Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google Redirect Virus


  • Please log in to reply
8 replies to this topic

#1 sanjoo9211

sanjoo9211

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:37 AM

Posted 17 June 2012 - 10:51 PM

Hello everybody,

It appears that I'm infected with the Google redirect virus. It redirects searches to:
109.206.160.225
173.214.255.51
206.51.231.116
217.159.171.218
63.209.69.107
64.15.72.104
64.21.9.244
65.97.58.10
66.246.72.42
67.196.0.168
68.232.188.245
8.26.70.252

I ran MalwareBytes, but it did not fix the issue.

Any assistance in removing this would be greatly appreciated.

BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:37 AM

Posted 17 June 2012 - 11:37 PM

Welcome aboard Posted Image

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

====================================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 sanjoo9211

sanjoo9211
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:37 AM

Posted 18 June 2012 - 08:40 PM

Welcome aboard Posted Image


Thank you for the welcome and your assistance. It is greatly appreciated.



Security Check

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 8 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Java™ 6 Update 29
Mozilla Firefox (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent

Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
``````````End of Log````````````




Farbar Service Scanner

Farbar Service Scanner Version: 09-06-2012
Ran by RJ (administrator) on 18-06-2012 at 21:17:57
Running from "C:\Users\RJ\Desktop\BC"
Microsoft Windows 7 Home Premium (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2009-07-13 19:25] - [2009-07-13 21:45] - 1898576 ____A (Microsoft Corporation) 912107716BAB424C7870E8E6AF5E07E1

C:\Windows\System32\dnsrslvr.dll
[2009-07-13 19:21] - [2009-07-13 21:40] - 0182272 ____A (Microsoft Corporation) 676108C4E3AA6F6B34633748BD0BEBD9

C:\Windows\System32\mpssvc.dll
[2009-07-13 20:09] - [2009-07-13 21:41] - 0824832 ____A (Microsoft Corporation) AECAB449567D1846DAD63ECE49E893E3

C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll
[2009-07-13 19:36] - [2009-07-13 21:41] - 0170496 ____A (Microsoft Corporation) 765A27C3279CE11D14CB9E4F5869FCA5

C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll
[2009-07-13 20:36] - [2009-07-13 21:41] - 2418176 ____A (Microsoft Corporation) 38340204A2D0228F1E87740FC5E554A7

C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****




MiniToolBox

MiniToolBox by Farbar Version: 09-06-2012
Ran by RJ (administrator) on 18-06-2012 at 21:19:31
Microsoft Windows 7 Home Premium (X64)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ==============================

========================= Hosts content: =================================

# ::1 localhost

========================= IP Configuration: ================================

802.11n Wireless LAN Card = Wireless Network Connection (Connected)
VMware Virtual Ethernet Adapter for VMnet1 = VMware Network Adapter VMnet1 (Connected)
VMware Virtual Ethernet Adapter for VMnet8 = VMware Network Adapter VMnet8 (Connected)
Realtek PCIe GBE Family Controller = Local Area Connection (Hardware not present)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
add address name="VMware Network Adapter VMnet1" address=192.168.14.1
add address name="VMware Network Adapter VMnet8" address=192.168.77.1


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : HP
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : 802.11n Wireless LAN Card
Physical Address. . . . . . . . . : 70-F1-A1-8B-AF-BD
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::a1a2:2a87:a0e6:f5f%13(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.2.131(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, June 16, 2012 5:05:49 PM
Lease Expires . . . . . . . . . . : Tuesday, June 19, 2012 11:16:39 AM
Default Gateway . . . . . . . . . : 10.0.2.1
DHCP Server . . . . . . . . . . . : 10.0.2.1
DHCPv6 IAID . . . . . . . . . . . : 242282913
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D0-6F-0D-6C-62-6D-0E-BF-DB
DNS Servers . . . . . . . . . . . : 10.0.2.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet1:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet1
Physical Address. . . . . . . . . : 00-50-56-C0-00-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::20f4:c297:704b:c55c%15(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.14.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 419450966
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D0-6F-0D-6C-62-6D-0E-BF-DB
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter VMware Network Adapter VMnet8:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Virtual Ethernet Adapter for VMnet8
Physical Address. . . . . . . . . : 00-50-56-C0-00-08
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::414b:1f94:d205:a4ee%16(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.77.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 436228182
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-D0-6F-0D-6C-62-6D-0E-BF-DB
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{1DA84757-33BC-43E4-8769-C366D0C033F2}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{034ECC4A-1AEA-4B99-992B-0571D19777FC}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{E25CDE2F-491F-4C90-B187-A76C9FF6CCB1}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: Legend
Address: 10.0.2.1

Name: google.com
Addresses: 2607:f8b0:4004:801::1007
74.125.228.0
74.125.228.5
74.125.228.7
74.125.228.3
74.125.228.9
74.125.228.1
74.125.228.4
74.125.228.2
74.125.228.8
74.125.228.14
74.125.228.6


Pinging google.com [74.125.228.6] with 32 bytes of data:
Reply from 74.125.228.6: bytes=32 time=18ms TTL=55
Reply from 74.125.228.6: bytes=32 time=17ms TTL=55

Ping statistics for 74.125.228.6:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 17ms, Maximum = 18ms, Average = 17ms
Server: Legend
Address: 10.0.2.1

Name: yahoo.com
Addresses: 209.191.122.70
98.139.183.24
72.30.38.140


Pinging yahoo.com [72.30.38.140] with 32 bytes of data:
Reply from 72.30.38.140: bytes=32 time=104ms TTL=49
Reply from 72.30.38.140: bytes=32 time=91ms TTL=49

Ping statistics for 72.30.38.140:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 91ms, Maximum = 104ms, Average = 97ms
Server: Legend
Address: 10.0.2.1

Name: bleepingcomputer.com
Address: 208.43.87.2


Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:
Reply from 208.43.87.2: Destination host unreachable.
Reply from 208.43.87.2: Destination host unreachable.

Ping statistics for 208.43.87.2:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
13...70 f1 a1 8b af bd ......802.11n Wireless LAN Card
15...00 50 56 c0 00 01 ......VMware Virtual Ethernet Adapter for VMnet1
16...00 50 56 c0 00 08 ......VMware Virtual Ethernet Adapter for VMnet8
1...........................Software Loopback Interface 1
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
11...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.2.1 10.0.2.131 25
10.0.2.0 255.255.255.0 On-link 10.0.2.131 281
10.0.2.131 255.255.255.255 On-link 10.0.2.131 281
10.0.2.255 255.255.255.255 On-link 10.0.2.131 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.14.0 255.255.255.0 On-link 192.168.14.1 276
192.168.14.1 255.255.255.255 On-link 192.168.14.1 276
192.168.14.255 255.255.255.255 On-link 192.168.14.1 276
192.168.77.0 255.255.255.0 On-link 192.168.77.1 276
192.168.77.1 255.255.255.255 On-link 192.168.77.1 276
192.168.77.255 255.255.255.255 On-link 192.168.77.1 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.14.1 276
224.0.0.0 240.0.0.0 On-link 192.168.77.1 276
224.0.0.0 240.0.0.0 On-link 10.0.2.131 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.14.1 276
255.255.255.255 255.255.255.255 On-link 192.168.77.1 276
255.255.255.255 255.255.255.255 On-link 10.0.2.131 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
15 276 fe80::/64 On-link
16 276 fe80::/64 On-link
13 281 fe80::/64 On-link
15 276 fe80::20f4:c297:704b:c55c/128
On-link
16 276 fe80::414b:1f94:d205:a4ee/128
On-link
13 281 fe80::a1a2:2a87:a0e6:f5f/128
On-link
1 306 ff00::/8 On-link
15 276 ff00::/8 On-link
16 276 ff00::/8 On-link
13 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [51712] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [134528] (Microsoft Corporation)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 11 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346672] (VMware, Inc.)
Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346672] (VMware, Inc.)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70144] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [168304] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [320000] (Microsoft Corporation)
x64-Catalog9 11 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446512] (VMware, Inc.)
x64-Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446512] (VMware, Inc.)

========================= Event log errors: ===============================

Application errors:
==================
Error: (06/18/2012 05:08:12 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/18/2012 03:44:41 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/18/2012 00:57:02 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/18/2012 06:41:13 AM) (Source: Application Error) (User: )
Description: Faulting application name: iexplore.exe, version: 8.0.7600.16385, time stamp: 0x4a5bc69e
Faulting module name: mshtml.dll, version: 8.0.7600.16466, time stamp: 0x4b04f118
Exception code: 0xc0000005
Fault offset: 0x001f452d
Faulting process id: 0x50c
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3

Error: (06/17/2012 05:07:45 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/17/2012 00:34:44 AM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
Invalid Xml syntax.

Error: (06/16/2012 05:16:03 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/16/2012 05:06:05 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/16/2012 11:20:33 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.

Error: (06/15/2012 09:59:06 PM) (Source: Application Error) (User: )
Description: Faulting application name: iexplore.exe, version: 8.0.7600.16385, time stamp: 0x4a5bc69e
Faulting module name: mshtml.dll, version: 8.0.7600.16466, time stamp: 0x4b04f118
Exception code: 0xc0000005
Fault offset: 0x001f452d
Faulting process id: 0x1b30
Faulting application start time: 0xiexplore.exe0
Faulting application path: iexplore.exe1
Faulting module path: iexplore.exe2
Report Id: iexplore.exe3


System errors:
=============
Error: (06/15/2012 00:22:00 AM) (Source: Microsoft-Windows-DNS-Client) (User: NETWORK SERVICE)
Description: There was an error while attempting to read the local hosts file.

Error: (06/07/2012 06:22:13 PM) (Source: Service Control Manager) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (06/07/2012 06:22:13 PM) (Source: Service Control Manager) (User: )
Description: The Windows Search service terminated with service-specific error %%-1073473535.

Error: (06/03/2012 10:25:11 AM) (Source: bowser) (User: )
Description: The master browser has received a server announcement from the computer BHARATI-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{1DA84757-33BC-43E4-8769-C366D0C033F2}.
The master browser is stopping or an election is being forced.

Error: (05/24/2012 05:52:33 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 6:36:55 PM on ?5/?23/?2012 was unexpected.

Error: (05/13/2012 11:29:47 AM) (Source: EventLog) (User: )
Description: The previous system shutdown at 11:28:54 AM on ?5/?13/?2012 was unexpected.

Error: (04/16/2012 10:16:47 PM) (Source: NetBT) (User: )
Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.106.
The computer with the IP address 192.168.1.100 did not allow the name to be claimed by
this computer.

Error: (04/16/2012 09:46:06 PM) (Source: BROWSER) (User: )
Description: The browser was unable to promote itself to master browser. The computer that currently
believes it is the master browser is unknown.

Error: (04/16/2012 09:17:49 PM) (Source: NetBT) (User: )
Description: The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.106.
The computer with the IP address 192.168.1.100 did not allow the name to be claimed by
this computer.

Error: (02/08/2012 08:02:25 PM) (Source: Service Control Manager) (User: )
Description: The LeapFrog Connect Device Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.


Microsoft Office Sessions:
=========================
Error: (06/18/2012 05:08:12 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/18/2012 03:44:41 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/18/2012 00:57:02 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/18/2012 06:41:13 AM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.7600.163854a5bc69emshtml.dll8.0.7600.164664b04f118c0000005001f452d50c01cd4d3c371ab03dC:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\mshtml.dll1f9d85bb-b932-11e1-be57-005056c00008

Error: (06/17/2012 05:07:45 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/17/2012 00:34:44 AM) (Source: SideBySide)(User: )
Description: c:\program files (x86)\microsoft\search enhancement pack\search helper\sepsearchhelperie.dllc:\program files (x86)\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll2

Error: (06/16/2012 05:16:03 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/16/2012 05:06:05 PM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/16/2012 11:20:33 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (06/15/2012 09:59:06 PM) (Source: Application Error)(User: )
Description: iexplore.exe8.0.7600.163854a5bc69emshtml.dll8.0.7600.164664b04f118c0000005001f452d1b3001cd4b62ddce8991C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\mshtml.dllda024f68-b756-11e1-8925-005056c00008


=========================== Installed Programs ============================

µTorrent (Version: 2.0.4)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.1)
Adblock Pro 2.6 (Version: 2.6)
Adobe AIR (Version: 3.2.0.2070)
Adobe Community Help (Version: 3.4.980)
Adobe Content Viewer (Version: 1.4.0)
Adobe Download Assistant (Version: 1.0.6)
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.1.102.62)
Adobe Flash Player 11 Plugin 64-bit (Version: 11.2.202.235)
Adobe InDesign CS5.5 (Version: 7.5)
Adobe Media Player (Version: 1.8)
Adobe Photoshop CS5 (Version: 12.0)
Adobe Photoshop Lightroom 3 64-bit (Version: 3.0.2)
Adobe Reader 9.4.0 Lite (Version: 9.4.0)
Audacity 2.0
avast! Free Antivirus (Version: 5.0.677.0)
AVI Splitter
Bejeweled 2 Deluxe (Version: 2.2.0.82)
Blackhawk Striker 2 (Version: 2.2.0.82)
Blasterball 3 (Version: 2.2.0.82)
Build-a-lot 2 (Version: 2.2.0.82)
Cake Mania (Version: 2.2.0.82)
CCleaner (Version: 3.19)
Chuzzle Deluxe (Version: 2.2.0.82)
CinemaNow Media Manager (Version: 1.9.1.105)
CopyTrans Suite Remove Only (Version: 2.27)
CyberLink DVD Suite Deluxe (Version: 7.0.2712)
Diner Dash 2 Restaurant Rescue (Version: 2.2.0.82)
Dora's Carnival Adventure (Version: 2.2.0.82)
DVD Decrypter (Remove Only)
DVD Menu Pack for HP MediaSmart Video (Version: 4.0.3715)
Escape Rosecliff Island (Version: 2.2.0.82)
Faerie Solitaire (Version: 2.2.0.82)
FATE (Version: 2.2.0.82)
Google Chrome (Version: 19.0.1084.56)
Google Talk Plugin (Version: 2.9.10.7526)
HandBrake 0.9.5 (Version: 0.9.5)
Hardware Diagnostic Tools (Version: 6.0.5418.39)
HP Advisor (Version: 3.4.10262.3295)
HP Customer Experience Enhancements (Version: 6.0.1.4)
HP Game Console
HP Games (Version: 1.0.0.80)
HP MAINSTREAM KEYBOARD (Version: 1.4.3.0)
HP MediaSmart CinemaNow 2.0 (Version: 2.0)
HP MediaSmart DVD (Version: 4.0.3902)
HP MediaSmart Music (Version: 4.0.3910)
HP MediaSmart Photo (Version: 4.0.3911)
HP MediaSmart SmartMenu (Version: 3.1.1.12)
HP MediaSmart Video (Version: 4.0.3911)
HP MediaSmart/TouchSmart Netflix (Version: 1.0.2.0)
HP Odometer (Version: 2.10.0000)
HP Setup (Version: 1.2.4048.3310)
HP Support Assistant (Version: 4.3.1.2)
HP Support Information (Version: 10.1.0002)
HP Update (Version: 5.002.003.003)
HPAsset component for HP Active Support Library (Version: 3.0.0.3)
Hulu Desktop (Version: 0.9.11)
Intel® Management Engine Components (Version: 6.0.0.1179)
Intel® Rapid Storage Technology (Version: 9.5.7.1002)
IrfanView (remove only) (Version: 4.27)
Java Auto Updater (Version: 2.0.6.1)
Java™ 6 Update 29 (Version: 6.0.290)
Jewel Quest 3 (Version: 2.2.0.82)
Jewel Quest Solitaire 2 (Version: 2.2.0.82)
Junk Mail filter update (Version: 14.0.8089.726)
LabelPrint (Version: 2.5.2610)
LAME v3.99.3 (for Windows)
LeapFrog Connect (Version: 3.2.19.13664)
LeapFrog Tag Junior Plugin (Version: 3.2.19.13664)
LightScribe System Software (Version: 1.18.11.1)
magicJack (Version: 2.0.5940.4152)
Malwarebytes Anti-Malware version 1.61.0.1400 (Version: 1.61.0.1400)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Default Manager (Version: 2.1.54.0)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - English (Version: 14.0.4763.1000)
Microsoft Search Enhancement Pack (Version: 2.0.270.0)
Microsoft Silverlight (Version: 3.0.40818.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Movie Theme Pack for HP MediaSmart Video (Version: 4.0.3715)
Mozilla Firefox 6.0.1 (x86 en-US) (Version: 6.0.1)
MSN Toolbar (Version: 4.0.0369.0)
MSN Toolbar Platform (Version: 4.0.0369.0)
MSVCRT (Version: 14.0.1468.721)
Mystery P.I. - The New York Fortune (Version: 2.2.0.82)
Nero 7 Ultra Edition (Version: 7.02.9753)
neroxml (Version: 1.0.0)
Norton Online Backup (Version: 2.0.0.34)
NVIDIA Display Control Panel (Version: 1.10)
NVIDIA Drivers (Version: 1.10.57.35)
NVIDIA PhysX (Version: 9.09.1112)
Paragon Partition Manager™ 10.0 Server (Version: 90.00.0003)
PDF Settings CS5 (Version: 10.0)
Penguins! (Version: 2.2.0.82)
Photomatix Pro version 3.2 (Version: 3.2)
Photomatix Pro version 4.0 (Version: 4.0)
PhotoNow! (Version: 1.1.6904)
PictureMover (Version: 3.3.1.19)
Plants vs. Zombies (Version: 2.2.0.82)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poker Superstars III (Version: 2.2.0.82)
Polar Bowler (Version: 2.2.0.82)
Polar Golfer (Version: 2.2.0.82)
Power2Go (Version: 6.1.3810)
PowerDirector (Version: 8.0.2704)
Ralink RT2860 Wireless LAN Card
Realtek High Definition Audio Driver (Version: 6.0.1.6053)
Recovery Manager (Version: 5.5.2719)
Roxio CinemaNow 2.0 (Version: 1.0.262)
SUPERAntiSpyware (Version: 5.0.1150)
TeamViewer 6 (Version: 6.0.11117)
TeamViewer 7 (Version: 7.0.12979)
TextTwist 2 (Version: 2.2.0.82)
tools-freebsd (Version: 8.4.4.14247)
tools-linux (Version: 8.4.4.14247)
tools-netware (Version: 8.4.4.14247)
tools-solaris (Version: 8.4.4.14247)
tools-windows (Version: 8.4.4.14247)
tools-winPre2k (Version: 8.4.4.14247)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Junior Plugin)
Virtual Families (Version: 2.2.0.82)
Virtual Villagers - The Secret City (Version: 2.2.0.82)
VMware Workstation (Version: 7.1.2.14247)
Wheel of Fortune 2 (Version: 2.2.0.82)
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0) (Version: 11/05/2008 1.1.1.0)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (Version: 09/10/2009 02.03.05.012)
Windows Live Call (Version: 14.0.8064.0206)
Windows Live Communications Platform (Version: 14.0.8064.206)
Windows Live Essentials (Version: 14.0.8089.0726)
Windows Live Essentials (Version: 14.0.8089.726)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (Version: 14.0.8089.0726)
Windows Live Messenger (Version: 14.0.8089.0726)
Windows Live Photo Gallery (Version: 14.0.8081.709)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live Upload Tool (Version: 14.0.8014.1029)
Windows Live Writer (Version: 14.0.8089.0726)
WinPcap 4.0.2 (Version: 4.0.0.1040)
WinRAR archiver
WM Recorder
WM Recorder (Version: 14)
Zuma's Revenge (Version: 2.2.0.82)

========================= Devices: ================================

Name: Realtek PCIe GBE Family Controller
Description: Realtek PCIe GBE Family Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


========================= Memory info: ===================================

Percentage of memory in use: 43%
Total physical RAM: 3959.08 MB
Available physical RAM: 2238.45 MB
Total Pagefile: 7916.3 MB
Available Pagefile: 6118.22 MB
Total Virtual: 4095.88 MB
Available Virtual: 3968.25 MB

========================= Partitions: =====================================

1 Drive c: (OS) (Fixed) (Total:352.88 GB) (Free:306.55 GB) NTFS
2 Drive d: (HP_RECOVERY) (Fixed) (Total:11.56 GB) (Free:1.4 GB) NTFS
3 Drive e: (GoDiamond2012) (CDROM) (Total:0.15 GB) (Free:0 GB) UDF
4 Drive f: (NIKON D40) (Removable) (Total:0.95 GB) (Free:0.88 GB) FAT
9 Drive x: () (Fixed) (Total:200.01 GB) (Free:6.77 GB) NTFS
10 Drive y: () (Fixed) (Total:134.09 GB) (Free:29.05 GB) NTFS

========================= Users: ========================================

User accounts for \\HP

__vmware_user__ Administrator Guest
RJ


**** End of log ****




Malwarebytes' Anti-Malware

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.06.16.06

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
RJ :: HP [administrator]

6/18/2012 9:22:24 PM
mbam-log-2012-06-18 (21-22-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 209303
Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)




aswMBR

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-06-18 21:31:12
-----------------------------
21:31:12.481 OS Version: Windows x64 6.1.7600
21:31:12.482 Number of processors: 4 586 0x2502
21:31:12.482 ComputerName: HP UserName: RJ
21:31:13.197 Initialize success
21:31:13.793 AVAST engine defs: 12061802
21:31:38.865 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:31:38.868 Disk 0 Vendor: ST375052 HP35 Size: 715404MB BusType: 8
21:31:38.886 Disk 0 MBR read successfully
21:31:38.889 Disk 0 MBR scan
21:31:38.893 Disk 0 unknown MBR code
21:31:38.901 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
21:31:38.912 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 361350 MB offset 206848
21:31:38.917 Disk 0 Partition - 00 0F Extended LBA 342113 MB offset 740251648
21:31:38.942 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 11839 MB offset 1440899072
21:31:38.970 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 204805 MB offset 740259198
21:31:38.976 Disk 0 Partition - 00 05 Extended 137304 MB offset 1159700220
21:31:38.995 Disk 0 Partition 5 00 07 HPFS/NTFS NTFS 137304 MB offset 1159700283
21:31:39.038 Disk 0 scanning C:\Windows\system32\drivers
21:31:45.742 Service scanning
21:31:57.915 Modules scanning
21:31:57.925 Disk 0 trace - called modules:
21:31:57.940 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:31:57.948 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80049fa060]
21:31:57.955 3 CLASSPNP.SYS[fffff88000c5543f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80046d9050]
21:31:58.399 AVAST engine scan C:\Windows
21:32:00.014 AVAST engine scan C:\Windows\system32
21:33:04.006 AVAST engine scan C:\Windows\system32\drivers
21:33:11.083 AVAST engine scan C:\Users\RJ
21:40:06.978 Disk 0 MBR has been saved successfully to "C:\Users\RJ\Desktop\BC\MBR.dat"
21:40:06.984 The log file has been saved successfully to "C:\Users\RJ\Desktop\BC\04_aswMBR.txt"

#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:37 AM

Posted 18 June 2012 - 09:15 PM

I don't see much there.

Which browser is affected?

Download Bootkit Remover to your desktop.

  • Unzip downloaded file to your Desktop.
  • Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
  • It will show a Black screen with some data on it.
  • Right click on the screen and click Select All.
  • Press CTRL+C
  • Open a Notepad and press CTRL+V
  • Post the output back here.

===============================================

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 sanjoo9211

sanjoo9211
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:37 AM

Posted 21 June 2012 - 11:45 PM

Which browser is affected?

Firefox


Bootkit Remover

Bootkit Remover
© 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Home Premium Edition (build 7600), 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`06500000
Boot sector MD5 is: 2c55a7937cd245684f8c74ce86f57c13

Size Device Name MBR Status
--------------------------------------------
698 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...




GMER

No Modifications found.

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:37 AM

Posted 21 June 2012 - 11:57 PM

Please check if IE is redirected as well.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#7 sanjoo9211

sanjoo9211
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:37 AM

Posted 22 June 2012 - 12:53 AM

Yes, IE is also redirecting.

Thanks for your quick responses and assistance. I do appreciate it.

#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,699 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:37 AM

Posted 22 June 2012 - 05:35 PM

It looks like we'll need to take deeper look.

Please follow the instructions in ==>This Guide<== starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#9 sanjoo9211

sanjoo9211
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:37 AM

Posted 01 July 2012 - 12:03 AM

Broni,

Thanks for your assistance.

I have created the new topic here: http://www.bleepingcomputer.com/forums/topic458925.html




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users