has been happening for a couple days now
I full scanned using Malwarebytes' Anti-Malware and it found a trojan and removed
it but it still redirects the links
DDS (Ver_10-03-17.01) - NTFSx86
Run by Administrator at 10:45:46.04 on Thu 09/09/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.163 [GMT -7:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Multimedia Card Reader\readericon10.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator.ALO.000\Desktop\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Megaupload Toolbar: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} - c:\progra~1\megaup~2\MEGAUP~1.DLL
BHO: IeMonitorBho Class: {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\program files\megaupload\mega manager\MegaIEMn.dll
TB: Megaupload Toolbar: {a057a204-bacc-4d26-c39e-35f1d2a32ec8} - c:\progra~1\megaup~2\MEGAUP~1.DLL
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [readericon10] c:\program files\multimedia card reader\readericon10.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: &Download All using 4shared Desktop
IE: &Download All with FlashGet
IE: &Download with FlashGet
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download Link Using Mega Manager... - c:\program files\megaupload\mega manager\mm_file.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\windows\system32\idmmbc.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\admini~1.000\applic~1\mozilla\firefox\profiles\7s5vudf7.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\documents and settings\administrator.alo.000\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\administrator.alo.000\application data\mozilla\firefox\profiles\7s5vudf7.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R1 IDMTDI;IDMTDI;c:\windows\system32\drivers\idmtdi.sys [2010-8-25 76768]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2010-3-28 10640]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-9-3 304464]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-9-3 20952]
S0 cerc6;cerc6; [x]
S3 libusb0;LibUsb-Win32 - Kernel Driver 1.1.14.3, 06/11/2010;c:\windows\system32\drivers\libusb0.sys [2010-6-14 21504]
=============== Created Last 30 ================
2010-09-09 01:13:35 33 ----a-w- c:\windows\EasyRip.ini
2010-09-08 05:11:31 0 d-----w- c:\docume~1\alluse~1.win\applic~1\IObit
2010-09-07 23:13:51 0 d-----w- c:\docume~1\admini~1.000\applic~1\IObit
2010-09-07 23:13:50 0 d-----w- c:\program files\IObit
2010-09-07 22:55:17 0 d-----w- c:\docume~1\admini~1.000\applic~1\Auslogics
2010-09-07 22:52:18 0 d-----w- c:\program files\Auslogics
2010-09-05 07:18:38 0 d-----w- c:\docume~1\alluse~1.win\applic~1\MusicMP3Downloader
2010-09-05 07:18:38 0 d-----w- c:\docume~1\admini~1.000\applic~1\MusicMP3Downloader
2010-09-05 07:17:26 0 d-----w- c:\program files\MusicMp3Downloader
2010-09-04 04:08:46 0 d-----w- c:\docume~1\admini~1.000\applic~1\TuneUp Software
2010-09-04 04:08:12 0 d-----w- c:\docume~1\alluse~1.win\applic~1\TuneUp Software
2010-09-04 04:08:01 0 d-sh--w- c:\docume~1\alluse~1.win\applic~1\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-09-04 03:52:56 0 d-----w- c:\program files\CCleaner
2010-09-04 00:01:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-04 00:01:17 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-04 00:01:17 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-02 03:47:47 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest
2010-09-02 03:47:46 50688 ----a-w- c:\windows\system32\ff_acm.acm
2010-09-02 03:47:46 108032 ----a-w- c:\windows\system32\ff_vfw.dll
2010-09-02 03:47:42 0 d-----w- c:\program files\ffdshow
2010-09-02 03:24:27 0 d-----w- c:\docume~1\admini~1.000\applic~1\BSplayer PRO
2010-09-02 03:24:25 0 d-----w- c:\program files\Webteh
2010-09-01 07:19:42 0 d-----w- c:\program files\LimeWire
2010-09-01 00:49:01 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-08-31 17:53:10 200704 ----a-w- c:\windows\Dtysya.exe
2010-08-31 17:52:50 75776 --sha-r- c:\windows\system32\nbtstatf.dll
2010-08-31 17:44:23 0 d-----w- c:\docume~1\admini~1.000\applic~1\Xilisoft
2010-08-31 09:26:23 69 ----a-w- c:\windows\NeroDigital.ini
2010-08-31 08:01:34 39 ----a-w- c:\windows\Irremote.ini
2010-08-31 07:22:28 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Nero
2010-08-31 06:32:35 87608 ----a-w- c:\docume~1\admini~1.000\applic~1\inst.exe
2010-08-31 06:32:35 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-08-31 06:32:35 47360 ----a-w- c:\docume~1\admini~1.000\applic~1\pcouffin.sys
2010-08-30 15:41:08 0 d--h--w- c:\windows\PIF
2010-08-30 07:43:51 0 d-----w- c:\docume~1\admini~1.000\applic~1\IDM
2010-08-30 07:11:25 33 ----a-w- c:\windows\DownloadStudioScheduleMonitor.INI
2010-08-30 05:28:47 0 d-----w- c:\program files\Internet Download Manager
2010-08-30 04:19:34 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Kaspersky Lab Setup Files
2010-08-30 01:28:50 0 d-----w- c:\docume~1\admini~1.000\applic~1\MozillaControl
2010-08-30 01:26:42 0 d-----w- c:\windows\'Full Speed' Internet Booster + Performance Tests
2010-08-30 01:24:46 0 d-----w- C:\aidualc3
2010-08-29 22:51:21 0 d-----w- c:\docume~1\alluse~1.win\applic~1\SpeedBit
2010-08-27 08:59:48 0 d-----w- c:\docume~1\admini~1.000\applic~1\DMCache
2010-08-25 14:40:03 76768 ----a-w- c:\windows\system32\drivers\idmtdi.sys
2010-08-22 23:32:00 0 d-----w- c:\documents and settings\administrator.alo.000\dwhelper
2010-08-16 08:51:46 0 d-----w- c:\program files\Free M4a to MP3 Converter
==================== Find3M ====================
2010-08-22 20:38:48 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys
2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:10:44 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-06-24 12:10:44 667136 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-12 03:43:28 37888 ----a-w- c:\windows\system32\libusb0.dll
============= FINISH: 10:46:35.48 ===============
Attached Files
Edited by alo, 09 September 2010 - 02:08 PM.