What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Microsoft did not Fix

40 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Satchfan I just noticed that when I click on a lot of sites now, it says it is unavailable. When I refresh, i will often get the site but often times not. Thanks GB
Post #32
Hi gbsk

We’ll flush your DNS cache to see if that is causing this problem.

Also, to make sure there is nothing else lurking I still need to look at the contents of hosts.ics, a gmer log and a current OTL log. If you can’t find gmer.txt, you can run it again. Please follow these instructions through as they are given. As you said, it would be best if this is cleared up before you go away.


Flush the DNS cache
  • Go to Start > Run > type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.

To show the contents of hosts.ics:
• Open Windows Explorer (Windows key+E}
• Navigate to C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents
• Click on My Documents to show the contents
• In the right window, right-click on hosts.ics and then on Open
• A list will appear asking what to open it with: choose Notepad
• Copy and paste the contents in your next reply.


Run OTL
• Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
• Post the OTL.txt log it produces in your next reply.


Open GMER Rootkit Scanner

If you no longer have it, download it from [external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • All drives/partitions except C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

OTL.txt
Gmer.txt

Please remember to send the contents of hosts.ics

Thanks

Satchfan
Post #33
Satchfan

I ran all the things you wanted me to run. Here are the logfiles.


## Copyright © 1993-2001 Microsoft Corp.
#
# This file has been automatically generated for use by Microsoft Internet
# Connection Sharing. It contains the mappings of IP addresses to host names
# for the home network. Please do not make changes to the HOSTS.ICS file.
# Any changes may result in a loss of connectivity between machines on the
# local network.
#

#66.58.181.223 khalsa.mshome.net # 2014 6 1 23 17 48 24 156


OTL logfile created on: 6/15/2010 2:06:44 AM - Run 3
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 8.00% Memory free
3.00 Gb Paging File | 1.00 Gb Available in Paging File | 50.00% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WIXP | %ProgramFiles% = C:\Program Files
Drive C: | 38.25 Gb Total Space | 18.26 Gb Free Space | 47.75% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KHALSA-FAMILY
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\Program Files\Opera\opera.exe (Opera Software)
PRC - C:\Program Files\Outlook Express\msimn.exe (Microsoft Corporation)
PRC - C:\WIXP\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WIXP\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (McAfee SiteAdvisor Service) – c:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (wuauserv) – C:\WINDOWS\system32\wuauserv.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (aswMon2) – C:\WIXP\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) – C:\WIXP\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\WIXP\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) – C:\WIXP\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) – C:\WIXP\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) – C:\WIXP\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (BANTExt) – C:\WIXP\System32\Drivers\BANTExt.sys ()
DRV - (portD) – C:\WIXP\system32\drivers\portd2k.sys (CMS Peripherals, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WIXP\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (AN983) – C:\WIXP\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (OMCI) – C:\WIXP\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/06/02 21:21:08 | 000,000,000 | —D | M]

[2009/12/21 14:30:16 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/06/12 01:05:28 | 000,000,098 | —- | M]) - C:\WIXP\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (GigagetIEHelper Class) - {111CAA23-6F4F-42AC-8555-B48C1D87BBAB} - C:\WIXP\system32\gigagetbho_v10.dll (Giganology Inc.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (xplorer2 Toolbar) - {db35fda8-77e3-4784-92c2-ee7345e91af4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (xplorer2 Toolbar) - {DB35FDA8-77E3-4784-92C2-EE7345E91AF4} - C:\Program Files\xplorer2\tbxpl0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [V71IQL7HI7] C:\WIXP\Qtabua.exe File not found
O4 - Startup: C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download All by Gigaget - C:\Program Files\Giganology\Gigaget\getAllurl.htm ()
O8 - Extra context menu item: &Download by Gigaget - C:\Program Files\Giganology\Gigaget\geturl.htm ()
O9 - Extra Button: Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Add to TimeLeft Auction Watch - {21196042-830F-419f-A594-F9D456A6C29A} - Reg Error: Key error. File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WIXP\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WIXP\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WIXP\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WIXP\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WIXP\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 18:29:56 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/15 02:04:44 | 000,561,664 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\OTL.exe
[2010/06/07 20:59:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Toastmasters
[2010/06/07 16:29:44 | 000,000,000 | —D | C] – C:\WIXP\Sun
[2010/06/07 16:09:32 | 000,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 15:17:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/06/07 15:16:20 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:16:19 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:16:19 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:16:18 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/04 15:27:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\OLYMPUS
[2010/06/04 15:14:05 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/06/03 15:55:10 | 016,295,712 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 22:34:15 | 000,023,120 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswRdr.sys
[2010/06/02 22:34:13 | 000,048,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswTdi.sys
[2010/06/02 22:34:12 | 000,027,408 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aavmker4.sys
[2010/06/02 22:34:09 | 000,097,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\AvastSS.scr
[2010/06/02 22:34:08 | 000,114,768 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswSP.sys
[2010/06/02 22:34:08 | 000,094,160 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon2.sys
[2010/06/02 22:34:08 | 000,093,424 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswmon.sys
[2010/06/02 22:34:08 | 000,020,560 | —- | C] (ALWIL Software) – C:\WIXP\System32\drivers\aswFsBlk.sys
[2010/06/02 22:33:39 | 001,280,480 | —- | C] (ALWIL Software) – C:\WIXP\System32\aswBoot.exe
[2010/06/02 22:33:39 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\WIXP\System32\MFC71.dll
[2010/05/28 15:21:07 | 000,031,232 | —- | C] (NirSoft) – C:\WIXP\NIRCMD.exe
[2010/05/21 05:16:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/17 20:58:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
[2010/05/17 20:36:53 | 000,000,000 | —D | C] – C:\Program Files\JRE
[2010/05/17 20:36:43 | 000,000,000 | —D | C] – C:\Program Files\OpenOffice.org 3
[2009/09/20 14:20:41 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2009/06/10 22:37:38 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/06/10 18:33:18 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/06/10 18:29:31 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/06/15 02:11:00 | 000,000,884 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/15 02:02:00 | 000,001,006 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
[2010/06/15 01:44:00 | 000,000,240 | -H– | M] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/14 15:11:00 | 000,000,880 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/14 12:02:00 | 000,000,954 | —- | M] () – C:\WIXP\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
[2010/06/13 21:45:59 | 000,000,006 | -H– | M] () – C:\WIXP\tasks\SA.DAT
[2010/06/13 21:45:45 | 000,002,048 | –S- | M] () – C:\WIXP\bootstat.dat
[2010/06/13 21:41:19 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2010/06/13 21:41:18 | 002,883,584 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2010/06/13 21:41:16 | 001,381,864 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\IconCache.db
[2010/06/13 19:04:43 | 000,092,316 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Loretta 2010 birthday.jpeg
[2010/06/13 13:55:05 | 000,021,852 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\sample_coaching_agreement.pdf
[2010/06/13 13:44:57 | 000,008,780 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\M4L3call_focus_form_rev10_09.pdf
[2010/06/12 01:05:28 | 000,000,098 | —- | M] () – C:\WIXP\System32\drivers\etc\Hosts
[2010/06/11 23:05:45 | 000,363,520 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\rkill.scr
[2010/06/10 10:25:24 | 001,076,779 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Dev Dharam Singh -Transcript.pdf
[2010/06/09 22:09:31 | 000,034,816 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\4thMeeting Minutes_051910.doc
[2010/06/09 08:36:54 | 000,015,429 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom%20from%20Mo.odt_0.odt
[2010/06/08 14:47:06 | 000,000,166 | -H– | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\.~lock.SpeakerInfoSheet_2007_08.doc#
[2010/06/07 19:11:05 | 000,002,259 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\Skype.lnk
[2010/06/07 16:23:16 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ATF-Cleaner.exe
[2010/06/07 15:15:32 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaws.exe
[2010/06/07 15:15:32 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javaw.exe
[2010/06/07 15:15:32 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\javacpl.cpl
[2010/06/07 15:15:31 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\java.exe
[2010/06/07 15:15:30 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WIXP\System32\deployJava1.dll
[2010/06/05 17:22:09 | 000,007,782 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 14:58:56 | 000,058,542 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:54 | 000,009,340 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/03 16:45:12 | 000,000,227 | —- | M] () – C:\WIXP\system.ini
[2010/06/03 15:55:11 | 016,295,712 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\jre-6u20-windows-i586.exe
[2010/06/03 10:57:31 | 000,092,533 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 22:34:08 | 000,002,626 | —- | M] () – C:\WIXP\System32\CONFIG.NT
[2010/06/02 19:01:11 | 000,249,139 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/06/02 18:49:31 | 000,000,430 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/05/31 22:05:49 | 000,030,771 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/28 22:29:22 | 000,229,727 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/28 13:51:07 | 003,700,495 | R— | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\ComboFix.exe
[2010/05/23 14:29:07 | 002,150,480 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/23 13:41:09 | 000,018,008 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/05/20 23:12:27 | 000,000,056 | -H– | M] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 22:00:06 | 000,115,768 | —- | M] () – C:\WIXP\System32\FNTCACHE.DAT
[2010/05/20 21:54:50 | 000,006,604 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:14 | 000,000,687 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/20 21:45:48 | 000,000,016 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/19 18:34:19 | 000,026,112 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:41 | 000,001,689 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | M] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | M] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | M] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt

========== Files Created - No Company Name ==========

[2010/06/13 19:04:43 | 000,092,316 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Loretta 2010 birthday.jpeg
[2010/06/13 13:55:56 | 000,021,852 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\sample_coaching_agreement.pdf
[2010/06/13 13:47:11 | 000,008,780 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\M4L3call_focus_form_rev10_09.pdf
[2010/06/12 01:47:39 | 000,000,240 | -H– | C] () – C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/06/12 00:32:07 | 000,015,429 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Wisdom%20from%20Mo.odt_0.odt
[2010/06/11 23:05:44 | 000,363,520 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\rkill.scr
[2010/06/10 11:19:39 | 001,076,779 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Dev Dharam Singh -Transcript.pdf
[2010/06/09 22:09:29 | 000,034,816 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\4thMeeting Minutes_051910.doc
[2010/06/08 14:47:06 | 000,000,166 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\.~lock.SpeakerInfoSheet_2007_08.doc#
[2010/06/05 17:22:07 | 000,007,782 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.pdf
[2010/06/05 15:27:25 | 000,058,542 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\mo 036.JPG
[2010/06/05 14:49:32 | 000,032,308 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Mo's SD 2009 344.JPG
[2010/06/04 17:23:53 | 000,009,340 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom for Dev Dharm from Kailee.odt
[2010/06/04 17:22:35 | 000,012,669 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Words of Wisdom from Tony.odt
[2010/06/03 14:56:08 | 000,092,533 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Health Risks.PDF
[2010/06/02 22:33:39 | 000,380,928 | —- | C] () – C:\WIXP\System32\actskin4.ocx
[2010/06/02 18:49:31 | 000,000,430 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental2.rtf
[2010/06/02 18:48:23 | 000,005,794 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Car Rental.rtf
[2010/06/02 12:52:07 | 000,000,436 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics
[2010/06/01 12:43:37 | 000,030,771 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Policies and Produres (1).pdf
[2010/05/31 16:58:35 | 000,237,314 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Intermediate.pdf
[2010/05/30 13:50:13 | 002,150,480 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\untitled_0.odt
[2010/05/28 22:46:10 | 000,229,727 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Graduation-Invitation.jpg
[2010/05/28 22:29:22 | 000,249,139 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\Graduation-Invitation.jpg
[2010/05/28 22:17:37 | 000,025,563 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\class_of_2010-21926.jpg
[2010/05/20 23:12:27 | 000,000,056 | -H– | C] () – C:\WIXP\System32\ezsidmv.dat
[2010/05/20 21:54:50 | 000,006,604 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\2010 May letter to MSBSD.rtf
[2010/05/20 21:53:13 | 000,000,687 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\latest herbs for us 2010.rtf
[2010/05/19 18:34:18 | 000,026,112 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\Budget-YACT PR Committee-May 7.xls
[2010/05/17 21:04:44 | 000,000,016 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb.lck
[2010/05/17 21:04:40 | 000,001,689 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\New Database.odb
[2010/05/17 21:01:07 | 000,000,864 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/05/17 20:39:06 | 000,000,905 | —- | C] () – C:\Documents and Settings\All Users.WIXP\Desktop\OpenOffice.org 3.2.lnk
[2010/05/17 19:54:09 | 000,000,754 | —- | C] () – C:\WIXP\WORDPAD.INI
[2010/05/16 16:43:20 | 000,062,976 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Desktop\7Habits+class01.ppt
[2010/05/07 01:03:11 | 000,000,237 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Application Data\burnaware.ini
[2010/04/07 05:46:10 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\housecall.guid.cache
[2010/03/08 13:21:09 | 000,004,608 | —- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/03 06:41:44 | 000,003,840 | —- | C] () – C:\WIXP\System32\drivers\BANTExt.sys
[2010/01/22 13:22:54 | 000,767,952 | —- | C] () – C:\WIXP\BDTSupport.dll.old
[2009/12/21 17:57:56 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.ini
[2009/12/21 17:57:54 | 000,001,024 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\ntuser.dat.LOG
[2009/12/21 17:57:52 | 002,883,584 | -H– | C] () – C:\Documents and Settings\Owner.KHALSA-FAMILY\NTUSER.DAT
[2002/09/03 08:58:49 | 000,027,440 | —- | C] () – C:\WIXP\System32\drivers\secdrv.sys
< End of report >


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-15 03:52:40
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\OWNER~1.KHA\LOCALS~1\Temp\fwlcqpog.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xB1EA16B8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xB1EA1574]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xB1EA1A52]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xB1EA114C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xB1EA164E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xB1EA108C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xB1EA10F0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xB1EA176E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xB1EA172E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xB1EA18AE]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xB2070320]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device A mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device A B0235C8A

AttachedDevice A fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-
Post #35
Hi gbsk.

OK. Thanks for letting us know. Leave these instructions until you return.

A couple of stubborn entries so we’ll try something heavier.

1. Please download The Avenger2 by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All…"
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics

Registry values to delete:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
“V71IQL7HI7”=-


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. (In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply..


Run Malwarebytes’ Anti-Malware

If you no longer have it, you can download it from here:
  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


Run OTL
• Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
• Post the OTL.txt log it produces in your next reply.
Please post back with logs:

Avenger.txt
MBAM.txt
OTL.txt

Also, please let me know the situation with the redirects.

Regards

Satchfan
Post #37
I downloaded Avenger. I tried to run it twice but got error messages. One message said V71IQL7HI7=- Skipping line Registry Value Deletion Mode The first one was too long to copy but said something like the script entered was wrong. I did not do anything until I hear again from you. Thanks GB
Post #38
Hi gbsk

I think the fact that the script didn’t work was my fault because of the program I used to write it in.

Please try running it again.

Run The Avenger

Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics

Registry values to delete:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"V71IQL7HI7"=-


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
The Avenger will automatically do the following:
  • It will Restart your computer. (In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply.


When this is done, please update and run Malwarebytes' as previously instructed.

Files to nclude:

Avenger.txt
MBAM.txt

What is the situation with the redirects.

Satchfan
Post #40
gbsk

Open ComboFix

Please do the following:
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the codebox below into it:
File::
C:\WIXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
C:\Documents and Settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"V71IQL7HI7"=-

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.


Run Malwarebytes

Please run Malwarebytes as previously asked , whether there are any other error messages or not.

If there are any error messages, please post the complete message so that I can see what is happening.

Also let me know of you are still being re-directed.

Thanks

Satchfan
Post #41
Satchfan,

Sorry it took so long. I spilled some tea on the keyboard so I did not work. I had to get another one. Here is the log. Malwarebytes did not find any infections. The computer works better. However, I noticed I got a popup ad. I did not get them before the infrection. The site was zedo.

GB

ComboFix 10-07-01.02 - Owner 07/04/2010 15:02:36.10.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1534.1073 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.KHALSA-FAMILY\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100704-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FILE ::
"c:\documents and settings\Owner.KHALSA-FAMILY\My Documents\hosts.ics"
"c:\wixp\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job"
.

((((((((((((((((((((((((( Files Created from 2010-06-04 to 2010-07-04 )))))))))))))))))))))))))))))))
.

2010-07-02 23:34 . 2004-08-04 06:58 14848 -c–a-w- c:\wixp\system32\dllcache\kbdhid.sys
2010-07-02 23:34 . 2004-08-04 06:58 14848 —-a-w- c:\wixp\system32\drivers\kbdhid.sys
2010-06-08 00:29 . 2010-06-08 00:29 ——– d—–w- c:\wixp\Sun
2010-06-07 23:17 . 2010-06-07 23:17 ——– d—–w- c:\program files\Common Files\Java
2010-06-04 23:27 . 2010-06-04 23:27 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\OLYMPUS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-04 23:06 . 2010-05-07 04:17 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Skype
2010-07-04 16:06 . 2010-05-07 05:05 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\skypePM
2010-07-04 00:01 . 2010-05-18 04:58 1 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-01 00:40 . 2010-07-01 00:40 348 —-a-w- c:\program files\rwbpg.txt
2010-06-07 23:15 . 2010-04-26 04:47 411368 —-a-w- c:\wixp\system32\deployJava1.dll
2010-06-03 22:39 . 2009-08-04 18:12 ——– d—–w- c:\program files\Java
2010-06-03 06:33 . 2010-01-23 23:16 ——– d—–w- c:\program files\Alwil Software
2010-06-03 04:31 . 2010-01-23 23:16 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Alwil Software
2010-05-24 07:01 . 2010-05-24 07:01 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcp71.dll
2010-05-24 07:01 . 2010-05-24 07:01 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\jmc.dll
2010-05-24 07:01 . 2010-05-24 07:01 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-sse.dll
2010-05-24 07:01 . 2010-05-24 07:01 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-1cad44af-n\msvcr71.dll
2010-05-24 07:01 . 2010-05-24 07:01 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3d654dee-n\decora-d3d.dll
2010-05-23 21:41 . 2009-12-22 12:33 18008 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-05-21 17:21 . 2010-03-20 23:33 ——– d—–w- c:\program files\xplorer2
2010-05-21 13:16 . 2010-05-21 13:16 ——– d—–w- c:\program files\ESET
2010-05-21 07:12 . 2010-05-21 07:12 56 —ha-w- c:\wixp\system32\ezsidmv.dat
2010-05-18 04:58 . 2010-05-18 04:58 ——– d—–w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\OpenOffice.org
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\JRE
2010-05-18 04:36 . 2010-05-18 04:36 ——– d—–w- c:\program files\OpenOffice.org 3
2010-05-14 14:49 . 2009-12-24 04:05 ——– d—–w- c:\program files\Google
2010-05-12 21:43 . 2009-12-23 06:33 117760 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-05-08 03:26 . 2010-01-24 08:41 ——– d—–w- c:\program files\McAfee
2010-05-07 08:56 . 2010-05-07 08:56 ——– d—–w- c:\program files\BurnAware Free
2010-05-07 00:32 . 2010-05-07 00:31 ——– d—–w- c:\program files\FinalBurner
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–r- c:\program files\Skype
2010-05-06 21:55 . 2009-08-19 21:17 ——– d—–w- c:\program files\Common Files\Skype
2010-05-06 21:55 . 2010-05-06 21:55 ——– d—–w- c:\documents and settings\All Users.WIXP\Application Data\Skype
2010-04-26 04:48 . 2010-04-26 04:48 503808 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcp71.dll
2010-04-26 04:48 . 2010-04-26 04:48 499712 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\jmc.dll
2010-04-26 04:48 . 2010-04-26 04:48 348160 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-55cf543c-n\msvcr71.dll
2010-04-26 04:48 . 2010-04-26 04:48 61440 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-sse.dll
2010-04-26 04:48 . 2010-04-26 04:48 12800 —-a-w- c:\documents and settings\Owner.KHALSA-FAMILY\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-77b8d3b4-n\decora-d3d.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-05-13_00.41.58 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-07-03 20:50 . 2010-07-03 20:50 16384 c:\wixp\Temp\Perflib_Perfdata_5d0.dat
+ 2010-07-03 20:49 . 2010-07-03 20:49 16384 c:\wixp\Temp\Perflib_Perfdata_46c.dat
+ 2010-06-03 06:34 . 2009-11-24 22:49 48560 c:\wixp\system32\drivers\aswTdi.sys
+ 2010-06-03 06:34 . 2009-11-24 22:48 23120 c:\wixp\system32\drivers\aswRdr.sys
+ 2010-06-03 06:34 . 2009-11-24 22:50 94160 c:\wixp\system32\drivers\aswmon2.sys
+ 2010-06-03 06:34 . 2009-11-24 22:51 93424 c:\wixp\system32\drivers\aswmon.sys
+ 2010-06-03 06:34 . 2009-11-24 22:50 20560 c:\wixp\system32\drivers\aswFsBlk.sys
+ 2010-06-03 06:34 . 2009-11-24 22:47 27408 c:\wixp\system32\drivers\aavmker4.sys
+ 2010-06-03 06:34 . 2009-11-24 22:47 97480 c:\wixp\system32\AvastSS.scr
+ 2010-06-15 17:57 . 2010-06-15 17:57 21504 c:\wixp\Installer\7c76c85.msi
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 25214 c:\wixp\Installer\{F7B0939E-58DF-11DF-B3A6-005056806466}\ARPPRODUCTICON.exe
+ 2010-02-02 08:22 . 2010-02-02 08:22 655872 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 568832 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2010-02-02 08:22 . 2010-02-02 08:22 224768 c:\wixp\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
- 2010-04-26 04:47 . 2010-04-26 04:47 153376 c:\wixp\system32\javaws.exe
+ 2010-06-07 23:16 . 2010-06-07 23:15 153376 c:\wixp\system32\javaws.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\javaw.exe
+ 2010-06-07 23:16 . 2010-06-07 23:15 145184 c:\wixp\system32\javaw.exe
+ 2010-06-07 23:16 . 2010-06-07 23:15 145184 c:\wixp\system32\java.exe
- 2010-04-26 04:47 . 2010-04-26 04:47 145184 c:\wixp\system32\java.exe
+ 2009-12-21 15:13 . 2010-05-21 06:00 115768 c:\wixp\system32\FNTCACHE.DAT
+ 2010-06-03 06:34 . 2009-11-24 22:50 114768 c:\wixp\system32\drivers\aswSP.sys
+ 2010-06-03 04:31 . 2010-06-03 04:31 262144 c:\wixp\system32\config\systemprofile\NtUser.dat
+ 2010-06-07 23:17 . 2010-06-07 23:17 180224 c:\wixp\Installer\f7bd250.msi
+ 2010-06-07 23:15 . 2010-06-07 23:15 577536 c:\wixp\Installer\f7bd24b.msi
+ 2010-06-03 06:33 . 2003-03-18 19:20 1060864 c:\wixp\system32\MFC71.dll
+ 2010-06-03 06:33 . 2009-11-24 22:54 1280480 c:\wixp\system32\aswBoot.exe
+ 2010-05-14 14:51 . 2010-05-14 14:51 1235968 c:\wixp\Installer\1692ac23.msi
+ 2010-05-18 04:39 . 2010-05-18 04:39 7424000 c:\wixp\Installer\{6ADD0603-16EF-400D-9F9E-486432835002}\soffice.exe
+ 2010-05-18 04:39 . 2010-05-18 04:39 10174464 c:\wixp\Installer\1057e2f1.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{db35fda8-77e3-4784-92c2-ee7345e91af4}]
2010-05-21 17:21 2515552 —-a-w- c:\program files\xplorer2\tbxpl0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{db35fda8-77e3-4784-92c2-ee7345e91af4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{DB35FDA8-77E3-4784-92C2-EE7345E91AF4}"= "c:\program files\xplorer2\tbxpl0.dll" [2010-05-21 2515552]

[HKEY_CLASSES_ROOT\clsid\{db35fda8-77e3-4784-92c2-ee7345e91af4}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [2010-04-06 2010864]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-20 26192680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\wixp\system32\igfxtray.exe" [2004-02-10 155648]
"HotKeysCmds"="c:\wixp\system32\hkcmd.exe" [2004-02-10 118784]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\Owner.KHALSA-FAMILY\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2010-01-26 02:20 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIXP^Start Menu^Programs^Startup^BounceBack Launcher.lnk]
backup=c:\wixp\pss\BounceBack Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner.KHALSA-FAMILY^Start Menu^Programs^Startup^TimeLeft.lnk]
backup=c:\wixp\pss\TimeLeft.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-12-24 04:05 135664 —-atw- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-09 00:50 54576 —-a-w- c:\program files\Hp\HP Software Update\hpwuschd2.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Giganology\\Gigaget\\Gigaget.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WIXP\\system32\\spoolsv.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;c:\wixp\system32\drivers\aswSP.sys [6/2/2010 10:34 PM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [5/26/2009 10:05 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 66632]
R2 aswFsBlk;aswFsBlk;c:\wixp\system32\drivers\aswFsBlk.sys [6/2/2010 10:34 PM 20560]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [1/24/2010 12:42 AM 93320]
R2 portD;CMS PortIO Service;c:\wixp\system32\drivers\portd2k.sys [1/13/2010 2:43 PM 7424]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/23/2009 8:05 PM 135664]
S3 BIOSCHK;BIOSCHK;\??\c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS –> c:\docume~1\OWNER~1.KHA\LOCALS~1\Temp\TII69D.tmp\disk1\BIOSCHK.SYS [?]
.
Contents of the 'Scheduled Tasks' folder

2010-07-04 c:\wixp\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-07-04 c:\wixp\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-07-04 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003Core.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]

2010-07-04 c:\wixp\Tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1383384898-725345543-1003UA.job
- c:\documents and settings\Owner.KHALSA-FAMILY\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-12-24 04:05]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://yahoo.com/
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
IE: &Download All by Gigaget - c:\program files\Giganology\Gigaget\getallurl.htm
IE: &Download by Gigaget - c:\program files\Giganology\Gigaget\geturl.htm
IE: {{21196042-830F-419f-A594-F9D456A6C29A} - {21196042-830F-419f-A594-F9D456A6C29A} c:\program files\TimeLeft3\TLIntergIE.html - c:\program files\timeleft3\tlintergie.html\inprocserver32 does not exist!
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: DirectAnimation Java Classes - file://c:\wixp\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\wixp\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-04 15:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(488)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2024)
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\wixp\system32\browselc.dll
c:\wixp\system32\WPDShServiceObj.dll
c:\wixp\system32\PortableDeviceTypes.dll
c:\wixp\system32\PortableDeviceApi.dll
.
Completion time: 2010-07-04 15:08:01
ComboFix-quarantined-files.txt 2010-07-04 23:07
ComboFix2.txt 2010-07-04 22:17
ComboFix3.txt 2010-07-04 21:50
ComboFix4.txt 2010-07-03 21:06
ComboFix5.txt 2010-07-04 23:00

Pre-Run: 19,810,414,592 bytes free
Post-Run: 19,796,226,048 bytes free

- - End Of File - - 0295DFCE43C9D3EB746165E590654889
Post #43
Satchfan I also got popups from other vendors. My wife said she clicked on a link. She got that link but also got a link to some other place. GB
Post #45
Hi gbsk,

Do you know what this text file is?

c:\program files\rwbpg.txt

It was created July 1st


Are you using a router?

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI