Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

google redirect virus


  • This topic is locked This topic is locked
4 replies to this topic

#1 ellakroeker

ellakroeker

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:08 AM

Posted 08 March 2011 - 02:46 PM

Hooked new computer up to current home network, and now have a google redirect virus. Restored computer to earlier time (when I first set it up) and virus remains.

.
DDS (Ver_11-03-05.01) - NTFS_AMD64
Run by Landes at 8:06:26.93 on Tue 03/08/2011
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.6007.3649 [GMT -5:00]
.
AV: Spyware Doctor with AntiVirus *Enabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spyware Doctor *Enabled/Outdated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\mfevtps.exe
C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
C:\Program Files\mcafee.com\agent\mcagent.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\mswinext.exe
C:\Program Files\mcafee\VirusScan\mcods.exe
C:\Program Files\Common Files\McAfee\Core\mchost.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10l_ActiveX.exe
C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe
C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
C:\Program Files (x86)\Spyware Doctor\pctsTray.exe
C:\Program Files (x86)\Spyware Doctor\TFEngine\TFService.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Landes\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ODVHL6BA\dds[1].scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20110224191904.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
mRun: [ISTray] "C:\Program Files (x86)\Spyware Doctor\pctsTray.exe"
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
mRunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe"
mRunOnce: [STToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe
mRunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110224191904.dll
BHO-X64: scriptproxy - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
mRun-x64: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
mRun-x64: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj"
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-10-13 529128]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2010-10-13 283360]
R0 PCTCore;PCTools KDS;C:\Windows\System32\drivers\PCTCore64.sys [2011-3-7 218056]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-2-24 55856]
R0 TfFsMon;TfFsMon;C:\Windows\System32\drivers\TfFsMon.sys [2011-3-7 65072]
R0 TfSysMon;TfSysMon;C:\Windows\System32\drivers\TfSysMon.sys [2011-3-7 60416]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\System32\drivers\mfenlfk.sys [2010-10-13 75032]
R1 pctgntdi;pctgntdi;C:\Windows\System32\drivers\pctgntdi64.sys [2011-3-7 306648]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-2-24 203264]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-2-28 821664]
R2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [2010-3-10 355440]
R2 McNaiAnn;McAfee VirusScan Announcer;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2010-3-10 355440]
R2 McProxy;McAfee Proxy Service;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2010-3-10 355440]
R2 McShield;McShield;C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe [2011-2-24 200056]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2011-2-24 245352]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2011-2-24 149032]
R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]
R2 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe [2011-3-7 365280]
R2 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe [2011-3-7 1141712]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-2 483688]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-2-24 689472]
R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atikmdag.sys [2011-2-24 6853632]
R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2011-2-24 263680]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2010-10-13 62800]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2011-2-24 56344]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-2-24 271872]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2011-2-24 321064]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-10-13 190136]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2010-10-13 441328]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 pctplsg;pctplsg;C:\Windows\System32\drivers\pctplsg64.sys [2011-3-7 92896]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2009-12-2 721768]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2009-12-2 269672]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2009-12-2 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2009-12-2 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-2 209768]
R3 TfNetMon;TfNetMon;C:\Windows\System32\drivers\TfNetMon.sys [2011-3-7 41888]
R3 ThreatFire;ThreatFire;C:\Program Files (x86)\Spyware Doctor\TFEngine\TFService.exe service --> C:\Program Files (x86)\Spyware Doctor\TFEngine\TFService.exe service [?]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2011-2-24 158976]
S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2011-2-24 220528]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\drivers\mferkdet.sys [2010-10-13 94864]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S4 McOobeSv;McAfee OOBE Service;"C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [2010-3-10 355440]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-03-08 12:45:55 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
2011-03-08 12:38:59 659456 ----a-w- C:\Windows\System32\tmp6EC8.tmp
2011-03-08 05:15:06 -------- d-----w- C:\PROGRA~3\VirtualizedApplications
2011-03-08 02:54:09 -------- d-----w- C:\Users\Landes\AppData\Roaming\Malwarebytes
2011-03-08 02:53:56 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-03-08 02:53:55 -------- d-----w- C:\PROGRA~3\Malwarebytes
2011-03-08 02:53:46 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-03-08 02:53:46 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-03-08 02:43:57 65072 --s---w- C:\Windows\System32\drivers\TfFsMon.sys
2011-03-08 02:43:57 60416 --s---w- C:\Windows\System32\drivers\TfSysMon.sys
2011-03-08 02:43:57 41888 --s---w- C:\Windows\System32\drivers\TfNetMon.sys
2011-03-08 02:41:57 306648 ----a-w- C:\Windows\System32\drivers\pctgntdi64.sys
2011-03-08 02:41:57 133072 ----a-w- C:\Windows\System32\drivers\pctwfpfilter64.sys
2011-03-08 02:41:51 218056 ----a-w- C:\Windows\System32\drivers\PCTCore64.sys
2011-03-08 02:41:48 92896 ----a-w- C:\Windows\System32\drivers\pctplsg64.sys
2011-03-08 02:41:44 -------- d-----w- C:\Users\Landes\AppData\Roaming\PC Tools
2011-03-08 02:41:44 -------- d-----w- C:\Program Files (x86)\Spyware Doctor
2011-03-08 02:41:44 -------- d-----w- C:\Program Files (x86)\Common Files\PC Tools
2011-03-08 02:41:44 -------- d-----w- C:\PROGRA~3\PC Tools
2011-03-08 02:38:47 -------- d-----w- C:\Users\Landes\AppData\Roaming\GetRightToGo
2011-03-07 21:39:56 -------- d-----w- C:\PROGRA~3\Citrix
2011-03-07 21:38:21 -------- d-----w- C:\Users\Landes\AppData\Local\Deployment
2011-03-07 21:38:21 -------- d-----w- C:\Users\Landes\AppData\Local\Apps
2011-03-07 21:27:35 -------- d-----w- C:\Users\Landes\AppData\Local\Microsoft Help
2011-03-07 21:26:36 -------- d-----w- C:\Users\Landes\AppData\Local\SoftGrid Client
2011-03-07 21:26:35 -------- d-----w- C:\Users\Landes\AppData\Roaming\SoftGrid Client
2011-03-07 21:26:02 -------- d-----w- C:\Program Files (x86)\Microsoft Application Virtualization Client
2011-03-07 21:09:27 -------- d-----w- C:\Program Files (x86)\Dell Touch Software Suite
2011-03-07 21:09:10 -------- d-----w- C:\Users\Landes\AppData\Roaming\TP
2011-03-07 21:00:19 -------- d-----w- C:\Users\Landes\AppData\Roaming\PCDr
2011-03-07 21:00:00 -------- d-----w- C:\PROGRA~3\PCDr
2011-03-07 18:13:31 -------- d-----w- C:\Users\Landes\AppData\Roaming\WildTangent
2011-03-07 17:50:07 -------- d-----w- C:\Users\Landes\AppData\Local\Microsoft Games
2011-03-07 17:45:59 -------- d-sh--w- C:\System Recovery
2011-03-07 17:44:51 -------- d-----w- C:\Users\Landes\AppData\Local\Dell
2011-03-07 17:44:15 -------- d-----w- C:\Users\Landes\AppData\Roaming\Dell
2011-03-07 17:44:13 -------- d-----w- C:\Users\Landes\AppData\Roaming\Dell Touch Zone
2011-03-07 17:44:13 -------- d-----w- C:\Users\Landes\AppData\Local\ATI
2011-03-07 16:47:44 -------- d-----w- C:\Users\Landes\AppData\Local\VirtualStore
2011-02-25 02:54:34 0 ----a-w- C:\Windows\ativpsrm.bin
2011-02-25 02:53:18 -------- d-----w- C:\Program Files\Realtek
2011-02-25 02:53:17 -------- d-----w- C:\Windows\SysWow64\RTCOM
2011-02-25 02:38:41 -------- d-----w- C:\Apps
2011-02-25 02:34:05 -------- d-----w- C:\Program Files\Dell Games Folder
2011-02-25 02:14:57 321064 ----a-w- C:\Windows\System32\drivers\k57nd60a.sys
2011-02-25 02:10:21 -------- d-----w- C:\Windows\System32\oem
2011-02-25 02:10:18 -------- d-----w- C:\Windows\Panther
2011-02-25 02:10:18 -------- d-----w- C:\Drivers
2011-02-25 01:59:24 -------- d-----w- C:\dell
2011-02-25 01:30:22 -------- d-----w- C:\Program Files\dell stage
2011-02-25 01:29:26 -------- d-----w- C:\Program Files (x86)\Microsoft
2011-02-25 01:29:24 -------- d-----w- C:\Program Files (x86)\MSN Toolbar
2011-02-25 01:29:05 -------- d-----w- C:\Program Files (x86)\Jagex
2011-02-25 01:29:05 -------- d-----w- C:\Program Files (x86)\Bing Bar Installer
2011-02-25 01:29:04 -------- d-----w- C:\Program Files (x86)\TrustedID
2011-02-25 01:26:23 -------- d-----w- C:\PROGRA~3\Uninstall
2011-02-25 01:24:44 -------- d-----w- C:\Program Files (x86)\Common Files\SureThing Shared
2011-02-25 01:24:34 -------- d-----w- C:\PROGRA~3\PhotoShow Shared Assets
2011-02-25 01:24:32 -------- d-----w- C:\Program Files\Roxio
2011-02-25 01:22:48 55856 ------w- C:\Windows\System32\drivers\PxHlpa64.sys
2011-02-25 01:22:48 10224 ------w- C:\Windows\System32\drivers\cdralw2k.sys
2011-02-25 01:22:48 10224 ------w- C:\Windows\System32\drivers\cdr4_xp.sys
2011-02-25 01:22:19 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
2011-02-25 01:22:01 -------- d-----w- C:\Program Files (x86)\Common Files\Sonic Shared
2011-02-25 01:19:03 9984 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
2011-02-25 01:18:33 149032 ----a-w- C:\Windows\System32\mfevtps.exe
2011-02-25 01:18:21 -------- d-----w- C:\Program Files\Common Files\mcafee
2011-02-25 01:18:21 -------- d-----w- C:\Program Files (x86)\mcafee.com
2011-02-25 01:18:21 -------- d-----w- C:\Program Files (x86)\Common Files\mcafee
2011-02-25 01:18:20 -------- d-----w- C:\Program Files\mcafee.com
2011-02-25 01:18:20 -------- d-----w- C:\Program Files\mcafee
2011-02-25 01:18:20 -------- d-----w- C:\Program Files (x86)\McAfee
2011-02-25 01:18:13 -------- d-----w- C:\Program Files\Dell Support Center
2011-02-25 01:16:51 -------- d-----w- C:\Windows\en
2011-02-25 01:16:00 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2011-02-25 01:14:49 -------- d-----w- C:\Windows\PCHEALTH
2011-02-25 01:14:19 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
2011-02-25 01:14:19 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
2011-02-25 01:14:19 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
2011-02-25 01:14:19 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
2011-02-25 01:13:36 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
2011-02-25 01:13:36 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
2011-02-25 01:12:25 3860992 ----a-w- C:\Windows\System32\UIRibbon.dll
2011-02-25 01:12:25 2983424 ----a-w- C:\Windows\SysWow64\UIRibbon.dll
2011-02-25 01:12:25 1164800 ----a-w- C:\Windows\SysWow64\UIRibbonRes.dll
2011-02-25 01:12:25 1164800 ----a-w- C:\Windows\System32\UIRibbonRes.dll
2011-02-25 01:10:57 -------- d--h--w- C:\Windows\msdownld.tmp
2011-02-25 01:10:32 -------- d-----w- C:\Program Files (x86)\Dell Stage
2011-02-25 01:09:40 -------- d-----w- C:\Program Files (x86)\Dell
2011-02-25 01:06:43 -------- d-----w- C:\Temp
2011-02-25 01:06:41 151656 ----a-w- C:\Windows\System32\drivers\WimFltr.sys
2011-02-25 01:06:31 -------- d-----w- C:\Program Files (x86)\Dell DataSafe Local Backup
2011-02-25 01:06:22 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2011-02-25 01:06:22 172032 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2011-02-25 01:06:21 733184 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2011-02-25 01:06:21 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2011-02-25 01:06:21 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2011-02-25 01:06:21 303236 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2011-02-25 01:06:21 180356 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2011-02-25 01:03:42 -------- d-----w- C:\Program Files (x86)\WildTangent
2011-02-25 01:03:42 -------- d-----w- C:\PROGRA~3\WildTangent
2011-02-25 01:02:05 -------- d-----w- C:\Program Files (x86)\Citrix
2011-02-25 01:00:48 -------- d-----w- C:\Program Files (x86)\Multimedia Card Reader(9106)
2011-02-25 00:58:27 -------- d-----w- C:\Program Files\Dell Inc
2011-02-25 00:58:23 -------- d-sh--w- C:\Windows\Installer
.
==================== Find3M ====================
.
2011-02-25 00:59:26 521448 ----a-w- C:\Windows\System32\deployJava1.dll
2011-02-25 00:59:00 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
.
============= FINISH: 8:10:40.88 ===============


When I ran the gmer, some of the places that needed to be checked were shadowed, so I couldn't place a checkmark in the square.

Attached Files



BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:08 AM

Posted 10 March 2011 - 05:43 PM

Try resetting your router:

Router Reset
  • Please read this: Malware Silently Alters Wireless Router Settings

  • Consult this link to find out what is the default username and password of your router and note down them: Route Passwords

  • Then rest your router to it's factory default settings:

    "If your machine has been infected by one of these Zlob/DNSchanger Trojans, and your router settings have been altered, I would strongly recommend that you reset the router to its default configuration. Usually, this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 30 seconds)"


  • This is the difficult part.
    First get to the routers server. To do that type http:\\192.168.1.1 in the address bar and click Enter. You get the log in window.
    Fill in the password you have already found and you will get the configuration page.
    Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard. But you have to fill in the log in password your ISP has initially given to you.
    You can also call your ISP if you don't have your initial password.
    Don't forget to change the routers default password and set a strong password. Note down the password and keep it somewhere for future reference.

  • Please make sure of the following settings:
    • Go to Start => Control Panel => Network and Internet => Double-click Network and Internet.
    • In the left window select Manage network Connection.
    • In the right window right-click Local Area Connection and select Properties .
    • Internet Protocol Version 6 (IP6v) should be checked. Double-click on it: Make sure of the following settings:
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
    • Click OK.
    • Internet Protocol Version 4 (IP4v) should be checked. Double-click on it.
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
  • Click OK twice.
  • If you should change any setting reboot the computer.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 ellakroeker

ellakroeker
  • Topic Starter

  • Members
  • 16 posts
  • OFFLINE
  •  
  • Local time:01:08 AM

Posted 11 March 2011 - 08:44 AM

Wow! I didn't even know that it was possible it was the router! Lucky me.
I think it's fixed. I've tried a few sites and it seems like it's taking me to the correct places.

Thanks a million!

#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:08 AM

Posted 11 March 2011 - 09:48 AM

You're more than welcome. I am glad to have been of assistance.

Take care.


Kindest Regards,
ST.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:02:08 AM

Posted 11 March 2011 - 09:48 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users