google.com is getting automatically shifted to google.de and if I try to open gmail.com then I am getting "Connection is untrusted" error..
Date n time on my computer is upto date..I used Malwarebytes to remove the malware and it has removed much of it but not all of it..there are still one remaiining
MalwareBytes LOG:
Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
12/9/2009 11:18:33 AM
mbam-log-2009-12-09 (11-18-33).txt
Scan type: Full Scan (C:\|)
Objects scanned: 304567
Time elapsed: 47 minute(s), 45 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\disableconfig (Windows.Tool.Disabled) -> Delete on reboot.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
but this DISABLECONFIG seems to be the problem as it is the only malware getting detected now and even if I reboot its not getting deleted
while doing a scan using HijackThis..I got two warnings..
HiJackThis logfile is as follows:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:49:07 AM, on 12/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Timbuktu Pro\tb2launch.exe
C:\Program Files\Timbuktu Pro\TimbuktuRemoteConsole.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Timbuktu Pro\Tb2Logon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Timbuktu Pro\tb2pro.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClientUI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Timbuktu Pro\TNOTIFY.EXE
C:\Documents and Settings\mrkassistant\My Documents\Downloads\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fullerton.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 http://www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 http://www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 http://www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 88.198.247.66 google.ae
O1 - Hosts: 88.198.247.66 google.as
O1 - Hosts: 88.198.247.66 google.at
O1 - Hosts: 88.198.247.66 google.az
O1 - Hosts: 88.198.247.66 google.ba
O1 - Hosts: 88.198.247.66 google.be
O1 - Hosts: 88.198.247.66 google.bg
O1 - Hosts: 88.198.247.66 google.bs
O1 - Hosts: 88.198.247.66 google.ca
O1 - Hosts: 88.198.247.66 google.cd
O1 - Hosts: 88.198.247.66 google.com.gh
O1 - Hosts: 88.198.247.66 google.com.hk
O1 - Hosts: 88.198.247.66 google.com.jm
O1 - Hosts: 88.198.247.66 google.com.mx
O1 - Hosts: 88.198.247.66 google.com.my
O1 - Hosts: 88.198.247.66 google.com.na
O1 - Hosts: 88.198.247.66 google.com.nf
O1 - Hosts: 88.198.247.66 google.com.ng
O1 - Hosts: 88.198.247.66 google.ch
O1 - Hosts: 88.198.247.66 google.com.np
O1 - Hosts: 88.198.247.66 google.com.pr
O1 - Hosts: 88.198.247.66 google.com.qa
O1 - Hosts: 88.198.247.66 google.com.sg
O1 - Hosts: 88.198.247.66 google.com.tj
O1 - Hosts: 88.198.247.66 google.com.tw
O1 - Hosts: 88.198.247.66 google.dj
O1 - Hosts: 88.198.247.66 google.de
O1 - Hosts: 88.198.247.66 google.dk
O1 - Hosts: 88.198.247.66 google.dm
O1 - Hosts: 88.198.247.66 google.ee
O1 - Hosts: 88.198.247.66 google.fi
O1 - Hosts: 88.198.247.66 google.fm
O1 - Hosts: 88.198.247.66 google.fr
O1 - Hosts: 88.198.247.66 google.ge
O1 - Hosts: 88.198.247.66 google.gg
O1 - Hosts: 88.198.247.66 google.gm
O1 - Hosts: 88.198.247.66 google.gr
O1 - Hosts: 88.198.247.66 google.ht
O1 - Hosts: 88.198.247.66 google.ie
O1 - Hosts: 88.198.247.66 google.im
O1 - Hosts: 88.198.247.66 google.in
O1 - Hosts: 88.198.247.66 google.it
O1 - Hosts: 88.198.247.66 google.ki
O1 - Hosts: 88.198.247.66 google.la
O1 - Hosts: 88.198.247.66 google.li
O1 - Hosts: 88.198.247.66 google.lv
O1 - Hosts: 88.198.247.66 google.ma
O1 - Hosts: 88.198.247.66 google.ms
O1 - Hosts: 88.198.247.66 google.mu
O1 - Hosts: 88.198.247.66 google.mw
O1 - Hosts: 88.198.247.66 google.nl
O1 - Hosts: 88.198.247.66 google.no
O1 - Hosts: 88.198.247.66 google.nr
O1 - Hosts: 88.198.247.66 google.nu
O1 - Hosts: 88.198.247.66 google.pl
O1 - Hosts: 88.198.247.66 google.pn
O1 - Hosts: 88.198.247.66 google.pt
O1 - Hosts: 88.198.247.66 google.ro
O1 - Hosts: 88.198.247.66 google.ru
O1 - Hosts: 88.198.247.66 google.rw
O1 - Hosts: 88.198.247.66 google.sc
O1 - Hosts: 88.198.247.66 google.se
O1 - Hosts: 88.198.247.66 google.sh
O1 - Hosts: 88.198.247.66 google.si
O1 - Hosts: 88.198.247.66 google.sm
O1 - Hosts: 88.198.247.66 google.sn
O1 - Hosts: 88.198.247.66 google.st
O1 - Hosts: 88.198.247.66 google.tl
O1 - Hosts: 88.198.247.66 google.tm
O1 - Hosts: 88.198.247.66 google.tt
O1 - Hosts: 88.198.247.66 google.us
O1 - Hosts: 88.198.247.66 google.vu
O1 - Hosts: 88.198.247.66 google.ws
O1 - Hosts: 88.198.247.66 google.co.ck
O1 - Hosts: 88.198.247.66 google.co.id
O1 - Hosts: 88.198.247.66 google.co.il
O1 - Hosts: 88.198.247.66 google.co.in
O1 - Hosts: 88.198.247.66 google.co.jp
O1 - Hosts: 88.198.247.66 google.co.kr
O1 - Hosts: 88.198.247.66 google.co.ls
O1 - Hosts: 88.198.247.66 google.co.ma
O1 - Hosts: 88.198.247.66 google.co.nz
O1 - Hosts: 88.198.247.66 google.co.tz
O1 - Hosts: 88.198.247.66 google.co.ug
O1 - Hosts: 88.198.247.66 google.co.uk
O1 - Hosts: 88.198.247.66 google.co.za
O1 - Hosts: 88.198.247.66 google.co.zm
O1 - Hosts: 88.198.247.66 google.com
O1 - Hosts: 88.198.247.66 google.com.af
O1 - Hosts: 88.198.247.66 google.com.ag
O1 - Hosts: 88.198.247.66 google.com.ar
O1 - Hosts: 88.198.247.66 google.com.au
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TLogonPath] "C:\Program Files\Timbuktu Pro\Tb2Logon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mkumuf] rundll32.exe "C:\WINDOWS\unokijirazohit.dll",Startup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03A89EFD-E023-9000-A22D-45F77558EB4C} (ILINCInstall9 Class) - https://content9.ilinc.com/download/AXCltInstall.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2451130359
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 7778105946
O16 - DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} (VodClient Control Class) - http://www.tvucricket.com/player/vjocx-en-black.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AD.FULLERTON.EDU
O17 - HKLM\Software\..\Telephony: DomainName = AD.FULLERTON.EDU
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AD.FULLERTON.EDU
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = fullerton.edu,ad.fullerton.edu
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = fullerton.edu,ad.fullerton.edu
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Tb2 Launch (Tb2Launch) - Netopia, Inc. - C:\Program Files\Timbuktu Pro\tb2launch.exe
--
End of file - 13667 bytes
