Good Evening,
it seems my pc has been infected by the google redirect virus. This started about 2 days ago with, what I thought was a malware issue. I kept receiving pop ups from Security Essentials 2010 saying i had infections and needed to buy & download their antivirus, and it would not let me access the Internet at all. I immediately suspected spyware & ran malwarebytes, which I already had downloaded months ago. It seemed to work & successfully remove the pop ups. However my computer is extremely slow and Internet explorer redirects to sites such as tazinga.com and stopzilla.com. I am able to access my task manager however I can't find the lurking culprit and myantivirus must be dead. I tried rerunning malwarebytes but it hasn't found any infections. I have hijackthis but I don't know what I'm looking at & without the Internet to post it online, it's of little help. I need any help I can get, I understand this is difficult though without Internet access on the infected computer!
Thanks for your time ,
Sarah

Hello see if this gets the connection back.
++
Try this--open control, internet options, connections tab, lan settings, uncheck the box next to "use proxy...."
OR
Go to Start ... Run and type in cmd
A dos Window will appear.
Type in the dos window: netsh winsock reset
Click on the enter key.

If so Run RKILL then update and rerun MABm and post a log.

If not you'll need to copy SAS to a usb or CD and run from there.

RKill....

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4


• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  
• If nothing happens or if the tool does not run, please let me know in your next reply

Do not reboot your computer after running rkill as the malware programs will start again.

^^

If you get an alert that Rkill is "infected", ignore it. The alert is just a fake warning given by the rogue software which tries to terminate programs that try to remove it. If you see such a warning, leave the warning on the screen and then run Rkill again. By not closing the warning, this sometimes allows you to bypass the malware's attempt to protect itself so that Rkill can perform its routine.


Download and scan with SUPERAntiSpyware Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
• In the Main Menu, click the Preferences... button.
• Click the Scanning Control tab.
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan.
• Click "Next" to start the scan. Please be patient while it scans your computer.
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes".
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.

Thank you for all your assistance! Before you had replied I managed to get back internet acces by deleting a file in my All Programs>Startup that was titled zipgaz32? I couldn't find any information on it online really so I deleted it. This at least allowed me internet access however my computer was very slow. I ran rkill and Superantispy, and have posted the log below.

-Also, after running SAS I'm still being redirected on internet explorer to other strange websites (toseeka.com, europeancakes.com, etc.)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/18/2010 at 08:45 PM

Application Version : 4.37.1000

Core Rules Database Version : 4952
Trace Rules Database Version: 2764

Scan type : Complete Scan
Total Scan Time : 03:33:12

Memory items scanned : 802
Memory threats detected : 0
Registry items scanned : 7297
Registry threats detected : 0
File items scanned : 176276
File threats detected : 270

Adware.Tracking Cookie
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@apmebf[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@stopzilla[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@www.stopzilla[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@bs.serving-sys[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@advertise[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@atdmt[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@revsci[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@counter.surfcounters[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ads.bleepingcomputer[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@avgtechnologies.112.2o7[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@admarketplace[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@serving-sys[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@mediaplex[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@bridge2.admarketplace[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@ad.yieldmanager[2].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@bizzclick[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@content.yieldmanager[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@doubleclick[1].txt
C:\Documents and Settings\HP_Administrator\Cookies\hp_administrator@collective-media[1].txt
.247realmedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.247realmedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adbrite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adinterax.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adinterax.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adopt.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adopt.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adopt.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adopt.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.ads.pointroll.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adserver.adtechus.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultadworld.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultfriendfinder.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultfriendfinder.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultfriendfinder.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultfriendfinder.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.adultfriendfinder.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.atdmt.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.axxessads.valuead.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.axxessads.valuead.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.axxessads.valuead.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.axxessads.valuead.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.axxessads.valuead.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.azjmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.azjmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.azjmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.beporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.beporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.bs.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.collective-media.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.collective-media.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.collective-media.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.collective-media.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.crackle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.crackle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.crackle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.crackle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz11.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz11.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz5.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz5.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz6.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz6.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz6.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.cz6.clickzs.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.enhance.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.enhance.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.free.porndirt.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.free.porndirt.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.freeporn.hu [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.freeporn.hu [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.hornyandhappy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.hornyandhappy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.hornyandhappy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.hornystyle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.hornystyle.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.humornsex.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.humornsex.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.imrworldwide.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.imrworldwide.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.insightexpressai.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.interclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.justsexyvideos.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.justsexyvideos.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.maxporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.maxporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.media6degrees.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.myroitracking.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.nakedonthestreets.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.nakedonthestreets.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.nonkporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.nonkporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.novoporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.novoporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.novoporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.overture.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.overture.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.overture.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.paypal.112.2o7.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornforwomen.thumblogger.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornforwomen.thumblogger.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornhub.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornhub.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornvisit.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.pornvisit.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.questionmarket.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.questionmarket.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.richmedia.yahoo.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serv.clicksor.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.serving-sys.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexy-babes.tv [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexy-babes.tv [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexy-babes.tv [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexykittenporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexykittenporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.sexykittenporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.thesexblog.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.thesexblog.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.track.bestbuy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.track.bestbuy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.track.bestbuy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.track.bestbuy.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.tracking.vindicosuite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.tracking.vindicosuite.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.trafficmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.trafficmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.trafficmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.trafficmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.trafficmp.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.twobleepers.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.twobleepers.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.viacom.adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.viacom.adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.viacom.adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.viacom.adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.viacom.adbureau.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
.www.beporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
1xxx.cqcounter.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad.yieldmanager.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad1.clickhype.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ad2.clickhype.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ads.crakmedia.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ads.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ads.revsci.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ads2.blastro.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
ads3.blastro.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
adserv01.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
audit.median.hu [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
clicks.adengage.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
eas.apm.emediate.eu [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
eas.apm.emediate.eu [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
media.ntsserve.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
media.ntsserve.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
optimize.indieclick.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
pornforwomen.thumblogger.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
promo.adultemart.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
promo.adultemart.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
promo.adultemart.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
promo.adultemart.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
rotator.adjuggler.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
rotator.adjuggler.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
rotator.adjuggler.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
server.iad.liveperson.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
server.iad.liveperson.net [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
tour.sexsearchcom.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
tracking.the7thchamber.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
wt.sexsearch.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.burstbeacon.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.clickr.us [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.diabloadult.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.everythingfreeporn.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.mediaigniter.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.pornhub.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.sexyblast.com [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.usenext.de [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www.usenext.de [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
www3.clickr.info [ C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\tt38bf0q.default\cookies.txt ]
C:\WINDOWS\Temp\Cookies\hp_administrator@4.adbrite[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@adbrite[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@adrevolver[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@advertising[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@anad.tacoda[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@atdmt[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@casalemedia[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@doubleclick[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@fastclick[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@insightexpressai[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@media.adrevolver[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@media.adrevolver[3].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@mywebsearch[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@richmedia.yahoo[1].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@specificclick[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@tacoda[2].txt
C:\WINDOWS\Temp\Cookies\hp_administrator@zedo[1].txt

Trojan.RootKit/Gen
C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\DX6CAQWB\EXE[1].EXE
C:\WINDOWS\SYSTEM32\14771.EXE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\UNS18Z0T\EXE[1].EXE
C:\WINDOWS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\66FRTK05\EXE[1].EXE
C:\WINDOWS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\B5MTRUHQ\EXE[1].EXE

Hello Sarah.. I see you are being bombarded,but we are making progress.

Next run TFC by OT to clear the Temp infections..
Please download TFC by Old Timer and save it to your desktop.
alternate download link

Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware (v1.46) and save it to your desktop.

alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

• If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to Common Issues, Questions, and their Solutions, Frequently Asked Questions. If the error you are receiving is not in the list, please report it here so the research team can investigate.

• Some types of malware will target Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in For those having trouble running Malwarebytes Anti-Malware.

How is it now?

Ran the TFC and rebooted. Also ran the quick scan, 0 items found, I attached the MBAM log below. However, first site I tried on IE redirected me to Tazinga.com after doing a google search. Another pop-up has started lurking as well called Just-in-time debugging? I've noticed through search, that others who have this have visual studio installed which I do not. Is this something else out to get me!? Also, google chrome will not even open...

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

5/19/2010 12:18:19 AM
mbam-log-2010-05-19 (00-18-19).txt

Scan type: Quick scan
Objects scanned: 132141
Time elapsed: 9 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

MBam needs an update.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select FULL scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Now an online scan please.
ESET
Please perform a scan with Eset Online Antiivirus Scanner.
(Requires Internet Explorer to work. If given the option, choose "Quarantine" instead of delete.)
Vista users need to run Internet Explorer as Administrator. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Click the green ESET Online Scanner button.
• Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
• Click on the Start button next to it.
• You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.
• A new window will appear asking "Do you want to install this software?"".
• Answer Yes to download and install the ActiveX controls that allows the scan to run.
• Click Start.
• Check Remove found threats and Scan potentially unwanted applications.
• Click Scan to start. (please be patient as the scan could take some time to complete)
• If offered the option to get information or buy software. Just close the window.
• When the scan has finished, a log.txt file will be created and automatically saved in the C:\Program Files\ESET\ESET Online Scanner\log.txt
  folder.
• Click > Run..., then copy and paste this command into the open box: C:\Program Files\EsetOnlineScanner\log.txt
• The scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply.

Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

Ran the Eset online scan, it found 0 infected files, so the log was empty. I updated and ran mbam before running eset, and sure enough, 1 threat found, I posted below the log...
Ran google just now and while internet access is faster, my search results lead me to big redirected to asklots.com, allthebrands.com, or 5liter.com...
Thanks for everything so far though! I feel like we're getting close!
Sarah

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4118

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

5/19/2010 11:11:50 PM
mbam-log-2010-05-19 (23-11-50).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 300297
Time elapsed: 1 hour(s), 59 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1377\A0119701.exe (Rootkit.TDSS.Gen) -> Quarantined and deleted successfully.

Thar she blows
Run TDDS Killer

1. Go to this page and Download TDSSKiller.zip to your Desktop.
2. Extract its contents to your desktop and drag TDSSKiller.exe on the desktop, not in the folder.
3. Vista Start logo >All Programs> Accessories> RIGHT-click on Command Prompt and Select Run As Administrator. Copy/paste the following bolded command and hit Enter.
   
   "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v
4. If TDSSKiller alerts you that the system needs to reboot, please consent.
5. When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.

Update rerun MBAm ..thanks.

Ran Tdss killer, here is the log and I'm running Mbam scan right now

10:58:33:921 4128 TDSS rootkit removing tool 2.3.0.0 May 12 2010 18:11:17
10:58:33:921 4128 ================================================================================
10:58:33:921 4128 SystemInfo:

10:58:33:921 4128 OS Version: 5.1.2600 ServicePack: 3.0
10:58:33:921 4128 Product type: Workstation
10:58:33:921 4128 ComputerName: R2D2
10:58:33:921 4128 UserName: HP_Administrator
10:58:33:921 4128 Windows directory: C:\WINDOWS
10:58:33:921 4128 Processor architecture: Intel x86
10:58:33:921 4128 Number of processors: 1
10:58:33:921 4128 Page size: 0x1000
10:58:33:921 4128 Boot type: Normal boot
10:58:33:921 4128 ================================================================================
10:58:33:937 4128 UnloadDriverW: NtUnloadDriver error 2
10:58:33:937 4128 ForceUnloadDriverW: UnloadDriverW(klmd23) error 2
10:58:34:000 4128 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
10:58:34:000 4128 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:58:34:000 4128 wfopen_ex: Trying to KLMD file open
10:58:34:000 4128 wfopen_ex: File opened ok (Flags 2)
10:58:34:000 4128 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
10:58:34:015 4128 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:58:34:015 4128 wfopen_ex: Trying to KLMD file open
10:58:34:015 4128 wfopen_ex: File opened ok (Flags 2)
10:58:34:015 4128 KLAVA engine initialized
10:58:34:328 4128 Initialize success
10:58:34:328 4128
10:58:34:328 4128 Scanning Services ...
10:58:34:718 4128 Raw services enum returned 387 services
10:58:34:734 4128
10:58:34:734 4128 Scanning Drivers ...
10:58:35:187 4128 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
10:58:35:234 4128 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
10:58:35:281 4128 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
10:58:35:343 4128 AegisP (2c5c22990156a1063e19ad162191dc1d) C:\WINDOWS\system32\DRIVERS\AegisP.sys
10:58:35:437 4128 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
10:58:35:671 4128 ALCXWDM (7f26d024355cbadb60838f53dfb171ec) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
10:58:35:890 4128 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
10:58:35:984 4128 AR5211 (f6f31f142a2ff302b8d1ecda9fe14a6b) C:\WINDOWS\system32\DRIVERS\WG311T13.sys
10:58:36:046 4128 aracpi (00523019e3579c8f8a94457fe25f0f24) C:\WINDOWS\system32\DRIVERS\aracpi.sys
10:58:36:062 4128 arhidfltr (9fedaa46eb1a572ac4d9ee6b5f123cf2) C:\WINDOWS\system32\DRIVERS\arhidfltr.sys
10:58:36:109 4128 arkbcfltr (82969576093cd983dd559f5a86f382b4) C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys
10:58:36:140 4128 armoucfltr (9b21791d8a78faece999fadbebda6c22) C:\WINDOWS\system32\DRIVERS\armoucfltr.sys
10:58:36:187 4128 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
10:58:36:203 4128 ARPolicy (7a2da7c7b0c524ef26a79f17a5c69fde) C:\WINDOWS\system32\DRIVERS\arpolicy.sys
10:58:36:265 4128 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
10:58:36:296 4128 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
10:58:36:500 4128 ati2mtag (c51608bba3248be2f6d21b132910752a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
10:58:36:921 4128 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
10:58:36:968 4128 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
10:58:37:031 4128 AvgLdx86 (9c0a7e6d3cb9a8a7ad4e4575d9a42e94) C:\WINDOWS\system32\Drivers\avgldx86.sys
10:58:37:109 4128 AvgMfx86 (f9caeec3ff1545991f490264429724c5) C:\WINDOWS\system32\Drivers\avgmfx86.sys
10:58:37:140 4128 AvgTdiX (cf9ac576490bb6c547cd16ef0b782358) C:\WINDOWS\system32\Drivers\avgtdix.sys
10:58:37:171 4128 bb-run (7270d070173b20ac9487ea16bb08b45f) C:\WINDOWS\system32\DRIVERS\bb-run.sys
10:58:37:218 4128 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
10:58:37:250 4128 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
10:58:37:250 4128 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
10:58:37:281 4128 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
10:58:37:296 4128 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
10:58:37:343 4128 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
10:58:37:375 4128 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
10:58:37:437 4128 cdrbsdrv (351735695e9ead93de6af85d8beb1ca8) C:\WINDOWS\system32\drivers\cdrbsdrv.sys
10:58:37:468 4128 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
10:58:37:546 4128 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
10:58:37:609 4128 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
10:58:37:656 4128 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
10:58:37:671 4128 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
10:58:37:703 4128 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
10:58:37:765 4128 DNINDIS5 (d2ee54cdbced01d48f2b18642be79a98) C:\WINDOWS\system32\DNINDIS5.SYS
10:58:37:812 4128 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
10:58:37:828 4128 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
10:58:37:859 4128 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
10:58:37:890 4128 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
10:58:37:906 4128 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
10:58:37:953 4128 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
10:58:37:968 4128 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
10:58:37:984 4128 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
10:58:38:000 4128 ftsata2 (22399d3ce5840c6082844679cca5d2fc) C:\WINDOWS\system32\DRIVERS\ftsata2.sys
10:58:38:046 4128 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
10:58:38:062 4128 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
10:58:38:140 4128 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
10:58:38:203 4128 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
10:58:38:218 4128 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
10:58:38:281 4128 HSFHWBS2 (5df616addb75c1ad36c1f9e4de0f7654) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
10:58:38:343 4128 HSF_DP (dfa8f86c0dbca7db948043aa3be6793b) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
10:58:38:453 4128 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
10:58:38:500 4128 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
10:58:38:562 4128 iaStor (9a65e42664d1534b68512caad0efe963) C:\WINDOWS\system32\DRIVERS\iaStor.sys
10:58:38:750 4128 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
10:58:38:781 4128 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
10:58:38:812 4128 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
10:58:38:828 4128 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
10:58:38:843 4128 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
10:58:38:859 4128 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
10:58:38:890 4128 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
10:58:38:921 4128 IPSec (e60c7e62c0e51381fc7318341fe84d38) C:\WINDOWS\system32\DRIVERS\ipsec.sys
10:58:38:921 4128 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ipsec.sys. Real md5: e60c7e62c0e51381fc7318341fe84d38, Fake md5: 23c74d75e36e7158768dd63d92789a91
10:58:38:921 4128 File "C:\WINDOWS\system32\DRIVERS\ipsec.sys" infected by TDSS rootkit ... 10:58:50:390 4128 Backup copy found, using it..
10:58:50:515 4128 will be cured on next reboot
10:58:50:734 4128 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
10:58:50:843 4128 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
10:58:50:953 4128 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
10:58:51:078 4128 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
10:58:51:203 4128 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
10:58:51:265 4128 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
10:58:51:328 4128 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys
10:58:51:375 4128 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
10:58:51:437 4128 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
10:58:51:453 4128 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
10:58:51:484 4128 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
10:58:51:546 4128 mr7910 (6aa46f9896d3c9e5a00e01bb416c707b) C:\WINDOWS\system32\DRIVERS\mr7910.sys
10:58:51:593 4128 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
10:58:51:656 4128 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
10:58:51:687 4128 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
10:58:51:734 4128 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
10:58:51:750 4128 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
10:58:51:765 4128 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
10:58:51:812 4128 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
10:58:51:828 4128 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
10:58:51:859 4128 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
10:58:51:906 4128 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
10:58:51:953 4128 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
10:58:52:000 4128 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
10:58:52:031 4128 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
10:58:52:109 4128 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
10:58:52:250 4128 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
10:58:52:296 4128 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
10:58:52:328 4128 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
10:58:52:343 4128 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
10:58:52:421 4128 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
10:58:52:437 4128 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
10:58:52:468 4128 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
10:58:52:515 4128 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
10:58:52:546 4128 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
10:58:52:578 4128 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
10:58:52:625 4128 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
10:58:52:656 4128 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
10:58:52:671 4128 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
10:58:52:703 4128 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
10:58:52:718 4128 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
10:58:52:750 4128 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
10:58:52:781 4128 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
10:58:52:828 4128 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys
10:58:52:953 4128 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
10:58:52:968 4128 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
10:58:53:031 4128 Ps2 (0e2eb30605ca6ed2509d59af6a7362b4) C:\WINDOWS\system32\DRIVERS\PS2.sys
10:58:53:062 4128 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
10:58:53:078 4128 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
10:58:53:140 4128 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
10:58:53:437 4128 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
10:58:53:453 4128 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
10:58:53:484 4128 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
10:58:53:500 4128 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
10:58:53:531 4128 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
10:58:53:546 4128 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
10:58:53:562 4128 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
10:58:53:609 4128 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
10:58:53:656 4128 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
10:58:53:687 4128 RTL8023xp (7f0413bdd7d53eb4c7a371e7f6f84df1) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
10:58:53:734 4128 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
10:58:53:781 4128 SAMFILT (2e4164df4c460edf11232d893f3ce007) C:\WINDOWS\system32\drivers\samfilt.sys
10:58:53:921 4128 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
10:58:53:937 4128 SASKUTIL (4fd72291a89793049104ca0a7e353cd4) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
10:58:54:000 4128 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
10:58:54:046 4128 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
10:58:54:062 4128 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
10:58:54:109 4128 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
10:58:54:187 4128 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
10:58:54:218 4128 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
10:58:54:265 4128 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys
10:58:54:296 4128 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
10:58:54:343 4128 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
10:58:54:359 4128 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
10:58:54:421 4128 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
10:58:54:484 4128 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
10:58:54:546 4128 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
10:58:54:578 4128 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
10:58:54:609 4128 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
10:58:54:640 4128 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
10:58:54:687 4128 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
10:58:54:750 4128 USB55N51 (87a1966ce8380814204f75845afb6739) C:\WINDOWS\system32\DRIVERS\USB55N51.sys
10:58:54:843 4128 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys
10:58:54:906 4128 usbbus (d9f3bb7c292f194f3b053ce295754eb8) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
10:58:54:953 4128 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
10:58:55:000 4128 USBCM (d21cde1c635bcc5053463579eee453cf) C:\WINDOWS\system32\DRIVERS\Sacm2A.sys
10:58:55:046 4128 UsbDiag (c4f77da649f99fad116ea585376fc164) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
10:58:55:093 4128 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
10:58:55:281 4128 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
10:58:55:343 4128 USBModem (c0613ce45e617bc671de8ebb1b30d175) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
10:58:55:390 4128 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
10:58:55:406 4128 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
10:58:55:437 4128 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
10:58:55:468 4128 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\DRIVERS\usbser.sys
10:58:55:515 4128 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
10:58:55:875 4128 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
10:58:55:968 4128 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
10:58:56:046 4128 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
10:58:56:078 4128 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
10:58:56:093 4128 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
10:58:56:140 4128 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
10:58:56:265 4128 winachsf (473ee64c368ce2eed110376c11960259) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
10:58:56:343 4128 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
10:58:56:390 4128 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
10:58:56:437 4128 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
10:58:56:484 4128 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
10:58:56:515 4128 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
10:58:56:531 4128 Reboot required for cure complete..
10:58:56:531 4128 Cure on reboot scheduled successfully
10:58:56:531 4128
10:58:56:531 4128 Completed
10:58:56:531 4128
10:58:56:531 4128 Results:
10:58:56:531 4128 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
10:58:56:531 4128 File objects infected / cured / cured on reboot: 1 / 0 / 1
10:58:56:531 4128
10:58:56:546 4128 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
10:58:56:546 4128 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
10:58:56:546 4128 UnloadDriverW: NtUnloadDriver error 1
10:58:56:546 4128 KLMD(ARK) unloaded successfully

Ok will wait for that. If you didn't reboot after the Killer, do so.

Yes, I rebooted after tdss killer, and mbam found 0 threats, I posted the log below. I also checked out google and no redirects! YaY! Also, google chrome is up and working again! Oh how I've missed it so hopefully, I'm all set? Let me know if there are any other precautions I should take/scans I should run. Also, is this the type of virus that should limit my internet use? Like should I not use this computer to use online banking and such? Any of your opinions, I'd appreciate. Thanks so much! You people are miracle workers!


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4118

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

5/20/2010 12:56:18 PM
mbam-log-2010-05-20 (12-56-18).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 299043
Time elapsed: 1 hour(s), 45 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Excellent!!

Now do this and then I've posted a lin to some tips below.

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use Disk Cleanup to remove all but the most recently created Restore Point.
• Go to Start > Run and type: Cleanmgr
• Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
• Click Yes, then click Ok.
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
• Disk Cleanup will remove the files and close automatically.

Vista and Windows 7 users can refer to these links: Create a New Restore Point in Vista or Windows 7 and Disk Cleanup in Vista.


You're welcome from all of us here at BC. We are glad to have helped.
Please take a few minutes to read our quietman7's excellent Tips to protect yourself against malware and reduce the potential for re-infection:,in post 17.