conduit.search.com redirect/whitesmoke toolbar [Solved]

Hi Jason1970, Are you still getting redirected? Please post a new aswMBR.txt log. Thanks.

yes I am still being redirected, mbr logt attached

Jason1970, I need you to post aswMBR.txt not MBR.dat. Happy new year!

srry, not very computer literate here, I hope this is the right 1 aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2011-12-30 14:37:45 —————————– 14:37:45.281 OS Version: Windows 5.1.2600 Service Pack 3 14:37:45.281 Number of processors: 2 586 0x401 14:37:45.281 ComputerName: A UserName: b 14:37:46.593 Initialize success 14:45:18.562 AVAST engine defs: 11123001 15:12:46.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 15:12:46.953 Disk 0 Vendor: FUJITSU_MHV2080AT_PL 000000A0 Size: 76319MB BusType: 3 15:12:46.968 Disk 0 MBR read successfully 15:12:46.968 Disk 0 MBR scan 15:12:47.062 Disk 0 unknown MBR code 15:12:47.062 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63 15:12:47.062 Disk 0 scanning sectors +156296385 15:12:47.140 Disk 0 scanning C:\WINDOWS\system32\drivers 15:13:02.390 Service scanning 15:13:03.781 Modules scanning 15:13:10.218 Module: C:\WINDOWS\system32\dla\tfsndres.sys **SUSPICIOUS** 15:13:14.687 Disk 0 trace - called modules: 15:13:14.718 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 15:13:14.718 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a713ab8] 15:13:14.718 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000007a[0x8a74d268] 15:13:14.718 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a716940] 15:13:15.328 AVAST engine scan C:\WINDOWS 15:13:22.078 AVAST engine scan C:\WINDOWS\system32 15:15:25.453 AVAST engine scan C:\WINDOWS\system32\drivers 15:15:41.906 AVAST engine scan C:\Documents and Settings\b 15:16:27.593 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\b\Desktop\MBR.dat" 15:16:27.593 The log file has been saved successfully to "C:\Documents and Settings\b\Desktop\aswMBR.txt" aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2011-12-31 17:58:17 —————————– 17:58:17.390 OS Version: Windows 5.1.2600 Service Pack 3 17:58:17.390 Number of processors: 2 586 0x401 17:58:17.390 ComputerName: A UserName: b 17:58:17.953 Initialize success 17:59:54.203 AVAST engine defs: 11123101 18:02:00.437 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 18:02:00.437 Disk 0 Vendor: FUJITSU_MHV2080AT_PL 000000A0 Size: 76319MB BusType: 3 18:02:00.453 Disk 0 MBR read successfully 18:02:00.453 Disk 0 MBR scan 18:02:00.531 Disk 0 unknown MBR code 18:02:00.531 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63 18:02:00.531 Disk 0 scanning sectors +156296385 18:02:00.609 Disk 0 scanning C:\WINDOWS\system32\drivers 18:02:15.734 Service scanning 18:02:17.140 Modules scanning 18:02:25.343 Module: C:\WINDOWS\system32\dla\tfsndres.sys **SUSPICIOUS** 18:02:26.046 Disk 0 trace - called modules: 18:02:26.062 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 18:02:26.062 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a70aab8] 18:02:26.062 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000007b[0x8a7159e8] 18:02:26.062 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a716030] 18:02:26.937 AVAST engine scan C:\WINDOWS 18:02:34.468 AVAST engine scan C:\WINDOWS\system32 18:04:39.375 AVAST engine scan C:\WINDOWS\system32\drivers 18:04:58.937 AVAST engine scan C:\Documents and Settings\b 18:07:26.343 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\b\Desktop\MBR.dat" 18:07:26.343 The log file has been saved successfully to "C:\Documents and Settings\b\Desktop\aswMBR.txt" aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2011-12-31 17:58:17 —————————– 17:58:17.390 OS Version: Windows 5.1.2600 Service Pack 3 17:58:17.390 Number of processors: 2 586 0x401 17:58:17.390 ComputerName: A UserName: b 17:58:17.953 Initialize success 17:59:54.203 AVAST engine defs: 11123101 18:02:00.437 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 18:02:00.437 Disk 0 Vendor: FUJITSU_MHV2080AT_PL 000000A0 Size: 76319MB BusType: 3 18:02:00.453 Disk 0 MBR read successfully 18:02:00.453 Disk 0 MBR scan 18:02:00.531 Disk 0 unknown MBR code 18:02:00.531 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63 18:02:00.531 Disk 0 scanning sectors +156296385 18:02:00.609 Disk 0 scanning C:\WINDOWS\system32\drivers 18:02:15.734 Service scanning 18:02:17.140 Modules scanning 18:02:25.343 Module: C:\WINDOWS\system32\dla\tfsndres.sys **SUSPICIOUS** 18:02:26.046 Disk 0 trace - called modules: 18:02:26.062 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 18:02:26.062 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a70aab8] 18:02:26.062 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000007b[0x8a7159e8] 18:02:26.062 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a716030] 18:02:26.937 AVAST engine scan C:\WINDOWS 18:02:34.468 AVAST engine scan C:\WINDOWS\system32 18:04:39.375 AVAST engine scan C:\WINDOWS\system32\drivers 18:04:58.937 AVAST engine scan C:\Documents and Settings\b 18:07:26.343 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\b\Desktop\MBR.dat" 18:07:26.343 The log file has been saved successfully to "C:\Documents and Settings\b\Desktop\aswMBR.txt" 18:14:25.953 AVAST engine scan C:\Documents and Settings\All Users 18:17:52.656 Scan finished successfully 18:39:43.203 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\b\Desktop\MBR.dat" 18:39:43.203 The log file has been saved successfully to "C:\Documents and Settings\b\Desktop\aswMBR.txt" aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2012-01-01 10:07:25 —————————– 10:07:25.359 OS Version: Windows 5.1.2600 Service Pack 3 10:07:25.359 Number of processors: 2 586 0x401 10:07:25.359 ComputerName: A UserName: b 10:07:26.906 Initialize success 10:45:37.046 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 10:45:37.046 Disk 0 Vendor: FUJITSU_MHV2080AT_PL 000000A0 Size: 76319MB BusType: 3 10:45:37.062 Disk 0 MBR read successfully 10:45:37.062 Disk 0 MBR scan 10:45:37.062 Disk 0 unknown MBR code 10:45:37.062 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76316 MB offset 63 10:45:37.062 Disk 0 scanning sectors +156296385 10:45:37.156 Disk 0 scanning C:\WINDOWS\system32\drivers 10:45:46.609 Service scanning 10:45:48.375 Modules scanning 10:45:58.046 Disk 0 trace - called modules: 10:45:58.062 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 10:45:58.062 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a70bab8] 10:45:58.062 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000007b[0x8a71a650] 10:45:58.062 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a717940] 10:45:58.062 Scan finished successfully 10:58:09.609 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\b\Desktop\MBR.dat" 10:58:09.609 The log file has been saved successfully to "C:\Documents and Settings\b\Desktop\aswMBR.txt"

Happy New Year BTW

Thanks Jason1970, that's the one I needed .

• Please download GetPartitions from here
• You must right click on the link and choose Save as….
• Save it as GetPartitions.bat to your desktop
• Double click on the icon to run it (If running Vista or Windows 7, right click on it and select "Run as an Administrator").
• It will produce a log on your C:\ drive C:\DiskReport.txt
• please navigate to that file and post the contents of the log in your next reply

Microsoft DiskPart version 5.1.3565 Copyright © 1999-2003 Microsoft Corporation. On computer: A Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– Volume 0 D DVD-ROM 0 B Volume 1 C S3A1851D001 NTFS Partition 75 GB Healthy System

Hi Jason1970,

Ok, that's not giving me what I wanted <_<

Let's give GParted a run.

• Download the GParted Live CD ISO and burn it to a CD or DVD as an ISO image preferably using a clean computer.
• Insert the GParted CD in the infected computer's CD drive and restart the computer.
• Select the option to boot from CD.
• Once you have succesfully booted to the Linux Live CD, you'll see this display.
  [external image: Posted Image]
• Choose the GParted Live (Default Settings) option and hit Enter.
• Allow GParted to load by selecting all default options.
• When asked "Which Mode do you Prefer" - Hit Enter to use Gparted automatically, and the GParted Desktop will display:
  [external image: Posted Image]
• Take a photo of the screen with a camera and upload it to imageshack.
• Post a link to the photo.

Hi, can U recommend a good free winzip program to unzip the Gparted program, I have been looking for 1 but keep getting scared away when they want to install extra carp** on my computer & I recognize some of the names like NCH so I don't want to download more grief, thx

You can use IMGburn.

TY for your patience, I have tried burning the Gparted program to a disc & after 3 tries I got the blue screen of death so I rebooted & I am trying to burn using record now but it keeps saying to insert an apendable disc. I have tried 3 different blank discs (CD, CD-R, CDRW)& keep getting the same apendable disc msg so I am stuck, any ideas? Also, I only have this infected computer to burn with.

Do I have to unzip the Gparted program before burning it?

Hi Jason1970,

No problem. No you don't need to unzip an ISO image. The image burner should be able to extract the contents and create a bootable disk. Let's give Image Recorder a try. Download and install it, then double click the gParted image and follow the prompts to burn it. Make sure you select the lowest recording speed possible to avoid errors.

Hi, I am attaching the pic of the screen for the Gparted prog as I have no idea what or how to upload to imageshack. I hope this is acceptable

I think I got the image shack figured out, here is the link if I did this right

http://img841.imageshack.us/img841/2387/20120102104256.jpg