Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Infected with google redirect virus

  • This topic is locked This topic is locked
3 replies to this topic

#1 ersl


  • Members
  • 3 posts
  • Local time:09:56 AM

Posted 23 June 2010 - 11:56 PM


I got an auto redirect happening on some of google's web sites, I just discovered it redirects me from Google Analytics, as well as help in my Google Account, plus I could not get accepted itoi the google adsense program for 6 months because of it.

I have XO Home running on Eeepc 1000H, 1 Gb RAM, 160 Gb HD, 1.66 Mhz Intel Atom.

I have tried all the Trojan, etc apps I could find, even the Google Redirect Removal tool. I got rid of some viruses/trojans that must have been there for some time, even deactivated System Restore and Windows Recovery Console. Now it all works like a new machine, except for the redirect. Here's the redirect on a url:


Here is the DDX text log:

DDS (Ver_10-03-17.01) - NTFSx86
Run by ersl at 22:11:09.06 on Thu 07/22/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.559 [GMT 8:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: 3.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\EeePC\ACPI\AsTray.exe
C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe
C:\Program Files\EeePC\ACPI\AsEPCMon.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe
C:\Program Files\Google\Update\\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Documents and Settings\ersl\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://flvdirect.iamwired.net/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - c:\program files\ask.com\GenericAskToolbar.dll
uURLSearchHooks: Traffic Sparks Toolbar: {97170eca-317a-454b-914b-a0f37ca2912c} - c:\program files\traffic_sparks\tbTraf.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Traffic Sparks Toolbar: {97170eca-317a-454b-914b-a0f37ca2912c} - c:\program files\traffic_sparks\tbTraf.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Windows Live Toolbar Helper: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
BHO: 1 (0x1) - No File
BHO: Sopcast Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Windows Live Toolbar: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\windows live toolbar\msntb.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Sopcast Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
TB: Traffic Sparks Toolbar: {97170eca-317a-454b-914b-a0f37ca2912c} - c:\program files\traffic_sparks\tbTraf.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Web Video Downloader] "c:\program files\sothink web video downloader stand-alone\VideoDownloader.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AsusTray] c:\program files\eeepc\acpi\AsTray.exe
mRun: [AsusACPIServer] c:\program files\eeepc\acpi\AsAcpiSvr.exe
mRun: [AsusEPCMonitor] c:\program files\eeepc\acpi\AsEPCMon.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\docume~1\ersl\startm~1\programs\startup\Broadband Connection 2.lnk -
StartupFolder: c:\docume~1\ersl\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\superh~1.lnk - c:\program files\asus\eeepc\super hybrid engine\SuperHybridEngine.exe
IE: &Save Flash In This Page by Flash Saver
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: Translate this web page with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Action.htm
IE: {09EA1F80-F40A-11D1-B792-444553540001}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\\gears.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/da/PCPitStop.CAB
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/da2/PCPitStop2.cab
TCP: {352256BF-021F-4121-AF8B-3045FB42C868} =,
TCP: {731FAF43-B558-47B3-934B-F93C47A037A0} =
TCP: {95525638-DAD0-4B57-A0C7-A21BC9F43F5C} =
TCP: {F8DDE6D7-F996-4886-BE25-F3DF1570965E} =
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\skype recorder\skype recorder v7.0\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ersl\applic~1\mozilla\firefox\profiles\n4nculp3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - hxxp://flvdirect.iamwired.net/
FF - prefs.js: keyword.URL - hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\documents and settings\ersl\application data\mozilla\firefox\profiles\n4nculp3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\ersl\application data\mozilla\firefox\profiles\n4nculp3.default\extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}\components\nstidy.dll
FF - component: c:\documents and settings\ersl\application data\mozilla\firefox\profiles\n4nculp3.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - component: c:\documents and settings\ersl\application data\mozilla\firefox\profiles\n4nculp3.default\extensions\{d249fd00-4df9-11d9-9fdc-0080481ada61}\components\mpint.dll
FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\ersl\application data\mozilla\firefox\profiles\n4nculp3.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\ersl\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\ersl\local settings\application data\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\np32asw.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - user.js: browser.cache.memory.capacity - 16000
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.urlbar.autofill - true
FF - user.js: content.max.tokenizing.time - 3000000
FF - user.js: content.maxtextrun - 4095
FF - user.js: content.notify.backoffcount - 5
FF - user.js: content.notify.interval - 1000000
FF - user.js: content.notify.ontimer - true
FF - user.js: content.switch.threshold - 1000000
FF - user.js: dom.disable_window_status_change - true
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: network.http.pipelining - true
FF - user.js: network.http.pipelining.firstrequest - true
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.proxy.pipelining - true
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: nglayout.initialpaint.delay - 1000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
FF - user.js: yahoo.homepage.dontask - true
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-6-17 11608]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-3-14 33800]
R2 0VsNdis08;VitalAgent Network Driver 8.1;c:\program files\ins\vitalagent\program\VsNdis08.sys [2010-6-9 31671]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-6-17 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-6-17 267432]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-6-17 60936]
R2 ekrn;Eset Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2008-3-14 472320]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-6 135664]
S3 0VsComm12;VitalAgent Serial Port Driver 12.4;c:\program files\ins\vitalagent\program\VsComm12.sys [2010-6-9 15443]
S3 cpuz132;cpuz132;\??\c:\docume~1\ersl\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\ersl\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 NDISKIO;NDISKIO;\??\c:\docume~1\ersl\locals~1\temp\000010bd.nmc\nse\bin\ndiskio.sys --> c:\docume~1\ersl\locals~1\temp\000010bd.nmc\nse\bin\ndiskio.sys [?]
S3 Neo_rocket;VPN Client Device Driver - rocket;c:\windows\system32\drivers\Neo_0077.sys [2010-4-1 22000]
S3 Neo_tz;VPN Client Device Driver - tz;c:\windows\system32\drivers\Neo_0009.sys [2010-3-22 22000]
S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [2010-2-21 704384]
S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys --> c:\windows\system32\drivers\TMPassthru.sys [?]

=============== Created Last 30 ================

2010-07-22 12:53:30 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-07-22 12:53:24 0 d-----w- c:\program files\MagicDisc
2010-07-22 12:52:11 831776 ----a-w- c:\windows\system32\wodFtpDLX.dll
2010-07-22 12:52:11 401484 ----a-w- c:\windows\system32\msvcrtd.dll
2010-07-22 12:52:11 274976 ----a-w- c:\windows\system32\XceedFtp.dll
2010-07-22 12:44:54 0 d-----w- c:\program files\CoffeeCup Software
2010-07-22 10:16:12 0 d-----w- c:\program files\MagicISO
2010-07-22 08:33:28 25 ----a-w- c:\windows\.prj
2010-07-22 08:20:49 0 d-----w- c:\program files\PageBreeze
2010-07-21 11:42:54 0 d-----w- c:\docume~1\ersl\applic~1\Avira
2010-07-02 20:30:36 272128 -c--a-w- c:\windows\system32\dllcache\bthport.sys
2010-07-02 20:30:36 272128 ----a-w- c:\windows\system32\drivers\bthport.sys
2010-07-02 20:29:58 0 d--h--w- c:\windows\$hf_mig$
2010-07-02 20:28:20 0 d-----w- c:\windows\I386

==================== Find3M ====================

2010-06-17 23:11:30 72080 ----a-w- c:\documents and settings\ersl\g2mdlhlpx.exe
2010-06-16 13:52:42 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-06-16 13:52:41 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-06-14 12:32:51 536221 ----a-w- C:\fl.exe
2010-06-12 07:25:06 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-06-07 08:23:44 77824 ----a-w- C:\KeyGen.exe
2010-06-07 08:18:25 276655 ----a-w- C:\6.exe
2010-06-07 04:49:53 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-05-27 15:20:08 390182 ----a-w- c:\windows\1000H-ASUS-1902.zip
2010-05-21 01:31:23 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-05-21 01:31:23 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-05-06 10:41:53 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 04:14:47 203776 ----a-w- c:\windows\system32\clrviddc.dll
2010-04-26 07:58:12 256512 ----a-w- c:\windows\PEV.exe
2008-05-07 23:34:00 15523560 ----a-w- c:\program files\U1 Setup.exe
2006-11-17 16:24:06 66046 ----a-w- c:\program files\Dupe_Free_0_NO_VISTA.ico
2009-11-13 04:53:51 16384 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

============= FINISH: 22:12:01.79 ===============

Here is the GMER Log:

GMER - http://www.gmer.net
Rootkit scan 2010-07-22 23:43:32
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ersl\LOCALS~1\Temp\uxtdrpog.sys

---- System - GMER 1.0.15 ----

SSDT F7C8076E ZwCreateKey
SSDT F7C80764 ZwCreateThread
SSDT F7C80773 ZwDeleteKey
SSDT F7C8077D ZwDeleteValueKey
SSDT F7C80782 ZwLoadKey
SSDT F7C80750 ZwOpenProcess
SSDT F7C80755 ZwOpenThread
SSDT F7C8078C ZwReplaceKey
SSDT F7C80787 ZwRestoreKey
SSDT F7C80778 ZwSetValueKey

---- User code sections - GMER 1.0.15 ----

.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] kernel32.dll!DeviceIoControl 7C801629 7 Bytes JMP 00607340 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] kernel32.dll!IsDebuggerPresent 7C813133 6 Bytes JMP 00606C80 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 5 Bytes JMP 00606FFC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegCloseKey 77DD6C27 5 Bytes JMP 00606C84 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 5 Bytes JMP 00607170 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegCreateKeyExW 77DD776C 5 Bytes JMP 00606D68 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegOpenKeyExA 77DD7852 5 Bytes JMP 00606FC4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegOpenKeyW 77DD7946 5 Bytes JMP 00606F98 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 5 Bytes JMP 00607134 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegEnumKeyExW 77DD7BD9 5 Bytes JMP 00606EA0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegEnumValueW 77DD7EED 5 Bytes JMP 00606F28 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegSetValueExW 77DDD767 7 Bytes JMP 00607258 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryValueW 77DDD87A 5 Bytes JMP 00607100 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 5 Bytes JMP 00606D24 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegSetValueExA 77DDEAE7 7 Bytes JMP 0060721C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegDeleteValueA 77DDECE5 5 Bytes JMP 00606E04 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegDeleteValueW 77DDEDF1 5 Bytes JMP 00606E30 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 5 Bytes JMP 00606F6C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 5 Bytes JMP 00606DAC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryInfoKeyA 77DE4332 5 Bytes JMP 00607034 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryInfoKeyW 77DE49CE 5 Bytes JMP 00607080 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegEnumKeyExA 77DE51B6 5 Bytes JMP 00606E5C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegDeleteKeyW 77DE559B 5 Bytes JMP 00606DD8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegFlushKey 77DF4CE0 5 Bytes JMP 00606CA8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegEnumValueA 77DF9BBF 5 Bytes JMP 00606EE4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegCreateKeyW 77DFBA55 5 Bytes JMP 00606CF8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegQueryValueA 77DFBB8D 5 Bytes JMP 006070CC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 5 Bytes JMP 00606CCC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegSetValueA 77DFC79E 5 Bytes JMP 006071AC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ADVAPI32.dll!RegSetValueW 77E36116 5 Bytes JMP 006071E4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] USER32.dll!ChangeDisplaySettingsExA 7E42384E 5 Bytes JMP 006072E8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] USER32.dll!ChangeDisplaySettingsExW 7E4595BD 5 Bytes JMP 00607314 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
.text C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1768] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00606228 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys

---- EOF - GMER 1.0.15 ----

The Attach Text is attached

Thanks in advance


Attached Files

Edited by Orange Blossom, 24 June 2010 - 04:50 PM.
Deactivated link. ~ OB

BC AdBot (Login to Remove)


#2 gringo_pr


    Bleepin Gringo

  • Malware Response Team
  • 136,772 posts
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:56 PM

Posted 29 June 2010 - 04:25 AM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  1. Do not run any other tool untill instructed to do so!
  2. Do not Attach logs or put in code boxes.
  3. Tell me about any problems that have occurred during the fix.
  4. Tell me of any other symptoms you may be having as these can help also.
  5. Do not run anything while running a fix.
  6. Do not run any other tool untill instructed to do so!

In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.

Note** If you are having problems posting the complete log into this thread upload them here http://www.rapidshare.com/ and post the links in this thread

We are sorry it has taken so long to get to your problem (this forum is very busy)
to help me get an idea of what may have changed I would like a new set of logs please.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

    Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
    • The application window will appear
    • Click the Disable button to disable your CD Emulation drivers
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger may ask you to reboot the machine, if it does - click OK
    Do not re-enable these drivers until otherwise instructed.
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Download DDS:
    Please download DDS by sUBs from one of the links below and save it to your desktop:

    Download DDS and save it to your desktop


    Please disable any anti-malware program that will block scripts from running before running DDS.
    • Double-Click on dds.scr and a command window will appear. This is normal.
    • Shortly after two logs will appear:
      • DDS.txt
      • Attach.txt
    • A window will open instructing you save & post the logs
    • Save the logs to a convenient place such as your desktop
    • Copy the contents of both logs & post in your next reply

Scan With RKUnHooker
  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

information and logs:
    In your next post I need the following
      1.logs from DDS
      3.let me know of any problems you may have had


I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 gringo_pr


    Bleepin Gringo

  • Malware Response Team
  • 136,772 posts
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:56 PM

Posted 02 July 2010 - 06:42 AM


three day bump

It has been Three days since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!


I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#4 gringo_pr


    Bleepin Gringo

  • Malware Response Team
  • 136,772 posts
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:56 PM

Posted 05 July 2010 - 02:29 AM

Due to lack of feedback, this topic is now Closed

If you need this topic reopened, please send me a PM.
Please include the address of this thread in your request.
This applies only to the original topic starter.

Everyone else please start a new topic.

The fixes and advice in this thread are for this machine only.
Do not apply the instructions from this thread to your own machine.
Please start a new thread describing your issue and someone will be along to assist you.

With Regards,

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users