager. * Unzip HostsXpert 4.2.0.0 - Hosts File Manager to a convenient folder such as C:\HostsXpert * Click HostsXpert.exe to Run HostsXpert - Hosts File Manager from its new home * Click "Make Hosts Writable?" in the upper right corner (If available). * Click Restore Microsoft's Hosts file and then click OK. * Click the X to exit the program. * Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.
Post #13
While I can appreciate that you want your PC clean, when you run various tools "on your own", you take responsibility for the results. Following instructions that may very well be tailored to a specific PC rather than as a generic fix doesn't always produce the results that you hoped for - as in the case of your decimated HJT log.

As I don't know what has done the damage, or exactly how much damage has been done, I suggest you run System Restore and see if that puts things back how they were. I think that the point entitled Removed McAfee VirusScan Enterprise is the one to go with.

A tutorial for System Restore is available here.

Once you have done that, let me have a fresh HJT log and we'll see if that gets us anywhere.
Post #14
I restored to the point you suggested and then the previous one and still got this same log file for HJT.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:50:04 PM, on 8/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 1262 bytes
Post #15
You may well have to reinstall your operating system to solve this one, i'm afraid. Can you find the following text file and post the contents:

C:\Qoobox\ComboFix-quarantined-files.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI