trojans removed but left with redirect virus

View previous topic View next topic Go down

trojans removed but left with redirect virus

Post by ThE_RoGuE on 27th April 2010, 3:57 pm

last night i visited a site which avg blocked but after this my security programs were disabled and i couldnt open any apps i managed to get rid of some stuff in safe mode and then installed avast which found 3 more problems. i have since got rid of more using mbam, spybot and superantispyware but i am now left with google chrome crashing and firefox and IE8 redirecting me to random sites. i have ran OTL and this is the results

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
PRC - [2010/04/14 17:47:08 | 002,790,472 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/04/07 16:38:18 | 000,221,184 | ---- | M] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
PRC - [2010/04/07 16:38:18 | 000,090,112 | ---- | M] () -- C:\WINNT\system32\SnoopFreeSvc.exe
PRC - [2010/04/01 19:00:32 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2008/11/09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/21 11:26:10 | 003,068,352 | ---- | M] (Kontiki Inc.) -- C:\Program Files\Kontiki\KService.exe
PRC - [2008/10/21 11:26:10 | 001,032,640 | ---- | M] (Kontiki Inc.) -- C:\Program Files\Kontiki\KHost.exe
PRC - [2008/08/19 14:26:44 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINNT\SOUNDMAN.EXE
PRC - [2008/06/19 17:42:44 | 002,808,832 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINNT\ALCWZRD.EXE
PRC - [2007/06/13 11:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINNT\explorer.exe
PRC - [2007/03/22 12:09:16 | 004,540,120 | ---- | M] ( ) -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe
PRC - [2007/03/22 12:09:16 | 001,689,304 | ---- | M] ( ) -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
PRC - [2007/03/22 12:09:16 | 000,079,456 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\defragActivityMonitor.exe


========== Modules (SafeList) ==========

MOD - [2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
MOD - [2010/04/07 16:38:18 | 000,045,056 | ---- | M] () -- C:\WINNT\SnoopFreeDll.dll
MOD - [2006/08/25 16:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/04/14 17:47:05 | 000,040,384 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2010/04/07 16:38:18 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\WINNT\system32\SnoopFreeSvc.exe -- (SnoopFreeSvc)
SRV - [2008/11/09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/10/21 11:26:10 | 003,068,352 | ---- | M] (Kontiki Inc.) [Auto | Running] -- C:\Program Files\Kontiki\KService.exe -- (KService)
SRV - [2007/03/22 12:09:16 | 001,689,304 | ---- | M] ( ) [Auto | Running] -- C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe -- (AshampooDefragService)
SRV - [2006/10/04 09:48:37 | 000,050,176 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINNT\system32\utilman.exe -- (UtilMan)


========== Driver Services (SafeList) ==========

DRV - [2010/04/14 17:35:47 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/04/14 17:35:25 | 000,162,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/04/14 17:31:39 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/04/14 17:31:12 | 000,100,432 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINNT\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/04/14 17:31:01 | 000,019,024 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINNT\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/04/14 17:30:45 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINNT\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/04/07 16:38:18 | 000,009,472 | ---- | M] () [Kernel | Boot | Running] -- C:\WINNT\System32\Drivers\SnopFree.sys -- (SnoopFree)
DRV - [2009/03/30 18:13:30 | 005,063,168 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/08/05 21:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\ambfilt.sys -- (Ambfilt)
DRV - [2007/05/08 11:35:43 | 000,073,928 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2007/02/28 21:56:07 | 000,015,440 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINNT\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV - [2007/01/13 11:33:18 | 005,672,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2006/01/04 16:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2005/11/09 19:54:56 | 000,402,944 | ---- | M] (Belkin Corporation) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\BLKWGU.sys -- (BLKWGU(Belkin)) Belkin Wireless G USB Network Adapter(Belkin)
DRV - [2005/01/07 18:07:18 | 000,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\Hdaudbus.sys -- (HDAudBus)
DRV - [2005/01/07 18:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004/10/24 22:40:58 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINNT\system32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2003/06/19 13:05:04 | 000,049,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINNT\system32\drivers\usbhub20.sys -- (usbhub20)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/03 15:19:22 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/27 16:26:11 | 000,000,000 | ---D | M]

[2010/04/03 15:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Geo\Application Data\Mozilla\Extensions
[2010/04/27 16:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions
[2010/04/05 15:54:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/04/07 17:33:53 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Documents and Settings\Geo\Application Data\Mozilla\Firefox\Profiles\9yxxtgwz.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/04/27 16:28:23 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/27 16:26:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/27 16:25:45 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/01 17:56:49 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/04/01 17:56:50 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/04/01 17:56:50 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/04/01 17:56:50 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/04/27 06:24:41 | 000,391,995 | R--- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 [You must be registered and logged in to see this link.]
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 13564 more lines...
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O4 - HKLM..\Run: [AlcWzrd] C:\WINNT\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINNT\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKLM..\Run: [SnoopFreeUI] C:\WINNT\SnoopFreeUI.exe (SnoopFree Software)
O4 - HKLM..\Run: [SoundMan] C:\WINNT\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ashampoo Magical Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe ( )
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe (Belkin Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - Reg Error: Value error. File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} [You must be registered and logged in to see this link.] (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINNT\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\wzcnotif: DllName - wzcdlg.dll - C:\WINNT\System32\wzcdlg.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINNT\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINNT\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINNT\system32\ias [2010/02/14 22:05:27 | 000,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: AnyDVD - hkey= - key= - C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe (SlySoft, Inc.)

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NBF - Service
SafeBootNet: nbf.sys - Driver
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {1a3e09be-1e45-494b-9174-d7385b45bbf5} - Reg Error: Value error.
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows script 5.8
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6A5110B5-E14B-4268-A065-EF89FF33C325} - regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINNT\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINNT\system32\Rundll32.exe c:\WINNT\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {A00BF2EB-56EE-4fde-B5EA-6A8FA425B2A5} - W2KAppComp
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINNT\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINNT\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINNT\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINNT\system32\rundll32.exe" "C:\WINNT\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by ThE_RoGuE on 27th April 2010, 4:06 pm

Drivers32: aux - C:\WINNT\System32\mmdrv.dll (Microsoft Corporation)
Drivers32: aux2 - File not found
Drivers32: aux3 - File not found
Drivers32: aux4 - File not found
Drivers32: aux5 - File not found
Drivers32: aux6 - File not found
Drivers32: aux7 - File not found
Drivers32: aux8 - File not found
Drivers32: aux9 - File not found
Drivers32: midi1 - File not found
Drivers32: midi2 - File not found
Drivers32: midi3 - File not found
Drivers32: midi4 - File not found
Drivers32: midi5 - File not found
Drivers32: midi6 - File not found
Drivers32: midi7 - File not found
Drivers32: midi8 - File not found
Drivers32: midi9 - File not found
Drivers32: mixer1 - File not found
Drivers32: mixer2 - File not found
Drivers32: mixer3 - File not found
Drivers32: mixer4 - File not found
Drivers32: mixer5 - File not found
Drivers32: mixer6 - File not found
Drivers32: mixer7 - File not found
Drivers32: mixer8 - File not found
Drivers32: mixer9 - File not found
Drivers32: msacm.ac3acm - C:\WINNT\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINNT\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINNT\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINNT\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\WINNT\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINNT\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINNT\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINNT\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINNT\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\WINNT\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINNT\System32\ir32_32.dll ()
Drivers32: vidc.iv50 - C:\WINNT\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.wmv3 - C:\WINNT\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINNT\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINNT\System32\yv12vfw.dll ([You must be registered and logged in to see this link.]
Drivers32: wave1 - File not found
Drivers32: wave2 - File not found
Drivers32: wave3 - File not found
Drivers32: wave4 - File not found
Drivers32: wave5 - File not found
Drivers32: wave6 - File not found
Drivers32: wave7 - File not found
Drivers32: wave8 - File not found
Drivers32: wave9 - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17465059307421696)

========== Files/Folders - Created Within 30 Days ==========

[2010/04/27 16:30:26 | 000,000,000 | ---D | C] -- C:\WINNT\System32\appmgmt
[2010/04/27 16:27:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Geo\Recent
[2010/04/27 16:26:11 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\deployJava1.dll
[2010/04/27 16:26:11 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaws.exe
[2010/04/27 16:26:11 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javacpl.cpl
[2010/04/27 16:26:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaw.exe
[2010/04/27 16:26:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINNT\System32\java.exe
[2010/04/27 16:18:52 | 000,563,712 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
[2010/04/27 05:53:02 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/04/27 02:35:49 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/04/27 02:34:42 | 000,019,024 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2010/04/27 02:34:41 | 000,162,768 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2010/04/27 02:34:39 | 000,023,376 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2010/04/27 02:34:38 | 000,046,672 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2010/04/27 02:34:35 | 000,100,432 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2010/04/27 02:34:35 | 000,094,800 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2010/04/27 02:34:35 | 000,028,880 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2010/04/27 02:34:08 | 000,153,184 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\aswBoot.exe
[2010/04/27 02:34:08 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINNT\System32\avastSS.scr
[2010/04/27 02:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2010/04/27 02:33:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/04/27 02:16:19 | 000,000,000 | ---D | C] -- C:\WINNT\System32\avgrsstx.dll
[2010/04/27 01:46:18 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\dllcache\mouclass.sys
[2010/04/27 01:44:26 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/04/27 01:42:20 | 000,000,000 | ---D | C] -- C:\WINNT\ERDNT
[2010/04/27 01:17:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/04/27 01:17:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/04/24 15:24:12 | 000,000,000 | ---D | C] -- C:\Kontiki
[2010/04/24 15:13:29 | 000,000,000 | ---D | C] -- C:\WINNT\Minidump
[2010/04/16 16:08:09 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/04/07 16:38:18 | 000,221,184 | ---- | C] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
[2010/04/03 15:19:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Geo\Application Data\Mozilla
[2010/04/02 17:54:23 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\spmsgXP_2k3.dll
[2010/04/02 17:53:53 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\WINNT\System32\WdfCoInstaller01007.dll
[2010/04/02 17:49:31 | 000,000,000 | ---D | C] -- C:\Program Files\NetRatingsNetSight
[2010/04/01 23:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010/03/30 22:34:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Geo\Application Data\WinRAR
[2010/03/30 22:10:45 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[6 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/04/27 16:34:02 | 000,000,968 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1202660629-725345543-1000UA.job
[2010/04/27 16:25:44 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\deployJava1.dll
[2010/04/27 16:25:44 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaws.exe
[2010/04/27 16:25:44 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javaw.exe
[2010/04/27 16:25:44 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\java.exe
[2010/04/27 16:25:44 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINNT\System32\javacpl.cpl
[2010/04/27 16:18:56 | 000,563,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Geo\Desktop\OTL.exe
[2010/04/27 07:34:02 | 000,000,916 | ---- | M] () -- C:\WINNT\tasks\GoogleUpdateTaskUserS-1-5-21-2000478354-1202660629-725345543-1000Core.job
[2010/04/27 06:24:41 | 000,391,995 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts
[2010/04/27 06:10:42 | 000,002,443 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\HiJackThis.lnk
[2010/04/27 06:09:07 | 000,002,228 | ---- | M] () -- C:\WINNT\System32\wpa.dbl
[2010/04/27 06:08:10 | 000,000,006 | -H-- | M] () -- C:\WINNT\tasks\SA.DAT
[2010/04/27 06:07:16 | 000,002,048 | --S- | M] () -- C:\WINNT\bootstat.dat
[2010/04/27 06:06:32 | 006,291,456 | -H-- | M] () -- C:\Documents and Settings\Geo\NTUSER.DAT
[2010/04/27 06:06:32 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Geo\ntuser.ini
[2010/04/27 06:06:26 | 005,364,128 | -H-- | M] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\IconCache.db
[2010/04/27 02:34:43 | 000,001,700 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/04/27 02:34:36 | 000,002,626 | ---- | M] () -- C:\WINNT\System32\CONFIG.NT
[2010/04/27 02:03:04 | 000,000,227 | ---- | M] () -- C:\WINNT\system.ini
[2010/04/27 02:02:27 | 000,000,027 | ---- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100427-062441.backup
[2010/04/27 01:44:33 | 000,000,277 | RHS- | M] () -- C:\boot.ini
[2010/04/27 00:26:32 | 000,010,166 | -HS- | M] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\6Kw2
[2010/04/27 00:26:32 | 000,010,166 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\6Kw2
[2010/04/25 13:53:44 | 000,310,613 | ---- | M] () -- C:\Documents and Settings\Geo\My Documents\FIFA 2010.pdf
[2010/04/21 07:35:42 | 000,002,268 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\Google Chrome.lnk
[2010/04/16 16:08:12 | 000,001,548 | ---- | M] () -- C:\Documents and Settings\Geo\Desktop\CCleaner.lnk
[2010/04/16 12:58:05 | 000,000,040 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/04/14 23:00:16 | 000,081,920 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINNT\ALCFDRTM.VER
[2010/04/14 17:47:23 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\avastSS.scr
[2010/04/14 17:47:03 | 000,153,184 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\aswBoot.exe
[2010/04/14 17:35:47 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswTdi.sys
[2010/04/14 17:35:25 | 000,162,768 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswSP.sys
[2010/04/14 17:31:39 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswRdr.sys
[2010/04/14 17:31:12 | 000,100,432 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon2.sys
[2010/04/14 17:31:09 | 000,094,800 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswmon.sys
[2010/04/14 17:31:01 | 000,019,024 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aswFsBlk.sys
[2010/04/14 17:30:45 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINNT\System32\drivers\aavmker4.sys
[2010/04/07 16:38:18 | 000,221,184 | ---- | M] (SnoopFree Software) -- C:\WINNT\SnoopFreeUI.exe
[2010/04/07 16:38:18 | 000,090,112 | ---- | M] () -- C:\WINNT\System32\SnoopFreeSvc.exe
[2010/04/07 16:38:18 | 000,045,056 | ---- | M] () -- C:\WINNT\SnoopFreeDll.dll
[2010/04/07 16:38:18 | 000,009,472 | ---- | M] () -- C:\WINNT\System32\drivers\SnopFree.sys
[2010/04/03 15:19:12 | 000,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/04/02 20:30:12 | 000,385,955 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-210656.backup
[2010/04/02 20:29:19 | 000,385,955 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-203012.backup
[2010/04/02 17:54:39 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2010/04/02 17:54:33 | 000,000,000 | -H-- | M] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/03/30 17:14:31 | 000,516,596 | ---- | M] () -- C:\WINNT\System32\PerfStringBackup.INI
[2010/03/30 17:14:31 | 000,438,082 | ---- | M] () -- C:\WINNT\System32\perfh009.dat
[2010/03/30 17:14:31 | 000,069,442 | ---- | M] () -- C:\WINNT\System32\perfc009.dat
[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbam.sys
[2010/03/29 17:59:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINNT\System32\drivers\mbamswissarmy.sys
[2010/03/28 19:37:32 | 000,381,011 | R--- | M] () -- C:\WINNT\System32\drivers\etc\hosts.20100402-202919.backup
[6 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by ThE_RoGuE on 27th April 2010, 4:08 pm

========== Files Created - No Company Name ==========

[2010/04/27 02:34:43 | 000,001,700 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2010/04/27 00:00:45 | 000,010,166 | -HS- | C] () -- C:\Documents and Settings\Geo\Local Settings\Application Data\6Kw2
[2010/04/27 00:00:45 | 000,010,166 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\6Kw2
[2010/04/25 13:53:44 | 000,310,613 | ---- | C] () -- C:\Documents and Settings\Geo\My Documents\FIFA 2010.pdf
[2010/04/16 16:08:12 | 000,001,548 | ---- | C] () -- C:\Documents and Settings\Geo\Desktop\CCleaner.lnk
[2010/04/07 16:38:18 | 000,045,056 | ---- | C] () -- C:\WINNT\SnoopFreeDll.dll
[2010/04/07 16:38:18 | 000,009,472 | ---- | C] () -- C:\WINNT\System32\drivers\SnopFree.sys
[2010/04/07 16:38:17 | 000,090,112 | ---- | C] () -- C:\WINNT\System32\SnoopFreeSvc.exe
[2010/04/03 15:19:12 | 000,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/04/02 17:54:39 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2010/04/02 17:54:33 | 000,000,000 | -H-- | C] () -- C:\WINNT\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2010/02/15 03:35:42 | 000,765,952 | ---- | C] () -- C:\WINNT\System32\xvidcore.dll
[2010/02/15 03:35:42 | 000,180,224 | ---- | C] () -- C:\WINNT\System32\xvidvfw.dll
[2010/02/15 03:35:40 | 000,010,752 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll
[2010/02/15 03:35:40 | 000,000,547 | ---- | C] () -- C:\WINNT\System32\ff_vfw.dll.manifest
[2010/02/15 01:01:53 | 000,204,800 | ---- | C] () -- C:\WINNT\System32\igfxCoIn_v4764.dll
[2010/02/15 00:48:13 | 000,000,169 | ---- | C] () -- C:\WINNT\RtlRack.ini
[2010/02/14 22:01:35 | 000,001,793 | ---- | C] () -- C:\WINNT\System32\fxsperf.ini
[2010/02/14 21:33:15 | 000,000,132 | ---- | C] () -- C:\WINNT\ODBC.INI
[2005/07/11 23:44:42 | 000,015,872 | ---- | C] () -- C:\WINNT\System32\InsDrvZD64.DLL
[2004/03/23 01:38:00 | 000,028,672 | ---- | C] () -- C:\WINNT\System32\InsDrvZD.dll
[2003/06/18 13:00:00 | 000,176,400 | ---- | C] () -- C:\WINNT\System32\qcut.dll
[1999/09/25 11:36:24 | 000,088,816 | ---- | C] () -- C:\WINNT\System32\drivers\lvcam.sys
[1999/09/25 11:36:22 | 000,017,424 | ---- | C] () -- C:\WINNT\System32\drivers\lvsound.sys

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010/04/07 16:38:18 | 000,009,472 | ---- | M] () Unable to obtain MD5 -- C:\WINNT\system32\drivers\SnopFree.sys

< %systemroot%\System32\config\*.sav >
[2010/02/14 21:46:31 | 000,262,144 | ---- | M] () -- C:\WINNT\system32\config\default.sav
[2010/02/14 21:31:31 | 000,020,480 | ---- | M] () -- C:\WINNT\system32\config\security.sav
[2010/02/14 21:46:31 | 006,291,456 | ---- | M] () -- C:\WINNT\system32\config\software.sav
[2010/02/14 21:46:32 | 002,359,296 | ---- | M] () -- C:\WINNT\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2001/08/23 13:00:00 | 000,009,029 | ---- | M] () -- C:\WINNT\system32\ansi.sys
[2001/08/23 13:00:00 | 000,027,097 | ---- | M] () -- C:\WINNT\system32\country.sys
[2001/08/23 13:00:00 | 000,004,768 | ---- | M] () -- C:\WINNT\system32\himem.sys
[2001/08/23 13:00:00 | 000,042,809 | ---- | M] () -- C:\WINNT\system32\key01.sys
[2002/08/28 20:23:06 | 000,042,537 | ---- | M] () -- C:\WINNT\system32\keyboard.sys
[2001/08/23 13:00:00 | 000,027,866 | ---- | M] () -- C:\WINNT\system32\ntdos.sys
[2001/08/23 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINNT\system32\ntdos404.sys
[2001/08/23 13:00:00 | 000,029,370 | ---- | M] () -- C:\WINNT\system32\ntdos411.sys
[2001/08/23 13:00:00 | 000,029,274 | ---- | M] () -- C:\WINNT\system32\ntdos412.sys
[2001/08/23 13:00:00 | 000,029,146 | ---- | M] () -- C:\WINNT\system32\ntdos804.sys
[2004/08/03 23:45:10 | 000,033,840 | ---- | M] () -- C:\WINNT\system32\ntio.sys
[2004/08/03 23:45:16 | 000,034,560 | ---- | M] () -- C:\WINNT\system32\ntio404.sys
[2004/08/03 23:45:12 | 000,035,648 | ---- | M] () -- C:\WINNT\system32\ntio411.sys
[2004/08/03 23:45:16 | 000,035,424 | ---- | M] () -- C:\WINNT\system32\ntio412.sys
[2004/08/03 23:45:14 | 000,034,560 | ---- | M] () -- C:\WINNT\system32\ntio804.sys
[2004/08/04 00:07:34 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\watchdog.sys
[2009/08/14 13:19:41 | 001,850,112 | ---- | M] (Microsoft Corporation) -- C:\WINNT\system32\win32k.sys
[2004/01/13 20:30:00 | 000,017,151 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINNT\system32\ZDPNDIS5.SYS
[1 C:\WINNT\system32\*.tmp files -> C:\WINNT\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2004/08/04 01:56:42 | 000,004,255 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv01nt5.dll
[2004/08/04 01:56:42 | 000,003,967 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv02nt5.dll
[2004/08/04 01:56:42 | 000,003,615 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv05nt5.dll
[2004/08/04 01:56:42 | 000,003,647 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv07nt5.dll
[2004/08/04 01:56:42 | 000,003,135 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv08nt5.dll
[2004/08/04 01:56:42 | 000,003,711 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv09nt5.dll
[2004/08/04 01:56:42 | 000,003,775 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\adv11nt5.dll
[2004/08/04 01:56:42 | 000,021,183 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv01nt5.dll
[2004/08/04 01:56:42 | 000,011,359 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv02nt5.dll
[2004/08/04 01:56:42 | 000,025,471 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv04nt5.dll
[2004/08/04 01:56:42 | 000,014,143 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv06nt5.dll
[2004/08/04 01:56:42 | 000,017,279 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\atv10nt5.dll
[2004/08/04 01:56:42 | 000,015,423 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\ch7xxnt5.dll
[2004/08/04 01:56:46 | 000,003,901 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\siint5.dll
[2004/08/04 01:56:48 | 000,011,325 | ---- | M] (Intel(R) Corporation) -- C:\WINNT\system32\drivers\vchnt5.dll

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by ThE_RoGuE on 27th April 2010, 4:20 pm

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () -- C:\AUTOEXEC.BAT
[2010/04/27 01:44:33 | 000,000,277 | RHS- | M] () -- C:\boot.ini
[2010/02/14 21:26:57 | 000,000,000 | -H-- | M] () -- C:\CONFIG.SYS
[2010/02/14 21:26:57 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/04/27 16:27:38 | 000,012,366 | ---- | M] () -- C:\JavaRa.log
[2010/02/14 21:26:57 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2010/02/14 22:22:24 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/02/14 22:22:24 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/04/27 06:07:10 | 1585,446,912 | -HS- | M] () -- C:\pagefile.sys

< %PROGRAMFILES%\*. >
[2010/02/14 21:24:25 | 000,000,000 | ---D | M] -- C:\Program Files\Accessories
[2010/03/08 22:16:01 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/04/27 02:33:46 | 000,000,000 | ---D | M] -- C:\Program Files\Alwil Software
[2010/02/15 03:22:17 | 000,000,000 | ---D | M] -- C:\Program Files\Ashampoo
[2010/02/14 23:54:46 | 000,000,000 | ---D | M] -- C:\Program Files\Belkin
[2010/03/23 23:21:44 | 000,000,000 | ---D | M] -- C:\Program Files\CA Yahoo! Anti-Spy
[2010/04/16 16:08:12 | 000,000,000 | ---D | M] -- C:\Program Files\CCleaner
[2010/04/27 01:56:34 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/02/14 21:25:37 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2010/02/15 03:29:29 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/02/14 22:40:38 | 000,000,000 | ---D | M] -- C:\Program Files\DVDlab
[2010/02/15 02:51:24 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/02/14 22:35:42 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/03/31 06:43:03 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/04/27 16:21:19 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/02/15 03:35:41 | 000,000,000 | ---D | M] -- C:\Program Files\K-Lite Codec Pack
[2010/03/17 00:26:54 | 000,000,000 | ---D | M] -- C:\Program Files\Kontiki
[2010/04/02 01:07:03 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/02/15 01:26:09 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2010/02/14 21:27:19 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2010/02/15 21:05:38 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/03/11 08:27:22 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/04/27 15:30:43 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/03/17 12:14:35 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2010/02/14 22:01:50 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2010/03/17 12:10:48 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
[2010/02/14 22:24:05 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/04/02 17:49:31 | 000,000,000 | ---D | M] -- C:\Program Files\NetRatingsNetSight
[2010/02/14 22:02:08 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by ThE_RoGuE on 27th April 2010, 4:54 pm

pah i give up.evertime i try to add the log posts it says connection has timed out

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by Belahzur on 27th April 2010, 8:21 pm

Hello.
If the log is too long, please attach the logs.

Guide for attaching:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

log file

Post by ThE_RoGuE on 27th April 2010, 10:03 pm

ok i tried it but i get a message sayin ' the uploaded file is not valid '


Last edited by ThE_RoGuE on 27th April 2010, 10:05 pm; edited 1 time in total (Reason for editing : log file not attached)

ThE_RoGuE
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-06-23
Gender Gender : Male
OS OS : XP
Points Points : 27351
# Likes # Likes : 0

View user profile

Back to top Go down

Re: trojans removed but left with redirect virus

Post by Belahzur on 28th April 2010, 12:13 am

Copy the log to a new Notepad file, save that and then try upload that.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245091
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum