BleepingComputer.com: Scans can't seem to find (and kill) the Google Redirect Virus

Hello,
I seem to have found myself attacked by the Google Redirect Virus. I have been trying for days now to take care of this problem. In safe mode, I have run Malwarebytes, Ad-Aware, TDSSKiller, Spybot S&D, Microsoft Safety Scanner, RKill, and SUPERAntiSpyware. Most of them found nothing. Microsoft Safety Scanner found a few things and then upon removal and restart, I got an error that something was preventing windows from starting up and I had to let it sit for a while and 'fix it'. Also, most recently attempted, SUPERAntiSpyware found a handful of things but it said they were just tracking objects that were 'not harmful'. I removed them and restarted and I still have the google redirect problem.

Also, I'm wondering if this is affecting my PS3 Media Server connection as when this problem arose, that stopped working.

Any help is MUCH appreciated. I don't know what else to do!

This post has been edited by Tyme: 06 October 2011 - 12:07 PM

Hello it may be more than that.
Are you on a router? Are other machines on it,if so are they redirecting?

Do you use Firefox?

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:

• Flush DNS
  
• Report IE Proxy Settings
  
• Reset IE Proxy Settings
  
• Report FF Proxy Settings
  
• Reset FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size.
  
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.


Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
  
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  
• When prompted to run the scan, click Yes.
  
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

I am on a router, but the only things on it are the PC and the PS3. Yes, I am running the latest version of Firefox. Also, if it matters, I'm on Windows 7.


Upon running MiniToolBox I got this error twice:

nslookup.exe - Ordinal Not Found
The ordinal 1108 could not be located in the dynamic link library WSOCK32.dll.

Here are the results:

MiniToolBox by Farbar 
Ran by Katy (administrator) on 06-10-2011 at 13:26:50
Windows 7 Home Premium  (X64)

***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ============================== 

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ============================== 


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

Hosts file not detected in the default directory
========================= IP Configuration: ================================The following helper DLL cannot be loaded: WSHELPER.DLL.


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

   Host Name . . . . . . . . . . . . : Bernard
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : Belkin

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : Belkin
   Description . . . . . . . . . . . : Dell Wireless 1397 WLAN Mini-Card
   Physical Address. . . . . . . . . : 70-1A-04-51-A2-18
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a599:6691:8562:6a84%12(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.2.3(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, October 06, 2011 12:45:09 PM
   Lease Expires . . . . . . . . . . : Sunday, November 12, 2147 7:55:07 PM
   Default Gateway . . . . . . . . . : 192.168.2.1
   DHCP Server . . . . . . . . . . . : 192.168.2.1
   DHCPv6 IAID . . . . . . . . . . . : 225450500
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-74-CF-A9-00-25-64-64-16-88
   DNS Servers . . . . . . . . . . . : 192.168.2.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : Belkin
   Description . . . . . . . . . . . : Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller
   Physical Address. . . . . . . . . : 00-25-64-64-16-88
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.Belkin:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : Belkin
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:24aa:2ede:b5b1:d7d7(Preferred) 
   Link-local IPv6 Address . . . . . : fe80::24aa:2ede:b5b1:d7d7%13(Preferred) 
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

Pinging google.com [72.14.204.104] with 32 bytes of data:
Reply from 72.14.204.104: bytes=32 time=54ms TTL=50
Reply from 72.14.204.104: bytes=32 time=414ms TTL=50

Ping statistics for 72.14.204.104:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 54ms, Maximum = 414ms, Average = 234ms

Pinging yahoo.com [72.30.2.43] with 32 bytes of data:
Reply from 72.30.2.43: bytes=32 time=106ms TTL=52
Reply from 72.30.2.43: bytes=32 time=149ms TTL=52

Ping statistics for 72.30.2.43:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 106ms, Maximum = 149ms, Average = 127ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
 12...70 1a 04 51 a2 18 ......Dell Wireless 1397 WLAN Mini-Card
 11...00 25 64 64 16 88 ......Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller
  1...........................Software Loopback Interface 1
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
 13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1      192.168.2.3     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.2.0    255.255.255.0         On-link       192.168.2.3    281
      192.168.2.3  255.255.255.255         On-link       192.168.2.3    281
    192.168.2.255  255.255.255.255         On-link       192.168.2.3    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link       192.168.2.3    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       192.168.2.3    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 13     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 13     58 2001::/32                On-link
 13    306 2001:0:4137:9e76:24aa:2ede:b5b1:d7d7/128
                                    On-link
 12    281 fe80::/64                On-link
 13    306 fe80::/64                On-link
 13    306 fe80::24aa:2ede:b5b1:d7d7/128
                                    On-link
 12    281 fe80::a599:6691:8562:6a84/128
                                    On-link
  1    306 ff00::/8                 On-link
 13    306 ff00::/8                 On-link
 12    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 mswsock.dll [File Not found] ()
Catalog5 02 mswsock.dll [File Not found] ()
Catalog5 03 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog5 09 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 mswsock.dll [File Not found] ()
Catalog9 02 mswsock.dll [File Not found] ()
Catalog9 03 mswsock.dll [File Not found] ()
Catalog9 04 mswsock.dll [File Not found] ()
Catalog9 05 mswsock.dll [File Not found] ()
Catalog9 06 mswsock.dll [File Not found] ()
Catalog9 07 mswsock.dll [File Not found] ()
Catalog9 08 mswsock.dll [File Not found] ()
Catalog9 09 mswsock.dll [File Not found] ()
Catalog9 10 mswsock.dll [File Not found] ()
x64-Catalog5 01 mswsock.dll [File Not found] ()
x64-Catalog5 02 mswsock.dll [File Not found] ()
x64-Catalog5 03 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog9 01 mswsock.dll [File Not found] ()
x64-Catalog9 02 mswsock.dll [File Not found] ()
x64-Catalog9 03 mswsock.dll [File Not found] ()
x64-Catalog9 04 mswsock.dll [File Not found] ()
x64-Catalog9 05 mswsock.dll [File Not found] ()
x64-Catalog9 06 mswsock.dll [File Not found] ()
x64-Catalog9 07 mswsock.dll [File Not found] ()
x64-Catalog9 08 mswsock.dll [File Not found] ()
x64-Catalog9 09 mswsock.dll [File Not found] ()
x64-Catalog9 10 mswsock.dll [File Not found] ()

========================= Event log errors: ===============================

Application errors:
==================
Error: (10/06/2011 11:14:02 AM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}wltrynt SENS Logon Spy Subscription

Error: (10/05/2011 09:58:53 PM) (Source: Application Error) (User: )
Description: Faulting application name: iexplore.exe, version: 8.0.7600.16839, time stamp: 0x4e0015ef
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x02dc8ecb
Faulting process id: 0xfe4
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (10/05/2011 10:16:09 AM) (Source: Application Error) (User: )
Description: Faulting application name: bcmwltry.exe, version: 5.30.21.0, time stamp: 0x4a53eb54
Faulting module name: mfc90u.dll, version: 9.0.30729.6161, time stamp: 0x4dacf630
Exception code: 0xc0000005
Fault offset: 0x00000000003894e0
Faulting process id: 0x534
Faulting application start time: 0xbcmwltry.exe0
Faulting application path: bcmwltry.exe1
Faulting module path: bcmwltry.exe2
Report Id: bcmwltry.exe3

Error: (10/05/2011 10:15:46 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (10/05/2011 10:15:43 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service) (User: )
Description: 480: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service) (User: )
Description: 336: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service) (User: )
Description: 464: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 01:09:21 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: The Cryptographic Services service failed to initialize the VSS backup "System Writer" object.

Details:
Could not query the status of the EventSystem service.

System Error:
A system shutdown is in progress.
.

Error: (10/03/2011 02:31:45 PM) (Source: Application Error) (User: )
Description: Faulting application name: tsmuxer.exe, version: 0.0.0.0, time stamp: 0x48dca20a
Faulting module name: ntdll.dll, version: 6.1.7600.16695, time stamp: 0x4cc7ab86
Exception code: 0xc0000005
Fault offset: 0x00033ac6
Faulting process id: 0xdfc
Faulting application start time: 0xtsmuxer.exe0
Faulting application path: tsmuxer.exe1
Faulting module path: tsmuxer.exe2
Report Id: tsmuxer.exe3


System errors:
=============
Error: (10/06/2011 00:45:38 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (10/06/2011 00:45:31 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (10/06/2011 00:45:31 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (10/06/2011 00:45:19 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
Lbd
sptd

Error: (10/06/2011 00:45:18 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (10/06/2011 00:45:10 PM) (Source: Service Control Manager) (User: )
Description: The Windows Firewall service depends on the Windows Firewall Authorization Driver service which failed to start because of the following error: 
%%183

Error: (10/06/2011 00:45:10 PM) (Source: Service Control Manager) (User: )
Description: The Windows Firewall Authorization Driver service failed to start due to the following error: 
%%183

Error: (10/06/2011 00:45:06 PM) (Source: Service Control Manager) (User: )
Description: The Lavasoft Ad-Aware Service service failed to start due to the following error: 
%%2

Error: (10/06/2011 11:17:36 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (10/06/2011 11:17:33 AM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}


Microsoft Office Sessions:
=========================
Error: (10/06/2011 11:14:02 AM) (Source: EventSystem)(User: )
Description: 80070005EventSystem.EventSubscription{AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}wltrynt SENS Logon Spy Subscription

Error: (10/05/2011 09:58:53 PM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.7600.168394e0015efunknown0.0.0.000000000c000000502dc8ecbfe401cc83cb688a967fC:\Program Files (x86)\Internet Explorer\iexplore.exeunknownbd9e88f1-efbe-11e0-975e-002564641688

Error: (10/05/2011 10:16:09 AM) (Source: Application Error)(User: )
Description: bcmwltry.exe5.30.21.04a53eb54mfc90u.dll9.0.30729.61614dacf630c000000500000000003894e053401cc830aa43b2450C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exeC:\Windows\WinSxS\amd64_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_044aad0bab1eb146\mfc90u.dll9230b461-ef5c-11e0-b885-002564641688

Error: (10/05/2011 10:15:46 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (10/05/2011 10:15:43 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service)(User: )
Description: 480: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service)(User: )
Description: 336: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 10:46:16 PM) (Source: Bonjour Service)(User: )
Description: 464: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)

Error: (10/04/2011 01:09:21 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: Details:
Could not query the status of the EventSystem service.

System Error:
A system shutdown is in progress.

Error: (10/03/2011 02:31:45 PM) (Source: Application Error)(User: )
Description: tsmuxer.exe0.0.0.048dca20antdll.dll6.1.7600.166954cc7ab86c000000500033ac6dfc01cc81fab2b0d68aC:\Program Files (x86)\mkv2vob\tools\tsmuxer.exeC:\Windows\SysWOW64\ntdll.dllf2439d51-eded-11e0-a243-002564641688


=========================== Installed Programs ============================

µTorrent (Version: 2.0.0)
64 Bit HP CIO Components Installer (Version: 6.2.1)
7-Zip 4.65
AC-3 ACM Codec x64 1.6 (Version: 1.6)
Ad-Aware (Version: 9.0.1)
Adobe AIR (Version: 2.5.1.17730)
Adobe Anchor Service CS4 (Version: 2.0)
Adobe Anchor Service x64 CS4 (Version: 2.0)
Adobe Audition 3.0 (Version: 3.0)
Adobe Audition 3.0 Vista Compatibility
Adobe Audition CS5.5 (Version: 4.0)
Adobe Bridge CS4 (Version: 3)
Adobe CMaps CS4 (Version: 2.0)
Adobe CMaps x64 CS4 (Version: 2.0)
Adobe Color - Photoshop Specific CS4 (Version: 2.0)
Adobe Color EU Extra Settings CS4 (Version: 2.0)
Adobe Color JA Extra Settings CS4 (Version: 2.0)
Adobe Color NA Recommended Settings CS4 (Version: 2.0)
Adobe Color Video Profiles CS CS4 (Version: 2.0)
Adobe Community Help (Version: 3.4.980)
Adobe CSI CS4 (Version: 1)
Adobe CSI CS4 x64 (Version: 1)
Adobe Default Language CS4 (Version: 2.0)
Adobe Dreamweaver CS4 (Version: 10.0)
Adobe Drive CS4 x64 (Version: 1)
Adobe ExtendScript Toolkit CS4 (Version: 3.0.0)
Adobe Flash Player 10 ActiveX (Version: 10.1.102.64)
Adobe Flash Player 10 Plugin (Version: 10.3.183.7)
Adobe Fonts All (Version: 2.0)
Adobe Fonts All x64 (Version: 2.0)
Adobe Linguistics CS4 (Version: 4.0.0)
Adobe Linguistics CS4 x64 (Version: 4.0.0)
Adobe Output Module (Version: 2.0)
Adobe PDF Library Files CS4 (Version: 9.0)
Adobe PDF Library Files x64 CS4 (Version: 9.0)
Adobe Photoshop CS4 (64 Bit) (Version: 11.0)
Adobe Photoshop CS4 (Version: 11.0)
Adobe Photoshop CS4 Support (Version: 11.0)
Adobe Reader 9.1.2 (Version: 9.1.2)
Adobe Search for Help (Version: 1.0)
Adobe Service Manager Extension (Version: 1.0)
Adobe Setup (Version: 2.0)
Adobe Type Support CS4 (Version: 9.0)
Adobe Type Support x64 CS4 (Version: 9.0)
Adobe Update Manager CS4 (Version: 6.0.0)
Adobe WinSoft Linguistics Plugin (Version: 1.1)
Adobe WinSoft Linguistics Plugin x64 (Version: 1.1)
Adobe XMP Panels CS4 (Version: 2.0)
AdobeColorCommonSetCMYK (Version: 2.0)
AdobeColorCommonSetRGB (Version: 2.0)
Advanced Audio FX Engine (Version: 1.12.05)
Any Video Converter Professional 3.0.7
AoA Audio Extractor
AoA DVD Copy
Apple Application Support (Version: 1.5.2)
Apple Mobile Device Support (Version: 3.4.1.2)
Apple Software Update (Version: 2.1.3.127)
ASPCA Tri Reminder by We-Care.com (Version: 4.0.7.5)
Belkin Setup and Router Monitor
Bonjour (Version: 3.0.0.2)
BufferChm (Version: 130.0.331.000)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
Comcast High-Speed Internet Install Wizard
Comical 0.8
ComicRack v0.9.134 (Version: v0.9.134)
Compatibility Pack for the 2007 Office system (Version: 12.0.6425.1000)
Connect (Version: 1.0.0.1)
Copy (Version: 130.0.366.000)
dBpoweramp [Arrange Audio] Codec (Version: Release 3)
dBpoweramp [Audio Info] Codec (Version: Release 1)
dBpoweramp [Channel Split] Codec
dBpoweramp [ID Tag Update] Codec
dBpoweramp [Length Split] Codec
dBpoweramp [Multi Encoder] Codec (Version: Release 3)
dBpoweramp [ReplayGain] Codec (Version: Release 2)
dBpoweramp [Tag From Filename] Codec (Version: Release 1)
dBpoweramp m4a Codec (Version: Release 14 r2)
dBpoweramp Music Converter (Version: Release 13.2)
dBpoweramp Shorten Codec
dBpoweramp Windows Media Audio 10 Codec (Version: Release 7)
Dell DataSafe Local Backup - Support Software (Version: 2.25)
Dell DataSafe Local Backup (Version: 9.3.36)
Dell Dock (Version: 2.0.0)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (Version: 1.00.0000)
Dell Touchpad (Version: 7.104.115.102)
Dell Webcam Central (Version: 1.40.05)
Dell Wireless WLAN Card Utility (Version: 5.30.21.0)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.372.000)
DivX Setup (Version: 2.4.0.6)
DJ_AIO_05_F4400_Software_Min (Version: 130.0.448.000)
DVD Flick 1.3.0.7 (Version: 1.3.0.7)
DVD Shrink 3.2
EASEUS Partition Master 8.0.1 Home Edition
EPSON NX410 Series Printer Uninstall
F4400 (Version: 130.0.448.000)
File Type Assistant
Free File Viewer 2011
Freelang Dictionary (wordlist)
Freelang Dictionary 3.74 beta
Google Gears (Version: 0.5.3600)
Google Update Helper (Version: 1.3.21.69)
GoToAssist 8.0.0.514
GPBaseService2 (Version: 130.0.371.000)
Handbrake 0.9.4 (Version: 0.9.4)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Deskjet F4400 Printer Driver Software 13.0 Rel .5 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Print Projects 1.0 (Version: 1.0)
HP Smart Web Printing 4.5 (Version: 4.5)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 4.000.011.006)
HPPhotoGadget (Version: 130.0.282.000)
hpPrintProjects (Version: 130.0.303.000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
hpWLPGInstaller (Version: 130.0.303.000)
ImgBurn (Version: 2.5.1.0)
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
IrfanView (remove only) (Version: 4.28)
iSilo (Version: 5.10.13)
iTunes (Version: 10.4.0.80)
Java Auto Updater (Version: 2.0.5.1)
Java(TM) 6 Update 14 (64-bit) (Version: 6.0.140)
Java(TM) 6 Update 26 (Version: 6.0.260)
Junk Mail filter update (Version: 14.0.8117.416)
kuler (Version: 2.0)
Live 8.2.5
Live! Cam Avatar Creator (Version: 4.6.3009.1)
MagicDisc 2.7.106
MarketResearch (Version: 130.0.374.000)
MediaInfo 0.7.44 (Version: 0.7.44)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (Version: 3.5.50.0)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6425.1000)
Microsoft Silverlight (Version: 4.0.60531.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft VC90 CRT + OMP (Version: 1.0.0.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (Version: 9.7.0621)
Microsoft XML Parser (Version: 8.70.1104.04)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
MiniTool Partition Wizard Home Edition 6.0
mkv2vob (Version: 2.4.9)
MKVtoolnix 5.0.0 (Version: 5.0.0)
MMSSTV version 1.13A (Version: 1.13A)
Mozilla Firefox 7.0.1 (x86 en-US) (Version: 7.0.1)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NetAssistant (Version: 3.6.5)
novaPDF Standard Desktop 7.3 printer
NVIDIA PhysX (Version: 9.10.0513)
PDF Settings CS4 (Version: 9.0)
Photoshop Camera Raw (Version: 5.0)
Photoshop Camera Raw_x64 (Version: 5.0)
Pinnacle Video Driver (Version: 12.1.0.030)
PriceGong 2.5.0 (Version: 2.5.0)
PS3 Media Server (Version: 1.40.0)
Quickset64 (Version: 9.6.6)
QuickTime (Version: 7.69.80.9)
Rainlendar2 (remove only)
Real Alternative 2.0.2 (Version: 2.0.2)
Rosetta Stone Version 3 (Version: 3.4.5.0)
Roxio Burn (Version: 1.0)
Roxio Burn (Version: 1.0.0)
Roxio Update Manager (Version: 6.0.0)
Scan (Version: 13.0.0.0)
SES Driver (Version: 1.0.0)
Shop for HP Supplies (Version: 13.0)
Skype™ 5.3 (Version: 5.3.120)
SmartSound Quicktracks for Premiere Elements 8.0 (Version: 3.11.3090)
SmartWebPrinting (Version: 130.0.373.000)
SolutionCenter (Version: 130.0.373.000)
SoulSeek 157 NS 13e
Spybot - Search & Destroy (Version: 1.6.2)
Status (Version: 130.0.373.000)
Steam (Version: 1.0.0.0)
Suite Shared Configuration CS4 (Version: 1.0)
SUPERAntiSpyware (Version: 5.0.1128)
The Rosetta Stone
TomTom HOME 2.7.3.1894 (Version: 2.7.3.1894)
TomTom HOME Visual Studio Merge Modules (Version: 1.0.2)
Toolbox (Version: 130.0.648.000)
Transcribe! 7.31 (Version: 7.31)
TrayApp (Version: 130.0.376.000)
Tunatic
Ultra Video Joiner 6.1.0108
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
Visual C++ 2008 x86 Runtime - (v9.0.30729) (Version: 9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (Version: 9.0.30729.01)
VLC media player 1.1.10 (Version: 1.1.10)
WebReg (Version: 130.0.132.017)
WinAVI All in One Converter (Version: 1.6.0.4147)
Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM  (01/19/2011 1.0.0009.0) (Version: 01/19/2011 1.0.0009.0)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Movie Maker (Version: 14.0.8117.0416)
Windows Live Photo Gallery (Version: 14.0.8117.416)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8117.0416)
WinRAR archiver

========================= Memory info: ===================================

Percentage of memory in use: 67%
Total physical RAM: 3032.36 MB
Available physical RAM: 986.04 MB
Total Pagefile: 6062.87 MB
Available Pagefile: 3707.09 MB
Total Virtual: 4095.88 MB
Available Virtual: 3988.23 MB

========================= Partitions: =====================================

1 Drive c: (OS) (Fixed) (Total:218.2 GB) (Free:13.55 GB) NTFS

========================= Users: ========================================

User accounts for \\BERNARD

Administrator            Guest                    Katy                     

========================= Minidump Files ==================================


**** End of log ****

and here are the results from GooredFix

GooredFix by jpshortstuff (03.07.10.1)
Log created at 13:22 on 06/10/2011 (Katy)
Firefox version 7.0.1 (en-US)

========== GooredScan ==========

(none)
(none)

========== GooredLog ==========

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [01:59 06/10/2011]
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [16:45 24/06/2010]
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [20:01 27/04/2011]
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [17:37 05/07/2011]

C:\Users\Katy\Application Data\Mozilla\Firefox\Profiles\ixl15l7j.default\extensions\
(none)

C:\Users\Katy\Application Data\Mozilla\Firefox\Profiles\u6xs6jc9.default\extensions\
(none)

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{000a9d1c-beef-4f90-9363-039d445309b8}"="C:\Program Files (x86)\Google\Google Gears\Firefox\" [22:07 13/06/2010]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [22:05 12/08/2010]

-=E.O.F=-

Edit: Realized I didn't have 'List Minidump Files' checked the first time, so I re-did the MiniToolBox scan and updated the log I posted.

This post has been edited by Tyme: 06 October 2011 - 12:28 PM

OK,nothing serious there except you need to update to Java 7 and Adobe Reader X or 10.

I hav e seen in FireFox it may be the Add ons/Plugins. try disabling them one at a time and see which one was at fault.

How to disable extensions and plugins

Keeping your third-party plugins up to date


If nothing there then we need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

Nothing wrong in the add-ons/plug-ins so I've moved to the next step.
Also, updated Java & Adobe Reader.
Thanks for the help, boopme!

http://www.bleepingcomputer.com/forums/topic422215.html

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic422215.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom