Browser hijack redirection- HJT Log

Computer was previously infected by Antivirus System Pro, which was removed with PC Tools internet security. However, when I do a google search and click on a result, I am redirected to different sites.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:10:59 PM, on 12/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\PC Tools Internet Security\pctsTray.exe
C:\Program Files\PC Tools Internet Security\pctsAuxs.exe
C:\Program Files\PC Tools Internet Security\pctsSvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PC Tools Internet Security\TFEngine\TFService.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.stonewaveproductions.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\PC Tools Internet Security\BDT\PCTBrowserDefender.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\PC Tools Internet Security\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Internet Security\pctsTray.exe"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Internet Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Internet Security\pctsSvc.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\PC Tools Internet Security\TFEngine\TFService.exe

--
End of file - 3552 bytes

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.


If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

The problem I've been having is that all my google searches are being directed to different sites. Every time I search on google and click a result I am brought to another webpage. I have run scans with PC tools internet security, MalwareBytes Anti-Malware, and Ad-Aware, and none of the searches have found any malicious items. Here is the dds log.



DDS (Ver_09-12-01.01) - NTFSx86
Run by Jeff at 20:47:53.51 on Fri 01/08/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.2384 [GMT -5:00]

AV: Internet Security Anti-Virus *On-access scanning enabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
FW: Internet Security Firewall *enabled* {2BF21FEC-A5BE-424D-BDD7-3229CC84ED22}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\WIBUKEY\H2O\CXWibu.exe
C:\Program Files\PC Tools Internet Security\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PC Tools Internet Security\pctsAuxs.exe
C:\Program Files\PC Tools Internet Security\pctsSvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\PC Tools Internet Security\TFEngine\TFService.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeff\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.stonewaveproductions.com/
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools internet security\bdt\PCTBrowserDefender.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools internet security\bdt\PCTBrowserDefender.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [M-Audio Taskbar Icon] c:\windows\system32\M-AudioTaskBarIcon.exe
mRun: [H2OWIBU] c:\program files\wibukey\h2o\CXWibu.exe
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-12-2 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-12-1 207280]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-12-1 51984]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-12-1 59664]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-12-1 229304]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-12-1 87784]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools internet security\pctsAuxs.exe [2009-12-1 358600]
R3 BCMIDI;BCMIDI;c:\windows\system32\drivers\bcmidi2.sys [2005-10-19 22432]
R3 cxwibu;Team H2O WIBU Driver;c:\program files\wibukey\h2o\cxwibu.sys [2009-12-20 7040]
R3 MAUSBMP;Service for M-Audio Mobile Pre (WDM);c:\windows\system32\drivers\mausbmp.sys [2009-10-15 154248]
R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [2009-12-1 32552]
R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2009-12-1 70280]
R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [2009-12-1 46592]
R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-12-1 115216]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-12-1 70408]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-12-1 33552]
R3 ThreatFire;ThreatFire;c:\program files\pc tools internet security\tfengine\tfservice.exe service --> c:\program files\pc tools internet security\tfengine\TFService.exe service [?]
S?3 sdCoreService;PC Tools Security Service;c:\program files\pc tools internet security\pctsSvc.exe [2009-12-1 1141224]
S3 MarkFun_NT;MarkFun_NT;c:\program files\gigabyte\@bios\markfun.w32 [2009-10-7 17912]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]
S4 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools internet security\bdt\BDTUpdateService.exe [2009-12-1 112592]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-13 135664]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

=============== Created Last 30 ================

2010-01-08 23:29:27 0 d-----w- c:\docume~1\jeff\applic~1\GetRightToGo
2009-12-26 04:15:22 0 d-----w- c:\docume~1\jeff\applic~1\Cycling '74
2009-12-26 04:15:13 0 d-----w- c:\docume~1\jeff\applic~1\PACE Anti-Piracy
2009-12-26 04:15:13 0 d-----w- c:\docume~1\alluse~1\applic~1\PACE Anti-Piracy
2009-12-26 04:15:12 0 d-----w- c:\program files\common files\PACE Anti-Piracy
2009-12-26 04:05:27 0 d-----w- c:\program files\Cycling '74
2009-12-25 06:05:46 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
2009-12-22 00:58:45 0 d-----w- c:\docume~1\jeff\applic~1\Waves Audio
2009-12-22 00:57:21 0 d-----w- c:\program files\YAMAHA
2009-12-22 00:20:53 0 d-----w- c:\docume~1\jeff\applic~1\Waves Preferences
2009-12-22 00:16:50 0 d-----w- c:\program files\Waves
2009-12-22 00:15:58 5 ----a-w- c:\windows\wapc.dat
2009-12-22 00:15:58 5 ----a-w- c:\windows\wamv.dat
2009-12-22 00:15:00 0 d-----w- c:\program files\Wave Arts
2009-12-22 00:12:51 0 d-----w- c:\docume~1\jeff\applic~1\Voxengo
2009-12-22 00:04:48 0 d-----w- c:\program files\u-he
2009-12-21 23:58:12 53248 ----a-w- c:\windows\system32\stu.dll
2009-12-21 23:56:38 0 d-----w- c:\program files\Sonic Foundry Noise Reduction Plug-In
2009-12-21 23:55:16 306688 ----a-w- c:\windows\IsUninst.exe
2009-12-21 23:39:13 0 d-----w- c:\program files\Sonnox
2009-12-21 23:31:17 0 d-----w- c:\program files\rgcaudio software
2009-12-21 23:23:31 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-12-21 23:23:31 905290 ----a-w- c:\windows\system32\libmmd.dll
2009-12-21 23:23:31 0 d-----w- c:\program files\PSP VintageWarmer
2009-12-21 23:22:06 0 d-----w- c:\windows\PSP StereoPack
2009-12-21 23:22:06 0 d-----w- c:\program files\PSP StereoPack 1.8
2009-12-21 22:58:27 0 d-----w- c:\windows\PSP MasterComp
2009-12-21 22:58:27 0 d-----w- c:\program files\PSP MasterComp 1.0.0
2009-12-21 22:52:25 0 d-----w- c:\program files\PSPaudioware
2009-12-21 22:33:05 32 ----a-w- c:\windows\system32\w3data.vss
2009-12-21 22:33:05 32 ----a-w- c:\windows\system32\msvcsv60.dll
2009-12-21 22:33:05 32 ----a-w- c:\windows\msocreg32.dat
2009-12-21 22:32:07 0 d-----w- c:\program files\IK Multimedia
2009-12-21 22:24:37 0 d-----w- c:\program files\Antares
2009-12-21 00:16:44 0 d-----w- c:\docume~1\jeff\applic~1\Uniblue
2009-12-21 00:16:34 0 d-----w- c:\program files\Uniblue
2009-12-21 00:15:42 0 d-----w- c:\program files\GiPo@Utilities
2009-12-21 00:15:42 0 d-----w- c:\program files\common files\Gibinsoft Shared
2009-12-20 23:25:56 1228800 ------w- c:\windows\system32\WibuKe32.cpl
2009-12-20 23:25:54 524288 ------w- c:\windows\system32\wibuKJni.dll
2009-12-20 23:25:54 356352 ------w- c:\windows\system32\WkExt32.dll
2009-12-20 23:25:51 57552 ------w- c:\windows\system32\WkDos.exe
2009-12-20 23:25:49 17408 ------w- c:\windows\system32\drivers\Wibukey2.sys
2009-12-20 23:25:46 70144 ------w- c:\windows\system32\drivers\wibukey.sys
2009-12-20 23:25:46 53936 ------w- c:\windows\system\WkWin.dll
2009-12-20 23:25:46 139264 ------w- c:\windows\system32\WkWin32.dll
2009-12-20 23:25:36 0 d-----w- c:\program files\WIBUKEY
2009-12-20 23:25:36 0 d-----w- c:\program files\WIBU-SYSTEMS
2009-12-20 05:03:05 0 d--h--w- c:\program files\Zero G Registry
2009-12-20 04:54:28 0 d-----w- c:\program files\Softube
2009-12-20 04:52:50 1777664 ----a-w- c:\windows\system32\gdiplus.dll
2009-12-20 04:51:27 0 d-----w- c:\windows\Downloaded Installations
2009-12-20 04:48:34 0 d-----w- c:\program files\Mellowmuse
2009-12-19 10:59:21 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-17 07:04:33 0 d-----w- c:\program files\CleanUp!
2009-12-17 06:43:56 0 d-----w- c:\windows\system32\appmgmt
2009-12-17 00:57:27 0 d-----w- c:\windows\system32\NtmsData
2009-12-16 01:20:42 0 d-----w- c:\docume~1\jeff\applic~1\NCH Software
2009-12-16 01:20:18 0 d-----w- c:\program files\NCH Software
2009-12-12 23:31:50 0 d-----w- c:\program files\Trend Micro
2009-12-11 07:55:07 0 d-----w- c:\docume~1\jeff\applic~1\Ableton
2009-12-11 05:54:45 0 d-----w- c:\docume~1\alluse~1\applic~1\Ableton
2009-12-11 05:51:25 0 d-----w- c:\program files\Ableton

==================== Find3M ====================

2010-01-07 21:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-04 06:12:17 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-02 18:56:16 92792 ----a-w- c:\windows\system32\drivers\TPkd.sys
2009-12-02 18:51:08 54328 ----a-w- c:\windows\system32\drivers\iLokDrvr.sys
2009-12-02 05:28:05 93360 ------w- c:\windows\system32\drivers\SBREDrv.sys
2009-12-02 05:27:49 15880 ------w- c:\windows\system32\lsdelete.exe
2009-10-28 01:36:01 1152444 ------w- c:\windows\UDB.zip
2009-10-15 22:54:37 411368 ------w- c:\windows\system32\deploytk.dll
2009-10-15 15:56:29 118784 ------w- c:\windows\dsdxirmv.exe

============= FINISH: 20:49:44.65 ===============

I disabled my av before running this but the results say it was active. should I redo the dds scan?

Hello jroberts613 and Welcome to BleepingComputer.

I'm DocSatan and I will be helping you with your "Malware" related computer problems. Please give me some time to research your Log and I will get back to you ASAP.

In the meantime:

1. Please TRACK this Topic

• At the top-right of this thread, click on the button.
• In the list that drops down, click on
• Place a tick-mark next to Immediate E-Mail Notification
• Then click on
• You will now receive an e-mail as soon as a Reply is made to this Topic.

2. Do Not Make Any Changes to the "Infected" Computer.

• Once you have posted a NEW DDS Log, Do Not make any changes to the computer. I will be researching the DDS Log that you post and any changes made to the system might interfere with the FIX that I prepare for you. Examples of "Changes":
• Deleting Files/Folders
• Installing/Uninstalling Programs
• Running Anti-Virus, Anti-Malware, Anti-Spyware, etc., Programs

3. Please do not seek Help with this issue at another Computer Help Forum

• While we are working together I must insist that you do not seek help with this matter at any other Help Forum.
• Having multiple (more than one) Forums provide help for the same computer issue will result in confusion with preparing a Fix.
• It is also not fair to the Volunteer who is helping you, as her/his time will be wasted trying to fix a computer that someone else is also trying to fix.
• So, if you have posted at another Computer Help Forum for this same issue I would ask that you choose which Forum that you wish to stay with and inform the other Forum(s) that you no longer require their assistance.

4. Throughout the course of us working together, I will be posting step-by-step procedures for you to follow on your computer.

• If at any time you do not fully understand what I have said, or you are not exactly sure what you are supposed to do, then please stop there and Post back to this topic and ask your questions. That way I will be able to more clearly explain the step/procedure and we won't have to worry about any steps being done incorrectly.

Doc.

I have also recently began to experience "Generic Host Process for Win32" errors. I have read that this is a common error in Windows XP SP2, but I have SP3

Hello jroberts613,

A couple questions:

• Can you tell me where the Google Redirects are redirecting you to, i.e., the web pages?
• What are you doing when you receive those Win32 error? Running MBAM or Ad-Aware?

1. Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

Doc.

The site I am most often redirected to is http://r9237242.**/dZW2ZGDe5b7jkQo0ae35ba4c73ea231833d074501027277d08x]

They win32 errors seem to only occur when I am running Cakewalk Sonar (an audio production program)

I will be out of town all this week, and therefore and unable to run the GMER scan on the infected machine at the moment. I will be back on monday and will run the scan then. Sorry for the delay, and thanks for your help.

Edited by myrti, 11 January 2010 - 03:43 PM.
disabled link so noone would click it

OK jroberts613,

I'll be here when you get back.

Hey jroberts613,

Just checking in to see if you've made it back.

Just post the GMER results when you get a chance.

I got back later than I expected, so I didn't have time to run GMER last night. Upon running it today, after a while of scanning, an error popped up saying GMER experienced a problem and had to close. I then tried to run it again, and I got a blue screen telling me to restart my computer. I have restarted and am trying to run GMER one last time. If it works successfully, I will post the results, if it has another problem, I will let you know.

here are the results of the GMER scan. After copying the results and trying to open Internet Explorer, the computer once again went to a blue screen. I dont know if this was caused by GMER, some kind of malware, or another new problem with the computer, but I thought I should mention it.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-19 17:11:44
Windows 5.1.2600 Service Pack 3
Running: s7j9tvhg.exe; Driver: C:\DOCUME~1\Jeff\LOCALS~1\Temp\ufgyikoc.sys


---- System - GMER 1.0.15 ----

SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwCreateKey [0xF725EA1C]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF7284CDC]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF7284ECE]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteKey [0xF725EC10]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteValueKey [0xF725ECB6]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwOpenKey [0xF725E90C]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF72A4D30]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwSetValueKey [0xF725EE52]
SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwTerminateProcess [0xF7260B30]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2C68 805044F4 4 Bytes JMP 9192F725
.text ntkrnlpa.exe!ZwCallbackReturn + 2DA0 8050462C 4 Bytes JMP EE7B3D56
.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xF72E07A4]
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF5A3C000, 0x1A0E00, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Ip pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Tcp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\Udp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
AttachedDevice \Driver\Tcpip \Device\RawIp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

Device \FileSystem\Fastfat \Fat A98F2D20
Device \FileSystem\Fastfat \Fat A9902428

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8AFB9618

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesProcessed 0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@LastTraceFailure 0

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Edited by jroberts613, 19 January 2010 - 05:40 PM.

Hello Jroberts613,

One of the files detected by GMER is identified as a Backdoor/IRCBot Trojan

Important Note: Backdoor/IRCBot Trojans are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms. Remote attackers use Backdoor Trojans as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge. When infected by one of them you should disconnect the computer from the Internet until your system is cleaned. If your computer was used for online banking or has credit card information on it, ALL passwords should be changed immediately, including those used for email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breech.

• More info can be found here:
• How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
• What Should I Do If I've Become A Victim Of Identity Theft?
• Identity Theft Victims Guide - What to do

Though the Trojan has been identified and can be killed, because of it's Backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS.

• If you choose to Re-Format and Re-Install, see these links for instructions:
• When should I re-format? How should I reinstall?
• Help: I Got Hacked. Now What Do I Do?
• Where to draw the line? When to recommend a format and reinstall?

We can attempt to clean this machine but we CANNOT guarantee that it will be 100% secure afterwards. Please post a Reply to this Topic informing me of your decision as to whether or not you will be Reformatting.

Doc.

The infected computer is primarily used for music production. If I change all my passwords (which I've already done) and no longer use the computer for anything requiring a password, and just use it for simple web browsingrnet when using the inte, do you think it is necessary to reformat? Will the infection be able to damage my computer further if it is not removed, or is it just a security risk? I have another computer that I use for basically everything besides music production and burning DVDs, so the infected machine can be used only for those purposes. Let me know what you think I should do in this situation

Edited by jroberts613, 20 January 2010 - 10:14 PM.

Hi jroberts613,

With this type of infection, Backdoor/IRC Bot Trojan, I always recommend a Reformat and Reinstall of the Operating System.

• This infection has compromised the security of this computer, meaning that it can never be trusted again.
• Though you may not have anything on the computer that you are worried about, the author of this Trojan can still use your computer to attack other computers on the Internet.

So, unless you do not have an OS disk and/or cannot back up the Important Information on this computer I would suggest that you do a Reformat and Reinstall.

Sorry to be the bearer of bad news. Hope this has helped some. Please let me know how you have decided to proceed.

Doc.