What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google redirect issues after fighting off Internet Security

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,
Hopefully I have done everything correctly, as I am very new to this.

A couple days ago, my virus program alerted to me that I was infected with Coreguard antivirus 2009, which presented itself as a fake spyware program. it changed my desktop and had a lot of popups of fake virus warnings. I ran several antispyware scans to get the worst of the virus to go away. I ran the MBAM scan, which now comes up clean, but I will include the log anyway. I ran spybot, which I use on a fairly regular basis. I also used adaware and spydoctor, and all of my scans come up clean now. I also have Hijackthis, so I can supply a log for that as well. I do know not to delete anything from this without expert advice.
Everything is back to normal for the most part. The main thing now is that I keep getting a "302 Moved" error message when I use Google when I am to be redirected to a page. At first I thought this was a Firefox security measure, but upon research it seems it is still a product of the viruses I have been fighting off. My system has also seemed a bit slower ever since this all happened. My logs are to follow. Please let me know if there is any other information I should supply, I am quite the novice. I am terrified this virus is going to crop up again, and I am dependent on my laptop for school right now. I would appreciate any help at your earliest convenience. Thank you so much for your time.

MBAM:
Malwarebytes' Anti-Malware 1.44
Database version: 3723
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

2/12/2010 7:17:20 PM
mbam-log-2010-02-12 (19-17-20).txt

Scan type: Quick Scan
Objects scanned: 125157
Time elapsed: 13 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

————————————————–

I have attached my DDS logs, but I am having trouble with the GMER log, because it keeps saying it is too large to attach or too long to post. Advice?

HijackThis log just in case:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:20 PM, on 2/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TK8 StickyNotes\TK8StickyNotes.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/clientapps/AutoSear…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [TivoTransfer] "C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" /service /registry /auto:TivoTransfer
O4 - HKCU\..\Run: [TivoNotify] "C:\Program Files\TiVo\Desktop\TiVoNotify.exe" /service /registry /auto:TivoNotify
O4 - HKCU\..\Run: [TivoServer] "C:\Program Files\TiVo\Desktop\TiVoServer.exe" /service /registry
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TK8 StickyNotes] "C:\Program Files\TK8 StickyNotes\TK8StickyNotes.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1243721872828
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1260170207140
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/in…r_installer.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 14942 bytes

Thank you so much for your time!

Attachments:

Post #2
Hello nvielkind and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instruction I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #3
nvielkind,

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #4
Thank you for your quick reply. I believe I followed all of your directions properly. Here is the log:

ComboFix 10-02-12.01 - Natalie Vielkind 02/13/2010 8:42.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.544 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\11478.exe
c:\windows\system32\11538.exe
c:\windows\system32\11942.exe
c:\windows\system32\12316.exe
c:\windows\system32\12382.exe
c:\windows\system32\12859.exe
c:\windows\system32\14604.exe
c:\windows\system32\14771.exe
c:\windows\system32\15141.exe
c:\windows\system32\153.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\17035.exe
c:\windows\system32\17421.exe
c:\windows\system32\17673.exe
c:\windows\system32\18467.exe
c:\windows\system32\1869.exe
c:\windows\system32\18716.exe
c:\windows\system32\19169.exe
c:\windows\system32\19718.exe
c:\windows\system32\19895.exe
c:\windows\system32\19912.exe
c:\windows\system32\20037.exe
c:\windows\system32\21726.exe
c:\windows\system32\23281.exe
c:\windows\system32\23811.exe
c:\windows\system32\24464.exe
c:\windows\system32\25547.exe
c:\windows\system32\25667.exe
c:\windows\system32\26299.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\27529.exe
c:\windows\system32\27644.exe
c:\windows\system32\28145.exe
c:\windows\system32\28253.exe
c:\windows\system32\28703.exe
c:\windows\system32\292.exe
c:\windows\system32\29358.exe
c:\windows\system32\2995.exe
c:\windows\system32\30333.exe
c:\windows\system32\31322.exe
c:\windows\system32\32391.exe
c:\windows\system32\32662.exe
c:\windows\system32\32757.exe
c:\windows\system32\3902.exe
c:\windows\system32\4664.exe
c:\windows\system32\4827.exe
c:\windows\system32\491.exe
c:\windows\system32\5436.exe
c:\windows\system32\5447.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\6868.exe
c:\windows\system32\7711.exe
c:\windows\system32\778.exe
c:\windows\system32\8723.exe
c:\windows\system32\9741.exe
c:\windows\system32\9894.exe
c:\windows\system32\9961.exe
c:\windows\system32\drivers\1028_DELL_XPS_MM061 .MRK
c:\windows\system32\drivers\DELL_XPS_MM061 .MRK
c:\windows\system32\gfbaksm.dat
c:\windows\system32\gfbaksm.dll
c:\windows\system32\Settings
c:\windows\system32\Settings\Settings.ini
D:\AUTORUN.INF

—– BITS: Possible infected sites —–

hxxp://sus.isc.upenn.edu
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.

2010-02-13 03:36 . 2010-02-13 03:36 524288 —-a-w- c:\program files\dds1.scr
2010-02-13 03:16 . 2010-02-13 03:16 359929 —-a-w- c:\program files\dds.scr
2010-02-13 00:26 . 2010-02-13 00:26 293376 —-a-w- c:\program files\zitm02xj.exe
2010-02-11 18:52 . 2010-02-11 18:52 ——– d—–w- c:\program files\Trend Micro
2010-02-11 18:52 . 2010-02-11 18:52 812344 —-a-w- c:\program files\HJTInstall.exe
2010-02-11 17:59 . 2010-02-11 15:43 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-02-11 15:43 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-11 15:43 . 2010-02-11 15:43 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-02-11 15:43 . 2010-02-11 15:43 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-02-11 15:43 . 2010-02-11 15:43 15880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-02-11 15:43 . 2010-02-11 15:43 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-02-11 15:43 . 2010-02-11 15:43 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-02-11 15:43 . 2010-02-11 15:43 389784 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-11 15:43 . 2010-02-11 15:43 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-02-11 15:42 . 2010-02-11 15:42 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-02-11 15:42 . 2010-02-11 15:42 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-02-11 15:42 . 2010-02-11 15:42 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-02-11 15:42 . 2010-02-11 15:42 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-02-11 15:42 . 2010-02-11 15:42 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-11 15:42 . 2010-02-11 15:42 816784 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-02-11 15:42 . 2010-02-11 15:42 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-11 15:42 . 2010-02-11 15:42 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-02-11 15:42 . 2010-02-11 15:42 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-02-11 15:42 . 2010-02-11 15:42 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-11 15:41 . 2010-02-11 15:41 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-02-11 15:41 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-02-11 15:41 . 2010-02-11 15:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-11 15:41 . 2010-02-11 15:41 ——– d—–w- c:\program files\Lavasoft
2010-02-11 15:37 . 2010-02-11 15:39 91338304 —-a-w- c:\program files\Ad-AwareInstallation.exe
2010-02-11 06:01 . 2010-02-11 06:01 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\Malwarebytes
2010-02-11 06:00 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-11 06:00 . 2010-02-11 06:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-11 06:00 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-11 06:00 . 2010-02-11 06:01 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-11 05:57 . 2010-02-11 05:58 5115824 —-a-w- c:\program files\mbam-setup.exe
2010-02-10 15:51 . 2009-12-14 07:08 33280 -c—-w- c:\windows\system32\dllcache\csrsrv.dll
2010-02-10 15:51 . 2009-11-27 17:11 17920 -c—-w- c:\windows\system32\dllcache\msyuv.dll
2010-02-10 15:51 . 2009-11-27 16:07 8704 -c—-w- c:\windows\system32\dllcache\tsbyuv.dll
2010-02-10 15:51 . 2009-11-27 16:07 48128 -c—-w- c:\windows\system32\dllcache\iyuv_32.dll
2010-02-10 15:51 . 2009-11-27 16:07 11264 -c—-w- c:\windows\system32\dllcache\msrle32.dll
2010-02-10 15:50 . 2009-12-16 18:43 343040 -c—-w- c:\windows\system32\dllcache\mspaint.exe
2010-02-10 07:48 . 2010-02-10 07:52 7360288 —-a-w- c:\program files\sasetup3.0.1.159.exe
2010-02-10 03:02 . 2010-02-10 03:02 0 —-a-w- c:\program files\avinstall.exe
2010-02-08 04:01 . 2010-02-08 04:01 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-02-08 03:15 . 2010-02-08 03:15 ——– d-sh–w- c:\documents and settings\LocalService\IECompatCache
2010-02-08 03:15 . 2010-02-08 03:15 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Threat Expert
2010-02-08 03:10 . 2010-02-08 03:10 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\ATI
2010-02-08 03:10 . 2010-02-08 03:10 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\ATI
2010-02-08 02:48 . 2010-02-08 02:48 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Threat Expert
2010-02-08 02:46 . 2010-01-21 23:21 767952 —-a-w- c:\windows\BDTSupport.dll
2010-02-08 02:46 . 2010-01-21 23:21 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-02-08 02:46 . 2010-01-21 23:21 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-02-08 02:46 . 2010-01-21 23:21 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-02-08 02:46 . 2009-10-28 06:36 1152444 —-a-w- c:\windows\UDB.zip
2010-02-08 02:46 . 2008-11-26 17:08 131 —-a-w- c:\windows\IDB.zip
2010-02-08 02:41 . 2009-10-30 16:11 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-02-08 02:41 . 2009-11-09 16:20 207792 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-02-08 02:41 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-02-08 02:41 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-02-08 02:41 . 2010-02-13 13:29 ——– d—–w- c:\program files\Spyware Doctor
2010-02-08 02:41 . 2010-02-08 02:46 ——– d—–w- c:\program files\Common Files\PC Tools
2010-02-08 02:41 . 2010-02-08 02:41 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\PC Tools
2010-02-08 02:41 . 2010-02-08 02:41 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-08 02:41 . 2010-02-13 13:38 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-08 02:20 . 2010-02-08 02:20 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-02-08 02:05 . 2010-02-08 02:05 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-02-08 02:03 . 2010-02-08 02:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-02-08 02:02 . 2010-02-08 02:02 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-02-04 02:53 . 2010-02-04 02:53 ——– d—–w- c:\program files\Seagate
2010-02-04 02:53 . 2010-02-04 02:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Seagate
2010-02-04 02:52 . 2010-02-04 02:52 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Downloaded Installations
2010-02-04 02:52 . 2010-02-04 02:52 ——– d-sh–w- c:\windows\ftpcache
2010-01-23 19:35 . 2010-01-23 19:49 ——– d—–w- c:\program files\Hulu Downloader
2010-01-22 20:14 . 2010-01-22 20:14 56816 —ha-w- c:\windows\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 03:20 . 2007-01-19 23:03 ——– d—–w- c:\program files\Symantec AntiVirus
2010-02-10 23:00 . 2008-01-11 02:57 ——– d—–w- c:\program files\Norton Security Scan
2010-02-10 16:03 . 2007-03-04 22:22 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-10 03:03 . 2010-02-10 03:02 18167907 —-a-w- c:\program files\avinstall.exe.part
2010-02-08 00:41 . 2007-01-19 23:03 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-02-08 00:41 . 2007-01-19 23:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-04 02:54 . 2007-01-19 22:10 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-23 07:21 . 2009-05-20 04:12 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-12 17:11 . 2007-01-20 00:00 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\Apple Computer
2010-01-09 00:22 . 2007-04-26 21:13 ——– d—–w- c:\program files\Google
2009-12-31 16:50 . 2004-08-04 10:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-28 04:27 . 2007-01-19 23:49 ——– d—–w- c:\program files\Napster
2009-12-28 04:26 . 2009-12-28 04:26 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-12-28 04:26 . 2009-12-28 04:26 ——– d—–w- c:\program files\Common Files\Napster Shared
2009-12-25 03:00 . 2009-12-25 03:00 ——– d—–w- c:\program files\iMesh Applications
2009-12-23 18:30 . 2007-01-20 00:22 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\U3
2009-12-21 19:14 . 2006-03-04 03:33 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-20 21:47 . 2007-05-04 01:06 ——– d—–w- c:\program files\Java
2009-12-20 21:46 . 2009-12-20 21:46 152576 —-a-w- c:\documents and settings\Natalie Vielkind\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-20 21:46 . 2009-11-14 09:29 79488 —-a-w- c:\documents and settings\Natalie Vielkind\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-16 18:43 . 2007-01-19 21:54 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2005-03-30 01:23 2189184 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2005-03-30 01:01 2066048 —-a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-04 10:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2004-08-04 10:00 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 00:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2004-08-04 10:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2004-08-04 10:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 10:00 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 00:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2004-08-04 10:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-07-27 07:39 . 2009-07-27 07:38 482336 —-a-w- c:\program files\RealPlayer11GOLD.exe
2009-05-19 02:21 . 2009-05-19 02:21 5873216 —-a-w- c:\program files\SitcomStructure.zip
2008-11-22 21:54 . 2008-11-22 21:54 161541902 —-a-w- c:\program files\iMovieHD6.dmg
2008-10-28 01:51 . 2008-10-28 01:51 426668 —-a-w- c:\program files\Windows6.0-KB958644-x86.msu
2008-01-19 19:56 . 2008-01-19 19:56 1823792 —-a-w- c:\program files\GoogleDesktopSetup.exe
2007-11-16 21:05 . 2007-11-16 21:05 1164456 —-a-w- c:\program files\install_flash_player.exe
2007-11-14 04:00 . 2007-11-14 03:59 54326568 —-a-w- c:\program files\iTunes75Setup.exe
2007-08-14 01:51 . 2007-08-14 01:51 1005270 —-a-w- c:\program files\instzip3.exe
2007-08-14 00:56 . 2007-08-14 00:51 50005304 —-a-w- c:\program files\iTunesSetup.exe
2007-01-20 00:11 . 2007-01-20 00:11 104 -c-ha-w- c:\program files\PR10.dta
2005-11-28 14:02 . 2005-11-28 14:02 73728 —-a-w- c:\program files\AM.dll
2005-11-28 14:02 . 2005-11-28 14:02 183 —-a-w- c:\program files\KodakGallery.com.url
2005-09-16 15:01 . 2005-09-16 15:01 454656 —-a-w- c:\program files\MSICrlPCU.dll
2007-05-27 04:12 . 2007-01-20 00:11 1004 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TivoTransfer"="c:\program files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2007-09-25 1195008]
"TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2007-09-25 384000]
"TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2007-09-25 1495040]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"TK8 StickyNotes"="c:\program files\TK8 StickyNotes\TK8StickyNotes.exe" [2009-10-20 9122128]
"Google Update"="c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-23 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 185640]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-16 127037]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\Natalie Vielkind\Start Menu\Programs\Startup\
Last.fm Helper.lnk - c:\program files\Last.fm\LastFMHelper.exe [2008-3-11 106496]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-5-17 57344]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Napster\\napster.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/11/2010 10:43 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2/7/2010 9:41 PM 207792]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [2/7/2010 9:46 PM 112592]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [5/1/2009 2:35 PM 181544]
R2 TivoBeacon2;TiVo Beacon;c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [9/25/2007 10:33 AM 867328]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/2/2007 7:38 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [9/2/2009 7:03 PM 102448]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2009 10:50 AM 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/2/2009 8:19 AM 1181328]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 1:40 AM 115952]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2/7/2010 9:41 PM 359624]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 15:50]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 15:50]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-484061587-725345543-1003Core.job
- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 01:15]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-484061587-725345543-1003UA.job
- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 01:15]

2010-02-10 c:\windows\Tasks\Norton Security Scan for Natalie Vielkind.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 09:18]

2010-02-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2010-02-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-12-07 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/clientapps/AutoSearch/SearchBarLM/YSetSearch/2007/05/03/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Natalie Vielkind\Application Data\Mozilla\Firefox\Profiles\ca4a7b6j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npstrlnk.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
Notify-WgaLogon - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 08:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1012)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-13 08:53:20
ComboFix-quarantined-files.txt 2010-02-13 13:53

Pre-Run: 15,014,961,152 bytes free
Post-Run: 15,272,529,920 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(4)\WINDOWS
[operating systems]
d:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(4)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 09A95AE5242E394D1AAD3F1265463FB9
Post #5
nvielkind,

Looks like we are making progress. Are you still being redirected?

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.whatthetech.com/Google_redirect_issues_after_fighting_off_Internet_Security_2010_virus_t110235.h
tml&gopid=632543#entry632543

Collect::
c:\program files\zitm02xj.exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • ComboFix log
  • Kaspersky log
  • Let me know how your computer is running
Post #6
I will have to work through these directions a little later today, but I have a quick question. I am still being redirected - should I have restarted my computer after the combofix scan? I did not, and I wasn't sure if that would make a difference. I will get back to you after I can follow your instructions. Thanks again!
Post #8
Hi, finally got a chance to do the scans. Everything with my computer seems to be running the same as first described. Still getting the 302 redirect through Google. Thanks again!

Combofix:
ComboFix 10-02-12.01 - Natalie Vielkind 02/13/2010 18:23:48.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.475 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Natalie Vielkind\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

file zipped: c:\program files\zitm02xj.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\zitm02xj.exe

.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.

2010-02-13 03:36 . 2010-02-13 03:36 524288 —-a-w- c:\program files\dds1.scr
2010-02-13 03:16 . 2010-02-13 03:16 359929 —-a-w- c:\program files\dds.scr
2010-02-11 18:52 . 2010-02-11 18:52 ——– d—–w- c:\program files\Trend Micro
2010-02-11 18:52 . 2010-02-11 18:52 812344 —-a-w- c:\program files\HJTInstall.exe
2010-02-11 17:59 . 2010-02-11 15:43 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-02-11 15:43 . 2009-12-02 13:19 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-02-11 15:43 . 2010-02-11 15:43 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-02-11 15:43 . 2010-02-11 15:43 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-02-11 15:43 . 2010-02-11 15:43 15880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2010-02-11 15:43 . 2010-02-11 15:43 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-02-11 15:43 . 2010-02-11 15:43 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-02-11 15:43 . 2010-02-11 15:43 389784 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-02-11 15:43 . 2010-02-11 15:43 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2010-02-11 15:42 . 2010-02-11 15:42 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-02-11 15:42 . 2010-02-11 15:42 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2010-02-11 15:42 . 2010-02-11 15:42 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2010-02-11 15:42 . 2010-02-11 15:42 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-02-11 15:42 . 2010-02-11 15:42 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-02-11 15:42 . 2010-02-11 15:42 816784 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-02-11 15:42 . 2010-02-11 15:42 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-02-11 15:42 . 2010-02-11 15:42 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-02-11 15:42 . 2010-02-11 15:42 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-02-11 15:42 . 2010-02-11 15:42 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-02-11 15:41 . 2010-02-11 15:41 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-02-11 15:41 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-02-11 15:41 . 2010-02-11 15:43 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-02-11 15:41 . 2010-02-11 15:41 ——– d—–w- c:\program files\Lavasoft
2010-02-11 15:37 . 2010-02-11 15:39 91338304 —-a-w- c:\program files\Ad-AwareInstallation.exe
2010-02-11 06:01 . 2010-02-11 06:01 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\Malwarebytes
2010-02-11 06:00 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-11 06:00 . 2010-02-11 06:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-11 06:00 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-02-11 06:00 . 2010-02-11 06:01 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-11 05:57 . 2010-02-11 05:58 5115824 —-a-w- c:\program files\mbam-setup.exe
2010-02-10 15:51 . 2009-12-14 07:08 33280 -c—-w- c:\windows\system32\dllcache\csrsrv.dll
2010-02-10 15:51 . 2009-11-27 17:11 17920 -c—-w- c:\windows\system32\dllcache\msyuv.dll
2010-02-10 15:51 . 2009-11-27 16:07 8704 -c—-w- c:\windows\system32\dllcache\tsbyuv.dll
2010-02-10 15:51 . 2009-11-27 16:07 48128 -c—-w- c:\windows\system32\dllcache\iyuv_32.dll
2010-02-10 15:51 . 2009-11-27 16:07 11264 -c—-w- c:\windows\system32\dllcache\msrle32.dll
2010-02-10 15:50 . 2009-12-16 18:43 343040 -c—-w- c:\windows\system32\dllcache\mspaint.exe
2010-02-10 07:48 . 2010-02-10 07:52 7360288 —-a-w- c:\program files\sasetup3.0.1.159.exe
2010-02-10 03:02 . 2010-02-10 03:02 0 —-a-w- c:\program files\avinstall.exe
2010-02-08 04:01 . 2010-02-08 04:01 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-02-08 03:15 . 2010-02-08 03:15 ——– d-sh–w- c:\documents and settings\LocalService\IECompatCache
2010-02-08 03:15 . 2010-02-08 03:15 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Threat Expert
2010-02-08 03:10 . 2010-02-08 03:10 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\ATI
2010-02-08 03:10 . 2010-02-08 03:10 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\ATI
2010-02-08 02:48 . 2010-02-08 02:48 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Threat Expert
2010-02-08 02:46 . 2010-01-21 23:21 767952 —-a-w- c:\windows\BDTSupport.dll
2010-02-08 02:46 . 2010-01-21 23:21 165840 —-a-w- c:\windows\PCTBDRes.dll
2010-02-08 02:46 . 2010-01-21 23:21 149456 —-a-w- c:\windows\SGDetectionTool.dll
2010-02-08 02:46 . 2010-01-21 23:21 1652688 —-a-w- c:\windows\PCTBDCore.dll
2010-02-08 02:46 . 2009-10-28 06:36 1152444 —-a-w- c:\windows\UDB.zip
2010-02-08 02:46 . 2008-11-26 17:08 131 —-a-w- c:\windows\IDB.zip
2010-02-08 02:41 . 2009-10-30 16:11 233136 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2010-02-08 02:41 . 2009-11-09 16:20 207792 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2010-02-08 02:41 . 2009-10-06 21:31 87784 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2010-02-08 02:41 . 2009-09-03 14:45 70408 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2010-02-08 02:41 . 2010-02-13 13:29 ——– d—–w- c:\program files\Spyware Doctor
2010-02-08 02:41 . 2010-02-08 02:46 ——– d—–w- c:\program files\Common Files\PC Tools
2010-02-08 02:41 . 2010-02-08 02:41 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\PC Tools
2010-02-08 02:41 . 2010-02-08 02:41 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Tools
2010-02-08 02:41 . 2010-02-13 13:38 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-08 02:20 . 2010-02-08 02:20 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-02-08 02:05 . 2010-02-08 02:05 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec
2010-02-08 02:03 . 2010-02-08 02:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-02-08 02:02 . 2010-02-08 02:02 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2010-02-04 02:53 . 2010-02-04 02:53 ——– d—–w- c:\program files\Seagate
2010-02-04 02:53 . 2010-02-04 02:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Seagate
2010-02-04 02:52 . 2010-02-04 02:52 ——– d—–w- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Downloaded Installations
2010-02-04 02:52 . 2010-02-04 02:52 ——– d-sh–w- c:\windows\ftpcache
2010-01-23 19:35 . 2010-01-23 19:49 ——– d—–w- c:\program files\Hulu Downloader
2010-01-22 20:14 . 2010-01-22 20:14 56816 —ha-w- c:\windows\system32\mlfcache.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 03:20 . 2007-01-19 23:03 ——– d—–w- c:\program files\Symantec AntiVirus
2010-02-10 23:00 . 2008-01-11 02:57 ——– d—–w- c:\program files\Norton Security Scan
2010-02-10 16:03 . 2007-03-04 22:22 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-02-10 03:03 . 2010-02-10 03:02 18167907 —-a-w- c:\program files\avinstall.exe.part
2010-02-08 00:41 . 2007-01-19 23:03 ——– d—–w- c:\program files\Common Files\Symantec Shared
2010-02-08 00:41 . 2007-01-19 23:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2010-02-04 02:54 . 2007-01-19 22:10 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-23 07:21 . 2009-05-20 04:12 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-12 17:11 . 2007-01-20 00:00 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\Apple Computer
2010-01-09 00:22 . 2007-04-26 21:13 ——– d—–w- c:\program files\Google
2009-12-31 16:50 . 2004-08-04 10:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-28 04:27 . 2007-01-19 23:49 ——– d—–w- c:\program files\Napster
2009-12-28 04:26 . 2009-12-28 04:26 ——– d—–w- c:\program files\Common Files\Roxio Shared
2009-12-28 04:26 . 2009-12-28 04:26 ——– d—–w- c:\program files\Common Files\Napster Shared
2009-12-25 03:00 . 2009-12-25 03:00 ——– d—–w- c:\program files\iMesh Applications
2009-12-23 18:30 . 2007-01-20 00:22 ——– d—–w- c:\documents and settings\Natalie Vielkind\Application Data\U3
2009-12-21 19:14 . 2006-03-04 03:33 916480 ——w- c:\windows\system32\wininet.dll
2009-12-20 21:47 . 2007-05-04 01:06 ——– d—–w- c:\program files\Java
2009-12-20 21:46 . 2009-12-20 21:46 152576 —-a-w- c:\documents and settings\Natalie Vielkind\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-20 21:46 . 2009-11-14 09:29 79488 —-a-w- c:\documents and settings\Natalie Vielkind\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-16 18:43 . 2007-01-19 21:54 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-08-04 10:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:27 . 2005-03-30 01:23 2189184 ——w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2005-03-30 01:01 2066048 ——w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2004-08-04 10:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2004-08-04 10:00 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 00:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2004-08-04 10:00 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2004-08-04 10:00 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 10:00 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2004-08-04 00:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2004-08-04 10:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-07-27 07:39 . 2009-07-27 07:38 482336 —-a-w- c:\program files\RealPlayer11GOLD.exe
2009-05-19 02:21 . 2009-05-19 02:21 5873216 —-a-w- c:\program files\SitcomStructure.zip
2008-11-22 21:54 . 2008-11-22 21:54 161541902 —-a-w- c:\program files\iMovieHD6.dmg
2008-10-28 01:51 . 2008-10-28 01:51 426668 —-a-w- c:\program files\Windows6.0-KB958644-x86.msu
2008-01-19 19:56 . 2008-01-19 19:56 1823792 —-a-w- c:\program files\GoogleDesktopSetup.exe
2007-11-16 21:05 . 2007-11-16 21:05 1164456 —-a-w- c:\program files\install_flash_player.exe
2007-11-14 04:00 . 2007-11-14 03:59 54326568 —-a-w- c:\program files\iTunes75Setup.exe
2007-08-14 01:51 . 2007-08-14 01:51 1005270 —-a-w- c:\program files\instzip3.exe
2007-08-14 00:56 . 2007-08-14 00:51 50005304 —-a-w- c:\program files\iTunesSetup.exe
2007-01-20 00:11 . 2007-01-20 00:11 104 -c-ha-w- c:\program files\PR10.dta
2005-11-28 14:02 . 2005-11-28 14:02 73728 —-a-w- c:\program files\AM.dll
2005-11-28 14:02 . 2005-11-28 14:02 183 —-a-w- c:\program files\KodakGallery.com.url
2005-09-16 15:01 . 2005-09-16 15:01 454656 —-a-w- c:\program files\MSICrlPCU.dll
2007-05-27 04:12 . 2007-01-20 00:11 1004 –sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TivoTransfer"="c:\program files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2007-09-25 1195008]
"TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2007-09-25 384000]
"TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2007-09-25 1495040]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"TK8 StickyNotes"="c:\program files\TK8 StickyNotes\TK8StickyNotes.exe" [2009-10-20 9122128]
"Google Update"="c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-23 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 185640]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-16 127037]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\Natalie Vielkind\Start Menu\Programs\Startup\
Last.fm Helper.lnk - c:\program files\Last.fm\LastFMHelper.exe [2008-3-11 106496]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-5-17 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]
[BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Napster\\napster.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2/11/2010 10:43 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2/7/2010 9:41 PM 207792]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [2/7/2010 9:46 PM 112592]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [5/1/2009 2:35 PM 181544]
R2 TivoBeacon2;TiVo Beacon;c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [9/25/2007 10:33 AM 867328]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/2/2007 7:38 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [9/2/2009 7:03 PM 102448]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2009 10:50 AM 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/2/2009 8:19 AM 1181328]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/15/2006 1:40 AM 115952]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2/7/2010 9:41 PM 359624]

— Other Services/Drivers In Memory —

*Deregistered* - PCTSDInjDriver32

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 15:42]

2010-02-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 15:50]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-19 15:50]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-484061587-725345543-1003Core.job
- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 01:15]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-484061587-725345543-1003UA.job
- c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-23 01:15]

2010-02-10 c:\windows\Tasks\Norton Security Scan for Natalie Vielkind.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 09:18]

2010-02-13 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2010-02-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-12-07 03:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/clientapps/AutoSearch/SearchBarLM/YSetSearch/2007/05/03/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\Natalie Vielkind\Application Data\Mozilla\Firefox\Profiles\ca4a7b6j.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\Natalie Vielkind\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npstrlnk.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 18:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1012)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-13 18:39:08
ComboFix-quarantined-files.txt 2010-02-13 23:39
ComboFix2.txt 2010-02-13 13:53

Pre-Run: 15,289,909,248 bytes free
Post-Run: 15,267,450,880 bytes free

- - End Of File - - EAAB2F7809A1E09A906C969969D2A4C0
Upload was successful












Kaspersky:
——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, February 13, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, February 13, 2010 23:59:19
Records in database: 3497252
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 81938
Threats found: 2
Infected objects found: 10
Suspicious objects found: 0
Scan duration: 03:03:24


File name / Threat / Threats count
C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\51\23354cf3-562e563c Infected: Exploit.Java.ByteVerify 1
C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\55\34e0b7f7-7aa82b5b Infected: Exploit.Java.ByteVerify 1
C:\WINDOWS\system32\drivers\etc\hosts Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214756.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214809.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214821.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214835.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214847.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214900.backup Infected: Trojan.Win32.Qhost.mcf 1
C:\WINDOWS\system32\drivers\etc\hosts.20090615-153100.backup Infected: Trojan.Win32.Qhost.mcf 1

Selected area has been scanned.
Post #9
nvielkind,

🖼Click to load external image (Posted Image) Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed.
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Files
C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\51\23354cf3-562e563c
C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\55\34e0b7f7-7aa82b5b
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214756.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214809.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214821.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214835.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214847.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090525-214900.backup
C:\WINDOWS\system32\drivers\etc\hosts.20090615-153100.backup

:Commands
[purity]
[emptytemp]
[RESETHOSTS]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, it will reboot when it is done and produce a log

Please include the following in your next post:
  • OTL Fix log
  • Let me know if you are still being redirected
Post #10
I am actually no longer getting the Google 302 Moved message. Now, when I click on links from a Google search, it takes me right to the desired webpage. I don't believe there are any other glaring problems I am getting on my computer, but I don't want to get too optimistic before I get the green light. Are there any further instructions? OTL Fix log: All processes killed ========== FILES ========== C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\51\23354cf3-562e563c moved successfully. C:\Documents and Settings\Natalie Vielkind\Application Data\Sun\Java\Deployment\cache\6.0\55\34e0b7f7-7aa82b5b moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214756.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214809.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214821.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214835.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214847.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090525-214900.backup moved successfully. C:\WINDOWS\system32\drivers\etc\hosts.20090615-153100.backup moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->FireFox cache emptied: 2918791 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 491764 bytes User: Natalie Vielkind ->Temp folder emptied: 94696563 bytes ->Temporary Internet Files folder emptied: 22070997 bytes ->Java cache emptied: 95338428 bytes ->FireFox cache emptied: 83953980 bytes ->Google Chrome cache emptied: 7511636 bytes ->Apple Safari cache emptied: 1247238 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2195181 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3616989 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 2412876 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 302.00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.1.28.0 log created on 02142010_111323 Files\Folders moved on Reboot… Registry entries deleted on Reboot…
Post #11
nvielkind,

Good job, your logs look clean! We have some important clean up and housekeeping to do now:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
        Applications and AppletsTrace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.
    Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

    Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

    Click to load external image (Posted Image) You have Viewpoint software installed on your system. While this is not malware, it can be installed without your knowledge. See this thread for more information and removal instructions for Viewpoint.

    Click to load external image (Posted Image) Uninstall ComboFix
    • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
      Combofix /Uninstall
    Click to load external image (Posted Image)

    Click to load external image (Posted Image) Clean up with OTL:
    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.
    • Manually delete any remaining logs or tools.
    Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
    • Restart any anti-malware programs that we disabled while we were cleaning your machine.
    • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
    • Consider running in a limited user account. See this post for more information.
    • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
    Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!
Post #12
I have followed most of your suggestions about updates, and I am working through the rest of them. Everything seems great. Thanks so much for all of your help. it is definitely reassuring that the forum offers such quick and user-friendly help!
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI