What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser Redirect [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Just go ahead and uninstall Java completely…in my opinion there have been too many exploits from it. I have not had it on my system for over a year now and have never noticed any difference at all. Like I told you before…you need to uninstall Chrome as well and then install a fresh copy. Once you get that completed let me know how things are running as well as posting the logs to Malwarebytes and ESET online scanner. :)
Post #32
Uninstalled Chrome and downloaded a new one. Uninstalled all Java programs and installed the latest one. Cleared Java's cache. Installed the latest version of Malwarebytes Anti-Malware and performed Quick Scan - log attached. Running ESET Online Scanner (over 5 hours) - results next post.

Attachments:

Post #33
ESET scan results: C:\Users\jeremy\Documents\JEREMY\ETAX\USB DISK\autorun.inf INF/Autorun worm C:\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (1).exe Win32/Graboid application C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (2).exe Win32/Graboid application C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (3).exe Win32/Graboid application C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (4).exe Win32/Graboid application C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete.exe Win32/Graboid application C:\Users\jeremy\Downloads\iLividSetup.exe Win32/Toolbar.SearchSuite application C:\Users\jeremy\Downloads\iLividSetupV1.exe Win32/Toolbar.SearchSuite application C:\Users\jeremy\Downloads\MediaUpdater__2577_i28960778_il561391.exe a variant of Win32/Amonetize.E application C:\Users\jeremy\Downloads\Setup.exe a variant of Win32/Adware.iBryte.G application G:\WD SmartWare.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan G:\WD SmartWare.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Downloads\Unconfirmed 2452.crdownload Win32/Graboid application Internet Explorer still not working properly. Menus, favourites, home button, back arrow all not working. Performing a search in google and then clicking on search results only works for some websites.
Post #34
Hi,

Let's run the following and see how things are running afterwards…

ComboFix
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


    ClearJavaCache::

    File::
    C:\Users\jeremy\Documents\JEREMY\ETAX\USB DISK\autorun.inf
    C:\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3
    C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (1).exe
    C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (2).exe
    C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (3).exe
    C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (4).exe
    C:\Users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete.exe
    C:\Users\jeremy\Downloads\iLividSetup.exe
    C:\Users\jeremy\Downloads\iLividSetupV1.exe
    C:\Users\jeremy\Downloads\MediaUpdater__2577_i28960778_il561391.exe
    C:\Users\jeremy\Downloads\Setup.exe
    G:\WD SmartWare.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3
    G:\WD SmartWare.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Downloads\Unconfirmed 2452.crdownload

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #35
ComboFix log:

ComboFix 13-07-14.01 - jeremy 15/07/2013 8:19.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.3839.2330 [GMT 10:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\jeremy\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
.
FILE ::
"c:\users\jeremy\Documents\JEREMY\ETAX\USB DISK\autorun.inf"
"c:\users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3"
"c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (1).exe"
"c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (2).exe"
"c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (3).exe"
"c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (4).exe"
"c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete.exe"
"c:\users\jeremy\Downloads\iLividSetup.exe"
"c:\users\jeremy\Downloads\iLividSetupV1.exe"
"c:\users\jeremy\Downloads\MediaUpdater__2577_i28960778_il561391.exe"
"c:\users\jeremy\Downloads\Setup.exe"
"g:\wd smartware.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3"
"g:\wd smartware.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Downloads\Unconfirmed 2452.crdownload"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\jeremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\default.temp
c:\users\jeremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\ip3picfile.temp
c:\users\jeremy\AppData\Local\Microsoft\Windows\Temporary Internet Files\ip3Wmapic.temp
c:\users\jeremy\Documents\JEREMY\ETAX\USB DISK\autorun.inf
c:\users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3
c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (1).exe
c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (2).exe
c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (3).exe
c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete (4).exe
c:\users\jeremy\Downloads\GraboidVideoSetup-3.05-Complete.exe
c:\users\jeremy\Downloads\iLividSetup.exe
c:\users\jeremy\Downloads\iLividSetupV1.exe
c:\users\jeremy\Downloads\MediaUpdater__2577_i28960778_il561391.exe
c:\users\jeremy\Downloads\Setup.exe
g:\wd smartware.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Documents\LimeWire\Saved\fame - Naturi Naughton.mp3
g:\wd smartware.swstor\JEREMY-HP\Volume.10efdf77.d284.11df.846c.806e6f6e6963\Users\jeremy\Downloads\Unconfirmed 2452.crdownload
.
.
((((((((((((((((((((((((( Files Created from 2013-06-14 to 2013-07-14 )))))))))))))))))))))))))))))))
.
.
2013-07-14 22:29 . 2013-07-14 22:29 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-07-13 09:23 . 2013-07-13 09:23 ——– d—–w- c:\program files (x86)\ESET
2013-07-13 07:53 . 2013-07-13 07:53 ——– d—–w- c:\program files (x86)\Common Files\Java
2013-07-13 07:52 . 2013-07-13 07:52 96168 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-13 06:38 . 2013-07-13 06:38 ——– d—–w- c:\users\jeremy\AppData\Local\Mozilla
2013-07-13 06:38 . 2013-07-13 06:38 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service
2013-07-11 09:49 . 2013-07-11 09:49 ——– d—–w- c:\programdata\Recovery
2013-07-11 06:13 . 2013-07-11 06:18 ——– d—–w- c:\windows\system32\catroot2
2013-07-10 23:54 . 2013-07-10 23:54 ——– d—–w- c:\windows\ERUNT
2013-07-10 15:06 . 2013-07-10 15:08 ——– d—–w- c:\windows\SysWow64\wbem\Performance
2013-07-10 13:50 . 2013-07-10 15:20 181064 —-a-w- c:\windows\PSEXESVC.EXE
2013-07-10 13:43 . 2013-07-10 13:43 ——– d—–w- c:\users\jeremy\AppData\Roaming\Malwarebytes
2013-07-10 13:42 . 2013-07-10 13:42 ——– d—–w- c:\programdata\Malwarebytes
2013-07-10 13:42 . 2013-07-12 14:23 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-10 13:42 . 2013-04-04 04:50 25928 —-a-w- c:\windows\system32\drivers\mbam.sys
2013-07-10 13:39 . 2013-07-10 13:39 ——– d—–w- c:\program files (x86)\Tweaking.com
2013-07-09 23:39 . 2013-06-11 23:25 15404032 —-a-w- c:\windows\system32\ieframe.dll
2013-07-09 23:39 . 2013-06-11 23:25 19238912 —-a-w- c:\windows\system32\mshtml.dll
2013-07-09 02:00 . 2013-07-09 02:00 ——– d—–w- C:\_OTL
2013-07-09 01:54 . 2013-07-09 01:54 ——– d—–w- C:\RegBackup
2013-07-06 03:36 . 2012-05-04 11:00 366592 —-a-w- c:\windows\system32\qdvd.dll
2013-07-06 03:36 . 2012-05-04 09:59 514560 —-a-w- c:\windows\SysWow64\qdvd.dll
2013-07-04 12:14 . 2013-07-04 12:14 ——– d—–w- c:\users\jeremy\AppData\Local\Programs
2013-07-04 12:14 . 2013-07-04 12:14 773712 —-a-w- c:\windows\SysWow64\msvcr100.dll
2013-07-04 12:14 . 2013-07-04 12:14 420944 —-a-w- c:\windows\SysWow64\msvcp100.dll
2013-06-16 02:18 . 2013-06-16 02:18 ——– d—–w- c:\program files\iPod
2013-06-16 02:18 . 2013-06-16 02:18 ——– d—–w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-16 02:18 . 2013-06-16 02:18 ——– d—–w- c:\program files\iTunes
2013-06-16 02:18 . 2013-06-16 02:18 ——– d—–w- c:\program files (x86)\iTunes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-13 07:52 . 2012-07-06 02:53 867240 —-a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-07-13 07:52 . 2011-02-06 01:45 789416 —-a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-09 23:43 . 2011-01-15 03:41 78185248 —-a-w- c:\windows\system32\MRT.exe
2013-06-17 23:46 . 2011-01-12 10:46 177312 —-a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-05-23 05:25 . 2013-06-11 23:16 1139800 —-a-w- c:\windows\system32\drivers\NISx64\1404000.028\symefa64.sys
2013-05-21 05:02 . 2013-06-11 23:16 493656 —-a-w- c:\windows\system32\drivers\NISx64\1404000.028\symds64.sys
2013-05-20 04:06 . 2012-04-10 23:28 692104 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-20 04:06 . 2011-06-04 19:52 71048 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-16 05:02 . 2013-06-11 23:16 796760 —-a-w- c:\windows\system32\drivers\NISx64\1404000.028\srtsp64.sys
2013-05-13 05:51 . 2013-06-12 08:16 184320 —-a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 08:16 1464320 —-a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 08:16 139776 —-a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 08:16 52224 —-a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 08:16 1160192 —-a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 08:16 103936 —-a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 04:45 . 2013-06-12 08:16 140288 —-a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 03:43 . 2013-06-12 08:16 1192448 —-a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 08:16 903168 —-a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 08:16 43008 —-a-w- c:\windows\SysWow64\certenc.dll
2013-05-11 10:10 . 2010-06-24 01:33 22240 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-10 13:18 . 2013-05-10 13:18 73728 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-10 13:18 . 2013-05-10 13:18 719360 —-a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-05-10 13:18 . 2013-05-10 13:18 61952 —-a-w- c:\windows\SysWow64\tdc.ocx
2013-05-10 13:18 . 2013-05-10 13:18 523264 —-a-w- c:\windows\SysWow64\vbscript.dll
2013-05-10 13:18 . 2013-05-10 13:18 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll
2013-05-10 13:18 . 2013-05-10 13:18 38400 —-a-w- c:\windows\SysWow64\imgutil.dll
2013-05-10 13:18 . 2013-05-10 13:18 361984 —-a-w- c:\windows\SysWow64\html.iec
2013-05-10 13:18 . 2013-05-10 13:18 23040 —-a-w- c:\windows\SysWow64\licmgr10.dll
2013-05-10 13:18 . 2013-05-10 13:18 226304 —-a-w- c:\windows\system32\elshyph.dll
2013-05-10 13:18 . 2013-05-10 13:18 185344 —-a-w- c:\windows\SysWow64\elshyph.dll
2013-05-10 13:18 . 2013-05-10 13:18 158720 —-a-w- c:\windows\SysWow64\msls31.dll
2013-05-10 13:18 . 2013-05-10 13:18 150528 —-a-w- c:\windows\SysWow64\iexpress.exe
2013-05-10 13:18 . 2013-05-10 13:18 1441280 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2013-05-10 13:18 . 2013-05-10 13:18 138752 —-a-w- c:\windows\SysWow64\wextract.exe
2013-05-10 13:18 . 2013-05-10 13:18 137216 —-a-w- c:\windows\SysWow64\ieUnatt.exe
2013-05-10 13:18 . 2013-05-10 13:18 12800 —-a-w- c:\windows\SysWow64\mshta.exe
2013-05-10 13:18 . 2013-05-10 13:18 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-05-10 13:18 . 2013-05-10 13:18 1054720 —-a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-10 13:18 . 2013-05-10 13:18 197120 —-a-w- c:\windows\system32\msrating.dll
2013-05-10 13:18 . 2013-05-10 13:18 97280 —-a-w- c:\windows\system32\mshtmled.dll
2013-05-10 13:18 . 2013-05-10 13:18 92160 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-10 13:18 . 2013-05-10 13:18 905728 —-a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-10 13:18 . 2013-05-10 13:18 81408 —-a-w- c:\windows\system32\icardie.dll
2013-05-10 13:18 . 2013-05-10 13:18 77312 —-a-w- c:\windows\system32\tdc.ocx
2013-05-10 13:18 . 2013-05-10 13:18 762368 —-a-w- c:\windows\system32\ieapfltr.dll
2013-05-10 13:18 . 2013-05-10 13:18 62976 —-a-w- c:\windows\system32\pngfilt.dll
2013-05-10 13:18 . 2013-05-10 13:18 599552 —-a-w- c:\windows\system32\vbscript.dll
2013-05-10 13:18 . 2013-05-10 13:18 52224 —-a-w- c:\windows\system32\msfeedsbs.dll
2013-05-10 13:18 . 2013-05-10 13:18 51200 —-a-w- c:\windows\system32\imgutil.dll
2013-05-10 13:18 . 2013-05-10 13:18 48640 —-a-w- c:\windows\system32\mshtmler.dll
2013-05-10 13:18 . 2013-05-10 13:18 452096 —-a-w- c:\windows\system32\dxtmsft.dll
2013-05-10 13:18 . 2013-05-10 13:18 441856 —-a-w- c:\windows\system32\html.iec
2013-05-10 13:18 . 2013-05-10 13:18 281600 —-a-w- c:\windows\system32\dxtrans.dll
2013-05-10 13:18 . 2013-05-10 13:18 27648 —-a-w- c:\windows\system32\licmgr10.dll
2013-05-10 13:18 . 2013-05-10 13:18 270848 —-a-w- c:\windows\system32\iedkcs32.dll
2013-05-10 13:18 . 2013-05-10 13:18 247296 —-a-w- c:\windows\system32\webcheck.dll
2013-05-10 13:18 . 2013-05-10 13:18 235008 —-a-w- c:\windows\system32\url.dll
2013-05-10 13:18 . 2013-05-10 13:18 216064 —-a-w- c:\windows\system32\msls31.dll
2013-05-10 13:18 . 2013-05-10 13:18 173568 —-a-w- c:\windows\system32\ieUnatt.exe
2013-05-10 13:18 . 2013-05-10 13:18 167424 —-a-w- c:\windows\system32\iexpress.exe
2013-05-10 13:18 . 2013-05-10 13:18 1509376 —-a-w- c:\windows\system32\inetcpl.cpl
2013-05-10 13:18 . 2013-05-10 13:18 149504 —-a-w- c:\windows\system32\occache.dll
2013-05-10 13:18 . 2013-05-10 13:18 144896 —-a-w- c:\windows\system32\wextract.exe
2013-05-10 13:18 . 2013-05-10 13:18 1400416 —-a-w- c:\windows\system32\ieapfltr.dat
2013-05-10 13:18 . 2013-05-10 13:18 13824 —-a-w- c:\windows\system32\mshta.exe
2013-05-10 13:18 . 2013-05-10 13:18 136192 —-a-w- c:\windows\system32\iepeers.dll
2013-05-10 13:18 . 2013-05-10 13:18 135680 —-a-w- c:\windows\system32\IEAdvpack.dll
2013-05-10 13:18 . 2013-05-10 13:18 12800 —-a-w- c:\windows\system32\msfeedssync.exe
2013-05-10 13:18 . 2013-05-10 13:18 102912 —-a-w- c:\windows\system32\inseng.dll
2013-05-10 13:16 . 2013-05-10 13:16 9728 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 9728 —-a-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 648192 —-a-w- c:\windows\system32\d3d10level9.dll
2013-05-10 13:16 . 2013-05-10 13:16 604160 —-a-w- c:\windows\SysWow64\d3d10level9.dll
2013-05-10 13:16 . 2013-05-10 13:16 5632 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 5632 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 5632 —-a-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 5632 —-a-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 522752 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2013-05-10 13:16 . 2013-05-10 13:16 465920 —-a-w- c:\windows\system32\WMPhoto.dll
2013-05-10 13:16 . 2013-05-10 13:16 417792 —-a-w- c:\windows\SysWow64\WMPhoto.dll
2013-05-10 13:16 . 2013-05-10 13:16 4096 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 4096 —-a-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3928064 —-a-w- c:\windows\system32\d2d1.dll
2013-05-10 13:16 . 2013-05-10 13:16 364544 —-a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2013-05-10 13:16 . 2013-05-10 13:16 363008 —-a-w- c:\windows\system32\dxgi.dll
2013-05-10 13:16 . 2013-05-10 13:16 3584 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3584 —-a-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3419136 —-a-w- c:\windows\SysWow64\d2d1.dll
2013-05-10 13:16 . 2013-05-10 13:16 333312 —-a-w- c:\windows\system32\d3d10_1core.dll
2013-05-10 13:16 . 2013-05-10 13:16 3072 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3072 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3072 —-a-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 3072 —-a-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 296960 —-a-w- c:\windows\system32\d3d10core.dll
2013-05-10 13:16 . 2013-05-10 13:16 293376 —-a-w- c:\windows\SysWow64\dxgi.dll
2013-05-10 13:16 . 2013-05-10 13:16 2776576 —-a-w- c:\windows\system32\msmpeg2vdec.dll
2013-05-10 13:16 . 2013-05-10 13:16 2565120 —-a-w- c:\windows\system32\d3d10warp.dll
2013-05-10 13:16 . 2013-05-10 13:16 2560 —-a-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 2560 —-a-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-10 13:16 . 2013-05-10 13:16 249856 —-a-w- c:\windows\SysWow64\d3d10_1core.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-11 253816]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-11-8 4236288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 WDFME;WD File Management Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130702.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\BASHDefs\20130702.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130712.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\Definitions\IPSDefs\20130712.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE;c:\program files\Realtek\Audio\HDA\AERTSr64.EXE [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [x]
S2 GFIBckHAtt;GFI Backup 2009 - Home Edition Attendant Service;c:\progra~2\GFI\GFIBAC~1\GFIHInst.exe;c:\progra~2\GFI\GFIBAC~1\GFIHInst.exe [x]
S2 GFIBckHSched;GFI Backup 2009 - Home Edition Scheduler Service;c:\progra~2\GFI\GFIBAC~1\GFIHSC~1.EXE;c:\progra~2\GFI\GFIBAC~1\GFIHSC~1.EXE [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [x]
S2 WDSC;WD File Management Shadow Engine;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 11:10 1173456 —-a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-13 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files (x86)\EPSON\EPAPDL\E_SAPDL2.EXE [2009-05-26 01:43]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-28 10:28]
.
2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-28 10:28]
.
2013-06-27 c:\windows\Tasks\HPCeeScheduleForJEREMY-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 12:15]
.
2013-07-11 c:\windows\Tasks\HPCeeScheduleForjeremy.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 12:15]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
.
——- Supplementary Scan ——-
.
uStart Page = https://www.google.com.au/
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL =
mStart Page =
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: eq.edu.au\myhr-rct
TCP: DhcpNameServer = 10.1.1.1
FF - ProfilePath - c:\users\jeremy\AppData\Roaming\Mozilla\Firefox\Profiles\di3cfri5.default\
FF - ExtSQL: 2013-07-13 09:28; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\IPSFFPlgn
FF - ExtSQL: 2013-07-13 15:41; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.1.22\coFFPlgn
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-BreakingNews - c:\program files\BreakingNews\BreakingNews\DesktopContainer.exe
Wow6432Node-HKLM-Run- - (no file)
AddRemove-Tweaking.com - Registry Backup - c:\users\jeremy\Desktop\uninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2013-07-15 08:32:16
ComboFix-quarantined-files.txt 2013-07-14 22:32
ComboFix2.txt 2013-07-09 00:18
ComboFix3.txt 2013-07-08 03:18
.
Pre-Run: 422,825,455,616 bytes free
Post-Run: 422,361,600,000 bytes free
.
- - End Of File - - 97CDB204ACA9B296778848123536D18E
D41D8CD98F00B204E9800998ECF8427E
Post #37
Internet Explorer is the only problem I am aware of. Menus, favourites, Home button, back arrow, typing urls, selecting sites from History all not working. Typing a search topic and selecting from the search suggestions works for some websites but not others. Chrome and Firefox, which I have rarely used in the past, appear to be working OK.
Post #41
Do you have your Windows 7 CD or can you borrow one from a friend? If so, get it out as we may need this during the following steps:
  • Click on Start, type cmd in the Start Search bar.
  • Right click on Command Prompt at the top of the window and select Run as Administrator.
  • In the Command Prompt Window, type (or copy and paste) sfc /scannow and press Enter.
The scan may take some time, so be patient. Windows will repair any corrupted or missing files that it finds. If information from the installation CD is needed to repair the problem, you may be prompted to insert your Windows 7 CD.

After you run System File Checker (sfc /scannow), try to run Windows Update and then test out Internet Explorer and see if it is working now.

Let me know how that works. :)
Post #43
[external image: Posted Image] Malwarebytes Anti-Rootkit

Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up all your data before using.
  • Scan your system for malware
  • If malware is found, please go to the MBAR folder and then copy/paste the contents of the MBAR-log-***.txt file to your next reply.
If there is no malware found, please let me know as well.
———-
Post #45
Hi,

Ok I don't believe that this is malware related at this point. I don't see anything jumping out at me in the logs that you are providing. You may be better served by posting a new topic in the Browsers, Internet and email forum found here.

The techs there are fantastic! If they are able to fix you up, come back here and we will remove our tools….if not, we will dig a little deeper and see if we can shake something loose. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI