Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Google Search redirect Malware

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Google Search redirect Malware

Unread postby Mourinho » May 20th, 2011, 9:34 pm

Hi Guys,

So I've been struggling with a few problems for the last week or so. I started out with being infected by the 'Vista Internet Security 2011' virus, and downloaded a whole raft of things to get rid of it - and Malewarebytes seems to have done the job. (although i'm concerned that it's going to come back from the dead somehow as that already happened once).

It took me ages to find this forum, before which I also downloaded in a bit of a panicked spree: Avira, AVG free version 2011, spyware doctor and prevex3.0.

My remaining problem at the moment is a browser redirect when i click on google search results - it happens every time. Also, not sure if this is relevant, but I tried to end a program I had running through the task manager and was unable to and the error statement was that "the handle is invalid".

Anyways,

Here are my DDS and attach logs -

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 7.0.6000.17037 BrowserJavaVersion: 1.6.0_22
Run by Harj Narulla at 10:50:42 on 2011-05-21
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.61.1033.18.3581.1204 [GMT 10:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\aestsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\FsUsbExService.Exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\PC Tools Security\pctsAuxs.exe
C:\Program Files\PC Tools Security\pctsSvc.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\PC Tools Security\pctsGui.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\D-Link\DWA-131 revA\WlanWpsSvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Dell WUSB\WQ_Tray2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\program files\avira\antivir desktop\avscan.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\System32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\msiexec.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\Program Files\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\AVG\AVG10\avgui.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Users\Harj Narulla\Desktop\dds.scr
C:\Windows\system32\WSCRIPT.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uWinlogon: Shell=Explorer.exe, c:\program files\microsoft office\WINWORD.EXE
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: SafeOnline BHO: {69d72956-317c-44bd-b369-8e44d4ef9801} - c:\windows\system32\PxSecure.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [DELL Webcam Manager] "c:\program files\dell\dell webcam manager\DellWMgr.exe" /s
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [NPSStartup]
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ISTray] "c:\program files\pc tools security\pctsGui.exe" /hideGUI
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\program files\dell\quickset\quickset.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\ultraw~1.lnk - c:\program files\dell\dell wusb\WQ_Tray2.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wirele~1.lnk - c:\program files\d-link\dwa-131 reva\wirelesscm.exe
dPolicies-explorer: HideSCAHealth = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\harj narulla\appdata\roaming\dvdvideosoftiehelpers\youtubetomp3.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\harj narulla\appdata\roaming\mozilla\firefox\profiles\nrqpvciz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.unsw.edu.au/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\harj narulla\appdata\roaming\facebook\npfbplugin_1_0_3.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-5-20 239168]
R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-5-20 338880]
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2011-5-21 32008]
R1 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwd6x.sys [2010-7-12 54112]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
R1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-5-21 76696]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\drivers\RtlProt.sys [2010-7-1 25896]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-21 61960]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 28624]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-5-17 36608]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-5-21 26096]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [2010-7-1 503808]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-5-20 38224]
S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
S3 DM9USB;DM9601 USB To Fast Ethernet Adapter;c:\windows\system32\drivers\dm9usb.sys [2010-7-2 54272]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\dellsu~1\hwdiag\bin\PCD5SRVC.pkms [2008-11-5 22904]
S3 USB-100;Swann USB Fast Ethernet Adapter;c:\windows\system32\drivers\RTL8150.SYS [2010-5-2 22528]
.
=============== Created Last 30 ================
.
2011-05-21 00:48:03 -------- d-----w- c:\users\harj narulla\appdata\roaming\AVG10
2011-05-21 00:44:18 -------- d--h--w- c:\programdata\Common Files
2011-05-21 00:40:32 -------- d-----w- c:\windows\system32\drivers\AVG
2011-05-21 00:40:32 -------- d-----w- c:\programdata\AVG10
2011-05-21 00:39:37 -------- d-----w- c:\program files\AVG
2011-05-21 00:28:06 -------- d-----w- c:\programdata\MFAData
2011-05-20 23:34:52 -------- d-----w- c:\users\harj narulla\appdata\roaming\Avira
2011-05-20 23:14:06 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-20 23:13:53 -------- d-----w- c:\programdata\Avira
2011-05-20 23:13:53 -------- d-----w- c:\program files\Avira
2011-05-20 21:37:45 71880 ----a-w- c:\windows\system32\PxSecure.dll
2011-05-20 21:37:43 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-05-20 21:37:43 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-05-20 21:37:41 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-05-20 21:37:41 -------- d-----w- c:\program files\Prevx
2011-05-20 21:37:23 -------- d-----w- c:\programdata\PrevxCSI
2011-05-20 13:53:52 -------- d-----w- c:\users\harj narulla\appdata\roaming\Malwarebytes
2011-05-20 13:53:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-20 13:53:49 -------- d-----w- c:\programdata\Malwarebytes
2011-05-20 13:53:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-20 13:53:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-20 12:57:44 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys
2011-05-20 12:57:44 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys
2011-05-20 12:57:44 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2011-05-20 12:57:44 103232 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2011-05-20 12:57:41 239168 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2011-05-20 12:57:41 160448 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2011-05-20 12:57:38 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2011-05-20 12:57:35 -------- d-----w- c:\users\harj narulla\appdata\roaming\PC Tools
2011-05-20 12:57:35 -------- d-----w- c:\program files\PC Tools Security
2011-05-20 12:57:35 -------- d-----w- c:\program files\common files\PC Tools
2011-05-20 12:53:15 -------- d-----w- c:\programdata\PC Tools
2011-05-19 07:06:57 -------- d-----w- c:\users\harj narulla\appdata\roaming\Jagao
2011-05-19 07:06:57 -------- d-----w- c:\users\harj narulla\appdata\roaming\Guit
2011-05-15 14:32:26 11264 ----a-w- c:\windows\DCEBoot.exe
2011-05-15 14:00:19 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-05-15 13:41:52 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-15 13:41:52 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-15 13:41:52 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-15 13:41:52 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-15 13:41:52 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-15 13:41:52 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-15 13:41:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-15 13:41:51 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-15 13:39:31 7071056 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{01d78f15-512e-4028-897d-1b1e33554545}\mpengine.dll
2011-05-15 13:21:51 -------- d-----w- c:\programdata\oG02400IhPcB02400
.
==================== Find3M ====================
.
2011-04-14 11:28:18 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
2011-04-04 14:59:56 297168 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2011-03-26 12:19:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-16 06:03:20 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2011-02-21 22:12:38 22992 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
.
============= FINISH: 10:53:42.93 ===============

.
.
DDS (Ver_11-05-19.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 6/04/2010 7:44:07 PM
System Uptime: 21/05/2011 7:34:07 AM (3 hours ago)
.
Motherboard: Dell Inc. | | 0R387D
Processor: Intel(R) Core(TM)2 Duo CPU T9300 @ 2.50GHz | Microprocessor | 1600/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 295 GiB total, 107.197 GiB free.
D: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: Ethernet Controller
Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_022E1028&REV_12\4&1C4E7770&0&00E0
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_022E1028&REV_12\4&1C4E7770&0&00E0
Service:
.
Class GUID:
Description: Network Controller
Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_11208086&REV_61\4&2E66C02C&0&00E1
Manufacturer:
Name: Network Controller
PNP Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_11208086&REV_61\4&2E66C02C&0&00E1
Service:
.
==== System Restore Points ===================
.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.1
Advanced Audio FX Engine
Advanced Video FX Engine
Apple Application Support
Apple Mobile Device Support
Apple Software Update
µTorrent
AVG 2011
Avira AntiVir Personal - Free Antivirus
BitZipper 2010
Bonjour
ClocX (1.5b1)
Compatibility Pack for the 2007 Office system
D-Link DWA-131 Wireless N Nano USB Adapter
Dell Resource CD
Dell Support Center (Support Software)
Dell Webcam Center
Dell Webcam Manager
Dell Wireless WLAN Card
Dell WUSB
Facebook Plug-In
Free Audio CD Burner version 1.4
Free YouTube to MP3 Converter version 3.7
Graboid Video 1.73
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Live! Cam Avatar Creator
Live! Cam Avatar v1.0
Malwarebytes' Anti-Malware
MediaDirect
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Excel Viewer
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Modem Diagnostics Tool
Mozilla Firefox 4.0.1 (x86 en-GB)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
OutlookAddinSetup
PC Connectivity Solution
Pod to PC 2.6
Prevx
QuickSet
QuickTime
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
SAMSUNG Mobile Composite Device Software
Samsung Mobile Modem Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio
Samsung New PC Studio USB Driver Installer
SAMSUNG SYMBIAN USB Download Driver
SAMSUNG USB Mobile Device Software
SamsungConnectivityCableDriver
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2466156)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft Office Excel 2007 (KB2464583)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
SigmaTel Audio
Skype Toolbars
Skype™ 5.1
Spyware Doctor with AntiVirus 8.0
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office OneNote 2007 (KB980729)
VLC media player 1.0.1
Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
.
==== Event Viewer Messages From Past Week ========
.
21/05/2011 10:19:46 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: An instance of the service is already running.
21/05/2011 10:16:37 AM, Error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
20/05/2011 7:44:25 AM, Error: EventLog [6008] - The previous system shutdown at 9:38:28 PM on 19/05/2011 was unexpected.
20/05/2011 10:57:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
20/05/2011 10:40:46 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Remote Access Connection Manager service, but this action failed with the following error: An instance of the service is already running.
19/05/2011 6:06:49 PM, Error: Microsoft-Windows-WPD-MTPClassDriver [15300] - MTP WPD Driver has failed to start. Error 0x80070005.
18/05/2011 11:52:45 AM, Error: EventLog [6008] - The previous system shutdown at 11:49:33 AM on 18/05/2011 was unexpected.
18/05/2011 11:14:44 AM, Error: EventLog [6008] - The previous system shutdown at 5:52:26 AM on 18/05/2011 was unexpected.
17/05/2011 9:36:44 AM, Error: EventLog [6008] - The previous system shutdown at 12:51:01 AM on 17/05/2011 was unexpected.
16/05/2011 7:29:17 AM, Error: EventLog [6008] - The previous system shutdown at 4:16:57 AM on 16/05/2011 was unexpected.
16/05/2011 12:58:25 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
15/05/2011 11:44:32 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
15/05/2011 11:43:46 PM, Error: EventLog [6008] - The previous system shutdown at 11:42:30 PM on 15/05/2011 was unexpected.
15/05/2011 11:39:31 PM, Error: Microsoft-Windows-Windows Defender [2004] - Windows Defender has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x8050a001 Error description: The program can't find definition files that help detect unwanted software. Check for updates to the definition files, and then try again. For information on installing updates, see Help and Support. Signatures loading: Backup Loading signature version: 1.103.1349.0 Loading engine version: 1.1.6802.0
15/05/2011 11:35:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
15/05/2011 11:33:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
15/05/2011 11:30:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
15/05/2011 11:30:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
15/05/2011 11:29:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
15/05/2011 11:29:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
15/05/2011 11:29:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
15/05/2011 11:29:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
15/05/2011 11:29:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
15/05/2011 11:29:13 PM, Error: EventLog [6008] - The previous system shutdown at 11:27:17 PM on 15/05/2011 was unexpected.
15/05/2011 11:26:35 PM, Error: EventLog [6008] - The previous system shutdown at 11:25:28 PM on 15/05/2011 was unexpected.
15/05/2011 11:24:43 PM, Error: EventLog [6008] - The previous system shutdown at 11:23:37 PM on 15/05/2011 was unexpected.
.
==== End Of File ===========================


Thanks for the help!
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm
Advertisement
Register to Remove

Re: Google Search redirect Malware

Unread postby Alander » May 22nd, 2011, 2:06 am

Hello, I Am Alander :)

Welcome to the Malware Removal forums.

I would be glad to take a look at your log and help you with solving any malware problems.

DDS logs can take a while to research so please be patient while I work on your log and I will post back here with any recommendations.

As I am still training, everything that I post to you, must be checked by an Admin or Moderator.

Thus, there may be a tiny bit of a delay between posts. While it shouldn't be too long, you can be assured you will get the best possible advice.


  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 22nd, 2011, 6:37 am

Cheers Alander, I look forward to getting your help!
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Alander » May 22nd, 2011, 11:38 am

Hi
Remove P2P Programs

  • I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    uTorrent

  • Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.
  • Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

  • Click on Start > All programs > Accessories > Run.
  • In the open text box copy/paste appwiz.cpl Then click Ok.
  • Uninstall the programs listed above (in red) and any other P2P you have installed NOW.
  • Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Multiple Antivirus Programs
You are running more than 1 Antivirus program!

AVG 2011
Avira AntiVir Personal - Free Antivirus
Spyware Doctor with AntiVirus 8.0
Prevx

Running - more than one - antivirus program is not recommended because:
  1. They can conflict with each other.
  2. Report the other antivirus software as malicious.
  3. Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
  4. Can cause your computer to run slowly, become unstable and crash.
I strongly suggest you uninstall AVG 2011, because we may need to run a tool called ComboFix, ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus.
This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results".
Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.

I also strongly suggest you keep Avira AntiVir Personal - Free Antivirus, you can install AVG 2011 after your computer is clean again, but take note that only 1 Antivirus software should be on your computer at a time!

Please return with a new set of DDS logs after you complete the above procedures and restarted your machine[/quote]
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 22nd, 2011, 9:53 pm

Thanks for the advice - I'm at University for the day, but will get onto this tonight and post the new logs.
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Mourinho » May 23rd, 2011, 8:52 am

Hey alander, so I uninstalled AVG as well as Utorrent, and prevex. Here are the news logs, not sure if you wanted both but I included the Attach ones anyway.

Thanks

.
DDS (Ver_11-05-19.01) - NTFSx86
Internet Explorer: 7.0.6000.17037 BrowserJavaVersion: 1.6.0_22
Run by Harj Narulla at 22:50:15 on 2011-05-23
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.61.1033.18.3581.2140 [GMT 10:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\aestsrv.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\FsUsbExService.Exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\PC Tools Security\pctsAuxs.exe
C:\Program Files\PC Tools Security\pctsSvc.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\PC Tools Security\pctsGui.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\D-Link\DWA-131 revA\WlanWpsSvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Dell WUSB\WQ_Tray2.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Harj Narulla\Desktop\Anti virus\dds.scr
C:\Windows\system32\WSCRIPT.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uWinlogon: Shell=Explorer.exe, c:\program files\microsoft office\WINWORD.EXE
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [AutoStartNPSAgent] c:\program files\samsung\samsung new pc studio\NPSAgent.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [DELL Webcam Manager] "c:\program files\dell\dell webcam manager\DellWMgr.exe" /s
mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [NPSStartup]
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ISTray] "c:\program files\pc tools security\pctsGui.exe" /hideGUI
mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\program files\dell\quickset\quickset.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\ultraw~1.lnk - c:\program files\dell\dell wusb\WQ_Tray2.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wirele~1.lnk - c:\program files\d-link\dwa-131 reva\wirelesscm.exe
dPolicies-explorer: HideSCAHealth = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Free YouTube to Mp3 Converter - c:\users\harj narulla\appdata\roaming\dvdvideosoftiehelpers\youtubetomp3.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\harj narulla\appdata\roaming\mozilla\firefox\profiles\nrqpvciz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.unsw.edu.au/
FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\harj narulla\appdata\roaming\facebook\npfbplugin_1_0_3.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-5-20 239168]
R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-5-20 338880]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\drivers\RtlProt.sys [2010-7-1 25896]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2010-4-6 73728]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-5-21 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-21 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-21 61960]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-5-17 233472]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-5-20 366840]
R2 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-5-20 1150936]
R2 WlanWpsSvc;WlanWpsSvc;c:\program files\d-link\dwa-131 reva\WlanWpsSvc.exe [2010-7-1 167936]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-5-17 36608]
R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\drivers\RTL8192su.sys [2010-7-1 503808]
S3 DM9USB;DM9601 USB To Fast Ethernet Adapter;c:\windows\system32\drivers\dm9usb.sys [2010-7-2 54272]
S3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\dellsu~1\hwdiag\bin\PCD5SRVC.pkms [2008-11-5 22904]
S3 USB-100;Swann USB Fast Ethernet Adapter;c:\windows\system32\drivers\RTL8150.SYS [2010-5-2 22528]
.
=============== Created Last 30 ================
.
2011-05-21 00:48:03 -------- d-----w- c:\users\harj narulla\appdata\roaming\AVG10
2011-05-21 00:44:18 -------- d--h--w- c:\programdata\Common Files
2011-05-21 00:40:32 -------- d-----w- c:\programdata\AVG10
2011-05-21 00:39:37 -------- d-----w- c:\program files\AVG
2011-05-21 00:28:06 -------- d-----w- c:\programdata\MFAData
2011-05-20 23:34:52 -------- d-----w- c:\users\harj narulla\appdata\roaming\Avira
2011-05-20 23:14:06 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-20 23:13:53 -------- d-----w- c:\programdata\Avira
2011-05-20 23:13:53 -------- d-----w- c:\program files\Avira
2011-05-20 21:37:43 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-05-20 21:37:41 -------- d-----w- c:\program files\Prevx
2011-05-20 21:37:23 -------- d-----w- c:\programdata\PrevxCSI
2011-05-20 13:53:52 -------- d-----w- c:\users\harj narulla\appdata\roaming\Malwarebytes
2011-05-20 13:53:49 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-20 13:53:49 -------- d-----w- c:\programdata\Malwarebytes
2011-05-20 13:53:46 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-20 13:53:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-20 12:57:44 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys
2011-05-20 12:57:44 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys
2011-05-20 12:57:44 251560 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2011-05-20 12:57:44 103232 ----a-w- c:\windows\system32\drivers\pctwfpfilter.sys
2011-05-20 12:57:41 239168 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2011-05-20 12:57:41 160448 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2011-05-20 12:57:38 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2011-05-20 12:57:35 -------- d-----w- c:\users\harj narulla\appdata\roaming\PC Tools
2011-05-20 12:57:35 -------- d-----w- c:\program files\PC Tools Security
2011-05-20 12:57:35 -------- d-----w- c:\program files\common files\PC Tools
2011-05-20 12:53:15 -------- d-----w- c:\programdata\PC Tools
2011-05-19 07:06:57 -------- d-----w- c:\users\harj narulla\appdata\roaming\Jagao
2011-05-19 07:06:57 -------- d-----w- c:\users\harj narulla\appdata\roaming\Guit
2011-05-15 14:32:26 11264 ----a-w- c:\windows\DCEBoot.exe
2011-05-15 14:00:19 189520 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-05-15 13:41:52 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2011-05-15 13:41:52 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-05-15 13:41:52 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-05-15 13:41:52 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-05-15 13:41:52 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll
2011-05-15 13:41:52 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-05-15 13:41:52 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-05-15 13:41:51 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-05-15 13:39:31 7071056 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{01d78f15-512e-4028-897d-1b1e33554545}\mpengine.dll
2011-05-15 13:21:51 -------- d-----w- c:\programdata\oG02400IhPcB02400
.
==================== Find3M ====================
.
2011-03-26 12:19:43 472808 ----a-w- c:\windows\system32\deployJava1.dll
.





.

.
DDS (Ver_11-05-19.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 6/04/2010 7:44:07 PM
System Uptime: 23/05/2011 10:26:12 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0R387D
Processor: Intel(R) Core(TM)2 Duo CPU T9300 @ 2.50GHz | Microprocessor | 2501/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 295 GiB total, 106.861 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: Ethernet Controller
Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_022E1028&REV_12\4&1C4E7770&0&00E0
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_11AB&DEV_4354&SUBSYS_022E1028&REV_12\4&1C4E7770&0&00E0
Service:
.
Class GUID:
Description: Network Controller
Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_11208086&REV_61\4&2E66C02C&0&00E1
Manufacturer:
Name: Network Controller
PNP Device ID: PCI\VEN_8086&DEV_4229&SUBSYS_11208086&REV_61\4&2E66C02C&0&00E1
Service:
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.1
Advanced Audio FX Engine
Advanced Video FX Engine
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
BitZipper 2010
Bonjour
ClocX (1.5b1)
Compatibility Pack for the 2007 Office system
D-Link DWA-131 Wireless N Nano USB Adapter
Dell Resource CD
Dell Support Center (Support Software)
Dell Webcam Center
Dell Webcam Manager
Dell Wireless WLAN Card
Dell WUSB
Facebook Plug-In
Free Audio CD Burner version 1.4
Free YouTube to MP3 Converter version 3.7
Graboid Video 1.73
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Live! Cam Avatar Creator
Live! Cam Avatar v1.0
Malwarebytes' Anti-Malware
MediaDirect
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Excel Viewer
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Modem Diagnostics Tool
Mozilla Firefox 4.0.1 (x86 en-GB)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
OutlookAddinSetup
PC Connectivity Solution
Pod to PC 2.6
QuickSet
QuickTime
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
SAMSUNG Mobile Composite Device Software
Samsung Mobile Modem Device Software
SAMSUNG Mobile Modem Driver Set
Samsung Mobile phone USB driver Software
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio
Samsung New PC Studio USB Driver Installer
SAMSUNG SYMBIAN USB Download Driver
SAMSUNG USB Mobile Device Software
SamsungConnectivityCableDriver
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2466156)
Security Update for 2007 Microsoft Office System (KB2509488)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for Microsoft Office Excel 2007 (KB2464583)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
SigmaTel Audio
Skype Toolbars
Skype™ 5.1
Spyware Doctor with AntiVirus 8.0
Uninstall 1.0.0.1
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office OneNote 2007 (KB980729)
VLC media player 1.0.1
Windows Driver Package - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
.
==== Event Viewer Messages From Past Week ========
.
23/05/2011 10:50:22 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error: An instance of the service is already running.
23/05/2011 10:50:22 PM, Error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service has not been started.
23/05/2011 10:02:59 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgfws service.
21/05/2011 7:33:25 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
21/05/2011 6:11:32 PM, Error: Service Control Manager [7031] - The CSIScanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.
21/05/2011 10:19:46 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: An instance of the service is already running.
21/05/2011 10:16:37 AM, Error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
20/05/2011 7:44:25 AM, Error: EventLog [6008] - The previous system shutdown at 9:38:28 PM on 19/05/2011 was unexpected.
20/05/2011 10:57:36 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
20/05/2011 10:52:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
20/05/2011 10:51:39 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
20/05/2011 10:51:24 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
20/05/2011 10:51:23 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
20/05/2011 10:51:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
20/05/2011 10:40:46 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Remote Access Connection Manager service, but this action failed with the following error: An instance of the service is already running.
19/05/2011 6:06:49 PM, Error: Microsoft-Windows-WPD-MTPClassDriver [15300] - MTP WPD Driver has failed to start. Error 0x80070005.
18/05/2011 11:52:45 AM, Error: EventLog [6008] - The previous system shutdown at 11:49:33 AM on 18/05/2011 was unexpected.
18/05/2011 11:14:44 AM, Error: EventLog [6008] - The previous system shutdown at 5:52:26 AM on 18/05/2011 was unexpected.
17/05/2011 9:36:44 AM, Error: EventLog [6008] - The previous system shutdown at 12:51:01 AM on 17/05/2011 was unexpected.
16/05/2011 7:29:17 AM, Error: EventLog [6008] - The previous system shutdown at 4:16:57 AM on 16/05/2011 was unexpected.
16/05/2011 12:58:25 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
16/05/2011 12:36:05 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
.
==== End Of File ===========================
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Alander » May 24th, 2011, 8:37 am

Hi

  • Please download this tool from Microsoft.
  • Right click on MGADiag.exe and select Run As Administrator to run it.
  • Click Continue.
  • The program will run. It takes a while to finish the diagnosis, please be patient.
  • Once done, click on Copy.
  • Open Notepad and paste the contents in the window.
  • Save this file and copy/paste it in your next reply.

Please download GMER Rootkit Scanner from Here.
  • Right click the .exe file and chose Run as Administrator. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All << (don't miss this one)
    See image below, Click the image to enlarge it
    Image

  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
  • Save it where you can easily find it, such as your desktop, and post it in your next reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Note: Do not run any programs while Gmer is running.
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 24th, 2011, 9:23 am

Below are the texts for the microsoft tool first, and second the rootkit scan.

thanks

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Online Validation Code: N/A, hr = 0x80004005
Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2
Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=
Windows Product ID: 89578-OEM-7332157-00204
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.0.6000.2.00010300.0.0.003
ID: {8F4C8483-9802-42E7-B3DF-B1CBCCEEE95D}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows Vista (TM) Home Premium
Architecture: 0x00000000
Build lab: 6000.vista_gdr.100218-0019
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{8F4C8483-9802-42E7-B3DF-B1CBCCEEE95D}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-B9HD2</PKey><PID>89578-OEM-7332157-00204</PID><PIDType>2</PIDType><SID>S-1-5-21-3121467736-1160523801-210012447</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>XPS M1530 </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="4"/><Date>20080124000000.000000+000</Date></BIOS><HWID>F8323507010000F8</HWID><UserLCID>0C09</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>AUS Eastern Standard Time(GMT+10:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>M08 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>DB01D286C7C732</Val><Hash>8FaxLzkB6MznHy1EsmC5/RMO/C4=</Hash><Pid>81602-921-5037364-68351</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.0.6000.16386
Name: Windows(TM) Vista, HomePremium edition
Description: Windows Operating System - Vista, OEM_SLP channel
Activation ID: bffdc375-bbd5-499d-8ef1-4f37b61c895f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 89578-00146-321-500204-02-3081-6000.0000-0962010
Installation ID: 013170247831327802032953119213306906362441067042232474
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57201
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57203
Use License URL: http://go.microsoft.com/fwlink/?LinkId=57205
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkId=57204
Partial Product Key: B9HD2
License Status: Licensed

Windows Activation Technologies-->
N/A

HWID Data-->
HWID Hash Current: PAAAAAEABwABAAEAAQABAAAAAwABAAEA6GFKBxaWEnlOapp6HrMyD0aDBgx47b598vTuEee/rFZzRUbK

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20000
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL M08
FACP DELL M08
HPET DELL M08
BOOT DELL M08
MCFG DELL M08
SLIC DELL M08
OSFR DELL M08
SSDT PmRef CpuPm


GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-24 23:17:57
Windows 6.0.6000 Harddisk0\DR0 -> \Device\Ide\IdePort1 WDC_WD3200BEVT-00ZAT0 rev.01.01A01
Running: w9tewd8e.exe; Driver: C:\Users\HARJNA~1\AppData\Local\Temp\awtyauob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwAssignProcessToJobObject [0x8FE97AF0]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x80710F68]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x80711230]
SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwCreateThread [0x8FE97B40]
SSDT 8FE3DF78 ZwOpenProcess
SSDT 8FE3DF7D ZwOpenThread
SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwProtectVirtualMemory [0x8FE97BE0]
SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwSetContextThread [0x8FE97AA0]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x807109D8]
SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwTerminateThread [0x8FE97C80]
SSDT \SystemRoot\System32\drivers\pxrts.sys (Prevx Realtime Security/Prevx) ZwWriteVirtualMemory [0x8FE98000]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x8071152C]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp pxrts.sys (Prevx Realtime Security/Prevx)

Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
Device \Driver\BTHUSB \Device\00000075 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000075 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000077 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000077 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Processes - GMER 1.0.15 ----

Process (*** hidden *** ) -2111173672
Process (*** hidden *** ) -2069602120
Process (*** hidden *** ) -2069549568
Process (*** hidden *** ) -2069526920
Process (*** hidden *** ) -2069501600
Process (*** hidden *** ) -2069352264
Process (*** hidden *** ) -2069248648
Process (*** hidden *** ) -2069218976
Process (*** hidden *** ) -2068759040
Process (*** hidden *** ) -2068554240
Process (*** hidden *** ) -2068457120
Process (*** hidden *** ) -2068431360
Process (*** hidden *** ) -2067786032
Process (*** hidden *** ) -2067526144
Process (*** hidden *** ) -2067091272
Process (*** hidden *** ) -2066766168
Process (*** hidden *** ) -2066187936
Process (*** hidden *** ) -2066166272
Process (*** hidden *** ) -2065741384
Process (*** hidden *** ) -2065458848
Process (*** hidden *** ) -2065332880
Process (*** hidden *** ) -2065278624
Process (*** hidden *** ) -2065220704
Process (*** hidden *** ) -2064339456
Process (*** hidden *** ) -2064326472
Process (*** hidden *** ) -2064195400
Process (*** hidden *** ) -2063839744
Process (*** hidden *** ) -2062788064
Process (*** hidden *** ) -2062635520
Process (*** hidden *** ) -2062352896
Process (*** hidden *** ) -2060473576
Process (*** hidden *** ) -2059733640
Process (*** hidden *** ) -2059359984
Process (*** hidden *** ) -2057750840
Process (*** hidden *** ) -2057394912
Process (*** hidden *** ) -2057192976
Process (*** hidden *** ) -2053979976
Process (*** hidden *** ) -2053247656
Process (*** hidden *** ) -2052993704
Process (*** hidden *** ) -2052982704
Process (*** hidden *** ) -2052652872
Process (*** hidden *** ) -2052633088
Process (*** hidden *** ) -2052547072
Process (*** hidden *** ) -2052480840
Process (*** hidden *** ) -2052235080
Process (*** hidden *** ) -2051518280
Process (*** hidden *** ) -2051039048
Process (*** hidden *** ) -2050657720
Process (*** hidden *** ) -2050603672
Process (*** hidden *** ) -2050269000
Process (*** hidden *** ) -2049237504
Process (*** hidden *** ) -2049160776
Process (*** hidden *** ) -2048043440
Process (*** hidden *** ) -2047776328
Process (*** hidden *** ) -2047764128
Process (*** hidden *** ) -2047571784
Process (*** hidden *** ) -2047217480
Process (*** hidden *** ) -2047129248
Process (*** hidden *** ) -2047122064
Process (*** hidden *** ) -2047052368
Process (*** hidden *** ) -2046799520
Process (*** hidden *** ) -2046384872
Process (*** hidden *** ) -2046172480
Process (*** hidden *** ) -2045486928
Process (*** hidden *** ) -2045326040
Process (*** hidden *** ) -2045307632
Process (*** hidden *** ) -2044746840
Process (*** hidden *** ) -2043735536
Process (*** hidden *** ) -2040537600
Process (*** hidden *** ) -2032940448
Process (*** hidden *** ) -2032465080
Process (*** hidden *** ) -2032464384
Process (*** hidden *** ) -2025256680
Process (*** hidden *** ) -2023729248
Process (*** hidden *** ) -2023460680
Process (*** hidden *** ) -2023447176
Process (*** hidden *** ) -2023446088
Process (*** hidden *** ) -2019264160
Process (*** hidden *** ) -2016003656
Process (*** hidden *** ) -2015929544
Process (*** hidden *** ) -2015828200
Process (*** hidden *** ) -2015353576
Process (*** hidden *** ) -2015058016
Process (*** hidden *** ) -2014888552
Process (*** hidden *** ) -2014761472
Process (*** hidden *** ) -2013776528
Process (*** hidden *** ) -2013621800
Process (*** hidden *** ) -2012544840
Process (*** hidden *** ) -2012487088
Process (*** hidden *** ) -2010653184
Process (*** hidden *** ) -2010182656
Process (*** hidden *** ) -2010173256
Process (*** hidden *** ) -2009837384
Process (*** hidden *** ) -2009835448
Process (*** hidden *** ) -2009801216
Process (*** hidden *** ) -2009780736
Process (*** hidden *** ) -2009510400
Process (*** hidden *** ) -2009358152
Process (*** hidden *** ) -2009310880
Process (*** hidden *** ) -2009128704
Process (*** hidden *** ) -2009072128
Process (*** hidden *** ) -2008634408
Process (*** hidden *** ) -2008273744
Process (*** hidden *** ) -2007453512
Process (*** hidden *** ) -2007447112
Process (*** hidden *** ) -2007296536
Process (*** hidden *** ) -2007109448
Process (*** hidden *** ) -2007101256
Process (*** hidden *** ) -2006713776
Process (*** hidden *** ) -2006676848
Process (*** hidden *** ) -2006267464
Process (*** hidden *** ) -2006237696
Process (*** hidden *** ) -2006157392
Process (*** hidden *** ) -2006115880
Process (*** hidden *** ) -2005909320
Process (*** hidden *** ) -2005711504
Process (*** hidden *** ) -2005580416
Process (*** hidden *** ) -2005557760
Process (*** hidden *** ) -2005464648
Process (*** hidden *** ) -2005062144
Process (*** hidden *** ) -2005058048
Process (*** hidden *** ) -2004883936
Process (*** hidden *** ) -2004873728
Process (*** hidden *** ) -2004860744
Process (*** hidden *** ) -2004738960
Process (*** hidden *** ) -2004715800
Process (*** hidden *** ) -2004714312
Process (*** hidden *** ) -2004464512
Process (*** hidden *** ) -2003716752
Process (*** hidden *** ) -2003546624
Process (*** hidden *** ) -2002813440
Process (*** hidden *** ) -2002637472
Process (*** hidden *** ) -2002430608
Process (*** hidden *** ) -2002222920
Process (*** hidden *** ) -2000661736
Process (*** hidden *** ) -1993025184
Process (*** hidden *** ) -1990150464
Process (*** hidden *** ) -1988050392
Process (*** hidden *** ) -1983721288
Process (*** hidden *** ) -1979982336

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001f3ae1a052
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001f3ae1a052 (not active ControlSet)

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Alander » May 24th, 2011, 1:41 pm

Please uninstall Spyware Doctor with AntiVirus 8.0, you have missed it out.

Rootkit Warning
Your computer has multiple infections, including a rootkit.
A rootkit is a set of software tools intended for concealing running processes, files or system data from the operating system.

You are strongly advised to do the following:
  1. Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  2. Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts.
    If you don't mind the hassle, change all your account numbers.
  3. From a clean computer, change all your passwords
    (Internet login, your email address(es), financial accounts, PayPal, eBay, Amazon...any online activities you carry out which require a username and password).
    Do NOT change your passwords from this computer, the attacker can still get all the new passwords and transaction records.
  4. Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.

Due to its rootkit functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again.
Many experts in the security community believe that once infected with this type of trojan, the best course of action would be to do a reformat and re-installation of the operating system (OS).
This decision will have to be made by you on whether you want to clean it or not...

To help you understand more, please take some time to read the following articles:
When should I re-format and reinstall my OS
What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
How and Where to backup your files
Restoring your backups

Please let me know how you wish to proceed.
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Alander » May 26th, 2011, 2:06 pm

3 Day Response
Hi.
It has been 2 days since my last post to you.
  • Do you still need help with this problem?
  • Do you need more time?
  • Are you having problems understanding or following my instructions?
Just let me know what's going on otherwise...
After 24 hrs., if you have not replied to this thread... it will be closed!
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 26th, 2011, 8:34 pm

Hey, thanks for the feedback. I'm interested in trying to clean my computer up as much as possible, but i'm not opposed to reformatting, however I'm not sure if i have all the required discs to do so? I've changed my passwords etc. and am attempting to backup my files on an external harddrive but i'm having problems with the computer not recognising it when i plug it it.

So i'm thinking - could we attempt to clear the computer from whatever is on it, then reformat if need be?

thanks
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Alander » May 27th, 2011, 3:15 pm

Hi, we shall attempt to clean your machine, please follow instructions closely, this will take a while and take note of the 3 days rule

Step 1.
aswMBR - Scan

Please download aswMBR.exe ... © Avast Software ( 511KB ). Save it to your desktop.
  1. Double click the aswMBR.exe to run it
  2. Click the "Scan" button to start the scan.
  3. On completion of the scan, "Scan finished successfully" press the "Save log" button.
  4. You'll be prompted to save a file named "aswMBR.txt"... Save it to your desktop.
  5. Please copy and paste the contents of aswMBR.txt in your next reply.
Note: A file will be created and placed on your desktop when you execute aswMBR, named MBR.dat... this is a copy of your MBR record, before we make changes, it can be used to recover the MBR record to it's previous condition, if problems exist after changes.

Step 2.
ESET NOD32 Online Scan
Vista - W7 users: You will need to to right-click on the IE or FF icons on the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.
Note: If using Mozilla Firefox you will need to download "esetsmartinstaller_enu.exe" when prompted... then double click on it to install.
Please temporarily disable your Anti-virus real-time protection. If active, it could impact the online scan.
Please go to ESET Online Scanner - © ESET All Rights Reserved... to run an online scan.
** Make sure you are using an account that has Administrative privileges **
    Press the "ESET Online Scanner" button.
  1. Check the box next to "YES, I accept the Terms of Use."
  2. Click "Start"... a window will open... it may appear nothing is happening... please be patient.
  3. Click Yes... at the run ActiveX prompt. Click Install... at the install ActiveX prompt.
    Once installed, the scanner will be initialized.
  4. Click "Start". Make sure that the options:
    • Remove found threats is UNCHECKED
    • Leave the "default" settings under Advanced as they are, if not set , please check:
      • Scan for potentially unwanted applications
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth Technology
  5. Click "Start"... ESET scanner will begin to download the virus signatures database.
    When the signatures have been downloaded, the scan will start automatically.
  6. Wait for the scan to finish... it may take a while... please be patient. When the scan is finished...
  7. Use Notepad to open the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt
  8. Copy and paste the contents of log.txt in your next reply.
Remember to enable your Anti-virus protection... before continuing!


Step 3.
Scan with DDS Again
Please disable any anti-malware program that will block scripts from running before running DDS.

  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    • DDS.txt
    • Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply


Please include in your next reply:
  1. Any problem executing the instructions?
  2. aswMBR.txt from step1
  3. log.txt from step2
  4. DDS.txt & Attach.txt from step 3
  5. How is the computer behaving?

with each log file in a seperate post so that the logs wont be cut off due to the length
Thanks
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 27th, 2011, 10:58 pm

Hey Alander, So i've experienced some sort of crash - I was using skype and basically the computer shut itself down, and has rebooted with half of the icons missing from the desktop, and the remaining ones are kinda see-through which is odd. There are only a few things in the start menu. When i tired to run your above mentioned program, it comes up with 'application cannot be found' - as is the case when i try to run most programs.

I've backed up my most important files, but am wondering what to do!

thanks
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm

Re: Google Search redirect Malware

Unread postby Alander » May 29th, 2011, 12:56 am

Mourinho wrote:Hey Alander, So i've experienced some sort of crash - I was using skype and basically the computer shut itself down, and has rebooted with half of the icons missing from the desktop, and the remaining ones are kinda see-through which is odd. There are only a few things in the start menu. When i tired to run your above mentioned program, it comes up with 'application cannot be found' - as is the case when i try to run most programs.

I've backed up my most important files, but am wondering what to do!

thanks


Hi, don't worry, I will try my best to help you clean your computer

Step 1.
aswMBR - Download and run in safe mode

Please download aswMBR.exe ... © Avast Software ( 511KB ) again.
Note: You must rename it before saving it... Rename it: askyRMB.exe.
Save it to your desktop.

Step 2.
Boot into Safe Mode

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.

Once you are in the desktop of your account in safe mode...
Step 3.
  1. Double click the askyRMB.exe to run it
  2. Click the "Scan" button to start the scan.
  3. On completion of the scan, "Scan finished successfully" press the "Save log" button.
  4. You'll be prompted to save a file named "aswMBR.txt"... Save it to your desktop.
  5. Please copy and paste the contents of aswMBR.txt in your next reply.
Note: A file will be created and placed on your desktop when you execute aswMBR, named MBR.dat... this is a copy of your MBR record, before we make changes, it can be used to recover the MBR record to it's previous condition, if problems exist after changes.
User avatar
Alander
Regular Member
 
Posts: 1603
Joined: September 15th, 2007, 2:04 pm
Location: Singapore

Re: Google Search redirect Malware

Unread postby Mourinho » May 29th, 2011, 5:41 am

Hey, here is the scan log

aswMBR version 0.9.5.317 Copyright(c) 2011 AVAST Software
Run date: 2011-05-29 19:29:23
-----------------------------
19:29:23.910 OS Version: Windows 6.0.6000
19:29:23.910 Number of processors: 2 586 0x1706
19:29:23.910 ComputerName: HARJNARULLA-PC UserName: Harj Narulla
19:29:42.677 Initialize success
19:29:49.588 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2
19:29:49.588 Disk 0 Vendor: WDC_WD3200BEVT-00ZAT0 01.01A01 Size: 305245MB BusType: 3
19:29:51.647 Disk 0 MBR read successfully
19:29:51.647 Disk 0 MBR scan
19:29:51.647 Disk 0 TDL4@MBR code has been found
19:29:51.647 Disk 0 MBR hidden
19:29:51.647 Disk 0 MBR [TDL4] **ROOTKIT**
19:29:51.647 Disk 0 trace - called modules:
19:29:51.647 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys >>UNKNOWN [0x8537e4d0]<<
19:29:51.678 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x852b8030]
19:29:51.678 3 ntkrnlpa.exe[81cb07e2] -> nt!IofCallDriver -> [0x8529f020]
19:29:51.678 5 PCTCore.sys[80714099] -> nt!IofCallDriver -> [0x852bbbb0]
19:29:51.678 \Driver\atapi[0x8536ef38] -> IRP_MJ_CREATE -> 0x8537e4d0
19:29:59.244 Unsigned kernel modules:
19:29:59.307 0x80612000 C:\Windows\system32\drivers\volsnap.sys
19:30:07.403 Scan finished successfully
19:30:39.524 Disk 0 MBR has been saved successfully to "C:\Users\Harj Narulla\Desktop\MBR.dat"
19:30:39.539 The log file has been saved successfully to "C:\Users\Harj Narulla\Desktop\aswMBR.txt"


thanks
Mourinho
Member+
 
Posts: 8
Joined: May 20th, 2011, 9:01 pm
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 323 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware