What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected with JS/Redirector.B ? [Closed]

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi!

I run Eset on a Vista x64 computer. Today Eset gave an alert for 4 infections with 'js/redirector.b'. It gave me the option to delete the files, which I did. However, a full computer scan still showed these 4 files. I deleted again but I don't trust that this works.

Is there a reliable way to determine whether or not my computer is infected?

I ran HijackThis, per instructions. HijackThis gave me the warning that it was denied write access to the hosts file which could be a sign of an infection.

This is the Hijack log :

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:15:00 PM, on 1/16/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19154)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\System32\spool\drivers\x64\3\E_FATIBUA.EXE
C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe
C:\Apache\bin\ApacheMonitor.exe
C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe
C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files (x86)\Gateway\EzTune\DTHtml.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Portrait Displays\Pivot Software\floater.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch…M=FX4710-UB003A
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch…M=FX4710-UB003A
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch…M=FX4710-UB003A
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [Smart Copy] "C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe" -A
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT GWY] "C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" -GWY
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON Stylus Photo 1400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBUA.EXE /FU "C:\Windows\TEMP\E_SB91A.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Katrin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Apache\bin\ApacheMonitor.exe
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Apache\bin\httpd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files (x86)\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)

–
End of file - 10698 bytes


Thanks for your help in advance!
Katrin
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

First we need to make all files and folders VISIBLE:

  • Go to Start >> Control Panel >> Folder Options >> View
  • Choose to "show hidden files and folders,"
  • Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
  • Close the window with ok
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Right-click and Run as Administrator dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-


Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-


In your next reply please post the logs created by DDS and aswMBR.exe. :)
Post #3
Hi Jeff! Thanks very much for taking the time to help. It's great that you guys do this. Log files: DDS.txt . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 8.0.6001.19154 BrowserJavaVersion: 10.0.0 Run by [removed] at 19:38:02 on 2012-01-16 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6141.3027 [GMT -5:00] . AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\nvvsvc.exe C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe C:\Windows\SysWOW64\svchost.exe -k Akamai C:\Apache\bin\httpd.exe C:\Windows\system32\svchost.exe -k apphost C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Bonjour\mDNSResponder.exe C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe C:\Apache\bin\httpd.exe C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe C:\Program Files\Microsoft LifeCam\MSCamS64.exe C:\Windows\system32\rundll32.exe C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe C:\Program Files (x86)\Photodex\ProShowGold\ScsiAccess.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio64.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\RAVCpl64.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Windows\System32\spool\drivers\x64\3\E_FATIBUA.EXE C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe C:\Windows\ehome\ehmsas.exe C:\Apache\bin\ApacheMonitor.exe C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe C:\Program Files (x86)\Gateway\EzTune\DTHtml.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Portrait Displays\Pivot Software\floater.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Windows\splwow64.exe C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\nvvsvc.exe C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RAVCpl64.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\System32\spool\drivers\x64\3\E_IATIACA.EXE C:\Windows\ehome\ehtray.exe C:\Windows\System32\spool\drivers\x64\3\E_FATIBUA.EXE C:\Apache\bin\ApacheMonitor.exe C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe C:\Program Files (x86)\Gateway\EzTune\DTHtml.exe C:\Program Files (x86)\Portrait Displays\Pivot Software\floater.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\SysWOW64\rundll32.exe C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uSearch Bar = Preserve mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=&Br=GTW&Loc=ENG_US&Sys=DTP&M=FX4710-UB003A mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=&Br=GTW&Loc=ENG_US&Sys=DTP&M=FX4710-UB003A uInternet Settings,ProxyOverride = *.local mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=&Br=GTW&Loc=ENG_US&Sys=DTP&M=FX4710-UB003A mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe uRun: [EPSON Stylus Photo 1400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBUA.EXE /FU "C:\Windows\TEMP\E_SB91A.tmp" /EF "HKCU" uRun: [Google Update] "C:\Users\Katrin\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [Akamai NetSession Interface] "C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe" uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe mRun: [Smart Copy] "C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe" -A mRun: [PivotSoftware] "C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe" mRun: [DT GWY] "C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" -GWY mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" mRun: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe mRun: [AcronisTimounterMonitor] C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe StartupFolder: C:\Users\Katrin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~1.LNK - C:\Apache\bin\ApacheMonitor.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\NETGEA~1.LNK - C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.0.1 TCP: Interfaces\{86342265-B018-49C2-A596-7CA9E1B1BFBA} : DhcpNameServer = 192.168.0.1 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll LSA: Authentication Packages = msv1_0 relog_ap BHO-X64: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll mRun-x64: [Smart Copy] "C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe" -A mRun-x64: [PivotSoftware] "C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe" mRun-x64: [DT GWY] "C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" -GWY mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" mRun-x64: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe mRun-x64: [AcronisTimounterMonitor] C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin mRun-x64: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRunOnce-x64: [Launcher] %WINDIR%\SMINST\launcher.exe . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Katrin\AppData\Roaming\Mozilla\Firefox\Profiles\f07xmcbw.default\ FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p= FF - component: C:\Program Files (x86)\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll FF - plugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll FF - plugin: C:\Program Files (x86)\eMusic Download Manager\plugin\npemusic.dll FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Opera\program\plugins\np_gp.dll FF - plugin: C:\Users\Katrin\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R1 ehdrv;ehdrv;C:\Windows\system32\DRIVERS\ehdrv.sys –> C:\Windows\system32\DRIVERS\ehdrv.sys [?] R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312] R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2008-1-20 21504] R2 Apache2.2;Apache2.2;C:\Apache\bin\httpd.exe [2011-8-30 20549] R2 eamonm;eamonm;C:\Windows\system32\DRIVERS\eamonm.sys –> C:\Windows\system32\DRIVERS\eamonm.sys [?] R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2010-8-12 810144] R2 epfwwfpr;epfwwfpr;C:\Windows\system32\DRIVERS\epfwwfpr.sys –> C:\Windows\system32\DRIVERS\epfwwfpr.sys [?] R2 FontCache;Windows Font Cache Service;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2010-8-30 102608] R2 PdiService;Portrait Displays SDK Service;C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-9-18 90112] R3 CAXHWBS2;CAXHWBS2;C:\Windows\system32\DRIVERS\CAXHWBS2.sys –> C:\Windows\system32\DRIVERS\CAXHWBS2.sys [?] R3 MRV6X64P;Vista 64-bits Native WiFi Driver;C:\Windows\system32\DRIVERS\MRVW13C.sys –> C:\Windows\system32\DRIVERS\MRVW13C.sys [?] R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;C:\Windows\system32\Drivers\nx6000.sys –> C:\Windows\system32\Drivers\nx6000.sys [?] R3 Point64;Microsoft IntelliPoint Filter Driver;C:\Windows\system32\DRIVERS\point64k.sys –> C:\Windows\system32\DRIVERS\point64k.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 b57nd60a;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60a.sys –> C:\Windows\system32\DRIVERS\b57nd60a.sys [?] S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam.sys –> C:\Windows\system32\DRIVERS\wdcsam.sys [?] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768] S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-9-24 89920] . =============== File Associations =============== . JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %* .txt= . =============== Created Last 30 ================ . 2012-01-16 22:05:58 388096 —-a-r- C:\Users\Katrin\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2012-01-16 22:05:57 ——– d—–w- C:\Program Files (x86)\Trend Micro 2012-01-11 05:49:27 34152 —-a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys 2012-01-11 05:49:27 126312 —-a-w- C:\Windows\System32\GEARAspi64.dll 2012-01-11 05:49:27 107368 —-a-w- C:\Windows\SysWow64\GEARAspi.dll 2012-01-11 05:48:42 ——– d—–w- C:\Program Files\iPod 2012-01-11 05:48:41 ——– d—–w- C:\Program Files\iTunes 2012-01-11 05:48:41 ——– d—–w- C:\Program Files (x86)\iTunes 2012-01-11 05:45:31 ——– d—–w- C:\Program Files\Bonjour 2012-01-11 05:45:31 ——– d—–w- C:\Program Files (x86)\Bonjour 2012-01-07 00:57:09 ——– d—–w- C:\Program Files (x86)\Amazon 2012-01-06 22:08:12 ——– d—–w- C:\Users\Katrin\AppData\Local\ESET 2011-12-21 20:36:00 ——– d—–w- C:\Program Files (x86)\Audacity 1.3 Beta (Unicode) 2011-12-19 16:54:31 ——– d—–w- C:\Program Files (x86)\Common Files\Macrovision Shared . ==================== Find3M ==================== . 2011-12-12 17:05:59 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl . ============= FINISH: 19:38:31.63 =============== Attach.txt 📎Attach.txt aswMBR.txt aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software Run date: 2012-01-16 19:41:08 —————————– 19:41:08.446 OS Version: Windows x64 6.0.6002 Service Pack 2 19:41:08.446 Number of processors: 4 586 0x1707 19:41:08.446 ComputerName: CROUCHINGTIGER UserName: Katrin 19:41:10.630 Initialize success 19:41:35.052 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 19:41:35.052 Disk 0 Vendor: WDC_WD6400AAKS-00A7B0 01.03B01 Size: 610480MB BusType: 3 19:41:35.052 Disk 0 MBR read successfully 19:41:35.068 Disk 0 MBR scan 19:41:35.068 Disk 0 unknown MBR code 19:41:35.068 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 15915 MB offset 63 19:41:35.068 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 594561 MB offset 32595885 19:41:35.083 Service scanning 19:41:37.096 Modules scanning 19:41:37.096 Disk 0 trace - called modules: 19:41:37.096 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 19:41:37.096 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800771b060] 19:41:37.096 3 CLASSPNP.SYS[fffffa60011d5c33] -> nt!IofCallDriver -> [0xfffffa8006159520] 19:41:37.096 5 acpi.sys[fffffa60008f5fde] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8006156060] 19:41:37.111 Scan finished successfully 19:42:40.598 Disk 0 MBR has been saved successfully to "C:\Users\Katrin\Documents\hijackthisLog\MBR.dat" 19:42:40.598 The log file has been saved successfully to "C:\Users\Katrin\Documents\hijackthisLog\aswMBR.txt" Hope I did this correctly. Also, I just found the information in Eset that 4 files with js/redirector.b were quarantined - at least that's how I read it. I can't be totally sure whether I am supposed to quarantine it, or whether they did it. But there is no option to permanently remove it. This is my first virus - sorry for any confusion I may be creating. Katrin
Post #4
Hi katbo,

You are running everything just fine. :)
———–

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #5
Hi Jeff, Here's the MBR log file. There was in fact a problem with a 'non-standard or infected MBR"! Whatever that is…. MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 2 (build 6002), 64-bit Base Board Manufacturer: Gateway BIOS Manufacturer: Phoenix Technologies, LTD System Manufacturer: Gateway System Product Name: FX4710-UB003A Logical Drives Mask: 0x000001fc Kernel Drivers (total 167): 0x02205000 \SystemRoot\system32\ntoskrnl.exe 0x0271D000 \SystemRoot\system32\hal.dll 0x00603000 \SystemRoot\system32\kdcom.dll 0x0060D000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x00648000 \SystemRoot\system32\PSHED.dll 0x0065C000 \SystemRoot\system32\CLFS.SYS 0x006B9000 \SystemRoot\system32\CI.dll 0x00803000 \SystemRoot\system32\drivers\Wdf01000.sys 0x008DD000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x008EB000 \SystemRoot\system32\drivers\acpi.sys 0x00941000 \SystemRoot\system32\drivers\WMILIB.SYS 0x0094A000 \SystemRoot\system32\drivers\msisadrv.sys 0x00954000 \SystemRoot\system32\drivers\pci.sys 0x00984000 \SystemRoot\System32\drivers\partmgr.sys 0x00999000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x0099D000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x009A9000 \SystemRoot\system32\drivers\volmgr.sys 0x0076B000 \SystemRoot\System32\drivers\volmgrx.sys 0x009BD000 \SystemRoot\system32\drivers\pciide.sys 0x009C4000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x009D4000 \SystemRoot\System32\drivers\mountmgr.sys 0x009E7000 \SystemRoot\system32\drivers\atapi.sys 0x007D1000 \SystemRoot\system32\drivers\ataport.SYS 0x00A0D000 \SystemRoot\system32\drivers\fltmgr.sys 0x00A54000 \SystemRoot\system32\drivers\fileinfo.sys 0x00A68000 \SystemRoot\System32\Drivers\PxHlpa64.sys 0x00A74000 \SystemRoot\System32\Drivers\ksecdd.sys 0x00C01000 \SystemRoot\system32\drivers\ndis.sys 0x00AFB000 \SystemRoot\system32\drivers\msrpc.sys 0x00B4B000 \SystemRoot\system32\drivers\NETIO.SYS 0x00E0F000 \SystemRoot\System32\drivers\tcpip.sys 0x00F85000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x01003000 \SystemRoot\system32\DRIVERS\timntr.sys 0x0120A000 \SystemRoot\System32\Drivers\Ntfs.sys 0x0138A000 \SystemRoot\system32\drivers\volsnap.sys 0x010B3000 \SystemRoot\system32\DRIVERS\tdrpman.sys 0x013CE000 \SystemRoot\System32\Drivers\spldr.sys 0x01147000 \SystemRoot\system32\DRIVERS\snapman.sys 0x013D6000 \SystemRoot\system32\DRIVERS\sbp2port.sys 0x01182000 \SystemRoot\System32\Drivers\mup.sys 0x01194000 \SystemRoot\System32\drivers\ecache.sys 0x011C0000 \SystemRoot\system32\drivers\disk.sys 0x011D4000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x013F1000 \SystemRoot\system32\drivers\crcdisk.sys 0x00FCB000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x00FD8000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x00FE1000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x02807000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x03463000 \SystemRoot\System32\Drivers\nvBridge.kmd 0x03465000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x03548000 \SystemRoot\System32\drivers\watchdog.sys 0x03558000 \SystemRoot\system32\DRIVERS\e1e6032e.sys 0x035AA000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x035B6000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x00DC4000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x0360D000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x036FA000 \SystemRoot\system32\DRIVERS\CAXHWBS2.sys 0x03769000 \SystemRoot\system32\DRIVERS\ks.sys 0x03803000 \SystemRoot\system32\DRIVERS\CAX_DPV.sys 0x03A00000 \SystemRoot\system32\DRIVERS\CAX_CNXT.sys 0x03ACB000 \SystemRoot\system32\drivers\modem.sys 0x03ADA000 \SystemRoot\system32\DRIVERS\MRVW13C.sys 0x03B1B000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x03B2D000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x03B3D000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x03B53000 \SystemRoot\system32\DRIVERS\point64k.sys 0x03B61000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x03B6D000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x03B7B000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x03B97000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x03BA4000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x03975000 \SystemRoot\system32\DRIVERS\storport.sys 0x03BDD000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x039D2000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x03BEA000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x0379D000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x037CE000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x037DE000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x00DD5000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x03BF6000 \SystemRoot\system32\DRIVERS\PdiPorts.sys 0x00DED000 \SystemRoot\system32\DRIVERS\termdd.sys 0x039F5000 \SystemRoot\system32\DRIVERS\swenum.sys 0x00BA4000 \SystemRoot\system32\DRIVERS\circlass.sys 0x03600000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x00BB5000 \SystemRoot\system32\DRIVERS\umbus.sys 0x03E02000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x03E4A000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x03E5E000 \SystemRoot\system32\drivers\RTKVHD64.sys 0x03FB7000 \SystemRoot\system32\drivers\portcls.sys 0x00BC5000 \SystemRoot\system32\drivers\drmk.sys 0x03FF2000 \SystemRoot\system32\drivers\ksthunk.sys 0x00FF4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x039F7000 \SystemRoot\System32\Drivers\Null.SYS 0x04800000 \SystemRoot\system32\DRIVERS\ehdrv.sys 0x04830000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x04838000 \SystemRoot\System32\drivers\vga.sys 0x04846000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x0486B000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x04874000 \SystemRoot\system32\drivers\rdpencdd.sys 0x0487D000 \SystemRoot\System32\Drivers\Msfs.SYS 0x04888000 \SystemRoot\System32\Drivers\Npfs.SYS 0x04899000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x048A2000 \SystemRoot\system32\DRIVERS\tdx.sys 0x048BF000 \SystemRoot\system32\DRIVERS\smb.sys 0x048DA000 \SystemRoot\system32\drivers\afd.sys 0x04945000 \SystemRoot\System32\DRIVERS\netbt.sys 0x04989000 \SystemRoot\system32\DRIVERS\pacer.sys 0x049A7000 \SystemRoot\system32\DRIVERS\netbios.sys 0x049B6000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x04A02000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x04A4F000 \SystemRoot\system32\drivers\nsiproxy.sys 0x04A5B000 \SystemRoot\System32\Drivers\dfsc.sys 0x04A78000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x04A94000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x04A96000 \SystemRoot\System32\Drivers\nx6000.sys 0x04AA3000 \SystemRoot\System32\Drivers\usbvideo.sys 0x04ACD000 \SystemRoot\system32\drivers\usbaudio.sys 0x04AE6000 \SystemRoot\System32\Drivers\crashdmp.sys 0x04AF4000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x04B00000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x04B08000 \SystemRoot\system32\DRIVERS\usbprint.sys 0x04B13000 \SystemRoot\system32\drivers\RTSTOR64.SYS 0x04B27000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x04B30000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x00030000 \SystemRoot\System32\win32k.sys 0x04B42000 \SystemRoot\System32\drivers\Dxapi.sys 0x04B4E000 \SystemRoot\system32\DRIVERS\monitor.sys 0x04B61000 \SystemRoot\system32\DRIVERS\usbscan.sys 0x04B71000 \SystemRoot\system32\DRIVERS\usbcir.sys 0x04B8B000 \SystemRoot\system32\DRIVERS\hidir.sys 0x04B96000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x04BA1000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x00490000 \SystemRoot\System32\TSDDD.dll 0x00860000 \SystemRoot\System32\ATMFD.DLL 0x04BAC000 \SystemRoot\system32\drivers\luafv.sys 0x08A0A000 \SystemRoot\system32\DRIVERS\eamonm.sys 0x08AE1000 \SystemRoot\system32\DRIVERS\tifsfilt.sys 0x08AF8000 \SystemRoot\system32\drivers\spsys.sys 0x08B92000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x08BA6000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x08BDA000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x08BE5000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x09004000 \SystemRoot\system32\drivers\HTTP.sys 0x090A7000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x090D0000 \SystemRoot\system32\DRIVERS\bowser.sys 0x090EE000 \SystemRoot\System32\drivers\mpsdrv.sys 0x09108000 \SystemRoot\system32\drivers\mrxdav.sys 0x0912F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x09158000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x091A1000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x091C0000 \SystemRoot\System32\DRIVERS\srv2.sys 0x09202000 \SystemRoot\System32\DRIVERS\srv.sys 0x09295000 \SystemRoot\System32\Drivers\adfs.SYS 0x092AD000 \SystemRoot\system32\DRIVERS\epfwwfpr.sys 0x092CE000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0x092D3000 \SystemRoot\system32\drivers\peauth.sys 0x09389000 \SystemRoot\System32\Drivers\secdrv.SYS 0x09394000 \SystemRoot\System32\drivers\tcpipreg.sys 0x093A4000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0x093C4000 \SystemRoot\system32\DRIVERS\WUDFPf.sys 0x093DA000 \SystemRoot\system32\DRIVERS\xaudio64.sys 0x093E2000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x091F2000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x0BA0E000 \SystemRoot\System32\Drivers\fastfat.SYS 0x0BAEB000 \??\C:\Users\Katrin\AppData\Local\Temp\aswMBR.sys 0x00660000 \SystemRoot\System32\cdd.dll 0x779E0000 \Windows\System32\ntdll.dll Processes (total 101): 0 System Idle Process 4 System 540 C:\Windows\System32\smss.exe 616 csrss.exe 828 C:\Windows\System32\wininit.exe 848 csrss.exe 884 C:\Windows\System32\services.exe 896 C:\Windows\System32\lsass.exe 904 C:\Windows\System32\lsm.exe 404 C:\Windows\System32\winlogon.exe 468 C:\Windows\System32\svchost.exe 584 C:\Windows\System32\nvvsvc.exe 620 C:\Windows\System32\svchost.exe 1064 C:\Windows\System32\svchost.exe 1092 C:\Windows\System32\svchost.exe 1104 C:\Windows\System32\svchost.exe 1176 C:\Windows\System32\audiodg.exe 1200 C:\Windows\System32\svchost.exe 1216 C:\Windows\System32\SLsvc.exe 1264 C:\Windows\System32\svchost.exe 1368 C:\Windows\System32\svchost.exe 1588 C:\Windows\System32\spoolsv.exe 1612 C:\Windows\System32\svchost.exe 1940 C:\Windows\System32\nvvsvc.exe 1356 C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe 1452 C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe 1900 C:\Windows\SysWOW64\svchost.exe 2072 C:\Apache\bin\httpd.exe 2092 C:\Windows\System32\svchost.exe 2104 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 2172 C:\Program Files (x86)\Bonjour\mDNSResponder.exe 2196 C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe 2204 C:\Apache\bin\httpd.exe 2248 C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe 2532 C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE 2568 C:\PROGRA~2\McAfee\SITEAD~1\mcsacore.exe 2592 C:\Program Files\Microsoft LifeCam\MSCamS64.exe 2628 C:\Windows\System32\rundll32.exe 2640 C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe 2652 C:\Windows\SysWOW64\rundll32.exe 2760 C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe 2776 C:\Windows\System32\svchost.exe 2788 C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe 2928 C:\Program Files (x86)\Photodex\ProShowGold\scsiaccess.exe 2944 C:\Windows\System32\svchost.exe 2972 C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe 3032 C:\Windows\System32\svchost.exe 3060 C:\Windows\System32\SearchIndexer.exe 2696 C:\Windows\System32\drivers\XAudio64.exe 3048 WUDFHost.exe 3624 C:\Windows\System32\dwm.exe 3668 C:\Windows\System32\taskeng.exe 3696 C:\Windows\explorer.exe 3892 C:\Windows\RAVCpl64.exe 3908 C:\Program Files\Microsoft IntelliPoint\ipoint.exe 3924 C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe 3956 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe 3996 C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe 4004 C:\Program Files\Windows Sidebar\sidebar.exe 4036 C:\Windows\ehome\ehtray.exe 3132 C:\Windows\System32\spool\drivers\x64\3\E_FATIBUA.EXE 1720 C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe 2112 C:\Windows\ehome\ehmsas.exe 3208 C:\Apache\bin\ApacheMonitor.exe 484 C:\Program Files (x86)\NETGEAR\WG311v3\wlancfg5.exe 3592 C:\Program Files (x86)\IOI\Smart Copy\ButtonMonitor.exe 3572 C:\Program Files (x86)\Portrait Displays\Pivot Software\wpCtrl.exe 3776 C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe 3820 C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe 3904 C:\Program Files (x86)\Gateway\EzTune\dthtml.exe 3544 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 3968 C:\Program Files (x86)\Portrait Displays\Pivot Software\Floater.exe 1864 C:\Program Files (x86)\iTunes\iTunesHelper.exe 1716 C:\Users\Katrin\AppData\Local\Akamai\netsession_win.exe 4416 C:\Program Files\iPod\bin\iPodService.exe 4944 C:\Program Files\Windows Media Player\wmpnscfg.exe 5076 C:\Program Files\Windows Media Player\wmpnetwk.exe 4856 C:\Windows\System32\taskeng.exe 1184 C:\Windows\System32\svchost.exe 3164 C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe 3988 C:\Windows\splwow64.exe 3436 C:\Program Files (x86)\Adobe\Reader 8.0\Reader\AcroRd32.exe 6116 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 5184 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 4536 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 1448 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 1636 C:\Windows\SysWOW64\rundll32.exe 4908 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 4544 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 2256 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 5516 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 4540 C:\Windows\System32\wuauclt.exe 2812 C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe 5440 C:\Program Files (x86)\Mozilla Firefox\firefox.exe 3796 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe 3788 C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe 3728 C:\Program Files (x86)\TopStyle 4\TopStyle4.exe 4896 C:\Users\Katrin\AppData\Local\Google\Chrome\Application\chrome.exe 1996 C:\Windows\System32\SearchProtocolHost.exe 3484 C:\Windows\System32\SearchFilterHost.exe 5884 C:\Users\Katrin\Downloads\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000003`e2bf5a00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD6400AAKS-00A7B0, Rev: 01.03B01 Size Device Name MBR Status ——————————————– 596 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 16FACB29D75458833E397367B1DA17929157C2B3 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #6
Jeff,

Today, with less panic, I was able to research more efficiently, and there is a good chance that my virus checker Eset gave a false alarm.
My infected files were all from Adblock Plus which seemed either strange or a really big deal. So I googled and found this:

"Apparently ESET (NOD32 Antivirus, ESET Smart Security) recently released an update to their virus definition database (db 6799) that wrongfully detects the malware JS/Redirector.B in Adblock Plus installations using the EasyList filter subscription.

ESET has already confirmed and fixed this false positive, so all you need to do to fix the problem is to ignore the warning and update your virus signature database (db version 6800 contains the fix).

If you have already removed the files, restore them from ESET's Quarantine (is that possible?) to restore your filter rules. If that is not possible because the files have been completely removed, make sure to at least re-subscribe to a filter list: https://adblockplus.org/en/subscriptions

If you had any custom filters and no manual backup of them, they might be lost now."

It's here but I didn't want to link to it in case there are forum rules against that:
adblockplus dot org slash forum slash viewtopic.php?t=9348

So my computer hopefully might be just fine. But if you found anything that seemed wrong, please do still let me know!
Katrin
Post #8
Hi, Thanks for letting me know about the False Positive with ESET. :) We can continue on the be sure nothing is hiding. What brand of computer do you have? (Dell, HP….) Have you always had two partitions with your hard drive? (C: and D:)
Post #9
I have a Gateway FX4710. The D partition either came with it, or it got created as part of a backup action I had to do during setup - can't remember exactly. Either way, yes it was there from the start, and contains a system backup of some sort.
Post #10
Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
———-

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI