coldsmoke
Topic Starter
Sorry, cannot post log file. Was told to upgrade. I don't remember which version I was suppose to get but I am on 2.0.4
Thanks.
Spyware / Malware / Virus Removal
[Resolved] Google Redirect
14 min read
LDTate
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")
Stay with this topic until I give you the all clean post.
You might want to print these instructions out.
I suggest you do this:
XP Users
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.
Vista Users
To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:
Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.
Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:
If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.
If you are in the Control Panel Home view do the following:
Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Please do not delete anything unless instructed to.
We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache
Next:
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.
Next:
1. Download VIPRE Rescue to your desktop (it's a big download about 80mb…..takes about 4-5 minutes on broadband)
2. Double click on the VIPRE Rescue icon, it will ask if you want to extract VIPRE Rescue Scanner to your computer, click yes.
3. The "WinZip Self- Extractor" window will pop-up, click Unzip
It should by default unzip to C:
Make sure the checkbox for "When done unzipping open: .\deep_scan.bat" is checked
After the files are unzipped, click OK
4. VIPRE Rescue will now run automatically and perform a deep (full) scan.
5. When it's done, type exit and press enter to close the program.
6. The logs will be in the VIPRERESCUE folder and are listed as XML documents and CSV
Reboot and please describe how your computer behaves at the moment.
coldsmoke
Viper found 6 threats and quarantined them. Thought I may have prevented a proper quarantine because I forgot to stop WinPatrol so I ran it again. It didn't find any threats, but I am still being re-directed though and chrome still won't load pages (not sure if it's related or not). Thanks.
LDTate
Download ComboFix from one of these locations:
Link 1
Link 2 If using this link, Right Click and select Save As.
* IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.
Link 1
Link 2 If using this link, Right Click and select Save As.
* IMPORTANT !!! Save ComboFix.exe to your Desktop
- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
- Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
- As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Give it atleast 20-30 minutes to finish if needed.
Please do not attach the scan results from Combofx. Use copy/paste.
Also please describe how your computer behaves at the moment.
coldsmoke
ComboFix 10-05-20.06 - HLacey 05/20/2010 16:30:37.5.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1674 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\HLacey\LOCALS~1\Temp\install_flash_player.exe
c:\documents and settings\HLacey\g2mdlhlpx.exe
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\About.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Activate.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Buy.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Data Protection Support.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Data Protection.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Scan.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Settings.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Update.lnk
c:\windows\system32\drivers\1028_DELL_XPS_MP061 .MRK
c:\windows\system32\drivers\DELL_XPS_MP061 .MRK
c:\windows\system32\drivers\mtpavsu.sys
c:\windows\system32\id_cost.dol
c:\windows\system32\ukulizej.ini
Infected copy of c:\windows\system32\drivers\pciide.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_otqxp
——-\Service_otqxp
((((((((((((((((((((((((( Files Created from 2010-04-20 to 2010-05-20 )))))))))))))))))))))))))))))))
.
2010-05-20 22:44 . 2010-05-20 22:44 ——– d—–w- c:\windows\LastGood
2010-05-19 13:46 . 2009-09-07 20:02 27944 —-a-w- c:\windows\system32\sbbd.exe
2010-05-19 13:46 . 2009-08-05 21:58 93872 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-19 13:46 . 2010-05-20 04:12 ——– d—–w- C:\VIPRERESCUE
2010-05-16 13:52 . 2010-05-16 13:52 388096 —-a-r- c:\documents and settings\HLacey\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\documents and settings\HLacey\Application Data\WinPatrol
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Config.sys
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Autoexec.bat
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\program files\BillP Studios
2010-05-13 02:37 . 2010-05-13 02:37 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\documents and settings\All Users\Application Data\mpDRM
2010-05-08 02:04 . 2010-05-08 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\fluxDVD
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\program files\Common Files\fluxDVD
2010-05-08 02:04 . 2010-05-08 02:04 ——– d—–w- c:\program files\FlickRocket
2010-04-29 00:05 . 2010-04-29 00:05 ——– d—–w- C:\temp
2010-04-29 00:04 . 2010-04-29 00:04 ——– d—–w- c:\documents and settings\HLacey\.jnlp-applet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:02 . 2007-06-11 11:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-13 13:09 . 2009-04-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-11 02:19 . 2009-04-30 03:42 ——– d—–w- c:\documents and settings\HLacey\Application Data\Skype
2010-05-11 01:13 . 2009-04-30 03:43 ——– d—–w- c:\documents and settings\HLacey\Application Data\skypePM
2010-05-11 01:12 . 2009-04-29 00:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-11 01:12 . 2009-04-29 00:13 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-04-29 21:39 . 2009-04-06 02:56 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 21:39 . 2009-04-06 02:56 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-04-25 15:28 . 2009-04-25 15:28 5410 –sh–w- c:\windows\system32\reveraza.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-25 149280]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-21 86960]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-6-20 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 19:41 294912 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 1:53 PM 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 12:39 PM 51440]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [5/19/2010 7:46 AM 93872]
S2 gupdate1c9c945bac9930e;Google Update Service (gupdate1c9c945bac9930e);c:\program files\Google\Update\GoogleUpdate.exe [4/29/2009 9:42 PM 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 5:51 PM 4096]
.
Contents of the 'Scheduled Tasks' folder
2010-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
2010-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.divematrix.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.
- - - - ORPHANS REMOVED - - - -
AddRemove-Data Protection - c:\program files\Data Protection\Pklkvqdii+`}`
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-20 16:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7C0EE4]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cfc3
\Driver\ACPI -> ACPI.sys @ 0xba77fcb8
\Driver\atapi -> atapi.sys @ 0xba7117b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xba607ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5f6a0b
SendHandler -> NDIS.sys @ 0xba60ab31
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(856)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(7744)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\brsvc01a.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\brss01a.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\stsystra.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-05-20 16:56:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-20 22:56
ComboFix2.txt 2009-04-06 14:34
ComboFix3.txt 2007-08-21 16:55
Pre-Run: 26,618,085,376 bytes free
Post-Run: 34,158,346,240 bytes free
- - End Of File - - C9456B9DF9E649D85AE3E3131FF56EED
PC seems to boot and load faster but still being redirected with google searches and chrome is still not loading pages. I haven't tired other search engines.
Thanks.
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1674 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\HLacey\LOCALS~1\Temp\install_flash_player.exe
c:\documents and settings\HLacey\g2mdlhlpx.exe
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\About.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Activate.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Buy.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Data Protection Support.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Data Protection.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Scan.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Settings.lnk
c:\documents and settings\HLacey\Start Menu\Programs\Data Protection\Update.lnk
c:\windows\system32\drivers\1028_DELL_XPS_MP061 .MRK
c:\windows\system32\drivers\DELL_XPS_MP061 .MRK
c:\windows\system32\drivers\mtpavsu.sys
c:\windows\system32\id_cost.dol
c:\windows\system32\ukulizej.ini
Infected copy of c:\windows\system32\drivers\pciide.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_otqxp
——-\Service_otqxp
((((((((((((((((((((((((( Files Created from 2010-04-20 to 2010-05-20 )))))))))))))))))))))))))))))))
.
2010-05-20 22:44 . 2010-05-20 22:44 ——– d—–w- c:\windows\LastGood
2010-05-19 13:46 . 2009-09-07 20:02 27944 —-a-w- c:\windows\system32\sbbd.exe
2010-05-19 13:46 . 2009-08-05 21:58 93872 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-19 13:46 . 2010-05-20 04:12 ——– d—–w- C:\VIPRERESCUE
2010-05-16 13:52 . 2010-05-16 13:52 388096 —-a-r- c:\documents and settings\HLacey\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\documents and settings\HLacey\Application Data\WinPatrol
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Config.sys
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Autoexec.bat
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\program files\BillP Studios
2010-05-13 02:37 . 2010-05-13 02:37 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\documents and settings\All Users\Application Data\mpDRM
2010-05-08 02:04 . 2010-05-08 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\fluxDVD
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\program files\Common Files\fluxDVD
2010-05-08 02:04 . 2010-05-08 02:04 ——– d—–w- c:\program files\FlickRocket
2010-04-29 00:05 . 2010-04-29 00:05 ——– d—–w- C:\temp
2010-04-29 00:04 . 2010-04-29 00:04 ——– d—–w- c:\documents and settings\HLacey\.jnlp-applet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:02 . 2007-06-11 11:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-13 13:09 . 2009-04-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-11 02:19 . 2009-04-30 03:42 ——– d—–w- c:\documents and settings\HLacey\Application Data\Skype
2010-05-11 01:13 . 2009-04-30 03:43 ——– d—–w- c:\documents and settings\HLacey\Application Data\skypePM
2010-05-11 01:12 . 2009-04-29 00:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-11 01:12 . 2009-04-29 00:13 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-04-29 21:39 . 2009-04-06 02:56 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 21:39 . 2009-04-06 02:56 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-04-25 15:28 . 2009-04-25 15:28 5410 –sh–w- c:\windows\system32\reveraza.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-25 149280]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-21 86960]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-6-20 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 19:41 294912 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 1:53 PM 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 12:39 PM 51440]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [5/19/2010 7:46 AM 93872]
S2 gupdate1c9c945bac9930e;Google Update Service (gupdate1c9c945bac9930e);c:\program files\Google\Update\GoogleUpdate.exe [4/29/2009 9:42 PM 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 5:51 PM 4096]
.
Contents of the 'Scheduled Tasks' folder
2010-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
2010-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.divematrix.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.
- - - - ORPHANS REMOVED - - - -
AddRemove-Data Protection - c:\program files\Data Protection\Pklkvqdii+`}`
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-20 16:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7C0EE4]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cfc3
\Driver\ACPI -> ACPI.sys @ 0xba77fcb8
\Driver\atapi -> atapi.sys @ 0xba7117b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xba607ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5f6a0b
SendHandler -> NDIS.sys @ 0xba60ab31
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(856)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(7744)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\brsvc01a.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\brss01a.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\stsystra.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-05-20 16:56:45 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-20 22:56
ComboFix2.txt 2009-04-06 14:34
ComboFix3.txt 2007-08-21 16:55
Pre-Run: 26,618,085,376 bytes free
Post-Run: 34,158,346,240 bytes free
- - End Of File - - C9456B9DF9E649D85AE3E3131FF56EED
PC seems to boot and load faster but still being redirected with google searches and chrome is still not loading pages. I haven't tired other search engines.
Thanks.
LDTate
Copy/paste the text in the Codebox below into notepad:
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Drag CFScript.txt into ComboFix.exe
Then post the results log using Copy / Paste
Also please describe how your computer behaves at the moment.
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.
http://forums.whatthetech.com/Google_Redirect_t112120.html File:: Collect:: c:\windows\system32\reveraza.exe
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
Drag CFScript.txt into ComboFix.exe
Then post the results log using Copy / Paste
Also please describe how your computer behaves at the moment.
coldsmoke
ComboFix 10-05-20.A2 - HLacey 05/21/2010 7:52.6.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1664 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HLacey\Desktop\CFScript.txt
file zipped: c:\windows\system32\reveraza.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\reveraza.exe
Infected copy of c:\windows\system32\drivers\pciide.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2010-04-21 to 2010-05-21 )))))))))))))))))))))))))))))))
.
2010-05-19 13:46 . 2009-09-07 20:02 27944 —-a-w- c:\windows\system32\sbbd.exe
2010-05-19 13:46 . 2009-08-05 21:58 93872 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-19 13:46 . 2010-05-20 04:12 ——– d—–w- C:\VIPRERESCUE
2010-05-16 13:52 . 2010-05-16 13:52 388096 —-a-r- c:\documents and settings\HLacey\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\documents and settings\HLacey\Application Data\WinPatrol
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Config.sys
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Autoexec.bat
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\program files\BillP Studios
2010-05-13 02:37 . 2010-05-13 02:37 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\documents and settings\All Users\Application Data\mpDRM
2010-05-08 02:04 . 2010-05-08 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\fluxDVD
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\program files\Common Files\fluxDVD
2010-05-08 02:04 . 2010-05-08 02:04 ——– d—–w- c:\program files\FlickRocket
2010-04-29 00:05 . 2010-04-29 00:05 ——– d—–w- C:\temp
2010-04-29 00:04 . 2010-04-29 00:04 ——– d—–w- c:\documents and settings\HLacey\.jnlp-applet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:02 . 2007-06-11 11:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-13 13:09 . 2009-04-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-11 02:19 . 2009-04-30 03:42 ——– d—–w- c:\documents and settings\HLacey\Application Data\Skype
2010-05-11 01:13 . 2009-04-30 03:43 ——– d—–w- c:\documents and settings\HLacey\Application Data\skypePM
2010-05-11 01:12 . 2009-04-29 00:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-11 01:12 . 2009-04-29 00:13 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-04-29 21:39 . 2009-04-06 02:56 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 21:39 . 2009-04-06 02:56 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-25 149280]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-21 86960]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-6-20 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 19:41 294912 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 1:53 PM 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 12:39 PM 51440]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [5/19/2010 7:46 AM 93872]
S2 gupdate1c9c945bac9930e;Google Update Service (gupdate1c9c945bac9930e);c:\program files\Google\Update\GoogleUpdate.exe [4/29/2009 9:42 PM 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 5:51 PM 4096]
.
Contents of the 'Scheduled Tasks' folder
2010-05-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-06-11 00:12]
2010-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
2010-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.divematrix.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-21 08:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7D7EE4]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cfc3
\Driver\ACPI -> ACPI.sys @ 0xba77fcb8
\Driver\atapi -> atapi.sys @ 0xba7117b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xba607ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5f6a0b
SendHandler -> NDIS.sys @ 0xba60ab31
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(852)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-05-21 08:05:03
ComboFix-quarantined-files.txt 2010-05-21 14:04
ComboFix2.txt 2010-05-20 22:56
ComboFix3.txt 2009-04-06 14:34
ComboFix4.txt 2007-08-21 16:55
Pre-Run: 34,140,745,728 bytes free
Post-Run: 34,103,873,536 bytes free
- - End Of File - - 0C6085B0303F902A067C60E47F51587F
Upload was successful
Still being redirected sometimes. Chrome still not loading. Thanks.
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1664 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HLacey\Desktop\CFScript.txt
file zipped: c:\windows\system32\reveraza.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\reveraza.exe
Infected copy of c:\windows\system32\drivers\pciide.sys was found and disinfected
Restored copy from - Kitty had a snack
.
((((((((((((((((((((((((( Files Created from 2010-04-21 to 2010-05-21 )))))))))))))))))))))))))))))))
.
2010-05-19 13:46 . 2009-09-07 20:02 27944 —-a-w- c:\windows\system32\sbbd.exe
2010-05-19 13:46 . 2009-08-05 21:58 93872 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-19 13:46 . 2010-05-20 04:12 ——– d—–w- C:\VIPRERESCUE
2010-05-16 13:52 . 2010-05-16 13:52 388096 —-a-r- c:\documents and settings\HLacey\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\documents and settings\HLacey\Application Data\WinPatrol
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Config.sys
2010-05-15 13:17 . 2007-06-10 22:10 0 —-a-w- c:\documents and settings\HLacey\Application Data\WinPatrol\Autoexec.bat
2010-05-15 13:17 . 2010-05-15 13:17 ——– d—–w- c:\program files\BillP Studios
2010-05-13 02:37 . 2010-05-13 02:37 ——– d—–w- c:\windows\system32\wbem\Repository
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\documents and settings\All Users\Application Data\mpDRM
2010-05-08 02:04 . 2010-05-08 02:07 ——– d—–w- c:\documents and settings\All Users\Application Data\fluxDVD
2010-05-08 02:04 . 2010-05-13 02:37 ——– d—–w- c:\program files\Common Files\fluxDVD
2010-05-08 02:04 . 2010-05-08 02:04 ——– d—–w- c:\program files\FlickRocket
2010-04-29 00:05 . 2010-04-29 00:05 ——– d—–w- C:\temp
2010-04-29 00:04 . 2010-04-29 00:04 ——– d—–w- c:\documents and settings\HLacey\.jnlp-applet
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 14:02 . 2007-06-11 11:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-05-13 13:09 . 2009-04-06 02:56 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-05-11 02:19 . 2009-04-30 03:42 ——– d—–w- c:\documents and settings\HLacey\Application Data\Skype
2010-05-11 01:13 . 2009-04-30 03:43 ——– d—–w- c:\documents and settings\HLacey\Application Data\skypePM
2010-05-11 01:12 . 2009-04-29 00:14 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-05-11 01:12 . 2009-04-29 00:13 0 —-a-w- c:\windows\system32\drivers\logiflt.iad
2010-04-29 21:39 . 2009-04-06 02:56 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 21:39 . 2009-04-06 02:56 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-25 149280]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-02 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-21 86960]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-6-20 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 19:41 294912 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/10/2006 1:53 PM 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/27/2007 12:39 PM 51440]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [5/19/2010 7:46 AM 93872]
S2 gupdate1c9c945bac9930e;Google Update Service (gupdate1c9c945bac9930e);c:\program files\Google\Update\GoogleUpdate.exe [4/29/2009 9:42 PM 133104]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 5:51 PM 4096]
.
Contents of the 'Scheduled Tasks' folder
2010-05-21 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-06-11 00:12]
2010-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
2010-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-30 03:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.divematrix.com/
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-21 08:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A7D7EE4]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba90cfc3
\Driver\ACPI -> ACPI.sys @ 0xba77fcb8
\Driver\atapi -> atapi.sys @ 0xba7117b4
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
ParseProcedure -> ntkrnlpa.exe @ 0x80581684
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xba607ba0
PacketIndicateHandler -> NDIS.sys @ 0xba5f6a0b
SendHandler -> NDIS.sys @ 0xba60ab31
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(852)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-05-21 08:05:03
ComboFix-quarantined-files.txt 2010-05-21 14:04
ComboFix2.txt 2010-05-20 22:56
ComboFix3.txt 2009-04-06 14:34
ComboFix4.txt 2007-08-21 16:55
Pre-Run: 34,140,745,728 bytes free
Post-Run: 34,103,873,536 bytes free
- - End Of File - - 0C6085B0303F902A067C60E47F51587F
Upload was successful
Still being redirected sometimes. Chrome still not loading. Thanks.
LDTate
Please download DeFogger to your desktop.
Double click DeFogger to run the tool.
Do not re-enable these drivers until otherwise instructed.
To re-enable your Emulation drivers once you're clean, double click DeFogger to run the tool.
Your Emulation drivers are now re-enabled.
Next:
Please download GMER from one of the following locations and save it to your desktop:
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.
Double click DeFogger to run the tool.
- The application window will appear
- Click the Disable button to disable your CD Emulation drivers
- Click Yes to continue
- A 'Finished!' message will appear
- Click OK
- DeFogger will now ask to reboot the machine - click OK
Do not re-enable these drivers until otherwise instructed.
To re-enable your Emulation drivers once you're clean, double click DeFogger to run the tool.
- The application window will appear
- Click the Re-enable button to re-enable your CD Emulation drivers
- Click Yes to continue
- A 'Finished!' message will appear
- Click OK
- DeFogger will now ask to reboot the machine - click OK
Your Emulation drivers are now re-enabled.
Next:
Please download GMER from one of the following locations and save it to your desktop:
- Main Mirror
This version will download a randomly named file (Recommended) - Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
- Double click GMER.exe.
[external image: Posted Image] - If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
- In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
[external image: Posted Image]
Click the image to enlarge it
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
- Save the log where you can easily find it, such as your desktop.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.
coldsmoke
Defogger never asked to re-boot so I didn't continue. It did say "finished" and I clicked "ok". Here's the log file:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:24 on 26/05/2010 (HLacey)
Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers…
-=E.O.F=-
Thanks
LDTate
Please download GMER from one of the following locations and save it to your desktop:
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.
- Main Mirror
This version will download a randomly named file (Recommended) - Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
- Double click GMER.exe.
[external image: Posted Image] - If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
- In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
[external image: Posted Image]
Click the image to enlarge it
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
- Save the log where you can easily find it, such as your desktop.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.
coldsmoke
I have preformed the scan twice - both times the pc automatically reboots and never allows me to save a log file. Please advise.
Thanks,
LDTate
Run a new combofix scan please 
coldsmoke
After running a new combo fix scan the task bar changed style (not sure of the importance) and I am now unable to acquire an ip address. I have tired to set it up manually but I still cannot ping any other devices on the local network. I do have the recent combofix scan log file, but without network access it's a little more difficult to attach here so I thought I'd see if you have any ideas before I manually transfer the file using a flash drive.
Also, there were windows updates that were ready to install. I restarted the pc a few times in an attempt to correct the network issues and always chose to not install updates, however at one point it did it without prompting. I chose not to manually abort the installation fearing further problems. I hope that was the right choice.
Thanks,
LDTate
Try these
Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line:
IPCONFIG /release
IPCONFIG /renew
IPCONFIG /flushdns
IPCONFIG /registerdns
============================================================================
check some settings on your system:
ipconfig /flushdns (The space between g and / is needed)
regsvr32 netshell.dll
regsvr32 netcfgx.dll
regsvr32 netman.dll
Exit
Restart the computer.
Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line:
IPCONFIG /release
IPCONFIG /renew
IPCONFIG /flushdns
IPCONFIG /registerdns
============================================================================
check some settings on your system:
- Enter your Control Panel and double-click on Network Connections
- Then right click on your Default Connection
- Usually Local Area Connection for Cable and DSL, or AOL Connection.
- Left click on Properties
- Double-Click on the Internet Protocol (TCP/IP) item
- Select the radio dial that says Obtain DNS Servers Automatically
- Press OK twice to get out of the properties screen
- Restart the computer
ipconfig /flushdns (The space between g and / is needed)
regsvr32 netshell.dll
regsvr32 netcfgx.dll
regsvr32 netman.dll
Exit
Restart the computer.
coldsmoke
ipconfig /flushdns
Could not flush the DNS Resolver Cache: Function Failed during execution
IPCONFIG /registerdns
….failed : The RPC server is unavailable
Network settings are currently as you describe – to obtain automatically
ipconfig /flushdns
Could not flush the DNS Resolver Cache: Function Failed during execution
regsvr32 netshell.dll
DllRegisterServer in netshell.dll succeeded.
regsvr32 netcfgx.dll
DllRegisterServer in netcfgx.dll succeeded.
regsvr32 netman.dll
DllRegisterServer in netman.dll succeeded.
Rebooted and still unable to acquire IP address.
Please advise.
Thanks,
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI