Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

3 laptops infected at once


  • This topic is locked This topic is locked
4 replies to this topic

#1 xenophile

xenophile

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:32 PM

Posted 12 April 2011 - 02:15 PM

I have 2 acer laptops and one mac laptop all experiencing the redirect issues I've seen so many others posting about. The laptop with Vista has the redirect problem as well as browser windows just popping up unexpectedly. I returned it to the factory settings yesterday, but it's still doing it. My wife's work laptop has XP and is showing the worst effects, with the redirects, as well as loads of pop ups claiming to be windows warnings and antivirus offers. Her machine has even started shutting down on its own, and we struggle to go into safe mode on both. The mac was the biggest surprise when we started noticing the redirect problem on that too. We don't share files between the three machines. The only thing the 3 have in common is our internet connection. BT have, of course, claimed no responsibility, and say our connection is fine. I have no idea how to proceed. Any advice is very welcome.

Many thanks

Here's the DDS.txt log from the Vista laptop with attach and ark files attached.


.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Steve at 19:58:21.70 on 12/04/2011
Internet Explorer: 8.0.6001.19019
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.3001.1714 [GMT 1:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Windows\PLFSetI.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Steve\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0411&m=aspire_5410
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0411&m=aspire_5410
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0411&m=aspire_5410
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0411&m=aspire_5410
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
BHO: Partner BHO Class: {83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4} - c:\programdata\partner\partner.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe"
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [Skytel] c:\program files\realtek\audio\hda\Skytel.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [PLFSetI] c:\windows\PLFSetI.exe
mRun: [BackupManagerTray] "c:\program files\newtech infosystems\acer backup manager\BackupManagerTray.exe" -k
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe
mRun: [ODDPwr] "c:\program files\acer\optical drive power management\ODDPwr.exe"
mRun: [EgisTecLiveUpdate] "c:\program files\egistec egis software update\EgisUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec\mywinlocker 3\x86\mwlDaemon.exe
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\steve\appdata\roaming\mozilla\firefox\profiles\lxfvdju9.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.imdb.com/
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-1-19 32464]
R1 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwd6x.sys [2010-7-12 54112]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-2-10 296400]
R2 avgfws;AVG Firewall;c:\program files\avg\avg10\avgfws.exe [2011-2-8 2707512]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-2-15 7421280]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2011-4-11 117256]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2011-4-10 703008]
R2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-10-9 19504]
R2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-10-9 16432]
R2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-10-9 59952]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2008-10-27 306736]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-4-1 54528]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 ODDPwrSvc;Acer ODD Power Service;c:\program files\acer\optical drive power management\ODDPWRSvc.exe [2011-4-10 118784]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2011-4-10 237568]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-3-30 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 28624]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2011-4-11 112128]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C60x86.sys [2011-4-11 50176]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-10 135664]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-4-10 947528]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-1-21 179712]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-4-10 30192]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 Partner Service;Partner Service;c:\programdata\partner\partner.exe [2011-4-10 110576]
.
=============== Created Last 30 ================
.
2011-04-12 15:47:31 97800 ----a-w- c:\windows\system32\infocardapi.dll
2011-04-12 15:47:30 622080 ----a-w- c:\windows\system32\icardagt.exe
2011-04-12 15:47:30 37384 ----a-w- c:\windows\system32\infocardcpl.cpl
2011-04-12 15:47:30 11264 ----a-w- c:\windows\system32\icardres.dll
2011-04-12 15:47:30 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2011-04-12 15:47:29 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-04-12 15:47:28 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2011-04-12 15:47:25 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2011-04-12 14:22:59 7680 ----a-w- c:\program files\internet explorer\iecompat.dll
2011-04-12 14:16:14 -------- d-----w- c:\users\steve\appdata\roaming\eSobi
2011-04-12 14:14:14 96760 ----a-w- c:\windows\system32\dfshim.dll
2011-04-12 14:14:11 282112 ----a-w- c:\windows\system32\mscoree.dll
2011-04-12 14:14:08 41984 ----a-w- c:\windows\system32\netfxperf.dll
2011-04-12 14:13:58 158720 ----a-w- c:\windows\system32\mscorier.dll
2011-04-12 14:13:54 83968 ----a-w- c:\windows\system32\mscories.dll
2011-04-12 14:13:21 -------- d-----w- c:\windows\system32\x64
2011-04-12 13:06:32 80896 ----a-w- c:\windows\system32\MSNP.ax
2011-04-12 13:06:27 293376 ----a-w- c:\windows\system32\psisdecd.dll
2011-04-12 13:06:26 217088 ----a-w- c:\windows\system32\psisrndr.ax
2011-04-12 12:59:59 293376 ----a-w- c:\windows\system32\browserchoice.exe
2011-04-12 12:52:58 24064 ----a-w- c:\windows\system32\nshhttp.dll
2011-04-12 12:52:56 411136 ----a-w- c:\windows\system32\drivers\http.sys
2011-04-12 12:52:56 31232 ----a-w- c:\windows\system32\httpapi.dll
2011-04-12 12:52:35 231936 ----a-w- c:\windows\system32\msshsq.dll
2011-04-12 12:35:08 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
2011-04-12 12:35:07 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2011-04-12 12:33:48 513024 ----a-w- c:\windows\system32\wlansvc.dll
2011-04-12 12:32:52 71680 ----a-w- c:\windows\system32\atl.dll
2011-04-12 12:31:56 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
2011-04-12 12:31:49 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-04-12 12:31:20 636928 ----a-w- c:\windows\system32\localspl.dll
2011-04-12 12:31:16 954752 ----a-w- c:\windows\system32\mfc40.dll
2011-04-12 12:31:15 954288 ----a-w- c:\windows\system32\mfc40u.dll
2011-04-12 12:31:11 36352 ----a-w- c:\windows\system32\rtutils.dll
2011-04-12 12:31:08 499712 ----a-w- c:\windows\system32\kerberos.dll
2011-04-12 12:31:08 175104 ----a-w- c:\windows\system32\wdigest.dll
2011-04-12 12:31:08 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2011-04-12 12:31:07 9728 ----a-w- c:\windows\system32\lsass.exe
2011-04-12 12:31:07 72704 ----a-w- c:\windows\system32\secur32.dll
2011-04-12 12:31:07 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2011-04-12 12:29:59 2048 ----a-w- c:\windows\system32\tzres.dll
2011-04-12 12:27:12 61440 ----a-w- c:\windows\system32\msasn1.dll
2011-04-12 12:27:08 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2011-04-12 12:27:02 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-04-12 12:27:01 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-04-11 00:42:10 -------- d-----w- C:\Book
2011-04-11 00:42:05 49152 ----a-w- c:\windows\Interop.IWshRuntimeLibrary.dll
2011-04-11 00:42:05 380928 ----a-w- c:\windows\AcerStore.exe
2011-04-11 00:41:46 199176 ----a-w- c:\windows\GVUni.exe
2011-04-11 00:40:17 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2011-04-11 00:40:17 39936 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-04-11 00:40:17 23552 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2011-04-11 00:40:17 226304 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-04-11 00:40:17 194560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-04-11 00:40:16 73216 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-04-11 00:40:03 529464 ----a-w- c:\windows\system32\drivers\ndis.sys
2011-04-11 00:37:13 309768 ----a-w- c:\windows\UNINST32.EXE
2011-04-11 00:37:13 21000 ----a-w- c:\windows\system32\drivers\DKbFltr.sys
2011-04-11 00:37:10 206120 ----a-w- c:\windows\system32\SynCtrl.dll
2011-04-11 00:37:10 205232 ----a-w- c:\windows\system32\drivers\SynTP.sys
2011-04-11 00:37:10 169256 ----a-w- c:\windows\system32\SynCOM.dll
2011-04-11 00:37:10 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
2011-04-11 00:37:10 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2011-04-11 00:37:10 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2011-04-10 20:46:25 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-04-10 20:44:59 -------- d-----w- c:\users\steve\appdata\local\Microsoft Help
2011-04-10 20:40:18 -------- d-----w- c:\users\steve\appdata\local\Adobe
2011-04-10 18:28:20 -------- d--h--w- C:\$AVG
2011-04-10 16:55:36 -------- d-----w- c:\users\steve\appdata\roaming\AVG10
2011-04-10 16:53:10 -------- d--h--w- c:\progra~2\Common Files
2011-04-10 16:52:59 -------- d-----w- c:\progra~2\AVG Security Toolbar
2011-04-10 16:48:36 -------- d-----w- c:\windows\system32\drivers\AVG
2011-04-10 16:48:36 -------- d-----w- c:\progra~2\AVG10
2011-04-10 16:46:23 -------- d-----w- c:\program files\AVG
2011-04-10 16:43:32 171520 ----a-w- c:\windows\system32\wintrust.dll
2011-04-10 16:43:04 98304 ----a-w- c:\windows\system32\cabview.dll
2011-04-10 16:32:33 -------- d-----w- c:\progra~2\MFAData
2011-04-10 16:27:29 -------- d-----w- c:\users\steve\appdata\local\EgisTec
2011-04-10 16:27:29 -------- d-----w- c:\progra~2\EgisTec
2011-04-10 16:23:43 -------- d-----w- c:\program files\Acer Inc
2011-04-10 16:23:23 -------- d-----w- c:\progra~2\eSobi
2011-04-10 16:22:48 -------- d-----w- c:\program files\eSobi
2011-04-10 16:19:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2011-04-10 16:19:22 87552 ----a-w- c:\windows\system32\wudriver.dll
2011-04-10 16:19:09 -------- d-----w- c:\program files\EgisTec Egis Software Update
2011-04-10 16:19:09 -------- d-----w- c:\program files\common files\EgisTec
2011-04-10 16:18:58 33792 ----a-w- c:\windows\system32\wuapp.exe
2011-04-10 16:18:58 171608 ----a-w- c:\windows\system32\wuwebv.dll
2011-04-10 16:18:50 -------- d-----w- c:\program files\EgisTec
2011-04-10 16:17:44 -------- d-----w- c:\users\steve\appdata\roaming\Acer
2011-04-10 16:16:03 -------- d-----w- c:\users\steve\appdata\local\Acer ePower Management V4
2011-04-10 16:15:50 -------- d-----w- c:\program files\Acer
2011-04-10 16:15:06 47136 ----a-w- c:\windows\system32\msxm905.rra
2011-04-10 16:15:06 27168 ------w- c:\windows\system32\msxml3a.dll
2011-04-10 16:10:52 502816 ------w- c:\windows\system32\msvcp71.dll
2011-04-10 16:10:52 351264 ------w- c:\windows\system32\msvcr71.dll
2011-04-10 16:10:44 225280 ----a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-04-10 16:10:43 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-04-10 16:10:43 32768 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-04-10 16:10:43 176128 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-04-10 16:10:42 610436 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2011-04-10 16:10:05 855 ----a-w- c:\windows\regfile_I.cmd
2011-04-10 16:10:05 255 ----a-w- c:\windows\regfile_E.cmd
2011-04-10 16:09:32 -------- d-----w- c:\windows\Screensavers
2011-04-10 16:09:26 20480 ----a-w- c:\windows\USB_VIDEO_REG.exe
2011-04-10 16:09:25 8082 ----a-w- c:\windows\Suyin.reg
2011-04-10 16:09:25 626688 ----a-w- c:\windows\Image.dll
2011-04-10 16:09:25 200704 ----a-w- c:\windows\PLFSetI.exe
2011-04-10 16:09:25 1445888 ----a-w- c:\windows\Acer Crystal Eye webcam.EXE
2011-04-10 16:08:32 -------- d-----w- c:\program files\Launch Manager
2011-04-10 16:07:53 -------- d-----w- c:\program files\Synaptics
2011-04-10 16:06:36 -------- d-----w- c:\windows\system32\RTCOM
2011-04-10 16:06:03 712 ----a-w- c:\windows\system32\drivers\SamSfPa.dat
2011-04-10 16:06:03 632 ----a-w- c:\windows\system32\drivers\RtHdatEx.dat
2011-04-10 16:06:03 520 ----a-w- c:\windows\system32\drivers\RTEQEX2.dat
2011-04-10 16:06:03 319456 ----a-w- c:\windows\DIFxAPI.dll
2011-04-10 16:06:03 16 ----a-w- c:\windows\system32\drivers\rtkhdaud.dat
2011-04-10 16:06:02 520 ----a-w- c:\windows\system32\drivers\RTEQEX1.dat
2011-04-10 16:06:02 520 ----a-w- c:\windows\system32\drivers\RTEQEX0.dat
2011-04-10 16:06:02 107276 ----a-w- c:\windows\system32\drivers\RtConvEQ.DAT
2011-04-10 16:03:44 -------- d-----w- c:\users\steve\appdata\local\Google
2011-04-10 16:02:48 -------- d-----w- c:\program files\Convesoft
2011-04-10 16:02:24 -------- d-----w- c:\users\steve\appdata\local\VirtualStore
2011-04-10 16:02:20 -------- d-----w- c:\progra~2\Partner
2011-04-10 15:57:27 -------- d-sh--we C:\Documents and Settings
2011-04-10 15:53:05 948760 ----a-w- c:\windows\system32\igxpun.exe
2011-04-10 15:53:05 -------- d-----w- c:\windows\system32\Lang
2011-03-30 16:16:52 134480 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
.
==================== Find3M ====================
.
2011-04-11 00:40:15 8704 ----a-w- c:\windows\system32\hccoin.dll
2011-04-11 00:40:15 15872 ----a-w- c:\windows\system32\hcrstco.dll
2011-02-11 18:26:38 8198680 ----a-w- c:\windows\system32\TVWSetup.exe
2011-02-11 18:26:32 137752 ----a-w- c:\windows\system32\igfxtray.exe
2011-02-11 18:26:30 267800 ----a-w- c:\windows\system32\igfxsrvc.exe
2011-02-11 18:26:30 172568 ----a-w- c:\windows\system32\igfxpers.exe
2011-02-11 18:26:28 179224 ----a-w- c:\windows\system32\igfxext.exe
2011-02-11 18:26:26 171032 ----a-w- c:\windows\system32\hkcmd.exe
2011-02-11 18:26:22 3157528 ----a-w- c:\windows\system32\GfxUI.exe
2011-02-11 18:20:00 81920 ----a-w- c:\windows\system32\igfxCoIn_v2302.dll
2011-02-11 18:12:16 4967424 ----a-w- c:\windows\system32\igdumd32.dll
2011-02-11 18:10:52 439308 ----a-w- c:\windows\system32\igcompkrng500.bin
2011-02-11 18:10:50 982240 ----a-w- c:\windows\system32\igkrng500.bin
2011-02-11 18:10:50 92356 ----a-w- c:\windows\system32\igfcg500m.bin
2011-02-11 18:09:48 571904 ----a-w- c:\windows\system32\igdumdx32.dll
2011-02-11 18:04:40 4411392 ----a-w- c:\windows\system32\igd10umd32.dll
2011-02-11 17:51:10 11039744 ----a-w- c:\windows\system32\ig4icd32.dll
2011-02-11 17:41:30 261632 ----a-w- c:\windows\system32\igfxTMM.dll
2011-02-11 17:41:30 195584 ----a-w- c:\windows\system32\igfxpph.dll
2011-02-11 17:41:30 115200 ----a-w- c:\windows\system32\igfxcpl.cpl
2011-02-11 17:41:28 23552 ----a-w- c:\windows\system32\igfxexps.dll
2011-02-11 17:41:12 57856 ----a-w- c:\windows\system32\igfxsrvc.dll
2011-02-11 17:40:56 130048 ----a-w- c:\windows\system32\igfxdo.dll
2011-02-11 17:40:48 95232 ----a-w- c:\windows\system32\hccutils.dll
2011-02-11 17:40:42 120320 ----a-w- c:\windows\system32\gfxSrvc.dll
2011-02-11 17:40:40 4096 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2011-02-11 17:40:38 85504 ----a-w- c:\windows\system32\igfxrenu.lrc
2011-02-11 17:40:38 828928 ----a-w- c:\windows\system32\igfxress.dll
2011-02-11 17:40:38 228864 ----a-w- c:\windows\system32\igfxdev.dll
2011-02-11 17:35:00 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2011-02-11 17:35:00 208896 ----a-w- c:\windows\system32\iglhsip32.dll
2011-02-11 17:35:00 147456 ----a-w- c:\windows\system32\iglhcp32.dll
.
============= FINISH: 19:59:45.26 ===============

EDIT: Posts merged ~Budapest

Attached Files


Edited by Budapest, 12 April 2011 - 04:29 PM.


BC AdBot (Login to Remove)

 


#2 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:11:32 PM

Posted 19 April 2011 - 04:06 PM

Try to reset your router:

Router Reset
  • Please read this: Malware Silently Alters Wireless Router Settings

  • Consult this link to find out what is the default username and password of your router and note down them: Route Passwords

  • Then rest your router to it's factory default settings:

    "If your machine has been infected by one of these Zlob/DNSchanger Trojans, and your router settings have been altered, I would strongly recommend that you reset the router to its default configuration. Usually, this can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 30 seconds)"


  • This is the difficult part.
    First get to the routers server. To do that type http:\\192.168.1.1 in the address bar and click Enter. You get the log in window.
    Fill in the password you have already found and you will get the configuration page.
    Configure the router to allow you to connect to your ISP server. In some routers it is done by a setup wizard. But you have to fill in the log in password your ISP has initially given to you.
    You can also call your ISP if you don't have your initial password.
    Don't forget to change the routers default password and set a strong password. Note down the password and keep it somewhere for future reference.

  • Please make sure of the following settings:
    • Go to start => Control panel => Double-click Network and Sharing Center.
    • In the left window select Manage network Connection.
    • In the right window right-click Local Area connection and select Properties .
    • Internet Protocol Version 6 (IP6v) should be checked. Double-click on it: Make sure of the following settings:
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
    • Click OK.
    • Internet Protocol Version 4 (IP4v) should be checked. Double-click on it.
    • The option Obtain an IP address automatically should be checked.
    • The option Obtain DNS server address automatically should be checked.
  • Click OK twice.
  • If you should change any setting reboot the computer.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#3 xenophile

xenophile
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:32 PM

Posted 20 April 2011 - 07:38 AM

Perfect! Exactly the info I was looking for. After running the malware removal software, I restored my router to factory settings and changed my password. Haven't had the redirecting issues since. Thanks so much!

#4 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:11:32 PM

Posted 20 April 2011 - 08:51 AM

Glad to hear that resolved the issue.

Take care.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.


#5 SweetTech

SweetTech

    Agent ST


  • Members
  • 13,421 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Antarctica
  • Local time:11:32 PM

Posted 20 April 2011 - 08:51 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image


The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users