google redirect

chipnmissy · 04-18-2009, 06:56 PM

Hi, and thanks for your help in advance.
I have something that redirects my google links, sometimes once, sometimes two or three times. Often when I get redirected, I hit the back button, and instead of returning to my search, I land on google's home page. I have spyware doctor with anti virus, and it has found some things, but nothing seems to repair the problem. I am running firefox, I believe the latest version.

this is the dds log.

DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 20:38:42.78 on Sat 04/18/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.95 [GMT -4:00]

AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\eM\Bay Reader\Shwicon2k.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Spotmau\Desktop_Secretary\Spotmau_S.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\dds.scr
C:\WINDOWS\System32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uStart Page = hxxp://www.yahoo.com/
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
uURLSearchHooks: DefaultSearchHook Class: {c94e154b-1459-4a47-966b-4b843befc7db} - c:\program files\asksearch\bin\DefaultSearch.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [MoneyAgent] "c:\program files\microsoft money\system\mnyexpr.exe"
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [CHotkey] zHotkey.exe
mRun: [showicon2k] c:\program files\\em\bay reader\Shwicon2k.exe
mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\photosmart\hp share-to-web\hpgs2wnd.exe
mRun: [CXMon] "c:\program files\hewlett-packard\photosmart\photo imaging\Hpi_Monitor.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SpotmauSecretary] c:\program files\spotmau\desktop_secretary\Spotmau_S.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\frostw~1.lnk - c:\program files\frostwire\FrostWire.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bigfix.lnk - c:\program files\bigfix\BigFix.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
IE: Add to AMV Converter... - c:\program files\mp3 player utilities 4.19\amvconverter\grab.html
IE: {6224f700-cba3-4071-b251-47cb894244cd} - c:\program files\icq\ICQ.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131-win.cab
DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.3.1/jinstall-131_02-win.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\1spbq164.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-16 130424]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-4-16 51520]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-4-16 38208]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-4-16 159600]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-16 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-16 1095560]
R2 supersafer;supersafer;c:\windows\system32\drivers\supersafer.sys [2009-4-4 354176]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-4-16 64392]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-4-16 33088]
R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?]

=============== Created Last 30 ================

2009-04-18 20:13 <DIR> --d----- c:\program files\Trend Micro
2009-04-18 13:52 <DIR> --d----- c:\program files\UNICCodec
2009-04-16 22:55 38,208 a------- c:\windows\system32\drivers\TfSysMon.sys
2009-04-16 22:55 33,088 a------- c:\windows\system32\drivers\TfNetMon.sys
2009-04-16 22:55 12,608 a------- c:\windows\system32\drivers\TfKbMon.sys
2009-04-16 22:55 51,520 a------- c:\windows\system32\drivers\TfFsMon.sys
2009-04-16 22:39 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-16 22:39 130,424 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-16 22:39 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-16 22:39 <DIR> --d----- c:\program files\common files\PC Tools
2009-04-16 22:39 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-16 22:39 <DIR> --d----- c:\program files\Spyware Doctor
2009-04-16 22:39 <DIR> --d----- c:\docume~1\owner\applic~1\PC Tools
2009-04-16 22:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-16 22:34 <DIR> --d----- c:\program files\CCleaner
2009-04-14 18:54 <DIR> --d----- c:\documents and settings\owner\.tuxguitar-1.1
2009-04-14 18:54 <DIR> --d----- c:\program files\tuxguitar-1.1
2009-04-14 18:49 1,200 a------- c:\windows\system32\rzeksfsp.dat
2009-04-14 18:49 <DIR> --d----- c:\program files\SFaxTools
2009-04-12 17:27 <DIR> --d----- c:\program files\Blockland
2009-04-11 19:24 <DIR> --d----- c:\docume~1\owner\applic~1\Unity
2009-04-11 18:54 <DIR> --d----- c:\program files\Unity
2009-04-11 13:37 247,494 a------- c:\windows\PUZZLES.DAT
2009-04-11 13:24 92,208 a------- c:\windows\system\WING.DLL
2009-04-11 13:24 30 a------- c:\windows\PUZZLES.INI
2009-04-07 04:15 54,156 a---h--- c:\windows\QTFont.qfn
2009-04-07 04:15 1,409 a------- c:\windows\QTFont.for
2009-04-06 11:56 <DIR> --d----- c:\program files\Yahoo!
2009-04-05 14:41 72 a------- c:\windows\MediaManager.INI
2009-04-05 14:29 <DIR> --d----- c:\windows\system32\LogFiles
2009-04-05 14:28 <DIR> --d----- c:\program files\MP3 Player Utilities 4.19
2009-04-05 13:24 <DIR> --d----- c:\docume~1\owner\applic~1\FrostWire
2009-04-05 13:23 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-05 13:21 <DIR> --d----- c:\program files\AskSearch
2009-04-05 13:21 <DIR> --d----- c:\program files\AskBarDis
2009-04-04 19:44 <DIR> --d----- c:\docume~1\owner\applic~1\WinCare2009
2009-04-04 18:18 354,176 a------- c:\windows\system32\drivers\supersafer.sys
2009-04-04 18:18 470,528 a------- c:\windows\system32\wxmsw28u_html_vc_custom.dll
2009-04-04 18:18 2,771,968 a------- c:\windows\system32\wxmsw28u_core_vc_custom.dll
2009-04-04 18:18 1,163,776 a------- c:\windows\system32\wxbase28u_vc_custom.dll
2009-04-04 18:18 681,472 a------- c:\windows\system32\wxmsw28u_adv_vc_custom.dll
2009-04-04 18:18 118,784 a------- c:\windows\system32\wxbase28u_xml_vc_custom.dll
2009-04-04 18:18 <DIR> --d----- c:\program files\Spotmau
2009-04-04 13:21 31,768 a------- c:\windows\system32\wucltui.dll.mui
2009-04-04 13:21 23,576 a------- c:\windows\system32\wuaucpl.cpl.mui
2009-04-04 13:21 18,456 a------- c:\windows\system32\wuaueng.dll.mui
2009-04-04 13:21 23,576 a------- c:\windows\system32\wuapi.dll.mui

==================== Find3M ====================

2004-11-29 21:32 0 a---h--- c:\documents and settings\owner\hpothb07.dat
2004-01-26 19:45 0 ac--h--- c:\program files\hpothb07.dat
2004-01-26 19:44 15,628 a---h--- c:\program files\hpothb07.tif
2003-03-31 08:00 94,784 ---sh--- c:\windows\twain.dll
2004-08-04 03:56 50,688 ---sh--- c:\windows\twain_32.dll
2004-08-04 03:56 1,028,096 ---sh--- c:\windows\system32\mfc42.dll
2004-08-04 03:56 54,784 ---sh--- c:\windows\system32\msvcirt.dll
2004-08-04 03:56 413,696 a--sh--- c:\windows\system32\msvcp60.dll
2004-08-04 03:56 343,040 a--sh--- c:\windows\system32\msvcrt.dll
2004-08-04 03:56 11,776 ---sh--- c:\windows\system32\regsvr32.exe

============= FINISH: 20:38:57.67 ===============

tetonbob · 04-19-2009, 06:23 PM

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

---------------------------------------------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum.

---------------------------------------------------------------------------------------------

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

chipnmissy · 04-19-2009, 06:58 PM

here is the combofix log report

ComboFix 09-04-20.02 - Owner 04/19/2009 20:54.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.212 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.EXE.exe
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
.
/wow section not completed

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-09 02:08 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768]
"showicon2k"="c:\program files\\eM\Bay Reader\Shwicon2k.exe" [2003-07-04 135168]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]
"CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2003-04-24 77824]
"SpotmauSecretary"="c:\program files\Spotmau\Desktop_Secretary\Spotmau_S.exe" [2009-03-11 566784]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-04-19 1851128]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-05-02 323584]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\BigFix.exe [2003-4-23 1742384]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R3 cpuz129;cpuz129;c:\program files\PC Wizard 2008\pcwiz32.sys [2008-01-25 9600]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2008-12-10 64392]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-06-06 33088]
R3 ThreatFire;ThreatFire; [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-06-06 51520]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-06-06 38208]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-04-19 110992]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-04-19 24336]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2008-12-11 159600]
S2 supersafer;supersafer;c:\windows\system32\drivers\supersafer.sys [2009-03-11 354176]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-19 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2003-04-23 07:56]

2009-04-14 c:\windows\Tasks\Disk Defragmenter.job
- c:\documents and settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk [2003-04-24 03:48]

2004-09-06 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8075430597.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2009-04-19 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-04-24 16:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\1spbq164.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 20:55
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3508902286-1040935473-1732238221-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(744)
c:\windows\system32\guard32.dll
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
Completion time: 2009-04-20 20:56
ComboFix-quarantined-files.txt 2009-04-20 00:56

Pre-Run: 148,180,070,400 bytes free
Post-Run: 148,167,155,712 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

128

tetonbob · 04-19-2009, 08:06 PM

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/368141-google-redirect.html#post2090633

Collect::
C:\Windows\system32\gxvxcyvppjcxerthyaibwefxewlguhhlhbkba.dll

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
If you do not get a message box, please do the following:

There should be a file named [4]-Submit_date@time.zip with today's date, located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

---------------------------------------------------------------------------------------------

Is the machine still being redirected?

chipnmissy · 04-19-2009, 08:23 PM

Everything seems to be working fine now. Thank you. The files were successfully submitted. This is the last combofix log:

ComboFix 09-04-20.02 - Owner 04/19/2009 22:17.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.115 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.EXE.exe
Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gxvxccounter

.
((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 )))))))))))))))))))))))))))))))
.

2009-04-19 03:07 . 2007-09-15 19:11 27136 ----a-w c:\windows\system32\PCWizard.cpl
2009-04-19 02:40 . 2009-04-20 00:44 -------- d-----w c:\documents and settings\All Users\Application Data\Comodo
2009-04-19 02:40 . 2009-04-19 02:40 24336 ----a-w c:\windows\system32\drivers\cmdhlp.sys
2009-04-19 02:40 . 2009-04-19 02:40 155384 ----a-w c:\windows\system32\guard32.dll
2009-04-19 02:40 . 2009-04-19 02:40 110992 ----a-w c:\windows\system32\drivers\cmdguard.sys
2009-04-17 02:55 . 2008-06-06 16:15 38208 ----a-w c:\windows\system32\drivers\TfSysMon.sys
2009-04-17 02:55 . 2008-06-06 16:15 33088 ----a-w c:\windows\system32\drivers\TfNetMon.sys
2009-04-17 02:55 . 2008-06-06 16:15 12608 ----a-w c:\windows\system32\drivers\TfKbMon.sys
2009-04-17 02:55 . 2008-06-06 16:15 51520 ----a-w c:\windows\system32\drivers\TfFsMon.sys
2009-04-17 02:39 . 2008-12-11 12:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys
2009-04-17 02:39 . 2009-03-06 20:45 130424 ----a-w c:\windows\system32\drivers\PCTCore.sys
2009-04-17 02:39 . 2008-12-18 16:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-17 02:39 . 2009-04-20 00:37 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-17 02:39 . 2008-12-10 16:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys
2009-04-17 02:39 . 2009-04-17 02:56 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2009-04-17 02:39 . 2009-04-17 02:39 -------- d-----w c:\documents and settings\Owner\Application Data\PC Tools
2009-04-14 22:54 . 2009-04-14 22:54 -------- d-----w c:\documents and settings\Owner\.tuxguitar-1.1
2009-04-14 22:49 . 2009-04-14 22:49 1200 ----a-w c:\windows\system32\rzeksfsp.dat
2009-04-11 23:24 . 2009-04-11 23:24 -------- d-----w c:\documents and settings\Owner\Application Data\Unity
2009-04-11 22:54 . 2009-04-11 22:54 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Unity
2009-04-11 17:37 . 2009-04-11 17:38 247494 ----a-w c:\windows\PUZZLES.DAT
2009-04-11 17:24 . 2009-04-11 17:33 30 ----a-w c:\windows\PUZZLES.INI
2009-04-11 17:24 . 1994-09-21 04:00 92208 ----a-w c:\windows\system\WING.DLL
2009-04-07 08:15 . 2009-04-12 01:21 54156 ---ha-w c:\windows\QTFont.qfn
2009-04-07 08:15 . 2009-04-07 08:15 1409 ----a-w c:\windows\QTFont.for
2009-04-06 22:34 . 2009-04-06 22:34 -------- d-----w c:\windows\Sun
2009-04-06 15:58 . 2009-04-06 15:58 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Yahoo
2009-04-06 15:57 . 2009-04-06 15:57 -------- d-----w c:\documents and settings\Owner\Application Data\Yahoo!
2009-04-06 15:56 . 2009-04-06 15:58 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-04-05 18:41 . 2009-04-05 18:50 72 ----a-w c:\windows\MediaManager.INI
2009-04-05 18:29 . 2009-04-05 18:29 -------- d-----w c:\windows\system32\drivers\UMDF
2009-04-05 18:29 . 2009-04-05 18:29 -------- d-----w c:\windows\system32\LogFiles
2009-04-05 17:24 . 2009-04-05 20:06 -------- d-----w c:\documents and settings\Owner\Application Data\FrostWire
2009-04-05 17:23 . 2008-06-10 06:32 73728 ----a-w c:\windows\system32\javacpl.cpl
2009-04-04 23:47 . 2009-04-12 06:11 -------- d-----w c:\documents and settings\Owner\Application Data\U3
2009-04-04 23:44 . 2009-04-04 23:44 -------- d-----w c:\documents and settings\Owner\Application Data\WinCare2009
2009-04-04 22:18 . 2009-03-11 18:33 354176 ----a-w c:\windows\system32\drivers\supersafer.sys
2009-04-04 22:18 . 2009-03-11 18:33 470528 ----a-w c:\windows\system32\wxmsw28u_html_vc_custom.dll
2009-04-04 22:18 . 2009-03-11 18:33 681472 ----a-w c:\windows\system32\wxmsw28u_adv_vc_custom.dll
2009-04-04 22:18 . 2009-03-11 18:33 118784 ----a-w c:\windows\system32\wxbase28u_xml_vc_custom.dll
2009-04-04 22:18 . 2009-03-11 18:33 1163776 ----a-w c:\windows\system32\wxbase28u_vc_custom.dll
2009-04-04 22:18 . 2009-03-11 18:33 2771968 ----a-w c:\windows\system32\wxmsw28u_core_vc_custom.dll
2009-04-04 17:21 . 2008-10-16 19:09 31768 ----a-w c:\windows\system32\wucltui.dll.mui
2009-04-04 17:21 . 2008-10-16 19:07 23576 ----a-w c:\windows\system32\wuaucpl.cpl.mui
2009-04-04 17:21 . 2008-10-16 19:07 18456 ----a-w c:\windows\system32\wuaueng.dll.mui
2009-04-04 17:21 . 2008-10-16 19:07 23576 ----a-w c:\windows\system32\wuapi.dll.mui
2009-04-04 17:04 . 2009-04-04 17:04 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-20 00:36 . 2009-04-17 02:39 -------- d-----w c:\program files\Spyware Doctor
2009-04-19 03:07 . 2009-04-19 03:07 -------- d-----w c:\program files\PC Wizard 2008
2009-04-19 02:40 . 2009-04-19 02:40 -------- d-----w c:\program files\COMODO
2009-04-19 00:13 . 2009-04-19 00:13 -------- d-----w c:\program files\Trend Micro
2009-04-18 17:52 . 2009-04-18 17:52 -------- d-----w c:\program files\UNICCodec
2009-04-17 02:40 . 2009-04-17 02:39 -------- d-----w c:\program files\Common Files\PC Tools
2009-04-17 02:34 . 2009-04-17 02:34 -------- d-----w c:\program files\CCleaner
2009-04-14 22:54 . 2009-04-14 22:54 -------- d-----w c:\program files\tuxguitar-1.1
2009-04-14 22:49 . 2009-04-14 22:49 -------- d-----w c:\program files\SFaxTools
2009-04-12 21:27 . 2009-04-12 21:27 -------- d-----w c:\program files\Blockland
2009-04-11 22:54 . 2009-04-11 22:54 -------- d-----w c:\program files\Unity
2009-04-06 20:18 . 2009-04-06 15:56 -------- d-----w c:\program files\Yahoo!
2009-04-05 18:28 . 2009-04-05 18:28 -------- d-----w c:\program files\MP3 Player Utilities 4.19
2009-04-05 17:24 . 2009-04-05 17:21 -------- d-----w c:\program files\AskBarDis
2009-04-05 17:23 . 2009-04-05 17:22 -------- d-----w c:\program files\Java
2009-04-05 17:22 . 2009-04-05 17:22 -------- d-----w c:\program files\Common Files\Java
2009-04-05 17:21 . 2009-04-05 17:21 -------- d-----w c:\program files\AskSearch
2009-04-04 22:18 . 2009-04-04 22:18 -------- d-----w c:\program files\Spotmau
2009-04-04 03:31 . 2005-06-19 22:33 -------- d-----w c:\program files\Warcraft III
2009-04-04 03:27 . 2004-01-22 03:33 -------- d-----w c:\program files\EarthLink TotalAccess
2008-09-22 01:51 . 2004-02-05 22:09 24960 ----a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2004-11-30 01:32 . 2004-08-29 23:54 0 ---ha-w c:\documents and settings\Owner\hpothb07.dat
2004-05-27 00:42 . 2004-05-27 00:42 0 ---ha-w c:\documents and settings\NetworkService\hpothb07.dat
2004-01-26 23:45 . 2004-01-26 23:44 0 -c-ha-w c:\program files\hpothb07.dat
2004-01-26 23:44 . 2004-01-26 23:44 15628 ---ha-w c:\program files\hpothb07.tif
2003-03-31 12:00 . 2003-04-23 23:52 94784 --sh--w c:\windows\twain.dll
2004-08-04 07:56 . 2003-04-23 23:52 50688 --sh--w c:\windows\twain_32.dll
2004-08-04 07:56 . 2003-04-23 23:52 1028096 --sh--w c:\windows\system32\mfc42.dll
2004-08-04 07:56 . 2003-04-23 23:52 54784 --sh--w c:\windows\system32\msvcirt.dll
2004-08-04 07:56 . 2003-04-23 23:52 413696 --sha-w c:\windows\system32\msvcp60.dll
2004-08-04 07:56 . 2003-04-23 23:52 343040 --sha-w c:\windows\system32\msvcrt.dll
2004-08-04 07:56 . 2003-04-23 23:52 11776 --sh--w c:\windows\system32\regsvr32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-09-09 02:08 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768]
"showicon2k"="c:\program files\\eM\Bay Reader\Shwicon2k.exe" [2003-07-04 135168]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344]
"CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2003-04-24 77824]
"SpotmauSecretary"="c:\program files\Spotmau\Desktop_Secretary\Spotmau_S.exe" [2009-03-11 566784]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-04-19 1851128]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-05-02 323584]
"CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\BigFix.exe [2003-4-23 1742384]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R3 cpuz129;cpuz129;c:\program files\PC Wizard 2008\pcwiz32.sys [2008-01-25 9600]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2008-12-10 64392]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-06-06 33088]
R3 ThreatFire;ThreatFire; [x]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-06-06 51520]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-06-06 38208]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-04-19 110992]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-04-19 24336]
S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2008-12-11 159600]
S2 supersafer;supersafer;c:\windows\system32\drivers\supersafer.sys [2009-03-11 354176]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-19 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2003-04-23 07:56]

2009-04-14 c:\windows\Tasks\Disk Defragmenter.job
- c:\documents and settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk [2003-04-24 03:48]

2004-09-06 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8075430597.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2009-04-19 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-04-24 16:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\1spbq164.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-19 22:19
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3508902286-1040935473-1732238221-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(684)
c:\windows\system32\guard32.dll

- - - - - - - > 'lsass.exe'(744)
c:\windows\system32\guard32.dll
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
Completion time: 2009-04-20 22:20
ComboFix-quarantined-files.txt 2009-04-20 02:20
ComboFix2.txt 2009-04-20 00:56

Pre-Run: 148,160,679,936 bytes free
Post-Run: 148,149,035,008 bytes free

206

tetonbob · 04-19-2009, 08:43 PM

Hi -

I'm glad to hear things are working better. We'll have a bit more work to do.

First, I have a question.

Did you run ComboFix once, prior to the log posted in post # 3? The various data in the several logs and the upload aren't really lining up.

tetonbob · 05-03-2009, 11:31 AM

Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

04-19-2009, 06:23 PM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,135 OS: 2000 Pro; XP Pro; XP Home	Re: google redirect Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. --------------------------------------------------------------------------------------------- Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper at this forum. --------------------------------------------------------------------------------------------- Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-19-2009, 06:58 PM	#3 (permalink)
chipnmissy Registered User Join Date: Apr 2009 Location: vermont Posts: 3 OS: xp	Re: google redirect here is the combofix log report ComboFix 09-04-20.02 - Owner 04/19/2009 20:54.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.212 [GMT -4:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.EXE.exe AV: Spyware Doctor with AntiVirus On-access scanning disabled (Updated) FW: COMODO Firewall disabled . /wow section not completed ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_GXVXCSERV.SYS ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-09-09 02:08 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768] "showicon2k"="c:\program files\\eM\Bay Reader\Shwicon2k.exe" [2003-07-04 135168] "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344] "CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 45056] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2003-04-24 77824] "SpotmauSecretary"="c:\program files\Spotmau\Desktop_Secretary\Spotmau_S.exe" [2009-03-11 566784] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-04-19 1851128] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-05-02 323584] "CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BigFix.lnk - c:\program files\BigFix\BigFix.exe [2003-4-23 1742384] hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646] hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave"= serwvdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= R3 cpuz129;cpuz129;c:\program files\PC Wizard 2008\pcwiz32.sys [2008-01-25 9600] R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2008-12-10 64392] R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-06-06 33088] R3 ThreatFire;ThreatFire; [x] S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424] S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-06-06 51520] S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-06-06 38208] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-04-19 110992] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-04-19 24336] S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2008-12-11 159600] S2 supersafer;supersafer;c:\windows\system32\drivers\supersafer.sys [2009-03-11 354176] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2009-04-19 c:\windows\Tasks\Disk Cleanup.job - c:\windows\system32\cleanmgr.exe [2003-04-23 07:56] 2009-04-14 c:\windows\Tasks\Disk Defragmenter.job - c:\documents and settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk [2003-04-24 03:48] 2004-09-06 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8075430597.job - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52] 2009-04-19 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-04-24 16:24] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/http://www.yahoo.com IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\1spbq164.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-19 20:55 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose, ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3508902286-1040935473-1732238221-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(684) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(744) c:\windows\system32\guard32.dll c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-04-20 20:56 ComboFix-quarantined-files.txt 2009-04-20 00:56 Pre-Run: 148,180,070,400 bytes free Post-Run: 148,167,155,712 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 128

04-19-2009, 08:06 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,135 OS: 2000 Pro; XP Pro; XP Home	Re: google redirect Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. --------------------------------------------------------------------------------------------- Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix. Open notepad and copy/paste the text in the quotebox below into it: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/368141-google-redirect.html#post2090633 Collect:: C:\Windows\system32\gxvxcyvppjcxerthyaibwefxewlguhhlhbkba.dll Save this as CFScript.txt Referring to the picture above, drag CFScript.txt into ComboFix.exe Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. If you do not get a message box, please do the following: There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ Ensure your AntiVirus and AntiSpyware applications are re-enabled. --------------------------------------------------------------------------------------------- Is the machine still being redirected? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

04-19-2009, 08:23 PM	#5 (permalink)
chipnmissy Registered User Join Date: Apr 2009 Location: vermont Posts: 3 OS: xp	Re: google redirect Everything seems to be working fine now. Thank you. The files were successfully submitted. This is the last combofix log: ComboFix 09-04-20.02 - Owner 04/19/2009 22:17.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.447.115 [GMT -4:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.EXE.exe Command switches used :: c:\documents and settings\Owner\Desktop\cfscript.txt AV: Spyware Doctor with AntiVirus On-access scanning disabled (Updated) FW: COMODO Firewall disabled * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\gxvxccounter . ((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 ))))))))))))))))))))))))))))))) . 2009-04-19 03:07 . 2007-09-15 19:11 27136 ----a-w c:\windows\system32\PCWizard.cpl 2009-04-19 02:40 . 2009-04-20 00:44 -------- d-----w c:\documents and settings\All Users\Application Data\Comodo 2009-04-19 02:40 . 2009-04-19 02:40 24336 ----a-w c:\windows\system32\drivers\cmdhlp.sys 2009-04-19 02:40 . 2009-04-19 02:40 155384 ----a-w c:\windows\system32\guard32.dll 2009-04-19 02:40 . 2009-04-19 02:40 110992 ----a-w c:\windows\system32\drivers\cmdguard.sys 2009-04-17 02:55 . 2008-06-06 16:15 38208 ----a-w c:\windows\system32\drivers\TfSysMon.sys 2009-04-17 02:55 . 2008-06-06 16:15 33088 ----a-w c:\windows\system32\drivers\TfNetMon.sys 2009-04-17 02:55 . 2008-06-06 16:15 12608 ----a-w c:\windows\system32\drivers\TfKbMon.sys 2009-04-17 02:55 . 2008-06-06 16:15 51520 ----a-w c:\windows\system32\drivers\TfFsMon.sys 2009-04-17 02:39 . 2008-12-11 12:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys 2009-04-17 02:39 . 2009-03-06 20:45 130424 ----a-w c:\windows\system32\drivers\PCTCore.sys 2009-04-17 02:39 . 2008-12-18 16:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys 2009-04-17 02:39 . 2009-04-20 00:37 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-04-17 02:39 . 2008-12-10 16:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys 2009-04-17 02:39 . 2009-04-17 02:56 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools 2009-04-17 02:39 . 2009-04-17 02:39 -------- d-----w c:\documents and settings\Owner\Application Data\PC Tools 2009-04-14 22:54 . 2009-04-14 22:54 -------- d-----w c:\documents and settings\Owner\.tuxguitar-1.1 2009-04-14 22:49 . 2009-04-14 22:49 1200 ----a-w c:\windows\system32\rzeksfsp.dat 2009-04-11 23:24 . 2009-04-11 23:24 -------- d-----w c:\documents and settings\Owner\Application Data\Unity 2009-04-11 22:54 . 2009-04-11 22:54 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Unity 2009-04-11 17:37 . 2009-04-11 17:38 247494 ----a-w c:\windows\PUZZLES.DAT 2009-04-11 17:24 . 2009-04-11 17:33 30 ----a-w c:\windows\PUZZLES.INI 2009-04-11 17:24 . 1994-09-21 04:00 92208 ----a-w c:\windows\system\WING.DLL 2009-04-07 08:15 . 2009-04-12 01:21 54156 ---ha-w c:\windows\QTFont.qfn 2009-04-07 08:15 . 2009-04-07 08:15 1409 ----a-w c:\windows\QTFont.for 2009-04-06 22:34 . 2009-04-06 22:34 -------- d-----w c:\windows\Sun 2009-04-06 15:58 . 2009-04-06 15:58 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Yahoo 2009-04-06 15:57 . 2009-04-06 15:57 -------- d-----w c:\documents and settings\Owner\Application Data\Yahoo! 2009-04-06 15:56 . 2009-04-06 15:58 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! 2009-04-05 18:41 . 2009-04-05 18:50 72 ----a-w c:\windows\MediaManager.INI 2009-04-05 18:29 . 2009-04-05 18:29 -------- d-----w c:\windows\system32\drivers\UMDF 2009-04-05 18:29 . 2009-04-05 18:29 -------- d-----w c:\windows\system32\LogFiles 2009-04-05 17:24 . 2009-04-05 20:06 -------- d-----w c:\documents and settings\Owner\Application Data\FrostWire 2009-04-05 17:23 . 2008-06-10 06:32 73728 ----a-w c:\windows\system32\javacpl.cpl 2009-04-04 23:47 . 2009-04-12 06:11 -------- d-----w c:\documents and settings\Owner\Application Data\U3 2009-04-04 23:44 . 2009-04-04 23:44 -------- d-----w c:\documents and settings\Owner\Application Data\WinCare2009 2009-04-04 22:18 . 2009-03-11 18:33 354176 ----a-w c:\windows\system32\drivers\supersafer.sys 2009-04-04 22:18 . 2009-03-11 18:33 470528 ----a-w c:\windows\system32\wxmsw28u_html_vc_custom.dll 2009-04-04 22:18 . 2009-03-11 18:33 681472 ----a-w c:\windows\system32\wxmsw28u_adv_vc_custom.dll 2009-04-04 22:18 . 2009-03-11 18:33 118784 ----a-w c:\windows\system32\wxbase28u_xml_vc_custom.dll 2009-04-04 22:18 . 2009-03-11 18:33 1163776 ----a-w c:\windows\system32\wxbase28u_vc_custom.dll 2009-04-04 22:18 . 2009-03-11 18:33 2771968 ----a-w c:\windows\system32\wxmsw28u_core_vc_custom.dll 2009-04-04 17:21 . 2008-10-16 19:09 31768 ----a-w c:\windows\system32\wucltui.dll.mui 2009-04-04 17:21 . 2008-10-16 19:07 23576 ----a-w c:\windows\system32\wuaucpl.cpl.mui 2009-04-04 17:21 . 2008-10-16 19:07 18456 ----a-w c:\windows\system32\wuaueng.dll.mui 2009-04-04 17:21 . 2008-10-16 19:07 23576 ----a-w c:\windows\system32\wuapi.dll.mui 2009-04-04 17:04 . 2009-04-04 17:04 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\Mozilla . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-20 00:36 . 2009-04-17 02:39 -------- d-----w c:\program files\Spyware Doctor 2009-04-19 03:07 . 2009-04-19 03:07 -------- d-----w c:\program files\PC Wizard 2008 2009-04-19 02:40 . 2009-04-19 02:40 -------- d-----w c:\program files\COMODO 2009-04-19 00:13 . 2009-04-19 00:13 -------- d-----w c:\program files\Trend Micro 2009-04-18 17:52 . 2009-04-18 17:52 -------- d-----w c:\program files\UNICCodec 2009-04-17 02:40 . 2009-04-17 02:39 -------- d-----w c:\program files\Common Files\PC Tools 2009-04-17 02:34 . 2009-04-17 02:34 -------- d-----w c:\program files\CCleaner 2009-04-14 22:54 . 2009-04-14 22:54 -------- d-----w c:\program files\tuxguitar-1.1 2009-04-14 22:49 . 2009-04-14 22:49 -------- d-----w c:\program files\SFaxTools 2009-04-12 21:27 . 2009-04-12 21:27 -------- d-----w c:\program files\Blockland 2009-04-11 22:54 . 2009-04-11 22:54 -------- d-----w c:\program files\Unity 2009-04-06 20:18 . 2009-04-06 15:56 -------- d-----w c:\program files\Yahoo! 2009-04-05 18:28 . 2009-04-05 18:28 -------- d-----w c:\program files\MP3 Player Utilities 4.19 2009-04-05 17:24 . 2009-04-05 17:21 -------- d-----w c:\program files\AskBarDis 2009-04-05 17:23 . 2009-04-05 17:22 -------- d-----w c:\program files\Java 2009-04-05 17:22 . 2009-04-05 17:22 -------- d-----w c:\program files\Common Files\Java 2009-04-05 17:21 . 2009-04-05 17:21 -------- d-----w c:\program files\AskSearch 2009-04-04 22:18 . 2009-04-04 22:18 -------- d-----w c:\program files\Spotmau 2009-04-04 03:31 . 2005-06-19 22:33 -------- d-----w c:\program files\Warcraft III 2009-04-04 03:27 . 2004-01-22 03:33 -------- d-----w c:\program files\EarthLink TotalAccess 2008-09-22 01:51 . 2004-02-05 22:09 24960 ----a-w c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2004-11-30 01:32 . 2004-08-29 23:54 0 ---ha-w c:\documents and settings\Owner\hpothb07.dat 2004-05-27 00:42 . 2004-05-27 00:42 0 ---ha-w c:\documents and settings\NetworkService\hpothb07.dat 2004-01-26 23:45 . 2004-01-26 23:44 0 -c-ha-w c:\program files\hpothb07.dat 2004-01-26 23:44 . 2004-01-26 23:44 15628 ---ha-w c:\program files\hpothb07.tif 2003-03-31 12:00 . 2003-04-23 23:52 94784 --sh--w c:\windows\twain.dll 2004-08-04 07:56 . 2003-04-23 23:52 50688 --sh--w c:\windows\twain_32.dll 2004-08-04 07:56 . 2003-04-23 23:52 1028096 --sh--w c:\windows\system32\mfc42.dll 2004-08-04 07:56 . 2003-04-23 23:52 54784 --sh--w c:\windows\system32\msvcirt.dll 2004-08-04 07:56 . 2003-04-23 23:52 413696 --sha-w c:\windows\system32\msvcp60.dll 2004-08-04 07:56 . 2003-04-23 23:52 343040 --sha-w c:\windows\system32\msvcrt.dll 2004-08-04 07:56 . 2003-04-23 23:52 11776 --sh--w c:\windows\system32\regsvr32.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-09-09 02:08 279944 ----a-w c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-09 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768] "showicon2k"="c:\program files\\eM\Bay Reader\Shwicon2k.exe" [2003-07-04 135168] "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 57344] "CXMon"="c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe" [2001-09-19 45056] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2003-04-24 77824] "SpotmauSecretary"="c:\program files\Spotmau\Desktop_Secretary\Spotmau_S.exe" [2009-03-11 566784] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-04-19 1851128] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2003-05-02 323584] "CHotkey"="zHotkey.exe" - c:\windows\zHotkey.exe [2003-06-03 496640] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BigFix.lnk - c:\program files\BigFix\BigFix.exe [2003-4-23 1742384] hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646] hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32 "wave"= serwvdrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= R3 cpuz129;cpuz129;c:\program files\PC Wizard 2008\pcwiz32.sys [2008-01-25 9600] R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2008-12-10 64392] R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2008-06-06 33088] R3 ThreatFire;ThreatFire; [x] S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424] S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-06-06 51520] S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-06-06 38208] S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-04-19 110992] S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-04-19 24336] S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2008-12-11 159600] S2 supersafer;supersafer;c:\windows\system32\drivers\supersafer.sys [2009-03-11 354176] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2009-04-19 c:\windows\Tasks\Disk Cleanup.job - c:\windows\system32\cleanmgr.exe [2003-04-23 07:56] 2009-04-14 c:\windows\Tasks\Disk Defragmenter.job - c:\documents and settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk [2003-04-24 03:48] 2004-09-06 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8075430597.job - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52] 2009-04-19 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-04-24 16:24] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/http://www.yahoo.com IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.19\AMVConverter\grab.html LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\1spbq164.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-19 22:19 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwClose, ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3508902286-1040935473-1732238221-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(684) c:\windows\system32\guard32.dll - - - - - - - > 'lsass.exe'(744) c:\windows\system32\guard32.dll c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll . Completion time: 2009-04-20 22:20 ComboFix-quarantined-files.txt 2009-04-20 02:20 ComboFix2.txt 2009-04-20 00:56 Pre-Run: 148,160,679,936 bytes free Post-Run: 148,149,035,008 bytes free 206

04-19-2009, 08:43 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,135 OS: 2000 Pro; XP Pro; XP Home	Re: google redirect Hi - I'm glad to hear things are working better. We'll have a bit more work to do. First, I have a question. Did you run ComboFix once, prior to the log posted in post # 3? The various data in the several logs and the upload aren't really lining up. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

05-03-2009, 11:31 AM	#7 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,135 OS: 2000 Pro; XP Pro; XP Home	Re: google redirect Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here: NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009