Our November Competition
User Reviews - Add Yours!
The PCHF Lounge
Go Back   PC Help Forum » Security & Safety » [Fixed] Hijackthis! Logs
Register for a Free Account

[Fixed] Hijackthis! Logs - Google redirect virus help!! posted in the Security & Safety forums; Ok.Just this one to fix.. ======================================== Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are ...


Reply
Free PC Performance Scan
Old 3 Weeks Ago   #8
Senior Security Analyst
 
Pancake's Avatar
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 6,862
PC Experience: Elite PC Guru
Default Re: Google redirect virus help!!

Ok.Just this one to fix..
========================================
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the red text in the quotebox below into it:


File::
c:\documents and settings\Alan\killbat.bat
Folder::
Registry::
DDS::

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt in your next reply please.

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*
__________________
  • An Australian Member of
  • and
My real name is Eddy
Pancake is offline   Reply With Quote
Advertisement - Register to Remove

Old 3 Weeks Ago   #9
Bronze Member
 
Sneakyone's Avatar
 
Join Date: Oct 2009
Posts: 11
PC Experience: Very Experienced
Default Re: Google redirect virus help!!

heres the new combo-fix.exe log:
ComboFix 09-10-27.08 - Alan 10/28/2009 19:01.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.428 [GMT -5:00]
Running from: c:\documents and settings\Alan\Desktop\Combo-fix.exe
Command switches used :: c:\documents and settings\Alan\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
FILE ::
"c:\documents and settings\Alan\killbat.bat"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Alan\killbat.bat
.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-28 )))))))))))))))))))))))))))))))
.
2009-10-28 17:28 . 2009-10-28 17:28 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Threat Expert
2009-10-28 17:19 . 2009-10-08 16:31 767952 ----a-w- c:\windows\BDTSupport.dll
2009-10-28 17:19 . 2009-10-08 16:31 149456 ----a-w- c:\windows\SGDetectionTool.dll
2009-10-28 17:19 . 2009-10-08 16:31 165840 ----a-w- c:\windows\PCTBDRes.dll
2009-10-28 17:19 . 2009-10-08 16:31 1636304 ----a-w- c:\windows\PCTBDCore.dll
2009-10-28 17:19 . 2009-10-02 19:19 1152470 ----a-w- c:\windows\UDB.zip
2009-10-28 17:19 . 2008-11-26 17:08 131 ----a-w- c:\windows\IDB.zip
2009-10-28 17:16 . 2009-09-24 13:55 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-10-28 17:16 . 2009-10-06 21:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-10-28 17:16 . 2009-09-23 21:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-10-28 17:16 . 2009-09-03 14:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-10-28 17:16 . 2009-10-28 23:55 -------- d-----w- c:\program files\Spyware Doctor
2009-10-28 17:16 . 2009-10-28 17:20 -------- d-----w- c:\program files\Common Files\PC Tools
2009-10-28 17:16 . 2009-10-28 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-10-28 17:16 . 2009-10-28 17:16 -------- d-----w- c:\documents and settings\Alan\Application Data\PC Tools
2009-10-28 17:04 . 2009-10-28 17:04 -------- d-----w- C:\Combo-fix
2009-10-27 22:57 . 2009-10-27 23:01 111197 ----a-w- C:\MGlogs.zip
2009-10-27 22:57 . 2009-10-27 23:02 -------- d-----w- C:\MGtools
2009-10-27 21:41 . 2009-10-27 22:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-27 21:41 . 2009-10-27 21:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-27 02:52 . 2009-10-27 22:17 16750112 ----a-w- c:\documents and settings\Alan\ATT_SST_Installer.exe
2009-10-27 02:27 . 2009-10-27 02:27 -------- d-----w- c:\documents and settings\Alan\Application Data\AVG8
2009-10-27 01:19 . 2009-10-27 01:19 -------- d-----w- c:\program files\AxBx
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-26 23:14 . 2009-10-26 23:14 -------- d-----w- c:\documents and settings\Alan\Application Data\SUPERAntiSpyware.com
2009-10-26 23:13 . 2009-10-26 23:13 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-26 01:47 . 2009-10-27 02:06 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2009-10-25 23:17 . 2009-10-25 23:17 -------- d-----w- c:\documents and settings\Alan\Application Data\Malwarebytes
2009-10-25 23:17 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-25 23:16 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-14 21:34 . 2009-10-14 21:34 -------- d-----w- c:\documents and settings\Alan\Application Data\WebCam Recorder
2009-10-14 21:34 . 2009-10-14 21:34 -------- d-----w- c:\program files\Solent
2009-10-14 21:18 . 2009-10-14 21:18 -------- d-----w- c:\program files\LEDSET
2009-10-14 21:08 . 2007-08-13 19:51 446464 ----a-w- c:\windows\system32\wmvdmoe.dll
2009-10-14 21:08 . 2009-10-14 21:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PY_Software
2009-10-14 20:32 . 2008-04-13 17:39 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-10-14 20:32 . 2008-04-13 17:39 5504 ----a-w- c:\windows\system32\dllcache\mstee.sys
2009-10-14 20:32 . 2008-04-13 17:46 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-10-14 20:32 . 2008-04-13 17:46 10880 ----a-w- c:\windows\system32\dllcache\ndisip.sys
2009-10-14 20:32 . 2008-04-13 17:46 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-10-14 20:32 . 2008-04-13 17:46 15232 ----a-w- c:\windows\system32\dllcache\streamip.sys
2009-10-14 20:31 . 2008-04-13 17:46 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-10-14 20:31 . 2008-04-13 17:46 11136 ----a-w- c:\windows\system32\dllcache\slip.sys
2009-10-14 20:31 . 2008-04-13 17:46 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-10-14 20:31 . 2008-04-13 17:46 19200 ----a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-10-14 20:31 . 2008-04-13 17:46 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-10-14 20:31 . 2008-04-13 17:46 85248 ----a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-10-14 20:31 . 2008-04-13 17:46 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-10-14 20:31 . 2008-04-13 17:46 17024 ----a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-10-14 20:30 . 2008-04-13 23:12 53760 ----a-w- c:\windows\system32\vfwwdm32.dll
2009-10-14 20:30 . 2008-04-13 23:12 53760 ----a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-10-14 00:47 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Publish Providers
2009-10-14 00:47 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Local Settings\Application Data\Sony
2009-10-14 00:37 . 2009-10-14 00:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Sony
2009-10-14 00:35 . 2009-10-20 16:29 -------- d-----w- c:\program files\Sony
2009-10-14 00:34 . 2009-10-14 00:34 -------- d-----w- c:\program files\Sony Setup
2009-10-12 22:01 . 2009-10-12 22:15 -------- d-----w- c:\program files\PVPXX
2009-10-12 13:12 . 2009-09-23 15:41 26176 ---ha-w- c:\windows\system32\hamachi.sys
2009-10-05 23:20 . 2009-10-05 23:20 -------- d-----w- C:\Sun
2009-10-05 23:04 . 2009-10-05 23:16 -------- d-----w- c:\documents and settings\Alan\.SunDownloadManager
2009-10-04 20:52 . 2009-10-04 20:52 11933 ----a-w- c:\windows\begofyn.com
2009-10-03 18:03 . 2009-10-01 15:29 195440 ------w- c:\windows\system32\MpSigStub.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-10-28 23:08 . 2008-12-07 03:01 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-28 20:06 . 2008-12-10 00:38 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2009-10-28 03:15 . 2008-12-06 03:30 -------- d-----w- c:\program files\Unlocker
2009-10-28 03:01 . 2008-12-10 00:21 -------- d-----w- c:\program files\McAfee
2009-10-28 00:01 . 2007-08-02 03:24 -------- d-----w- c:\program files\Windows Live Safety Center
2009-10-27 22:26 . 2006-08-25 23:36 -------- d-----w- c:\program files\Common Files\Motive
2009-10-27 22:17 . 2006-08-25 23:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2009-10-27 02:54 . 2006-08-11 03:32 -------- d-----w- c:\program files\Common Files\Jasc Software Inc
2009-10-27 02:51 . 2006-08-11 03:32 -------- d-----w- c:\documents and settings\Alan\Application Data\Jasc Software Inc
2009-10-27 02:33 . 2008-12-06 04:58 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-10-27 00:17 . 2007-12-21 19:00 -------- d-----w- c:\program files\Bellsouth
2009-10-26 23:07 . 2006-08-08 07:13 -------- d-----w- c:\program files\WildTangent
2009-10-26 23:06 . 2006-08-08 07:08 -------- d-----w- c:\program files\Dell
2009-10-25 23:17 . 2008-12-06 03:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-24 23:12 . 2008-12-08 22:23 21870 ----a-w- c:\documents and settings\Everybody\Application Data\wklnhst.dat
2009-10-22 21:53 . 2006-08-29 00:43 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2009-10-22 21:53 . 2006-08-29 00:44 -------- d-----w- c:\program files\Dell Games
2009-10-22 21:24 . 2008-11-02 02:28 -------- d-----w- c:\program files\Sun
2009-10-22 21:20 . 2006-08-08 07:04 -------- d-----w- c:\program files\Java
2009-10-21 00:55 . 2006-08-22 22:51 29390 ----a-w- c:\documents and settings\Alan\Application Data\wklnhst.dat
2009-10-20 16:25 . 2009-08-17 22:55 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2009-10-15 03:32 . 2006-08-08 07:17 -------- d-----w- c:\program files\Microsoft Works
2009-10-09 13:29 . 2006-08-08 07:18 -------- d-----w- c:\program files\Microsoft Money 2006
2009-10-04 13:04 . 2006-08-11 03:30 -------- d-----w- c:\program files\Dl_cats
2009-09-23 21:57 . 2009-03-01 17:36 58600 ----a-w- c:\documents and settings\Connor\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-16 15:22 . 2008-12-10 00:22 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 15:22 . 2008-12-10 00:22 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 15:22 . 2008-12-10 00:22 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 15:22 . 2008-06-27 12:08 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 15:22 . 2008-12-10 00:20 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-16 08:20 . 2009-10-28 17:16 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-09-15 11:20 . 2009-10-28 17:16 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat
2009-09-15 07:12 . 2009-10-28 17:16 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat
2009-09-15 06:01 . 2009-10-28 17:16 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat
2009-09-11 14:18 . 2008-10-25 00:03 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 23:49 . 2009-09-09 21:46 540 ----a-w- c:\windows\system32\drivers\sthdae.log
2009-09-09 22:26 . 2009-09-09 22:26 -------- d-----w- c:\documents and settings\Alan\Application Data\Blitware
2009-09-09 21:44 . 2006-08-08 07:08 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-04 21:03 . 2004-08-10 17:51 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-04 00:29 . 2009-09-04 00:29 -------- d-----w- c:\documents and settings\Alan\Application Data\Mael
2009-09-02 12:52 . 2009-09-02 12:52 -------- d-----w- c:\documents and settings\Everybody\Application Data\Datel
2009-09-02 01:00 . 2008-12-14 00:17 58600 ----a-w- c:\documents and settings\Everybody\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 00:27 . 2006-08-11 01:50 58600 ----a-w- c:\documents and settings\Alan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-02 00:22 . 2009-09-02 00:22 -------- d-----w- c:\program files\MSBuild
2009-09-02 00:22 . 2009-09-02 00:22 -------- d-----w- c:\program files\Reference Assemblies
2009-09-01 23:47 . 2009-09-01 23:47 -------- d-----w- c:\documents and settings\Alan\Application Data\Datel
2009-08-29 07:36 . 2004-08-10 17:51 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-10 17:51 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2004-08-10 17:50 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-27 21:05 . 2009-08-27 21:04 34 ----a-w- c:\documents and settings\Connor\jagex_runescape_preferences.dat
2009-08-26 08:00 . 2004-08-10 17:51 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-20 20:09 . 2009-08-20 20:09 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-19 01:01 . 2008-12-10 21:28 34 ----a-w- c:\documents and settings\Everybody\jagex_runescape_preferences.dat
2009-08-07 01:10 . 2009-05-30 19:18 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-08-07 01:10 . 2009-05-30 19:18 88 --sh--r- c:\windows\system32\3F285D0D6D.sys
2009-08-05 09:01 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 15:13 . 2008-10-25 00:03 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2008-10-25 00:03 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2004-08-04 10:00 . 2004-08-10 17:51 94784 --sh--w- c:\windows\twain.dll
2008-04-14 00:12 . 2008-10-25 00:03 551936 --sha-w- c:\windows\system32\oleaut32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{472734EA-242A-422B-ADF8-83D1E48CC825}"= "c:\program files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-10-08 395216]
[HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{472734EA-242A-422B-ADF8-83D1E48CC825}"= "c:\program files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-10-08 395216]
[HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}]
[HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-07-28 68856]
"DellSupport-"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-13 2000112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X 86\3\DLCCtime.dll" [2005-09-14 73728]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 249856]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"HelpCenter4.1"="c:\program files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe" [2007-04-13 198184]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-11-01 94208]
"dlccmon.exe"="c:\program files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 430080]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2000-08-14 32768]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-23 116040]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-09-22 1243088]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-03-23 339968]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1 \DW\dwtrig20.exe" [2007-02-26 437160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-12-06 03:18 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Alan^Start Menu^Programs^Startup^Camio Viewer.lnk]
backup=c:\windows\pss\Camio Viewer.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Auto Detect.lnk]
backup=c:\windows\pss\Auto Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"tmproxy"=2 (0x2)
"TmPfw"=2 (0x2)
"Tmntsrv"=2 (0x2)
"PcCtlCom"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Microsoft Office\\Office10\\WINWORD.EXE"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\lxczcoms.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcods.exe"=
"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [10/28/2009 12:16 PM 207280]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [10/12/2009 9:24 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/12/2009 9:24 PM 74480]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [10/28/2009 12:19 PM 112592]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [12/9/2008 7:25 PM 210216]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [10/28/2009 12:16 PM 358600]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [10/12/2009 9:24 PM 7408]
S1 Hdaudioo;Hdaudioo; [x]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
*Deregistered* - PCTSDInjDriver32
.
Contents of the 'Scheduled Tasks' folder
2009-10-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
2009-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258719614-4290492059-3762695196-1011Core.job
- c:\documents and settings\Everybody\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-10 00:37]
2009-10-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258719614-4290492059-3762695196-1011UA.job
- c:\documents and settings\Everybody\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-10 00:37]
2009-06-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-10 17:22]
2009-08-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-12-10 17:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://my.att.net/
uInternet Settings,ProxyOverride = *.local
Trusted Zone: musicmatch.com\online
DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - hxxp://pbells.broadjump.com/wizlet/StandardInstall/static/controls/WebflowActiveXInstaller_4-2-0.cab
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-10-28 19:12
Windows 5.1.2600 Service Pack 3 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtim e.dll,_RunDLLEntry@16????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ??????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(644)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
Completion time: 2009-10-29 19:15
ComboFix-quarantined-files.txt 2009-10-29 00:15
ComboFix2.txt 2009-10-28 22:11
Pre-Run: 54,197,563,392 bytes free
Post-Run: 54,169,804,800 bytes free
- - End Of File - - 738453AC5DC0A7634BCBE47242F4E1AC
Sneakyone is offline   Reply With Quote
Old 3 Weeks Ago   #10
Senior Security Analyst
 
Pancake's Avatar
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 6,862
PC Experience: Elite PC Guru
Default Re: Google redirect virus help!!

Ok.That looks fine.I see no more malware...

This will clear away any of the files and folders that were created by ComboFix.
Go to :
Start > Run then copy and paste the following highlighted (blue) text below into the box and click OK.

ComboFix /u

Please read these for future reference it may save you future problems with malware:

http://www.pchelpforum.com/fixed-hij...afterwork.html
http://www.pchelpforum.com/fixed-hij...happening.html
http://www.pchelpforum.com/fixed-hij...-infected.html
__________________
  • An Australian Member of
  • and
My real name is Eddy
Pancake is offline   Reply With Quote
Old 3 Weeks Ago   #11
Bronze Member
 
Sneakyone's Avatar
 
Join Date: Oct 2009
Posts: 11
PC Experience: Very Experienced
Default Re: Google redirect virus help!!

thanks for all your help!
Sneakyone is offline   Reply With Quote

Reply

Bookmarks

Tags
google, google redirect virus, redirect, virus
Similar discussions...
Thread Thread Starter Forum Replies Last Post
Pending: Google Redirect vegaman Spyware / AdWare 1 09-17-2009 04:23 PM
Pending: Google Redirect Virus WJennings [Pending] HJT Logs 5 09-09-2009 05:49 AM
Fixed: The Google Redirect Virus korsondo [Fixed] Hijackthis! Logs 31 09-04-2009 12:13 AM
Fixed: Google redirect tenlarn [Fixed] Hijackthis! Logs 10 10-10-2008 10:38 PM
Google Redirect??????????? sbuxman Windows XP/2000 2 02-11-2008 12:36 PM

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On




All times are GMT. The time now is 12:48 PM.
Powered by vBulletin
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.2