Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Yafraudcheckonline Google Redirects / BSOD

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 3rd, 2011, 12:36 pm

Hello, forum. I had a problem with the yafraudcheckonline redirecting my Google searches to random websites. My Malwarebytes Anti-malware keeps bugging me that process scvhost.exe is trying to send something to a malicious website [Type: outgoing; website in 90.574.384.... form], but I don't know if that's the problem. I also BSOD'ed a few times, sometimes even while i'm not browsing. I mainly use Chrome. Here's my DDS.

Please let me know if there is anything I can do to get this thing removed.



DDS (Ver_10-12-12.02) - NTFSx86
Run by Owner at 11:22:20.68 on Thu 03/03/2011
Internet Explorer: 7.0.6002.18005
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2936.1668 [GMT -5:00]

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\DRIVERS\o2flash.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Camera Assistant Software for Gateway\traybar.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\M-Audio\USB MIDI Series\AudioDevMon.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\Camera Assistant Software for Gateway\CEC_MAIN.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\Owner\Downloads\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\msiexec.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Owner\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
mURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\tbBitT.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [AdobeBridge]
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for gateway\traybar.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/s ... wflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
R1 MpKslb157f8ed;MpKslb157f8ed;c:\programdata\microsoft\microsoft antimalware\definition updates\{20b8133d-c059-4812-bd24-dd7ec0efb859}\MpKslb157f8ed.sys [2011-3-2 28752]
R1 MpKslb6c72168;MpKslb6c72168;c:\programdata\microsoft\microsoft antimalware\definition updates\{20b8133d-c059-4812-bd24-dd7ec0efb859}\MpKslb6c72168.sys [2011-3-3 28752]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-3-2 363344]
R2 USBMIDIAudioDevMon;USB MIDI Series Audio Device Monitor;c:\program files\m-audio\usb midi series\AudioDevMon.exe [2010-4-13 1636872]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-3-2 20952]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2008-11-17 3668480]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2010-11-11 206360]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-12-10 52128]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2008-11-11 42144]
R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2011-1-26 22072]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 MAUSBMIDI;Service for M-Audio USB MIDI Series;c:\windows\system32\drivers\MAudioUSBMIDI.sys [2010-4-13 170248]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2008-1-20 16896]
S3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\drivers\WSDScan.sys [2011-1-29 19968]

=============== Created Last 30 ================

2011-03-03 15:19:03 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{20b8133d-c059-4812-bd24-dd7ec0efb859}\MpKslb6c72168.sys
2011-03-03 02:05:10 28752 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{20b8133d-c059-4812-bd24-dd7ec0efb859}\MpKslb157f8ed.sys
2011-03-02 14:36:59 -------- d-----w- c:\users\owner\appdata\roaming\Malwarebytes
2011-03-02 14:36:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-02 14:36:28 -------- d-----w- c:\progra~2\Malwarebytes
2011-03-02 14:36:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-02 14:36:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-02 14:17:54 5943120 ----a-w- c:\progra~2\microsoft\microsoft antimalware\definition updates\{20b8133d-c059-4812-bd24-dd7ec0efb859}\mpengine.dll
2011-03-02 13:48:42 -------- d-----w- C:\VundoFix Backups
2011-02-28 22:21:15 -------- d-----w- c:\program files\common files\Digidesign
2011-02-28 22:05:22 -------- d-----w- c:\program files\common files\Native Instruments
2011-02-28 21:22:35 -------- d-----w- c:\users\owner\appdata\local\Native Instruments
2011-02-28 02:44:20 -------- d-----w- c:\program files\daHornet
2011-02-27 05:19:27 -------- d-----w- c:\program files\goodlogin
2011-02-27 00:51:32 -------- d-----w- c:\program files\Combined Community Codec Pack
2011-02-27 00:50:21 -------- d-----w- c:\program files\MainConcept
2011-02-24 07:31:35 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2011-02-24 07:31:12 40448 ----a-w- c:\windows\system32\winrs.exe
2011-02-24 07:31:12 20480 ----a-w- c:\windows\system32\winrshost.exe
2011-02-24 07:31:12 12800 ----a-w- c:\windows\system32\wsmprovhost.exe
2011-02-24 07:31:10 10240 ----a-w- c:\windows\system32\wsmplpxy.dll
2011-02-24 07:31:10 10240 ----a-w- c:\windows\system32\winrssrv.dll
2011-02-24 07:31:05 81408 ----a-w- c:\windows\system32\wevtfwd.dll
2011-02-24 07:31:05 79872 ----a-w- c:\windows\system32\wecutil.exe
2011-02-24 07:31:05 56320 ----a-w- c:\windows\system32\wecapi.dll
2011-02-24 07:31:04 54272 ----a-w- c:\windows\system32\WsmRes.dll
2011-02-24 07:31:04 41472 ----a-w- c:\windows\system32\pwrshplugin.dll
2011-02-24 07:31:04 146944 ----a-w- c:\windows\system32\wecsvc.dll
2011-02-24 07:30:52 201184 ----a-w- c:\windows\system32\winrm.vbs
2011-02-24 07:30:49 145408 ----a-w- c:\windows\system32\WsmAuto.dll
2011-02-24 07:30:48 252416 ----a-w- c:\windows\system32\WSManMigrationPlugin.dll
2011-02-24 07:30:48 241152 ----a-w- c:\windows\system32\winrscmd.dll
2011-02-24 07:30:48 214016 ----a-w- c:\windows\system32\WsmWmiPl.dll
2011-02-24 07:30:47 246272 ----a-w- c:\windows\system32\WSManHTTPConfig.exe
2011-02-24 07:30:47 1181696 ----a-w- c:\windows\system32\WsmSvc.dll
2011-02-22 03:11:59 165376 ----a-w- c:\windows\system32\unrar.dll
2011-02-22 03:11:55 839680 ----a-w- c:\windows\system32\lameACM.acm
2011-02-22 03:11:54 810496 ----a-w- c:\windows\system32\xvidcore.dll
2011-02-22 03:11:54 80896 ----a-w- c:\windows\system32\ff_vfw.dll
2011-02-22 03:11:54 237568 ----a-w- c:\windows\system32\yv12vfw.dll
2011-02-22 03:11:54 183808 ----a-w- c:\windows\system32\xvidvfw.dll
2011-02-22 03:11:54 151552 ----a-w- c:\windows\system32\ac3acm.acm
2011-02-22 03:11:49 -------- d-----w- c:\program files\K-Lite Codec Pack
2011-02-22 01:25:34 -------- d-----w- c:\users\owner\appdata\roaming\TypingMaster7
2011-02-22 01:25:21 -------- d-----r- c:\program files\TypingMaster
2011-02-22 00:53:26 -------- d-----w- c:\users\owner\.NewTek
2011-02-22 00:44:16 -------- d-----w- c:\program files\NewTek
2011-02-21 15:36:16 -------- d-----w- c:\program files\Windows Portable Devices
2011-02-21 06:07:42 92672 ----a-w- c:\windows\system32\UIAnimation.dll
2011-02-21 06:07:41 3023360 ----a-w- c:\windows\system32\UIRibbon.dll
2011-02-21 06:07:41 1164800 ----a-w- c:\windows\system32\UIRibbonRes.dll
2011-02-21 06:07:18 369664 ----a-w- c:\windows\system32\WMPhoto.dll
2011-02-21 06:07:16 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-02-21 06:07:15 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2011-02-21 06:07:15 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-02-21 06:07:15 252928 ----a-w- c:\windows\system32\dxdiag.exe
2011-02-21 06:07:15 195584 ----a-w- c:\windows\system32\dxdiagn.dll
2011-02-21 06:07:14 519680 ----a-w- c:\windows\system32\d3d11.dll
2011-02-21 06:05:51 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2011-02-21 06:05:50 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2011-02-21 06:05:50 234496 ----a-w- c:\windows\system32\oleacc.dll
2011-02-21 03:45:56 49664 ----a-w- c:\windows\system32\CamCodec.dll
2011-02-21 03:45:56 -------- d-----w- c:\program files\CamStudio 2.6b
2011-02-21 02:00:58 231424 ----a-w- c:\windows\system32\msshsq.dll
2011-02-20 23:08:42 -------- d-----w- c:\users\owner\appdata\local\Microsoft Games
2011-02-20 20:04:40 -------- d-----w- c:\windows\system32\eu-ES
2011-02-20 20:04:40 -------- d-----w- c:\windows\system32\ca-ES
2011-02-20 20:04:39 -------- d-----w- c:\windows\system32\vi-VN
2011-02-20 19:43:21 -------- d-----w- c:\program files\EpsonNet
2011-02-20 16:53:15 -------- d-----w- c:\windows\system32\EventProviders
2011-02-19 02:39:17 -------- d-----w- c:\program files\Dweep
2011-02-18 21:20:08 -------- d-----w- c:\program files\Vstplugins
2011-02-17 23:31:26 -------- d-----w- c:\users\owner\appdata\local\Skyshare Manager
2011-02-17 23:31:10 -------- d-----w- c:\users\owner\appdata\roaming\Skyshare Manager
2011-02-17 23:30:55 -------- d-----w- c:\program files\Skyshare Manager 2
2011-02-17 19:32:03 -------- d-----w- c:\users\owner\appdata\roaming\AudioMulch
2011-02-17 19:30:01 -------- d-----w- c:\program files\AudioMulch 2.1.1
2011-02-11 00:35:11 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-02-11 00:35:11 1205080 ----a-w- c:\windows\system32\ntdll.dll
2011-02-11 00:35:09 3602320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-02-06 05:50:38 -------- d-----w- c:\users\owner\appdata\roaming\Mp3tag
2011-02-06 05:23:31 -------- d-----w- c:\program files\Mp3tag
2011-02-04 22:48:44 356352 ----a-w- c:\windows\system32\nvuninst.exe
2011-02-04 22:48:44 356352 ----a-w- c:\windows\system32\nvuhda.exe
2011-02-04 22:46:54 -------- d-----w- C:\cabs
2011-02-04 22:40:01 -------- d-----w- c:\users\owner\appdata\local\ElevatedDiagnostics
2011-02-04 22:35:29 -------- d-----w- c:\program files\Microsoft ATS
2011-02-02 03:07:43 -------- d-----w- c:\users\owner\appdata\local\Apple Computer
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll
2011-02-02 03:03:31 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll
2011-02-02 03:01:38 -------- d-----w- c:\users\owner\appdata\local\Apple

==================== Find3M ====================

2011-02-03 02:40:23 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-01-20 16:08:16 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08:06 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08:06 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08:06 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08:06 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07:58 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07:42 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07:16 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06:38 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06:35 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04:54 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 16:04:54 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 14:28:38 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27:50 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26:30 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25:25 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24:32 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-20 14:24:26 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15:10 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14:39 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14:03 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14:03 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12:46 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11:34 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47:51 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-20 13:44:05 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-01-20 13:44:03 797184 ----a-w- c:\windows\system32\FntCache.dll
2011-01-08 08:47:50 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-08 06:28:49 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 13:57:01 2039808 ----a-w- c:\windows\system32\win32k.sys
2010-12-28 15:55:03 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-20 16:36:20 834048 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 15:37:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-12-20 14:55:46 389632 ----a-w- c:\windows\system32\html.iec
2010-12-14 14:49:23 1169408 ----a-w- c:\windows\system32\sdclt.exe

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.0.6002 Disk: SAMSUNG_HM321HI rev.2AJ10001 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-0

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8606D439]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x860737b8]; MOV EAX, [0x86073834]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x81E5D912] -> \Device\Harddisk0\DR0[0x859D0858]
3 CLASSPNP[0x89DA58B3] -> ntkrnlpa!IofCallDriver[0x81E5D912] -> [0x86053AE0]
\Driver\atapi[0x85AD36E8] -> IRP_MJ_CREATE -> 0x8606D439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x132; MOV BP, 0x62a; ROR BYTE [BP+0x0], CL; INC BP; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-0 -> \??\IDE#DiskSAMSUNG_HM321HI_________________________2AJ10001#5&2657645f&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
user != kernel MBR !!!
sectors 625142446 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

============= FINISH: 11:23:14.65 ===============



Thank you so much beforehand.

-Deniss :bounce:
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm
Advertisement
Register to Remove

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 3rd, 2011, 1:47 pm

Hi and welcome to Malware Removal Forum.
My name is Cypher, and I will be helping you with your malware problems.
This may or may not, solve other issues you have with your machine.
If you no longer require help i would be grateful if you would let me know.

Before we start please note the following important guidelines.
  • The instructions being given are for YOUR computer and system only!.
    Using these instructions on a different computer, can damage that computer and possibly make it inoperable!
  • If you don't know or understand something, please don't hesitate to ask.
  • Only post your problem at One help site. Applying fixes from multiple help sites can cause problems.
  • Only reply to this thread do not start another, Please continue responding until I give you the "All Clean"
    Absence of symptoms does not mean that everything is clear.
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • Please DO NOT install any other software (or hardware) during the cleaning process.
  • Print each set of instructions... if possible...your Internet connection will not be available during some fix processes.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Note: No Reply Within 3 Days Will Result In Your Topic Being Closed!

Note: If you haven't done so already, please read this topic ALL USERS OF THIS FORUM MUST READ THIS FIRST where the conditions for receiving help here are explained.
Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.
Backup your data - XP
Backup your data - Vista
Backup your data - windows 7


I need to see the DDS Attach.txt., please run DDS again and post the Attach.txt. in your next reply.

Next.

Please download MiniToolBox.exe and save it to your Desktop.

  • Right click MiniToolBox and select " Run as administrator " to run it.
  • Check the following in the list:
  • List Windows version, partitions, and memory size.
  • Click Go
  • Please post the contents of the Result.txt in your next Reply.


Logs/Information to Post in your Next Reply

  • DDS Attach.txt.
  • Minitoolbox Result.txt.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 3rd, 2011, 5:57 pm

MiniToolBox by Farbar
Ran by Owner at 2011-03-03 16:53:46
Windows Vista (TM) Home Premium Service Pack 2 (X86)

***************************************************************************


========================= Memory info: ====================================

Percentage of memory in use: 44%
Total physical RAM: 2936 MB
Available physical RAM: 1629.64 MB
Total Pagefile: 6078.3 MB
Available Pagefile: 4744.83 MB
Total Virtual: 2047.88 MB
Available Virtual: 1969.01 MB

======================= Partitions: =======================================

1 Drive c: () (Fixed) (Total:298.09 GB) (Free:123.25 GB) NTFS


The Attach.txt is in the attachments :)
You do not have the required permissions to view the files attached to this post.
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 4th, 2011, 7:26 am

Hi denissj.
Please copy/paste all logs i request in your replies don't attach them.

Vista Advice:
  • All applications I ask to be used will require to be run in Administrator mode. IE: Right click on and select Run as Administrator.
  • Your Operating System in use comes with a inbuilt utility called User Access Control(UAC).
  • When prompted by this with anything I ask you to do carry out please select the option Allow.


Remove P2P Programs

  • I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    BitTorrent
    BitTorrentBar Toolbar

  • Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
  • Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
  • Click on Start > All programs > Accessories > Run.
  • In the open text box copy/paste appwiz.cpl Then click Ok.
  • Uninstall the programs listed above (in red) and any other P2P you have installed NOW.
  • Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Next.

Run CKScanner

  • Please download CKScanner from Here
  • Important: - Save it to your desktop.
  • Right-click CKScanner.exe > select " Run as administrator " then click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify the file saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

Next.

  • Please download this tool from Microsoft.
  • Right click on MGADiag.exe and select Run As Administrator to run it.
  • Click Continue.
  • The program will run. It takes a while to finish the diagnosis, please be patient.
  • Once done, click on Copy.
  • Open Notepad and paste the contents in the window.
  • Save this file and copy/paste it in your next reply.


Logs/Information to Post in your Next Reply

  • CKFiles.txt.
  • MGADiag log.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 4th, 2011, 12:42 pm

CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files\common files\native instruments\shared content\sounds\massive\crackle carl.ksd
c:\users\owner\documents\ableton\library\presets\audio effects\vinyl distortion\crack.adv
c:\users\owner\documents\transfer\ableton_suite_8_1_1_full_cracked.torrent
c:\users\owner\music\au\polyfonisk musik\classical\i_o\nutcrack.mid
c:\users\owner\music\au\polyfonisk musik\midi database\classicrock\georgeharrison\cracker_box_palace.mid
c:\users\owner\music\au\polyfonisk musik\movie_soundtracks\nutcrack.mid
c:\users\owner\music\au\polyfonisk musik\various artists\arabian dance nutcracker suite (tchaicovsky).mid
c:\users\owner\music\au\polyfonisk musik\various artists\arabian dancenutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\chinese dancenutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\dance of the reed flutesnutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\dance of the sugar-plumfairy nutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\marchnutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\m_tjaikovski-nut_cracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\nutcrack.mid
c:\users\owner\music\au\polyfonisk musik\various artists\nutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\overture nutcracker suite (tchaicovsky).mid
c:\users\owner\music\au\polyfonisk musik\various artists\overturenutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\rin_nutcracker_classic[1].mid
c:\users\owner\music\au\polyfonisk musik\various artists\russian dancenutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\the_nutcracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\tjaikovski-nut_cracker.mid
c:\users\owner\music\au\polyfonisk musik\various artists\vibes_crackheadnmagicmyron.mid
c:\users\owner\music\au\polyfonisk musik\various artists\waltz of the flowers from the nutcracker suite.mid
c:\users\owner\music\au\polyfonisk musik\various artists\waltz of the flowersnutcracker.mid
scanner sequence 3.ZZ.11
----- EOF -----

















Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-BPPBB-D4PR8-RK8G3
Windows Product Key Hash: nPzyb+OV5lpibeyxitOXERfAP8s=
Windows Product ID: 89578-OEM-7354126-67085
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.0.6002.2.00010300.2.0.003
ID: {B19E908E-D483-4D12-A3BD-C7A35331879E}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows Vista (TM) Home Premium
Architecture: 0x00000000
Build lab: 6002.vistasp2_gdr.101014-0432
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B19E908E-D483-4D12-A3BD-C7A35331879E}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RK8G3</PKey><PID>89578-OEM-7354126-67085</PID><PIDType>3</PIDType><SID>S-1-5-21-2545445818-3325752587-1448341868</SID><SYSTEM><Manufacturer>Gateway </Manufacturer><Model>MC7801U </Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies LTD</Manufacturer><Version>99.03 </Version><SMBIOSVersion major="2" minor="5"/><Date>20080912000000.000000+000</Date></BIOS><HWID>0A303507018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>GATEWA</OEMID><OEMTableID>SYSTEM </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>C0A25836FDBE5AC</Val><Hash>FmDbcrRY1pTOcrz4ZUZRHhpUuc0=</Hash><Pid>89396-726-2958074-65565</Pid><PidType>14</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.0.6002.18005
Name: Windows(TM) Vista, HomePremium edition
Description: Windows Operating System - Vista, OEM_COA_NSLP channel
Activation ID: f3acdd3c-119a-4932-a3d7-0b6f33a1dca9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 89578-00146-541-267085-02-1033-6001.0000-0262011
Installation ID: 001461026404313220084091988571967230710713952135212652
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=43473
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=43474
Use License URL: http://go.microsoft.com/fwlink/?LinkID=43476
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=43475
Partial Product Key: RK8G3
License Status: Licensed

Windows Activation Technologies-->
N/A

HWID Data-->
HWID Hash Current: OgAAAAEAAgABAAIAAwACAAAAAwABAAEAeqi6IDZbojV6f0xPxDbwI4iXBoXy9JiW1F96YUS5rFYqhQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20000
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GATEWA SYSTEM
FACP GATEWA SYSTEM
HPET GATEWA SYSTEM
BOOT GATEWA SYSTEM
MCFG GATEWA SYSTEM
SLIC GATEWA SYSTEM
SSDT PmRef CpuPm
SSDT PmRef CpuPm
SSDT PmRef CpuPm
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 4th, 2011, 1:11 pm

Hi denissj.
Unfortunately you have an infected (MBR) Master Boot Record.
The (Master Boot Record) tells your computer what to do when it starts up. Without that information, the computer won't start.
We can try to replace your MBR with a standard one but it is not without risk.
A couple of questions before we begin .
Did you install Windows yourself & if so do you have a Windows a vista installation disk? Or did Windows come pre-installed on the machine? If so you would have been prompted to make a set of Recovery Disks. Do you have those?
Due to the nature of the main infection, if Windows was pre-installed you may no longer have access to the Recovery Partition.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 4th, 2011, 2:58 pm

A few months ago, I had my hard-drive replaced and the person who did it installed the current OS. I really don't have any disk.

Is this unfixable for me?
If it is, what may I ask the person who installed the OS?
What is this infection capable of doing/damaging?

-Deniss
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 4th, 2011, 3:29 pm

Hi Deniss.
Is this unfixable for me?

As i explained in my last post the (MBR) Master Boot Record in your computer is infected.
Because the MBR tells your computer what to do when it starts up, if something goes wrong when we try to remove the infection, it could leave you with a computer that wont start.
This only happens occasionally but it does happen, we can attempt to fix it but as mentioned it is not without risk
if you understand the possible risk involved and would like to attempt to fix this infection, I would urge you first to ensure you have backed up any important data.
Please let me know what you decide to do.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 4th, 2011, 3:53 pm

I will backup the data and reply when that's done. I understand the risk and I want to proceed with it.

-Deniss
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 4th, 2011, 4:20 pm

Hi Deniss.
I will backup the data and reply when that's done.

No problem let me know when you are ready to proceed.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby denissj » March 6th, 2011, 6:45 pm

Done; what's next?
denissj
Active Member
 
Posts: 6
Joined: March 3rd, 2011, 12:18 pm

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 7th, 2011, 6:52 am

Hi Deniss.
Give me an update on how your PC is performing after doing the following.

Download MBRBackup to your Desktop.

  • Right-click MBRBackup.exe and select " Run as administrator " to run it.
  • Click SaveMBR (top left corner) and save the backup file to your Desktop.
  • It will have a name similar to MBR_2010-10-06.bin where the numbers correspond to the date the backup was made.
  • Exit the program.
  • I strongly suggest you keep a copy of this backup stored on an external device.

Next.

Disable Microsoft Security Essentials

  • Open MSE and go to Settings > Real Time Protection.
  • Then uncheck "Turn on real time protection".
  • Exit MSE when done.
  • Note: Don't forget to Re-enable it after the below fix.

Next.

Download and Run ComboFix

  • Please download ComboFix from one of the following links.

    Link 1.

    Link 2.

    **IMPORTANT !!! Save ComboFix.exe to your Desktop**
  • Please disable any Antivirus or Firewall you have active, as shown in this topic. Please close all open application windows.
  • Double click on ComboFix.exe & follow the prompts
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
Image
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Image

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper



Logs/Information to Post in your Next Reply

  • ComboFix.txt.
  • Please let me know how your computer is performing now.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns

Re: Yafraudcheckonline Google Redirects / BSOD

Unread postby Cypher » March 10th, 2011, 7:07 am

Due to a lack of response, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Cypher
Admin/Teacher
Admin/Teacher
 
Posts: 15148
Joined: October 29th, 2008, 12:49 pm
Location: Land Of The Leprechauns
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 297 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware