1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Search Engines Diverting to Random Sites

Discussion in 'Virus & Other Malware Removal' started by Catnapper, May 28, 2010.

Thread Status:
Not open for further replies.
Advertisement
  1. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    I am using Window XP and Internet Explorer 8. I was on the internet and alerted by McAfee to block a site. I did this and got off the internet. Next day tried to do a system restore, as I was nervous, and received message, "system restore has been blocked by group policy". In addition, my search engines keep diverting me. Spent day running Malewarebytes (33 problems), deleting McAfee and installing Microsoft Security Essentials, running scans, updating windows, running scans. All is working well today except the search engines. If I type in a seach, a list of appropriate sites will appear. When I click on a site, I am diverting to a random site, no pop ups are occurring. If I type an address in the address bar, I can access that site. I assume my search engine has been hijacked. I am including the results of HJT in case they are needed. Thank you in advance for any help.
     

    Attached Files:

  2. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    Download ComboFix here :

    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them

      Click me

    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    [​IMG]


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [​IMG]


    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
     
  3. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    HelloRorschach112,
    Thank you for helping me. I have done as instructed and am attaching the ComboFix log. I tried three searches on the internet after running ComboFix and each worked perfectly. Do you think my problem is solved? I don't know what I did to expose myself to these problems, but I am certainly grateful for your help.
    Regards, Catnapper
     

    Attached Files:

  4. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    don't attach the logs please


    1. Close any open browsers.

    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    3. Open notepad and copy/paste the text in the quotebox below into it:

    Save this as CFScript.txt, in the same location as ComboFix.exe


    [​IMG]

    Refering to the picture above, drag CFScript into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
     
  5. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    Hello,
    Here is the log. I hope I did this correctly.

    ComboFix 10-05-28.02 - Michele Nylen 05/28/2010 20:48:12.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.561 [GMT -4:00]
    Running from: c:\documents and settings\Michele Nylen\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Michele Nylen\Desktop\CFScript.txt
    AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    .
    The following files were disabled during the run:
    c:\windows\TEMP\logishrd\LVPrcInj01.dll

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\documents and settings\Michele Nylen\Local Settings\Application Data\odwdrlijf
    c:\documents and settings\Michele Nylen\Local Settings\Application Data\uoxnqfohx
    c:\windows\TEMP\logishrd\LVPrcInj01.dll
    .
    --------------- FCopy ---------------
    c:\windows\ServicePackFiles\i386\user32.dll --> c:\windows\system32\user32.dll
    .
    ((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-29 )))))))))))))))))))))))))))))))
    .
    2010-05-28 20:21 . 2010-05-28 20:21 -------- d-----w- c:\documents and settings\Michele Nylen\Local Settings\Application Data\PCHealth
    2010-05-28 03:00 . 2009-08-06 23:23 274288 ----a-w- c:\windows\system32\mucltui.dll
    2010-05-28 01:29 . 2010-05-28 01:29 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
    2010-05-27 22:44 . 2010-05-27 22:44 138496 ----a-w- c:\windows\system32\drivers\AFD.SYS
    2010-05-27 22:26 . 2010-05-21 18:14 221568 ------w- c:\windows\system32\MpSigStub.exe
    2010-05-27 21:59 . 2010-05-27 21:59 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-05-27 21:41 . 2010-05-28 20:19 -------- d-----w- c:\windows\system32\NtmsData
    2010-05-27 19:52 . 2010-05-27 19:52 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\Malwarebytes
    2010-05-27 19:52 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-05-27 19:52 . 2010-05-27 19:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-05-27 19:52 . 2010-05-27 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-05-27 19:52 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-05-27 13:34 . 2010-05-27 20:18 -------- d-----w- c:\windows\SxsCaPendDel
    2010-05-27 12:24 . 2010-05-27 13:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2010-05-27 02:28 . 2010-05-27 02:28 -------- d--h--w- c:\windows\system32\GroupPolicy
    2010-05-26 15:44 . 2010-05-26 15:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
    2010-05-26 15:39 . 2010-05-26 15:39 -------- d-----w- c:\documents and settings\Michele Nylen\Local Settings\Application Data\Citrix
    2010-05-26 13:59 . 2010-05-26 13:59 -------- d-----w- c:\documents and settings\Michele Nylen\Local Settings\Application Data\Motive
    2010-05-26 11:02 . 2010-05-26 11:02 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2010-05-26 03:44 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys
    2010-05-26 03:44 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys
    2010-05-26 03:44 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys
    2010-05-26 03:44 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-05-29 01:02 . 2009-12-25 18:25 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\Skype
    2010-05-29 00:58 . 2009-12-25 14:48 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
    2010-05-29 00:58 . 2009-12-25 14:47 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
    2010-05-28 22:37 . 2009-12-25 18:28 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\skypePM
    2010-05-28 19:45 . 2005-12-10 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
    2010-05-28 15:43 . 2005-12-10 05:12 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-05-28 15:43 . 2010-02-23 14:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Amazon
    2010-05-28 01:43 . 2005-12-26 21:07 77352 ----a-w- c:\documents and settings\Michele Nylen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2010-05-27 21:44 . 2005-12-26 22:53 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
    2010-05-27 21:43 . 2005-12-26 22:49 -------- d-----w- c:\program files\McAfee
    2010-05-27 21:43 . 2005-12-10 05:18 -------- d-----w- c:\program files\McAfee.com
    2010-05-26 15:39 . 2007-12-24 14:19 -------- d-----w- c:\program files\Citrix
    2010-05-26 15:26 . 2010-05-26 15:27 300384 ----a-w- c:\documents and settings\Michele Nylen\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll
    2010-05-26 15:26 . 2005-12-26 22:49 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\McAfee
    2010-05-26 14:00 . 2008-04-26 13:28 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\Motive
    2010-05-26 13:55 . 2009-09-16 22:54 -------- d-----w- c:\program files\ATT-SST
    2010-05-26 03:44 . 2008-04-26 13:27 -------- d-----w- c:\program files\Common Files\Motive
    2010-05-26 03:41 . 2009-12-26 19:18 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\HPAppData
    2010-05-24 15:16 . 2010-01-14 02:47 -------- d-----w- c:\documents and settings\Michele Nylen\Application Data\HpUpdate
    2010-05-24 15:15 . 2009-08-04 15:41 -------- d-----w- c:\program files\Hewlett_Packard
    2010-05-24 01:30 . 2005-12-27 20:46 -------- d-----w- c:\program files\Microsoft Picture It! PhotoPub
    2010-04-19 22:48 . 2010-04-19 22:47 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
    2010-04-19 22:48 . 2009-10-30 21:10 -------- d-----w- c:\program files\iTunes
    2010-04-19 22:47 . 2010-04-19 22:47 -------- d-----w- c:\program files\iPod
    2010-04-19 22:42 . 2010-04-19 22:42 -------- d-----w- c:\program files\QuickTime
    2010-04-19 22:37 . 2010-04-19 22:37 -------- d-----w- c:\program files\Bonjour
    2010-04-19 22:32 . 2010-04-19 22:32 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
    2010-04-19 22:29 . 2008-03-25 01:22 -------- d-----w- c:\program files\Safari
    2010-04-19 22:24 . 2010-04-19 22:24 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.22.7\SetupAdmin.exe
    2010-04-12 11:39 . 2010-04-12 11:38 14451728 ----a-w- c:\documents and settings\Michele Nylen\Application Data\Barnes & Noble\DesktopReader\Updater\bndr_setup_2.1.1.2.exe
    2010-03-18 12:30 . 2010-03-18 12:26 23165 ----a-w- c:\windows\hpqins15.dat
    2010-03-10 06:15 . 2008-10-09 20:50 420352 ----a-w- c:\windows\system32\vbscript.dll
    2010-03-02 01:29 . 2010-03-02 01:29 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
    2010-03-02 01:12 . 2009-09-25 21:15 61920 ---ha-w- c:\windows\system32\mlfcache.dat
    2007-04-14 01:21 . 2005-12-27 13:34 104 --sha-r- c:\windows\system32\C8F8DA288C.sys
    2007-04-14 01:21 . 2005-12-27 13:34 4184 --sha-w- c:\windows\system32\KGyGaAvL.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
    "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
    "dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-11 198160]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]
    "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
    "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
    "HP Software Update"="c:\program files\Hewlett_Packard\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
    "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-07-04 109056]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
    "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]
    "eBayToolbar"="c:\program files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2009-03-19 632048]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-10 24576]
    HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "FirewallOverride"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
    S0 epstwnt;epstwnt;c:\windows\system32\drivers\epstwnt.mpd [12/26/2005 4:34 PM 84480]
    S2 gupdate1ca858f69e7d3fe;Google Update Service (gupdate1ca858f69e7d3fe);c:\program files\Google\Update\GoogleUpdate.exe [12/25/2009 2:23 PM 133104]
    S2 SHARSHTL;Shuttle Sharer;c:\windows\system32\drivers\sharshtl.sys [12/26/2005 4:34 PM 18432]
    S3 APL531;OVT Scanner;c:\windows\system32\drivers\ov550i.sys [7/31/2006 8:44 AM 580992]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    HPService REG_MULTI_SZ HPSLPSVC
    .
    Contents of the 'Scheduled Tasks' folder
    2010-05-22 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]
    2010-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-25 18:23]
    2010-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-25 18:23]
    2010-05-29 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-09 22:02]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.com
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = <local>;*.local
    IE: eBay Search - c:\program files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    Trusted Zone: internet
    Trusted Zone: mcafee.com
    Trusted Zone: motive.com\pattta.att
    Trusted Zone: motive.com\patttbc.att
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-05-28 20:59
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    [HKEY_USERS\S-1-5-21-3018791857-2810793895-3073136319-1005\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    - - - - - - - > 'explorer.exe'(7492)
    c:\windows\system32\WININET.dll
    c:\windows\TEMP\logishrd\LVPrcInj01.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\Ati2evxx.exe
    c:\program files\Microsoft Security Essentials\MsMpEng.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\eHome\ehRecvr.exe
    c:\windows\eHome\ehSched.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    c:\program files\Common Files\Motive\McciCMService.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Dell Support Center\bin\sprtsvc.exe
    c:\windows\system32\dllhost.exe
    c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
    c:\program files\Skype\Plugin Manager\skypePM.exe
    c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe
    .
    **************************************************************************
    .
    Completion time: 2010-05-28 21:07:21 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-05-29 01:07
    ComboFix2.txt 2010-05-28 22:45
    Pre-Run: 121,283,846,144 bytes free
    Post-Run: 121,261,228,032 bytes free
    - - End Of File - - 41FD52BD80704800968E21D2208BB747
     
  6. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    Download TFC to your desktop
    • Open the file and close any other windows.
    • It will close all programs itself when run, make sure to let it run uninterrupted.
    • Click the Start button to begin the process. The program should not take long to finish its job
    • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean




    Please download Malwarebytes' Anti-Malware from Here

    Double Click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.
    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






    Go to Kaspersky website and perform an online antivirus scan.

    1. Read through the requirements and privacy statement and click on Accept button.
    2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    3. When the downloads have finished, click on Settings.
    4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        Mail databases
    5. Click on My Computer under Scan.
    6. Once the scan is complete, it will display the results. Click on View Scan Report.
    7. You will see a list of infected items there. Click on Save Report As....
    8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
  7. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    Should I disable Microsoft Security Essentials before runnining Malwarebytes?
     
  8. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    if you can
     
  9. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    Hello, I dowloaded and ran TFC. I dowloaded and ran Malwarebytes here is the log.

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org
    Database version: 4153
    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702
    5/29/2010 8:34:22 AM
    mbam-log-2010-05-29 (08-34-22).txt
    Scan type: Quick scan
    Objects scanned: 136572
    Time elapsed: 6 minute(s), 39 second(s)
    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0
    Memory Processes Infected:
    (No malicious items detected)
    Memory Modules Infected:
    (No malicious items detected)
    Registry Keys Infected:
    (No malicious items detected)
    Registry Values Infected:
    (No malicious items detected)
    Registry Data Items Infected:
    (No malicious items detected)
    Folders Infected:
    (No malicious items detected)
    Files Infected:
    (No malicious items detected)

    I went to Kaspersky and performed an online antivirus scan and here is the report.
    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7.0: scan report
    Saturday, May 29, 2010
    Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Last database update: Saturday, May 29, 2010 11:34:51
    Records in database: 4196408
    --------------------------------------------------------------------------------
    Scan settings:
    scan using the following database: extended
    Scan archives: yes
    Scan e-mail databases: yes
    Scan area - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    Z:\
    Scan statistics:
    Objects scanned: 91936
    Threats found: 1
    Infected objects found: 1
    Suspicious objects found: 0
    Scan duration: 03:03:53

    File name / Threat / Threats count
    C:\Documents and Settings\Michele Nylen\My Documents\regtools.vbs Infected: not-a-virus:RiskTool.VBS.DisReg.a 1
    Selected area has been scanned.

    Thanks, Catnapper
     
  10. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    Your logs are clean


    Follow these steps to uninstall Combofix and tools used in the removal of malware

    Uninstall ComboFix

    Remove Combofix now that we're done with it.
    • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
    • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
      [​IMG]
    • Please follow the prompts to uninstall Combofix.
    • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.


    • Download OTC to your desktop and run it
    • Click Yes to beginning the Cleanup process and remove these components, including this application.
    • You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.



    • Please read my guide on how to prevent malware and about safe computing here
    Thank you for your patience, and performing all of the procedures requested.
     
  11. Catnapper

    Catnapper Thread Starter

    Joined:
    May 28, 2010
    Messages:
    6
    I will do as instructed. Thank you for your help. Do I have to be concerned about the 1 infected file found by the Kaspersky scan?
     
  12. Rorschach112

    Rorschach112 Malware Specialist

    Joined:
    Oct 12, 2008
    Messages:
    2,392
    no, you can delete that file yourself if you want
     
  13. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/925802