Poor performance and browser page redirects

Edited by brokentavern, 28 August 2010 - 12:58 PM.

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Why we request you disable CD Emulation when receiving Malware Removal Advice

How to create a GMER log

Edited by brokentavern, 06 September 2010 - 10:40 AM.

1. Download TDSSKiller and save it to your Desktop.
2. Extract its contents to your desktop.
3. Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
4. If an infected file is detected, the default action will be Cure, click on Continue.
5. If a suspicious file is detected, the default action will be Skip, click on Continue.
6. It may ask you to reboot the computer to complete the process. Click on Reboot Now
7. If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
8. If a reboot is required, the report can also be found in your root directory, (usually C:\TDSSKiller folder). Please copy and paste the contents of that file here.
   Note:

1. Please download OTL and save it to your desktop.
2. Double click on the icon on your desktop.
3. Click the "Scan All Users" checkbox.
4. Click the "Quick Scan" button.
5. Two reports will open, OTListIt.txt <-- Will be opened and Extra.txt <-- Will be minimized
6. Copy and paste both logs back here in your next reply.

Edited by sundavis, 11 September 2010 - 12:31 PM.

1. Please start OTL on your desktop.
2. Under the Custom Scans/Fixes box at the bottom, copy/paste the following contents of code box.
   
   
   CODE
   :OTL
   IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
   IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
   IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
   IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522
   IE - HKU\S-1-5-21-981504363-461020599-25758258-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 69 C5 B3 A1 29 3B CB 01  [binary data]
   IE - HKU\S-1-5-21-981504363-461020599-25758258-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0:Commands
   O2 - BHO: (adShotHlpr Object) - {0B306F20-949A-4757-A947-38294DE74831} - C:\Windows\SysWow64\qslgp.dll File not found
   O2 - BHO: (moigh Object) - {B472FAD4-C741-404D-8754-8425A1F3C86A} - C:\Windows\SysWow64\mslgp.dll File not found
   O4 - HKU\.DEFAULT..\Run: [Srocivux] C:\Windows\SysWow64\config\systemprofile\AppData\Local\dskchFW0.DLL File not found
   O4 - HKU\.DEFAULT..\Run: [ynnmdfjj] C:\Windows\SysWow64\config\systemprofile\AppData\Local\asgvdxjxb\vcovwmlshdw.exe File not found
   O4 - HKU\.DEFAULT..\Run: [ZE18MW23GY] C:\Windows\TEMP\Tnk.exe File not found
   O4 - HKU\S-1-5-18..\Run: [Srocivux] C:\Windows\SysWow64\config\systemprofile\AppData\Local\dskchFW0.DLL File not found
   O4 - HKU\S-1-5-18..\Run: [ynnmdfjj] C:\Windows\SysWow64\config\systemprofile\AppData\Local\asgvdxjxb\vcovwmlshdw.exe File not found
   O4 - HKU\S-1-5-18..\Run: [ZE18MW23GY] C:\Windows\TEMP\Tnk.exe File not found
   O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
   O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
   O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
   O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
   O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
   O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
   O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 74.128.19.102 74.128.17.114
   O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.163.190,93.188.166.190
   O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
   O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
   O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
   O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
   O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
   
   :Files
   C:\WINDOWS\tasks\At*.job
   C:\Users\Thomas\Desktop\*.tmp
   
   [purity]
   [emptytemp]
   [EMPTYFLASH]
   [start explorer]
   [Reboot]
3. Click Run Fix button on the top.
4. Click OK and let it run unhindered.
5. OTL will ask to reboot the machine. Please OK the prompt.
6. A report will open. Copy and Paste that report in your next reply.

1. Double Click mbam-setup.exe to install the application.
2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
3. If an update is found, it will download and install the latest version.
4. Once the program has loaded, select "Perform Quick Scan", then click Scan.
5. The scan may take some time to finish,so please be patient.
6. When the scan is complete, click OK, then Show Results to view the results.
7. Make sure that everything is checked, and click Remove Selected.
8. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
9. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.or you can find from here:
10. C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
11. You can refer to this tutorial

1. If you are using LAN, click "LAN Settings" button. If you are using Dial-up or Virtual Private Network connection, select necessary connection and click "Settings" button.
2. In the "Proxy Server" area, uncheck the check mark next to Use a proxy server for ....
3. Click OK.
4. Click Privacy tab and press Sites button, click Remove all button if there are some urls out there.
5. Click Advanced tab and click on Reset button
6. In the Reset Internet Explorer Settings dialog box, click Reset to confirm. Reboot your pc

1. Please go to Kaspersky Online Scanner and perform an online antivirus scan.
2. Click Accept button on the "Requirements and limitations".
3. When Java warning " The applcation digital signature has been verified. Do you want to run the application " appears, Click on "Run" button.
4. It will be Downloading and installing the program and Updating the database.
5. When Updating the database have finished, click on Settings.
6. Make sure all boxes are checked. then click on the Save button.
7. Click on My Computer under Scan menu. It will start scanning, so be patient and let it run.
8. Once the scan is completed, Click on View Scan Report.
9. You may see a list of infected items over there. Click on Save Report As.
10. Click "Desktop" , Name the file as "KAS", Change the Files of type to Text file (.txt) and Click on Save button.
11. Please post the contents in your next reply.
12. You can refer to this animation