BleepingComputer.com: Clicking on a link redirects me.

First, I want to say that I have used this forum NUMEROUR times without making an account by following through others problems and steps to solve them, so I want to thank you.

I have went through many of these threads (on other forums) for my problem, and every one was solved the same... by multiple files, logs, etc needing corespondance back and forth to solve... so Ive decided to join in hopes someone can walk me through this.

A couple things first... Ive ran AdAware. It found some things, but didnt solve the problem. Ive "reste" IE, didnt solve the problem. I now (it started happening upon this same problem) have a warning window opening up upon computer start up/log on telling me a specific .dll couldnt be found. I would have to restart my computer to get the exact file name/location.

I need to get rid of this virus, and any/all help would be greatly appreciated. Thank you in advance.

Will

Edited to add: the file that I was previously refering to is... C:\Users\User\AppData\Local\SyncPath.NET\kbdcfgServ.dll

If I do a Google search, and instead of simply clicking on the link, I right click on the link, and open in a new tab... it still redirects. If I right click, and open in a NEW WINDOW, it DOES NOT redirect. Ive tried this over a dozen times both ways, always this result.

Edit: Moved topic from Windows 7 to the more appropriate forum. ~ Animal

Thanks... sorry for the wrong forum!

This post has been edited by Will843: 27 December 2011 - 09:33 PM

Welcome aboard

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:

• Report IE Proxy Settings
  
• Report FF Proxy Settings
  
• List content of Hosts
  
• List IP configuration
  
• List Winsock Entries
  
• List last 10 Event Viewer log
  
• List Installed Programs
  
• List Users, Partitions and Memory size

Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

I am posting this, and moving onto the GMER portion. I am posting so I can disconnect from the internet. Well edit and add when I return. Thank you so much!!!

Edited to add... Before I even came to this forum, I ran AdAware, full scan, deleted, rebooted, etc. It didnt fix the problem. Please refer to my next post.


Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
CCleaner
Java™ 6 Update 14
Out of date Java installed!
Adobe Flash Player ( 10.0.32.18) Flash Player Out of Date!
Mozilla Firefox (3.6.15) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe
``````````End of Log````````````





MiniToolBox by Farbar
Ran by BoatBright (administrator) on 27-12-2011 at 20:14:51
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ==============================

Hosts file not detected in the default directory
========================= IP Configuration: ================================

Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC = Wireless Network Connection (Connected)
Realtek PCIe FE Family Controller = Local Area Connection (Media disconnected)
The following helper DLL cannot be loaded: WSHELPER.DLL.


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : BoatBright-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC
Physical Address. . . . . . . . . : 00-26-B6-7D-D6-1A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::44c2:db57:233c:757e%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, December 27, 2011 4:23:05 PM
Lease Expires . . . . . . . . . . : Wednesday, December 28, 2011 4:23:04 PM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 318777014
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-9F-10-42-00-26-6C-34-CC-9B
DNS Servers . . . . . . . . . . . : 64.203.254.30
64.203.254.31
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
Physical Address. . . . . . . . . : 00-26-6C-34-CC-9B
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{683F6912-F688-46D3-A706-6D30C4BC3DDF}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{B2BED281-56BB-40DB-9096-2A8F9CA0D107}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Pinging google.com [74.125.159.99] with 32 bytes of data:
Reply from 74.125.159.99: bytes=32 time=49ms TTL=54
Reply from 74.125.159.99: bytes=32 time=52ms TTL=54

Ping statistics for 74.125.159.99:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 49ms, Maximum = 52ms, Average = 50ms

Pinging yahoo.com [72.30.2.43] with 32 bytes of data:
Reply from 72.30.2.43: bytes=32 time=154ms TTL=52
Reply from 72.30.2.43: bytes=32 time=150ms TTL=53

Ping statistics for 72.30.2.43:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 150ms, Maximum = 154ms, Average = 152ms

Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:
Reply from 208.43.87.2: Destination host unreachable.
Reply from 208.43.87.2: Destination host unreachable.

Ping statistics for 208.43.87.2:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
12...00 26 b6 7d d6 1a ......Realtek RTL8191SE Wireless LAN 802.11n PCI-E NIC
10...00 26 6c 34 cc 9b ......Realtek PCIe FE Family Controller
1...........................Software Loopback Interface 1
16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
11...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
13...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.3 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.3 281
192.168.1.3 255.255.255.255 On-link 192.168.1.3 281
192.168.1.255 255.255.255.255 On-link 192.168.1.3 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.3 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.3 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
12 281 fe80::/64 On-link
12 281 fe80::44c2:db57:233c:757e/128
On-link
1 306 ff00::/8 On-link
12 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 mswsock.dll [File Not found] ()
Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)
Catalog5 06 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Catalog5 07 mswsock.dll [File Not found] ()
Catalog5 08 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog9 01 mswsock.dll [File Not found] ()
Catalog9 02 mswsock.dll [File Not found] ()
Catalog9 03 mswsock.dll [File Not found] ()
Catalog9 04 mswsock.dll [File Not found] ()
Catalog9 05 mswsock.dll [File Not found] ()
Catalog9 06 mswsock.dll [File Not found] ()
Catalog9 07 mswsock.dll [File Not found] ()
Catalog9 08 mswsock.dll [File Not found] ()
Catalog9 09 mswsock.dll [File Not found] ()
Catalog9 10 mswsock.dll [File Not found] ()
Catalog9 11 mswsock.dll [File Not found] ()
x64-Catalog5 01 mswsock.dll [File Not found] ()
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)
x64-Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [193824] (Apple Inc.)
x64-Catalog5 07 mswsock.dll [File Not found] ()
x64-Catalog5 08 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog9 01 mswsock.dll [File Not found] ()
x64-Catalog9 02 mswsock.dll [File Not found] ()
x64-Catalog9 03 mswsock.dll [File Not found] ()
x64-Catalog9 04 mswsock.dll [File Not found] ()
x64-Catalog9 05 mswsock.dll [File Not found] ()
x64-Catalog9 06 mswsock.dll [File Not found] ()
x64-Catalog9 07 mswsock.dll [File Not found] ()
x64-Catalog9 08 mswsock.dll [File Not found] ()
x64-Catalog9 09 mswsock.dll [File Not found] ()
x64-Catalog9 10 mswsock.dll [File Not found] ()
x64-Catalog9 11 mswsock.dll [File Not found] ()

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7659

Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7659

Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6614

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6614

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4773

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4773

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:45 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2558


System errors:
=============
Error: (12/27/2011 04:23:11 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service terminated with the following error:
%%1060

Error: (12/27/2011 04:23:07 PM) (Source: Service Control Manager) (User: )
Description: The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

Error: (12/27/2011 04:23:07 PM) (Source: Service Control Manager) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Error: (12/27/2011 04:23:06 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 04:21:17 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 04:21:17 PM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 08:24:34 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 08:24:25 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 00:55:27 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (12/27/2011 00:55:25 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.


Microsoft Office Sessions:
=========================
Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7659

Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7659

Error: (12/27/2011 08:52:50 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6614

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6614

Error: (12/27/2011 08:52:49 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4773

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4773

Error: (12/27/2011 08:52:47 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/27/2011 08:52:45 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2558


=========================== Installed Programs ============================

Ad-Aware (Version: 9.0.7)
Adobe Flash Player 10 Plugin (Version: 10.0.32.18)
Adobe Flash Player 11 ActiveX (Version: 11.1.102.55)
Adobe Reader 9.4.1 (Version: 9.4.1)
Adobe Shockwave Player 11.5 (Version: 11.5.6.606)
Apple Application Support (Version: 1.4.1)
Apple Mobile Device Support (Version: 3.3.0.69)
Apple Software Update (Version: 2.1.2.120)
Bonjour (Version: 2.0.4.0)
CCleaner (Version: 2.34)
Chaos Pack v1.1 for Pocket Tanks Deluxe (Version: 1.1)
Compatibility Pack for the 2007 Office system (Version: 12.0.4518.1014)
Direct DiscRecorder (Version: 1.00.0000)
Dolby Control Center (Version: 2.2.1)
DVD MovieFactory for TOSHIBA (Version: 7.0.0)
Flamethrower Pack v1.1 for Pocket Tanks Deluxe (Version: 1.1)
FrostWire 4.21.1 (Version: 4.21.1.0)
Fuzz Pack v1.0 for Pocket Tanks Deluxe (Version: 1.0)
Google Earth (Version: 6.1.0.5001)
Google Update Helper (Version: 1.3.21.79)
Gravity Pack v1.1 for Pocket Tanks Deluxe (Version: 1.1)
Image Resizer Powertoy Clone for Windows (64 bit) (Version: 2.1)
Intel® Graphics Media Accelerator Driver (Version: 8.15.10.1883)
Intel® Matrix Storage Manager
iTunes (Version: 10.1.0.56)
Java™ 6 Update 14 (Version: 6.0.140)
Junk Mail filter update (Version: 14.0.8089.726)
Magic Pack v1.0 for Pocket Tanks Deluxe (Version: 1.0)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office Excel Viewer (Version: 12.0.6219.1000)
Microsoft Office XP Professional with FrontPage (Version: 10.0.2627.01)
Microsoft Silverlight (Version: 3.0.50106.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 2005 Tools for Office Runtime (Version: 8.0.60940.0)
Microsoft Works (Version: 9.7.0621)
Mozilla Firefox (3.6.15) (Version: 3.6.15 (en-US))
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
MyToshiba (Version: 2.2.0.3)
Nano Pack v1.0 for Pocket Tanks Deluxe (Version: 1.0)
Nuke Pack v1.1 for Pocket Tanks Deluxe (Version: 1.1)
Party Pack for Pocket Tanks Deluxe (Version: 1.1)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Pocket Tanks Deluxe v1.3 (Version: 1.3)
QuickBooks (Version: 20.0.4012.807)
QuickBooks Simple Start 2010 (Version: 20.0.4012.807)
QuickTime (Version: 7.68.75.0)
Realtek Ethernet Controller Driver (Version: 1.00.0008)
Realtek High Definition Audio Driver (Version: 6.0.1.5904)
Realtek WLAN Driver (Version: 2.00.0006)
RICOH R5U230 Media Driver ver.2.06.03.02 (Version: 2.06.03.02)
Rocket Pack v1.0 for Pocket Tanks Deluxe (Version: 1.0)
Snowball Pack v1.1 for Pocket Tanks Deluxe (Version: 1.1)
Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0)
StarCraft
StarCraft II (Version: 1.4.2.20141)
Stellar Phoenix Recovery for QuickBooks (Version: 2.0.0.0)
Super Pack v1.11 for Pocket Tanks Deluxe (Version: 1.11)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
System Requirements Lab (Version: 4.1.71.0)
Toshiba Application Installer (Version: 9.0.0.9)
TOSHIBA Assist (Version: 3.00.09)
TOSHIBA ConfigFree (Version: 8.0.21)
TOSHIBA Disc Creator (Version: 2.1.0.1 for x64)
TOSHIBA DVD PLAYER (Version: 3.01.0.07-A)
TOSHIBA eco Utility (Version: 1.1.7.64)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: )
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Face Recognition (Version: 3.1.0.64)
TOSHIBA Hardware Setup (Version: 2.00.11)
TOSHIBA HDD Protection (Version: 2.2.0.0)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.0)
Toshiba Online Backup (Version: 1.2.0.35)
TOSHIBA PC Health Monitor (Version: 1.4.1.64)
Toshiba Quality Application (Version: 1.001.0000)
TOSHIBA Recovery Media Creator (Version: 2.1.0.2 for x64)
TOSHIBA Service Station (Version: 2.1.31)
TOSHIBA Speech System Applications (Version: 1.00.2518)
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password (Version: 2.00.09)
TOSHIBA USB Sleep and Charge Utility (Version: 1.2.3.0)
TOSHIBA Value Added Package (Version: 1.2.25.64)
TOSHIBA Web Camera Application (Version: 1.1.1.4)
ToshibaRegistration (Version: 1.0.3)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
WildTangent Games (Version: 1.0.0.71)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Photo Gallery (Version: 14.0.8081.709)
Windows Live Sign-in Assistant (Version: 5.000.818.5)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8089.0726)
Windows Movie Maker 2.6 (Version: 2.6.4038.0)
Yahoo! Software Update

========================= Memory info: ===================================

Percentage of memory in use: 58%
Total physical RAM: 3963.98 MB
Available physical RAM: 1653.62 MB
Total Pagefile: 7926.16 MB
Available Pagefile: 5676.88 MB
Total Virtual: 4095.88 MB
Available Virtual: 3963.96 MB

========================= Partitions: =====================================

1 Drive c: (TI102782W0E) (Fixed) (Total:453.62 GB) (Free:377.05 GB) NTFS

========================= Users: ========================================

User accounts for \\BOATBRIGHT-PC

Administrator ASPNET BoatBright
Guest Marie Victoria


**** End of log ****






Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2011.12.27.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
BoatBright :: BOATBRIGHT-PC [administrator]

12/27/2011 8:19:24 PM
mbam-log-2011-12-27 (20-19-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 218357
Time elapsed: 5 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)





GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-12-27 21:31:52
Windows 6.1.7601 Service Pack 1
Running: xynjwxcb.exe


---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002258e33c73
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002258e33c73 (not active ControlSet)

---- EOF - GMER 1.0.15 ----

This post has been edited by Will843: 28 December 2011 - 08:02 PM

I didn't get any email notification because you edited your last post to include GMER log.
There are no email notifications for edits.

We have several issues there.

Let's start with missing "hosts" file.

Open Notepad.
Paste the following text into it:

# Copyright © 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost

Go File>Save As and...

1. Name the file hosts. (no extension; make sure there is just a "dot" at the end <--- VERY IMPORTANT!)
2. Make sure, "Save as type:" is set to "All Files (*.*)
3. File is saved to C:\WINDOWS\SYSTEM32\DRIVERS\ETC folder



NOTE.
If you receive You don't have permission to save in this location message take ownership of C:\windows\system32\drivers\etc folder: http://www.howtogeek.com/howto/windows-vista/add-take-ownership-to-explorer-right-click-menu-in-vista/
If the above doesn't work save the file to some known location, like your desktop, copy it from there and paste it to "etc" folder.

=================================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64-bit users go HERE

• Double-click SystemLook.exe to run it.
  
• Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  
• Copy the content of the following box into the main textfield:
  

  :dir
  C:\WINDOWS\SYSTEM32\DRIVERS\ETC
  

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

AdAware ran a full scan again last night for some reason, and found 4 more problems. I did as it requested, and this time, for some unknown reason, it seems to have stopped this entire problem (at least after 25-30 attempts, I havent been redirected as of yet.).

The only problem I have now is the file I was refering to still shows up when the computer boots up saying it cant be found...

C:\Users\User\AppData\Local\SyncPath.NET\kbdcfgServ.dll

Please read my previous reply.

Thank you sir!!! Log posted below...


SystemLook 30.07.11 by jpshortstuff
Log created at 20:23 on 28/12/2011 by BoatBright
Administrator - Elevation successful

========== dir ==========

C:\WINDOWS\SYSTEM32\DRIVERS\ETC - Parameters: "(none)"

---Files---
hosts --a---- 766 bytes [01:21 29/12/2011] [01:21 29/12/2011]
lmhosts.sam --a---- 3683 bytes [02:35 14/07/2009] [21:00 10/06/2009]
networks --a---- 407 bytes [02:34 14/07/2009] [21:00 10/06/2009]
protocol --a---- 1358 bytes [02:34 14/07/2009] [21:00 10/06/2009]
services --a---- 17463 bytes [02:34 14/07/2009] [21:00 10/06/2009]

---Folders---
None found.

-= EOF =-

How is redirection?

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

================================================================

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
  
  
• Press "Scan".
  
• It will create a log (FSS.txt) in the same directory the tool is run.
  
• Please copy and paste the log to your reply.

Redirection... (this is compared to around a 95-100% redirection rate prior to the beginning of the thread).

Google... 12 attempts, 0 Redirect.
Yahoo... 12 attempts, 3 Redirect. (All ad sites unreleated to the actual search)

Since I havent deleted anything, once this is all over, can you give me a quick rundown of what I can and how to get rid of all of these logs/files that are all over my desktop? Dont want to screw something else up... hahaha.

Logs......



aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software
Run date: 2011-12-28 21:00:43
-----------------------------
21:00:43.952 OS Version: Windows x64 6.1.7601 Service Pack 1
21:00:43.952 Number of processors: 2 586 0x170A
21:00:43.953 ComputerName: BOATBRIGHT-PC UserName: BoatBright
21:00:49.184 Initialize success
21:05:15.753 AVAST engine defs: 11122801
21:05:49.857 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:05:49.857 Disk 0 Vendor: TOSHIBA_ FG00 Size: 476940MB BusType: 3
21:05:49.877 Disk 0 MBR read successfully
21:05:49.877 Disk 0 MBR scan
21:05:49.887 Disk 0 Windows VISTA default MBR code
21:05:49.897 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
21:05:49.917 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 464503 MB offset 3074048
21:05:49.957 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 10936 MB offset 954376192
21:05:49.967 Service scanning
21:05:51.477 Modules scanning
21:05:51.477 Disk 0 trace - called modules:
21:05:51.517 ntoskrnl.exe CLASSPNP.SYS disk.sys thpdrv.sys iaStor.sys hal.dll
21:05:51.527 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800484c790]
21:05:51.537 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\THPDRV1[0xfffffa800484a5e0]
21:05:51.547 5 thpdrv.sys[fffff88001b9acc0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800469f050]
21:05:53.490 AVAST engine scan C:\windows
21:05:55.650 AVAST engine scan C:\windows\system32
21:06:07.232 File: C:\windows\system32\consrv.dll **INFECTED** Win64:Sirefef-C [Drp]
21:08:02.386 AVAST engine scan C:\windows\system32\drivers
21:08:15.678 AVAST engine scan C:\Users\BoatBright
21:12:32.783 AVAST engine scan C:\ProgramData
21:18:01.348 Scan finished successfully
21:19:45.837 Disk 0 MBR has been saved successfully to "C:\Users\BoatBright\Desktop\MBR.dat"
21:19:45.849 The log file has been saved successfully to "C:\Users\BoatBright\Desktop\aswMBR.txt"




Farbar Service Scanner
Ran by BoatBright (administrator) on 28-12-2011 at 21:20:36
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open MpsSvc registry key. The service key does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open bfe registry key. The service key does not exist.

mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.


Firewall Disabled Policy:
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open wscsvc registry key. The service key does not exist.


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

Additional 12 searches (different searches, and links from previous)

Google... 12 searches, 0 redirects
Yahoo... 12 searches, 3 (again) redirects... all 3 to unreleated add sites.

Since there is still some redirection present...
Open IE, go Tools>Internet options>Advanced tab, click on "Reset" tab.
Restart IE, do some searches and let me know.

Next...

You're not running any AV program.
Install ONE of these:
- Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html
- free Microsoft Security Essentials: http://windows.microsoft.com/en-GB/windows/products/security-essentials
- free Comodo Antivirus: http://www.comodo.com/home/internet-security/antivirus.php
Update, run full scan, report on any findings.

Next...
From your log I'd assume Windows firewall is not working.
Can you confirm?

Edited to add... reset IE as described, closed IE, reopened, performed searches.

Different searches, different links then previous 2 attempts...

Google... 0/10
Yahoo... 3/10

Pretty much the same as before.

I am running full scan with Avast as I type this.

As far as the Windows Firewall... I couldnt tell you.

Please understand... this is mostly foreign to me. I can navigate through my computer like a champ... but I dont have a single clue as to how/why this thing clicks... and can only follow along with you because youve made it idiot proof.

Will post findings from Avast....

This post has been edited by Will843: 28 December 2011 - 10:02 PM

See here how to access Windows firewall settings: http://www.sevenforums.com/tutorials/522-windows-firewall-turn-off.html
See if you can turn if off/on.

Ok... I believe Im worse off now then when I began.

I downloaded Avast. Upon it loading and saying "Welcome to Avast" it immediately went "ding ding ding" and a red screen saying it has blocked a trojan horse, and moved it to the "chest" appeared.

It then recommended I do a reboot, scan, where it would reboot the computer, and scan prior to loading any files. I allowed it to do so.

Upon rebooting, it went through its scan (taking around 2 hours or so). Now, as I said, im no expert here... but if every "is infected" file that I saw scroll through the screen is truely a virus... this computer is more dangerous then a 10c hooker.

I did notice at one point, that some of my Quickbooks files were infected (according to the screen while it was doing its scan). Around 6 months or so ago, I got a virus, which I was able to clean by using this website, from my phone, and get everything up and running. The only thing that never worked, was my Quickbooks file, and since I hadnt updated it in 3-4 months, I had to restore that update, and lost those months worth of data. Oh well. I now notice that this Avast has it listed as being infected again.

Now, it finishes its scan, and Windows boots up. I log into my user, and am able to do nothing. I can click on things, double click, start menu, etc, but when the computer doesnt respond. If I click on the start menu, it comes up, I can navigate through the menus, but when I click on a final "item" it wont load or anything. Same if I double click on icons on my desktop... nothing. Start menu, reboot... didnt even respond. I had to hold my power button to get it to shut down, and booted it back up in safe mode w/ networking. I have since now saved my quickbooks file on an external hard drive, in case I am forced to delete it due to what I saw in the log.

I will await further direction... so I dont screw anything else up...

Also... Windows Firewall.

When I clink on "turn on/off" it comes up with a screen to "Use Recommended Settings" I click on "Use Recommended Settings" and it comes up with a warning window stating "Windows Firewall cant change some of your settings. Error Code 0x80070424.

So, my guess is no, it isnt on, and I cant currently turn it on.

William