Redirect Virus

Hi there,
Whenever i go on google(UK) on IE, it does not suggest me anything and it is very slow.
Also it opens search pages on different tabs and redirects them to Ads, but i go onto preferences and i set them so it does suggest and does not open sites on new tabs.
But it still does not work.
I went on yahoo and it does the same thing.
Also on Mozilla home page
http://en-gb.start3.mozilla.com/firefox?cl...:en-GB:official
And it says that

The page isn't redirecting properly
Firefox has detected that the server is redirecting the request for this address in a way that will never complete
* This problem can sometimes be caused by disabling or refusing to accept
cookies.
I thought this may be a different problem or is it linked?

And so i am stuck.
I ran Malware first and no malicious things came up.
then i ran the Avast! and nothing came up either.
Then i ran on HJT
and here is my log:
i was wondering if i have a virus and if you could help me


Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 19:37:34, on 27/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

{EDITED out HJT log~~boopme}

Thanks

Edited by boopme, 28 March 2010 - 03:49 PM.

Hi,


No HijackThis logs should be posted here.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.



We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download (Recommended)
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
• Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
• Open on your desktop.
• Click the tab.
• Click the button.
• Check all seven boxes:
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Elle

Hi,
I can't seem to update Malwarebytes
An error mesage keeps coming up,
Error code 732.
and i can not access the Malwarebytes website.

Anyway this is my scan:

THere does not seem to be anything wrong but my google is still redirected?

Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28/03/2010 20:03:55
mbam-log-2010-03-28 (20-03-55).txt

Scan type: Full Scan (C:\|I:\|J:\|)
Objects scanned: 275753
Time elapsed: 55 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0


Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Hi here is my Root Repeal report

Path: c:\documents and settings\michael\local settings\temp\~df5a76.tmp
Status: Allocation size mismatch (API: 131072, Raw: 16384)

Path: c:\documents and settings\michael\local settings\temp\~df6e35.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\michael\local settings\temp\~df7910.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa89356b8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8935574

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa8935a52

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa893514c

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa893564e

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa893508c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa89350f0

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa893576e

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa893572e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa89358ae

Stealth Objects
-------------------
Object: Hidden Module [Name: z00clicker.dll]
Process: iexplore.exe (PID: 1584) Address: 0x10000000 Size: 225280

Object: Hidden Module [Name: z00clicker.dll]
Process: iexplore.exe (PID: 3200) Address: 0x10000000 Size: 225280

Object: Hidden Module [Name: z00clicker.dll]
Process: iexplore.exe (PID: 2576) Address: 0x10000000 Size: 225280

Object: Hidden Module [Name: z00clicker.dll]
Process: iexplore.exe (PID: 2920) Address: 0x10000000 Size: 225280

Object: Hidden Module [Name: z00clicker.dll]
Process: iexplore.exe (PID: 4752) Address: 0x10000000 Size: 225280

==EOF==

Thanks

Hi ,


So lets see.

Firstly try this:

Please download and scan with SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
• In the Main Menu, click the Preferences... button.
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen and exit the program.
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes" and reboot normally.
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.



Elle

Hi,

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/28/2010 at 11:51 PM

Application Version : 4.34.1000

Core Rules Database Version : 4596
Trace Rules Database Version: 1978

Scan type : Complete Scan
Total Scan Time : 01:10:37

Memory items scanned : 577
Memory threats detected : 0
Registry items scanned : 5733
Registry threats detected : 1
File items scanned : 126960
File threats detected : 131

Adware.Tracking Cookie
C:\Documents and Settings\Michael\Cookies\michael@statse.webtrendslive[3].txt
C:\Documents and Settings\Michael\Cookies\michael@collective-media[1].txt
C:\Documents and Settings\Michael\Cookies\michael@media6degrees[2].txt
C:\Documents and Settings\Michael\Cookies\michael@rts.pgmediaserve[1].txt
C:\Documents and Settings\Michael\Cookies\michael@stopzilla[3].txt
C:\Documents and Settings\Michael\Cookies\michael@mediaplex[2].txt
C:\Documents and Settings\Michael\Cookies\michael@advertise[2].txt
C:\Documents and Settings\Michael\Cookies\michael@track.adform[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.bleepingcomputer[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adbrite[2].txt
C:\Documents and Settings\Michael\Cookies\michael@fastclick[1].txt
C:\Documents and Settings\Michael\Cookies\michael@warez-bb[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.pushplay[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adbureau[1].txt
C:\Documents and Settings\Michael\Cookies\michael@videoegg.adbureau[2].txt
C:\Documents and Settings\Michael\Cookies\michael@doubleclick[1].txt
C:\Documents and Settings\Michael\Cookies\michael@xiti[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.cineble[1].txt
C:\Documents and Settings\Michael\Cookies\michael@specificclick[1].txt
C:\Documents and Settings\Michael\Cookies\michael@www.mediafire[3].txt
C:\Documents and Settings\Michael\Cookies\michael@data.coremetrics[1].txt
C:\Documents and Settings\Michael\Cookies\michael@www.warez-bb[2].txt
C:\Documents and Settings\Michael\Cookies\michael@www.stopzilla[1].txt
C:\Documents and Settings\Michael\Cookies\michael@revsci[3].txt
C:\Documents and Settings\Michael\Cookies\michael@hitbox[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ad2.yieldmanager[2].txt
C:\Documents and Settings\Michael\Cookies\michael@chitika[2].txt
C:\Documents and Settings\Michael\Cookies\michael@smartadserver[1].txt
C:\Documents and Settings\Michael\Cookies\michael@server.iad.liveperson[2].txt
C:\Documents and Settings\Michael\Cookies\michael@serving-sys[3].txt
C:\Documents and Settings\Michael\Cookies\michael@content.yieldmanager[3].txt
C:\Documents and Settings\Michael\Cookies\michael@server.iad.liveperson[3].txt
C:\Documents and Settings\Michael\Cookies\michael@tribalfusion[4].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.ad4game[1].txt
C:\Documents and Settings\Michael\Cookies\michael@mediafire[1].txt
C:\Documents and Settings\Michael\Cookies\michael@clicksor[2].txt
C:\Documents and Settings\Michael\Cookies\michael@apmebf[2].txt
C:\Documents and Settings\Michael\Cookies\michael@myroitracking[3].txt
C:\Documents and Settings\Michael\Cookies\michael@at.atwola[2].txt
C:\Documents and Settings\Michael\Cookies\michael@ehg-tfl.hitbox[1].txt
C:\Documents and Settings\Michael\Cookies\michael@advertising[3].txt
C:\Documents and Settings\Michael\Cookies\michael@tacoda[3].txt
C:\Documents and Settings\Michael\Cookies\michael@tradedoubler[3].txt
C:\Documents and Settings\Michael\Cookies\michael@interclick[3].txt
C:\Documents and Settings\Michael\Cookies\michael@questionmarket[1].txt
C:\Documents and Settings\Michael\Cookies\michael@content.yieldmanager[4].txt
C:\Documents and Settings\Michael\Cookies\michael@track.adform[3].txt
C:\Documents and Settings\Michael\Cookies\michael@adviva[2].txt
C:\Documents and Settings\Michael\Cookies\michael@pornhub[2].txt
C:\Documents and Settings\Michael\Cookies\michael@cgm.adbureau[1].txt
C:\Documents and Settings\Michael\Cookies\michael@richmedia.yahoo[2].txt
C:\Documents and Settings\Michael\Cookies\michael@atdmt[1].txt
C:\Documents and Settings\Michael\Cookies\michael@bs.serving-sys[3].txt
C:\Documents and Settings\Michael\Cookies\michael@overture[2].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.ft[2].txt
C:\Documents and Settings\Michael\Cookies\michael@tribalfusion[1].txt
C:\Documents and Settings\Michael\Cookies\michael@atdmt[2].txt
C:\Documents and Settings\Michael\Cookies\michael@www.teenfitnessadvice[2].txt
C:\Documents and Settings\CJ\Cookies\cj@adserver.bridgebase[2].txt
C:\Documents and Settings\CJ\Cookies\cj@adtech[1].txt
C:\Documents and Settings\CJ\Cookies\cj@atdmt[1].txt
C:\Documents and Settings\CJ\Cookies\cj@bs.serving-sys[1].txt
C:\Documents and Settings\CJ\Cookies\cj@doubleclick[2].txt
C:\Documents and Settings\CJ\Cookies\cj@imrworldwide[2].txt
C:\Documents and Settings\CJ\Cookies\cj@microsoftwindows.112.2o7[1].txt
C:\Documents and Settings\CJ\Cookies\cj@msnportal.112.2o7[1].txt
C:\Documents and Settings\CJ\Cookies\cj@nextmedia[2].txt
C:\Documents and Settings\CJ\Cookies\cj@serving-sys[2].txt
C:\Documents and Settings\CJ\Cookies\cj@tribalfusion[2].txt
C:\Documents and Settings\CJ\Cookies\cj@tw.nextmedia[1].txt
C:\Documents and Settings\CJ\Cookies\cj@zedo[2].txt
C:\Documents and Settings\Michael\Cookies\michael@ad.yieldmanager[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ad.yieldmanager[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adserver.adtechus[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adtech[1].txt
C:\Documents and Settings\Michael\Cookies\michael@advertising[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adviva[1].txt
C:\Documents and Settings\Michael\Cookies\michael@bravenet[2].txt
C:\Documents and Settings\Michael\Cookies\michael@bs.serving-sys[2].txt
C:\Documents and Settings\Michael\Cookies\michael@burstnet[1].txt
C:\Documents and Settings\Michael\Cookies\michael@casalemedia[1].txt
C:\Documents and Settings\Michael\Cookies\michael@content.yieldmanager[1].txt
C:\Documents and Settings\Michael\Cookies\michael@content.yieldmanager[2].txt
C:\Documents and Settings\Michael\Cookies\michael@e-2dj6wgkyomd5wcp.stats.esomniture[2].txt
C:\Documents and Settings\Michael\Cookies\michael@e-2dj6wgkywhd5aep.stats.esomniture[2].txt
C:\Documents and Settings\Michael\Cookies\michael@interclick[1].txt
C:\Documents and Settings\Michael\Cookies\michael@mediafire[2].txt
C:\Documents and Settings\Michael\Cookies\michael@mediafire[3].txt
C:\Documents and Settings\Michael\Cookies\michael@myroitracking[2].txt
C:\Documents and Settings\Michael\Cookies\michael@questionmarket[2].txt
C:\Documents and Settings\Michael\Cookies\michael@revsci[1].txt
C:\Documents and Settings\Michael\Cookies\michael@revsci[2].txt
C:\Documents and Settings\Michael\Cookies\michael@serving-sys[1].txt
C:\Documents and Settings\Michael\Cookies\michael@serving-sys[2].txt
C:\Documents and Settings\Michael\Cookies\michael@smartadserver[2].txt
C:\Documents and Settings\Michael\Cookies\michael@socialmedia[2].txt
C:\Documents and Settings\Michael\Cookies\michael@stat.dealtime[2].txt
C:\Documents and Settings\Michael\Cookies\michael@statse.webtrendslive[1].txt
C:\Documents and Settings\Michael\Cookies\michael@tacoda[2].txt
C:\Documents and Settings\Michael\Cookies\michael@tradedoubler[1].txt
C:\Documents and Settings\Michael\Cookies\michael@tribalfusion[3].txt
C:\Documents and Settings\Michael\Cookies\michael@www.mediafire[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@ad.yieldmanager[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@ads.adultswim[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@ads.contactmusic[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@adserver.adtechus[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@adtech[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@adultswim[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@advertising[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@adviva[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@at.atwola[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@atdmt[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@bs.serving-sys[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@chitika[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@content.yieldmanager[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@cracked[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@dmtracker[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@doubleclick[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@e-2dj6wjlowmc5agq.stats.esomniture[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@games.adultswim[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@imrworldwide[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@invitemedia[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@media6degrees[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@msnportal.112.2o7[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@revsci[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@serving-sys[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@specificclick[2].txt
C:\Documents and Settings\Tamy\Cookies\tamy@tacoda[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@tradedoubler[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@tribalfusion[1].txt
C:\Documents and Settings\Tamy\Cookies\tamy@trinitymirror.112.2o7[1].txt

Adware.IEPlugin
HKCR\Remove


First time
then next day i ran it again

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 03/29/2010 at 12:49 PM

Application Version : 4.34.1000

Core Rules Database Version : 4596
Trace Rules Database Version: 1978

Scan type : Complete Scan
Total Scan Time : 01:00:58

Memory items scanned : 535
Memory threats detected : 0
Registry items scanned : 5730
Registry threats detected : 0
File items scanned : 114801
File threats detected : 27

Adware.Tracking Cookie
C:\Documents and Settings\Michael\Cookies\michael@collective-media[2].txt
C:\Documents and Settings\Michael\Cookies\michael@stopzilla[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.bleepingcomputer[2].txt
C:\Documents and Settings\Michael\Cookies\michael@adserver.bridgebase[2].txt
C:\Documents and Settings\Michael\Cookies\michael@asianmedia[1].txt
C:\Documents and Settings\Michael\Cookies\michael@doubleclick[3].txt
C:\Documents and Settings\Michael\Cookies\michael@xiti[1].txt
C:\Documents and Settings\Michael\Cookies\michael@www.stopzilla[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ad2.yieldmanager[1].txt
C:\Documents and Settings\Michael\Cookies\michael@smartadserver[1].txt
C:\Documents and Settings\Michael\Cookies\michael@serving-sys[2].txt
C:\Documents and Settings\Michael\Cookies\michael@content.yieldmanager[1].txt
C:\Documents and Settings\Michael\Cookies\michael@clicksor[1].txt
C:\Documents and Settings\Michael\Cookies\michael@myroitracking[1].txt
C:\Documents and Settings\Michael\Cookies\michael@at.atwola[2].txt
C:\Documents and Settings\Michael\Cookies\michael@advertising[2].txt
C:\Documents and Settings\Michael\Cookies\michael@tacoda[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.ft[3].txt
C:\Documents and Settings\Michael\Cookies\michael@atdmt[1].txt
C:\Documents and Settings\Michael\Cookies\michael@overture[2].txt
C:\Documents and Settings\Michael\Cookies\michael@bs.serving-sys[2].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.bleepingcomputer[1].txt
C:\Documents and Settings\Michael\Cookies\michael@ads.ft[2].txt
C:\Documents and Settings\Michael\Cookies\michael@atdmt[2].txt
C:\Documents and Settings\Michael\Cookies\michael@clicksor[2].txt
C:\Documents and Settings\Michael\Cookies\michael@collective-media[1].txt
C:\Documents and Settings\Michael\Cookies\michael@doubleclick[2].txt

Hi,
Google still gets redirected
and random ads still just popup

Let's try updating Malwarebytes again.

Take a look at this tutorial Malwarebytes Anti-Malware troubleshoot. Exactly to those steps you are taken to.(1-4 from error 732)

About the error you've encountered.Follow the steps and please tell me if it worked.

Also, run a FULL scan with it and post the logs if it worked.


Elle

Hi got Malwarebytes updated
thanks


Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3930

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

01/04/2010 12:32:51
mbam-log-2010-04-01 (12-32-51).txt

Scan type: Full scan (C:\|I:\|J:\|)
Objects scanned: 236509
Time elapsed: 50 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
I:\RECYCLER\S-1-5-21-448539723-1343024091-1801674531-1003\Di2094\system32\dllcache\help.exe (Worm.Autorun. -> Quarantined and deleted successfully.
I:\RECYCLER\S-1-5-21-448539723-1343024091-1801674531-1003\Di2094\system32\dllcache\sysinfo.exe (Worm.Autorun. -> Quarantined and deleted successfully.


im stil google is redirected though.

google still redirected.

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
• Now click the Scan button. If you see a rootkit warning window, click OK.
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
• Click the Copy button and paste the results into your next reply.
• Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.




Elle

Hi ,

Sorry for the late reply

here is my rootkit log
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-05 12:31:52
Windows 5.1.2600 Service Pack 3
Running: pnvhkzug.exe; Driver: C:\DOCUME~1\Michael\LOCALS~1\Temp\pxtdqpow.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xA8470C56]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xA8470B12]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xA84710C6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xA8470FF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xA84706E8]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xA8470BEC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xA8470628]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xA847068C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xA8470D0C]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xA8471194]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xA8470CCC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xA8470E4C]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xA8534320]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xA847D4FE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xA847D322]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xA847D45C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2CD4 80504560 4 Bytes CALL 08F88C6B
PAGE ntkrnlpa.exe!ZwLoadDriver 8058413A 7 Bytes JMP A847D460 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!NtCreateSection 805AB3AE 7 Bytes JMP A847D326 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC512 5 Bytes JMP A84794BA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ObInsertObject 805C2F96 5 Bytes JMP A847A972 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1136 7 Bytes JMP A847D502 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xB9F21780]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[768] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00390002
IAT C:\WINDOWS\system32\services.exe[768] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00390000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort0 [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort1 [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort2 [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdePort3 [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [B9F14B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \FileSystem\Fastfat \Fat A71AFD20

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Michael\My Documents\The Prag Award.doc 24064 bytes
File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Hi,


With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!


Elle