Inactive [InActive] Google Redirect Problem - Beginner

gray916 · 2008/11/16

It seems i have a similar problem to some of you, after a goole search, clcicking on a hit will redirect me to some other site.

I have read the announcement at the top of the forum and downloaded RSIT. Unfortunatley when i run it, It gets to the point where it is 'Performing Registry Dump' and then i get an 'Autolt Error' which says 'Line-1: Error: Error parsing function call'.

I have downloaded 'Hijack This' and have posted my log at the bottom of this post.

I am running Windows XP.

Any help would be great thanks

----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 11:35:18, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Belkin\Flip\flip.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Documents and Settings\Gray\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdwyd.exe] C:\WINDOWS\system32\kdwyd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Flip.lnk = C:\Program Files\Belkin\Flip\flip.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39EA83D4-86B1-4C4F-9592-517144DFF1AE}: NameServer = 85.255.112.70;85.255.112.201
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

noahdfear · 2008/11/16

Welcome to WindowsBBS gray916

Download ComboFix by sUBs from here, saving the file to your desktop.

Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

Close all open programs and windows

Double click ComboFix.exe and follow the prompts.

It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

gray916 · 2008/11/16

Thanks for that

First is the combofix log then the new hijack this log.

Thanks

i also have spybot and it eeps popping up saying that certain files in the registry have been modified and do i want to allow it. Should i be allowing or denying these actions?

---------------------------------------------------------------
ComboFix 08-11-14.01 - Gray 2008-11-16 16:33:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.650 [GMT 0:00]
Running from: c:\documents and settings\Gray\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\resycled
c:\resycled\boot.com
c:\windows\system32\kdgbz.exe
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2008-11-16 11:29 . 2008-11-16 11:29 <DIR> d-------- C:\rsit
2008-11-16 11:29 . 2008-11-16 11:31 <DIR> d-------- c:\program files\trend micro
2008-11-16 09:43 . 2008-11-16 09:43 <DIR> d-------- C:\!KillBox
2008-11-15 21:40 . 2008-11-15 21:43 <DIR> d-------- c:\program files\WinAVIVideoConverter
2008-11-15 21:37 . 2008-11-16 08:46 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-15 21:37 . 2008-11-16 09:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 20:52 . 2008-11-15 21:00 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-15 13:44 . 2008-11-15 13:44 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVS4YOU
2008-11-15 13:43 . 2008-11-15 13:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\Common Files\AVSMedia
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\AVS4YOU
2008-11-15 13:31 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-11-15 13:31 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll
2008-11-15 13:31 . 2007-02-27 18:36 24,576 --a------ c:\windows\system32\msxml3a.dll
2008-11-15 12:29 . 2008-11-15 12:29 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-13 09:08 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 09:08 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-05 20:57 . 2006-05-03 11:57 520,192 --------- c:\windows\system32\ati2sgag.exe
2008-11-05 20:47 . 2008-11-05 20:58 <DIR> d-------- c:\program files\ATI Technologies
2008-11-05 20:18 . 2008-11-16 16:05 139 --a------ c:\windows\WININIT.INI
2008-11-05 18:55 . 2008-11-16 16:05 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-01 11:09 . 2008-11-01 11:09 <DIR> d-------- c:\program files\Alex Buturuga
2008-10-28 19:08 . 2008-10-28 19:08 <DIR> d-------- c:\windows\system32\scripting
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\en
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\bits
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\l2schemas
2008-10-27 21:01 . 2008-11-15 22:46 69 --a------ c:\windows\NeroDigital.ini
2008-10-27 20:55 . 2008-10-27 20:55 30,912 --a------ c:\documents and settings\Gray\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 20:33 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2008-10-27 20:33 . 2003-02-28 18:26 46,352 --a------ c:\windows\setdebug.exe
2008-10-27 20:33 . 2003-02-28 16:54 7,315 --a------ c:\windows\system32\javasup.vxd
2008-10-27 20:33 . 2003-02-28 16:35 6,550 --a------ c:\windows\jautoexp.dat
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedon.reg
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedoff.reg
2008-10-27 18:30 . 2008-10-27 18:30 <DIR> d-------- c:\program files\MSXML 4.0
2008-10-26 09:50 . 2008-10-26 09:50 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sonic
2008-10-26 09:49 . 2008-10-26 09:49 <DIR> d-------- c:\documents and settings\Gray\Application Data\Leadertech
2008-10-26 09:47 . 2008-10-26 09:47 <DIR> d-------- c:\program files\Belkin
2008-10-26 09:40 . 2008-11-05 21:04 <DIR> d-------- c:\documents and settings\Gray\Application Data\ATI
2008-10-26 09:28 . 2008-10-26 09:28 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-10-26 09:27 . 2008-10-26 09:27 <DIR> d-------- c:\program files\Common Files\Adobe
2008-10-25 21:16 . 2008-04-14 00:12 712,704 --------- c:\windows\system32\windowscodecs.dll
2008-10-25 21:16 . 2008-04-14 00:12 346,112 --------- c:\windows\system32\windowscodecsext.dll
2008-10-25 21:16 . 2008-04-14 00:12 276,992 --------- c:\windows\system32\wmphoto.dll
2008-10-25 21:16 . 2008-04-14 00:12 69,120 --------- c:\windows\system32\wlanapi.dll
2008-10-25 21:16 . 2008-04-14 00:12 53,248 --------- c:\windows\system32\tsgqec.dll
2008-10-25 21:16 . 2008-04-14 00:12 50,688 --------- c:\windows\system32\tspkg.dll
2008-10-25 21:16 . 2008-04-14 00:12 28,672 --------- c:\windows\system32\verclsid.exe
2008-10-25 21:14 . 2008-04-14 00:11 650,752 --------- c:\windows\system32\dot3ui.dll
2008-10-25 21:09 . 2008-10-25 21:10 <DIR> d-------- c:\documents and settings\Gray\Application Data\Teleca
2008-10-25 21:09 . 2007-04-23 14:54 108,680 -ra------ c:\windows\system32\drivers\s115mdm.sys
2008-10-25 21:09 . 2007-04-23 14:54 100,488 -ra------ c:\windows\system32\drivers\s115mgmt.sys
2008-10-25 21:09 . 2007-04-23 14:54 98,568 -ra------ c:\windows\system32\drivers\s115obex.sys
2008-10-25 21:09 . 2007-04-23 14:54 83,208 -ra------ c:\windows\system32\drivers\s115bus.sys
2008-10-25 21:09 . 2007-04-23 14:54 15,112 -ra------ c:\windows\system32\drivers\s115mdfl.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115whnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115wh.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cmnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cm.sys
2008-10-25 21:07 . 2008-10-25 21:08 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Sony Ericsson
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Common Files\Sony Ericsson Shared
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sony Ericsson
2008-10-25 21:04 . 2008-10-25 21:04 <DIR> d-------- c:\windows\Downloaded Installations
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Teleca
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-10-25 20:47 . 2008-10-25 21:07 <DIR> d-------- c:\program files\Common Files\Teleca Shared
2008-10-25 20:42 . 2008-10-25 20:42 <DIR> d-------- c:\program files\NOS
2008-10-25 20:42 . 2008-10-26 08:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-10-25 20:35 . 2008-09-15 12:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-25 20:35 . 2008-09-08 10:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-25 20:35 . 2008-06-13 11:05 272,128 --------- c:\windows\system32\dllcache\bthport.sys
2008-10-25 20:35 . 2008-05-08 14:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys
2008-10-25 20:34 . 2008-08-14 10:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-25 20:34 . 2008-08-14 10:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-25 20:34 . 2008-04-11 19:04 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-10-25 20:34 . 2008-05-01 14:33 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-10-25 20:31 . 2008-10-15 16:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-25 20:25 . 2008-10-25 20:26 <DIR> d-------- c:\program files\Google
2008-10-25 20:21 . 2008-10-26 07:59 51 --a------ c:\windows\iTouch.ini
2008-10-25 20:17 . 2008-10-25 20:17 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-10-25 20:17 . 2008-10-25 20:17 376 --a------ c:\windows\ODBC.INI
2008-10-25 20:16 . 2008-10-25 20:17 <DIR> d-------- c:\windows\ShellNew
2008-10-25 20:09 . 2008-10-25 20:09 <DIR> d-------- c:\documents and settings\Gray\Application Data\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Nero
2008-10-25 20:06 . 2008-10-25 20:10 <DIR> d-------- c:\program files\Common Files\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 81,920 -r------- c:\windows\bwUnin-6.1.4.36-8876480L.exe
2008-10-25 20:05 . 2002-11-21 08:50 155,648 --a------ c:\windows\system32\ifc21.dll
2008-10-25 20:05 . 2002-11-08 09:50 152,064 --------- c:\windows\system32\lmoufrc.dll
2008-10-25 20:05 . 2002-11-21 08:50 105,472 --a------ c:\windows\system32\COMNCTR.DLL
2008-10-25 20:05 . 2002-11-21 08:50 99,328 --a------ c:\windows\system32\LGUICOM.DLL
2008-10-25 20:05 . 2002-11-21 08:50 94,208 --a------ c:\windows\system32\FEELIT.DLL
2008-10-25 20:05 . 2002-11-08 09:50 70,238 --a------ c:\windows\system32\drivers\LMouFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 52,238 --------- c:\windows\system32\drivers\L8042PR2.SYS
2008-10-25 20:05 . 2002-11-08 09:50 23,838 --a------ c:\windows\system32\drivers\LHidFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 19,968 --------- c:\windows\LOGI_MWX.EXE
2008-10-25 20:05 . 2002-11-21 08:50 16,896 --a------ c:\windows\system32\LMOUSE32.DLL
2008-10-25 20:05 . 2002-11-08 09:50 4,524 --------- c:\windows\system32\LCOINST.DLL
2008-10-25 20:05 . 2002-11-21 08:50 3,568 --a------ c:\windows\system32\LMOUSE16.DLL
2008-10-25 20:04 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Logitech
2008-10-25 20:04 . 2008-10-25 20:04 <DIR> d-------- c:\program files\Common Files\Logitech
2008-10-25 20:04 . 2002-11-23 11:15 322,832 --a------ c:\windows\system32\MFC30.DLL
2008-10-25 20:04 . 2002-11-08 09:50 41,420 --a------ c:\windows\system32\drivers\LHidUsb.sys
2008-10-25 20:04 . 2002-11-08 09:50 14,156 --a------ c:\windows\system32\drivers\LCcfltr.sys
2008-10-25 20:04 . 2002-11-15 02:15 12,640 --------- c:\windows\system32\drivers\itchfltr.sys
2008-10-25 13:33 . 2008-10-25 13:33 <DIR> d-------- C:\OEMCUST
2008-10-25 13:31 . 2008-11-14 12:32 <DIR> d--h----- c:\windows\$hf_mig$
2008-10-25 13:29 . 2008-11-16 14:46 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\AVG
2008-10-25 13:29 . 2008-10-25 20:24 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVGTOOLBAR
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-25 13:29 . 2008-10-26 09:42 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-10-25 13:29 . 2008-10-25 13:29 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-10-25 13:29 . 2008-10-25 13:29 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-10-25 13:27 . 2008-10-25 13:27 <DIR> d-------- c:\windows\system32\LogFiles
2008-10-25 13:27 . 2008-10-25 13:28 <DIR> d-------- c:\windows\system32\drivers\UMDF
2008-10-25 13:19 . 2008-10-25 13:25 316,640 --a------ c:\windows\WMSysPr9.prx
2008-10-25 13:17 . 2008-10-28 19:08 <DIR> d-------- c:\windows\ServicePackFiles
2008-10-25 13:15 . 2008-10-25 13:15 <DIR> d-------- c:\program files\ZoneAlarmSB
2008-10-25 13:14 . 2008-10-25 13:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2008-10-25 13:14 . 2007-08-10 19:46 26,488 --a------ c:\windows\system32\spupdsvc.exe
2008-10-25 13:14 . 2004-07-17 10:40 19,528 --a------ c:\windows\002121_.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-10-26 1234712]
"ATICCC "= "c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-10-25 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Gray\Start Menu\Programs\Startup\
Flip.lnk - c:\program files\Belkin\Flip\flip.exe [2006-08-22 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-11-24 14:38 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2002-12-13 06:10 114688 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2002-12-13 06:22 155648 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2008-10-25 20:06 16384 c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-06-13 07:16 528384 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
--a------ 2002-11-23 01:15 631362 c:\program files\Logitech\iTouch\iTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
--------- 2002-11-08 09:50 19968 c:\windows\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-10-25 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-25 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-25 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-10-25 76040]
R3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2008-10-25 14156]
R3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [1979-12-31 296179]
R3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [1979-12-31 231983]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-25 33752]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-15 27904]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\DRIVERS\s115bus.sys [2008-10-25 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s115mdfl.sys [2008-10-25 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s115mdm.sys [2008-10-25 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s115mgmt.sys [2008-10-25 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s115obex.sys [2008-10-25 98568]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-c:\windows\system32\kdwyd.exe - c:\windows\system32\kdwyd.exe
HKLM-Run-NWEReboot - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = localhost
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 16:39:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\windows\system32\ati2evxx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-11-16 16:43:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-16 16:42:53

Pre-Run: 26,077,249,536 bytes free
Post-Run: 27,143,282,688 bytes free

278 --- E O F --- 2008-11-14 12:34:11

-------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 17:13:19, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Belkin\Flip\flip.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Gray\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.5470\swg.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Flip.lnk = C:\Program Files\Belkin\Flip\flip.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

noahdfear · 2008/11/16

Does Spybot tell you what changes are being requested? You need to determine if they are legitimate requests for changes made by the removal of rogues, or rogue requests to reset the repaired changes back to rogue.

Is Google still being redirected?

Download GMER

Right click and extract it to it's own folder on the desktop.

Open the program and click on the Rootkit tab.
Make sure all the boxes on the right of the screen are checked, EXCEPT for "˜Show Allâ€™.
Click on Scan.
When the scan has completed, click Copy and paste the results (if any) into this topic.

gray916 · 2008/11/16

Thanks again,

As i said am a novice at this so im not sure how to determine how whether the chage requests are genuine.

The re directs are still happening. I shall post the results from GMER and wait for your respone.

In the meantime i will ruin spybot again and make a note of the changes it requests.

The results file for GMER is below:

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-11-16 17:42:54
Windows 5.1.2600 Service Pack 3

---- Kernel code sections - GMER 1.0.14 ----

? Combo-Fix.sys The system cannot find the file specified. !
? srescan.sys The system cannot find the file specified. !
? C:\ComboFix\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !

---- EOF - GMER 1.0.14 ----

noahdfear · 2008/11/16

Lets just turn Spybot off for now. Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once you're clean.

Open Spybot Search & Destroy.

In the Mode menu click "Advanced mode" if not already selected.

Choose "Yes" at the Warning prompt.

Expand the "Tools" menu.

Click "Resident ".

Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.

In the File menu click "Exit" to exit Spybot Search & Destroy.

Reboot.

Now, please run ComboFix again as previously described then post the new log.

gray916 · 2008/11/16

Hi

Done as asked

Here is the combofix log file

ComboFix 08-11-14.01 - Gray 2008-11-16 18:24:32.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.683 [GMT 0:00]
Running from: c:\documents and settings\Gray\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2008-11-16 17:34 . 2008-11-16 17:34 250 --a------ c:\windows\gmer.ini
2008-11-16 11:29 . 2008-11-16 17:31 <DIR> d-------- C:\rsit
2008-11-16 11:29 . 2008-11-16 17:31 <DIR> d-------- c:\program files\trend micro
2008-11-16 09:43 . 2008-11-16 09:43 <DIR> d-------- C:\!KillBox
2008-11-15 21:40 . 2008-11-15 21:43 <DIR> d-------- c:\program files\WinAVIVideoConverter
2008-11-15 21:37 . 2008-11-16 08:46 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-15 21:37 . 2008-11-16 09:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 20:52 . 2008-11-15 21:00 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-15 13:44 . 2008-11-15 13:44 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVS4YOU
2008-11-15 13:43 . 2008-11-15 13:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\Common Files\AVSMedia
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\AVS4YOU
2008-11-15 13:31 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-11-15 13:31 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll
2008-11-15 13:31 . 2007-02-27 18:36 24,576 --a------ c:\windows\system32\msxml3a.dll
2008-11-15 12:29 . 2008-11-15 12:29 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-13 09:08 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 09:08 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-05 20:57 . 2006-05-03 11:57 520,192 --------- c:\windows\system32\ati2sgag.exe
2008-11-05 20:47 . 2008-11-05 20:58 <DIR> d-------- c:\program files\ATI Technologies
2008-11-05 20:18 . 2008-11-16 16:05 139 --a------ c:\windows\WININIT.INI
2008-11-05 18:55 . 2008-11-16 17:10 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-01 11:09 . 2008-11-01 11:09 <DIR> d-------- c:\program files\Alex Buturuga
2008-10-28 19:08 . 2008-10-28 19:08 <DIR> d-------- c:\windows\system32\scripting
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\en
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\bits
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\l2schemas
2008-10-27 21:01 . 2008-11-15 22:46 69 --a------ c:\windows\NeroDigital.ini
2008-10-27 20:55 . 2008-10-27 20:55 30,912 --a------ c:\documents and settings\Gray\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 20:33 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2008-10-27 20:33 . 2003-02-28 18:26 46,352 --a------ c:\windows\setdebug.exe
2008-10-27 20:33 . 2003-02-28 16:54 7,315 --a------ c:\windows\system32\javasup.vxd
2008-10-27 20:33 . 2003-02-28 16:35 6,550 --a------ c:\windows\jautoexp.dat
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedon.reg
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedoff.reg
2008-10-27 18:30 . 2008-10-27 18:30 <DIR> d-------- c:\program files\MSXML 4.0
2008-10-26 09:50 . 2008-10-26 09:50 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sonic
2008-10-26 09:49 . 2008-10-26 09:49 <DIR> d-------- c:\documents and settings\Gray\Application Data\Leadertech
2008-10-26 09:47 . 2008-10-26 09:47 <DIR> d-------- c:\program files\Belkin
2008-10-26 09:40 . 2008-11-05 21:04 <DIR> d-------- c:\documents and settings\Gray\Application Data\ATI
2008-10-26 09:28 . 2008-10-26 09:28 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-10-26 09:27 . 2008-10-26 09:27 <DIR> d-------- c:\program files\Common Files\Adobe
2008-10-25 21:16 . 2008-04-14 00:12 712,704 --------- c:\windows\system32\windowscodecs.dll
2008-10-25 21:16 . 2008-04-14 00:12 346,112 --------- c:\windows\system32\windowscodecsext.dll
2008-10-25 21:16 . 2008-04-14 00:12 276,992 --------- c:\windows\system32\wmphoto.dll
2008-10-25 21:16 . 2008-04-14 00:12 69,120 --------- c:\windows\system32\wlanapi.dll
2008-10-25 21:16 . 2008-04-14 00:12 53,248 --------- c:\windows\system32\tsgqec.dll
2008-10-25 21:16 . 2008-04-14 00:12 50,688 --------- c:\windows\system32\tspkg.dll
2008-10-25 21:16 . 2008-04-14 00:12 28,672 --------- c:\windows\system32\verclsid.exe
2008-10-25 21:14 . 2008-04-14 00:11 650,752 --------- c:\windows\system32\dot3ui.dll
2008-10-25 21:09 . 2008-10-25 21:10 <DIR> d-------- c:\documents and settings\Gray\Application Data\Teleca
2008-10-25 21:09 . 2007-04-23 14:54 108,680 -ra------ c:\windows\system32\drivers\s115mdm.sys
2008-10-25 21:09 . 2007-04-23 14:54 100,488 -ra------ c:\windows\system32\drivers\s115mgmt.sys
2008-10-25 21:09 . 2007-04-23 14:54 98,568 -ra------ c:\windows\system32\drivers\s115obex.sys
2008-10-25 21:09 . 2007-04-23 14:54 83,208 -ra------ c:\windows\system32\drivers\s115bus.sys
2008-10-25 21:09 . 2007-04-23 14:54 15,112 -ra------ c:\windows\system32\drivers\s115mdfl.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115whnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115wh.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cmnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cm.sys
2008-10-25 21:07 . 2008-10-25 21:08 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Sony Ericsson
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Common Files\Sony Ericsson Shared
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sony Ericsson
2008-10-25 21:04 . 2008-10-25 21:04 <DIR> d-------- c:\windows\Downloaded Installations
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Teleca
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-10-25 20:47 . 2008-10-25 21:07 <DIR> d-------- c:\program files\Common Files\Teleca Shared
2008-10-25 20:42 . 2008-10-25 20:42 <DIR> d-------- c:\program files\NOS
2008-10-25 20:42 . 2008-10-26 08:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-10-25 20:35 . 2008-09-15 12:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-25 20:35 . 2008-09-08 10:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-25 20:35 . 2008-06-13 11:05 272,128 --------- c:\windows\system32\dllcache\bthport.sys
2008-10-25 20:35 . 2008-05-08 14:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys
2008-10-25 20:34 . 2008-08-14 10:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-25 20:34 . 2008-08-14 10:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-25 20:34 . 2008-04-11 19:04 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-10-25 20:34 . 2008-05-01 14:33 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-10-25 20:31 . 2008-10-15 16:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-25 20:25 . 2008-10-25 20:26 <DIR> d-------- c:\program files\Google
2008-10-25 20:21 . 2008-10-26 07:59 51 --a------ c:\windows\iTouch.ini
2008-10-25 20:17 . 2008-10-25 20:17 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-10-25 20:17 . 2008-10-25 20:17 376 --a------ c:\windows\ODBC.INI
2008-10-25 20:16 . 2008-10-25 20:17 <DIR> d-------- c:\windows\ShellNew
2008-10-25 20:09 . 2008-10-25 20:09 <DIR> d-------- c:\documents and settings\Gray\Application Data\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Nero
2008-10-25 20:06 . 2008-10-25 20:10 <DIR> d-------- c:\program files\Common Files\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 81,920 -r------- c:\windows\bwUnin-6.1.4.36-8876480L.exe
2008-10-25 20:05 . 2002-11-21 08:50 155,648 --a------ c:\windows\system32\ifc21.dll
2008-10-25 20:05 . 2002-11-08 09:50 152,064 --------- c:\windows\system32\lmoufrc.dll
2008-10-25 20:05 . 2002-11-21 08:50 105,472 --a------ c:\windows\system32\COMNCTR.DLL
2008-10-25 20:05 . 2002-11-21 08:50 99,328 --a------ c:\windows\system32\LGUICOM.DLL
2008-10-25 20:05 . 2002-11-21 08:50 94,208 --a------ c:\windows\system32\FEELIT.DLL
2008-10-25 20:05 . 2002-11-08 09:50 70,238 --a------ c:\windows\system32\drivers\LMouFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 52,238 --------- c:\windows\system32\drivers\L8042PR2.SYS
2008-10-25 20:05 . 2002-11-08 09:50 23,838 --a------ c:\windows\system32\drivers\LHidFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 19,968 --------- c:\windows\LOGI_MWX.EXE
2008-10-25 20:05 . 2002-11-21 08:50 16,896 --a------ c:\windows\system32\LMOUSE32.DLL
2008-10-25 20:05 . 2002-11-08 09:50 4,524 --------- c:\windows\system32\LCOINST.DLL
2008-10-25 20:05 . 2002-11-21 08:50 3,568 --a------ c:\windows\system32\LMOUSE16.DLL
2008-10-25 20:04 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Logitech
2008-10-25 20:04 . 2008-10-25 20:04 <DIR> d-------- c:\program files\Common Files\Logitech
2008-10-25 20:04 . 2002-11-23 11:15 322,832 --a------ c:\windows\system32\MFC30.DLL
2008-10-25 20:04 . 2002-11-08 09:50 41,420 --a------ c:\windows\system32\drivers\LHidUsb.sys
2008-10-25 20:04 . 2002-11-08 09:50 14,156 --a------ c:\windows\system32\drivers\LCcfltr.sys
2008-10-25 20:04 . 2002-11-15 02:15 12,640 --------- c:\windows\system32\drivers\itchfltr.sys
2008-10-25 13:33 . 2008-10-25 13:33 <DIR> d-------- C:\OEMCUST
2008-10-25 13:31 . 2008-11-14 12:32 <DIR> d--h----- c:\windows\$hf_mig$
2008-10-25 13:29 . 2008-11-16 14:46 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\AVG
2008-10-25 13:29 . 2008-10-25 20:24 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVGTOOLBAR
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-25 13:29 . 2008-10-26 09:42 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-10-25 13:29 . 2008-10-25 13:29 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-10-25 13:29 . 2008-10-25 13:29 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-10-25 13:27 . 2008-10-25 13:27 <DIR> d-------- c:\windows\system32\LogFiles
2008-10-25 13:27 . 2008-10-25 13:28 <DIR> d-------- c:\windows\system32\drivers\UMDF
2008-10-25 13:19 . 2008-10-25 13:25 316,640 --a------ c:\windows\WMSysPr9.prx
2008-10-25 13:17 . 2008-10-28 19:08 <DIR> d-------- c:\windows\ServicePackFiles
2008-10-25 13:15 . 2008-10-25 13:15 <DIR> d-------- c:\program files\ZoneAlarmSB
2008-10-25 13:14 . 2008-10-25 13:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\MailFrontier
2008-10-25 13:14 . 2007-08-10 19:46 26,488 --a------ c:\windows\system32\spupdsvc.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
.

((((((((((((((((((((((((((((( snapshot@2008-11-16_16.42.20.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-16 17:34:40 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-17 21:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2008-11-16 17:34:40 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-10-26 1234712]
"ATICCC "= "c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-10-25 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Gray\Start Menu\Programs\Startup\
Flip.lnk - c:\program files\Belkin\Flip\flip.exe [2006-08-22 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-11-24 14:38 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2002-12-13 06:10 114688 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2002-12-13 06:22 155648 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2008-10-25 20:06 16384 c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-06-13 07:16 528384 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
--a------ 2002-11-23 01:15 631362 c:\program files\Logitech\iTouch\iTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
--------- 2002-11-08 09:50 19968 c:\windows\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-10-25 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-25 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-25 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-10-25 76040]
R3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [1979-12-31 296179]
R3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [1979-12-31 231983]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-25 33752]
S3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2008-10-25 14156]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-15 27904]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\DRIVERS\s115bus.sys [2008-10-25 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s115mdfl.sys [2008-10-25 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s115mdm.sys [2008-10-25 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s115mgmt.sys [2008-10-25 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s115obex.sys [2008-10-25 98568]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = localhost
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 18:27:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-16 18:28:56
ComboFix-quarantined-files.txt 2008-11-16 18:28:51
ComboFix2.txt 2008-11-16 16:43:06

Pre-Run: 27,106,852,864 bytes free
Post-Run: 27,098,300,416 bytes free

262 --- E O F --- 2008-11-14 12:34:11

noahdfear · 2008/11/16

And is Google still redirecting?

gray916 · 2008/11/16

yes it is

noahdfear · 2008/11/16

Download ATF Cleaner by Atribune and save it to your Desktop.

Double click ATF-Cleaner.exe to run the program.

Check the boxes to the left of:

Windows Temp

Current User Temp

All Users Temp

Temporary Internet Files

Prefetch

Java Cache

Recycle bin

The rest are optional - if you want it to remove everything check "Select All ".

Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.

Reboot

Now, highlight and copy the contents of the code box below.
Code:
reg query HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces /s>check.txt
start notepad check.txt
exit
cls
Click Start>Run and type cmd then hit enter to open a command window. Right click in the command window and select paste. The command window will close on it's own and a log will open. Post the contents of that log.

gray916 · 2008/11/16

Here it is

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0E04FC30-8D36-43B4-9D5D-E30458C65896}
UseZeroBroadcast REG_DWORD 0x0
EnableDHCP REG_DWORD 0x0
IPAddress REG_MULTI_SZ 0.0.0.0\0\0
SubnetMask REG_MULTI_SZ 0.0.0.0\0\0
DefaultGateway REG_MULTI_SZ \0
EnableDeadGWDetect REG_DWORD 0x1
DontAddDefaultGateway REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{39EA83D4-86B1-4C4F-9592-517144DFF1AE}
UseZeroBroadcast REG_DWORD 0x0
EnableDeadGWDetect REG_DWORD 0x1
EnableDHCP REG_DWORD 0x1
IPAddress REG_MULTI_SZ 0.0.0.0\0\0
SubnetMask REG_MULTI_SZ 0.0.0.0\0\0
DefaultGateway REG_MULTI_SZ \0
DefaultGatewayMetric REG_MULTI_SZ \0
NameServer REG_SZ
Domain REG_SZ
RegistrationEnabled REG_DWORD 0x1
RegisterAdapterName REG_DWORD 0x0
TCPAllowedPorts REG_MULTI_SZ 0\0\0
UDPAllowedPorts REG_MULTI_SZ 0\0\0
RawIPAllowedProtocols REG_MULTI_SZ 0\0\0
NTEContextList REG_MULTI_SZ 0x00000002\0\0
DhcpClassIdBin REG_BINARY
DhcpIPAddress REG_SZ 192.168.1.3
DhcpSubnetMask REG_SZ 255.255.255.0
DhcpServer REG_SZ 192.168.1.1
Lease REG_DWORD 0x15180
LeaseObtainedTime REG_DWORD 0x49206d9f
T1 REG_DWORD 0x4921165f
T2 REG_DWORD 0x492194ef
LeaseTerminatesTime REG_DWORD 0x4921bf1f
IPAutoconfigurationAddress REG_SZ 0.0.0.0
IPAutoconfigurationMask REG_SZ 255.255.0.0
IPAutoconfigurationSeed REG_DWORD 0x0
AddressType REG_DWORD 0x0
IsServerNapAware REG_DWORD 0x0
DhcpRetryTime REG_DWORD 0xa8bd
DhcpRetryStatus REG_DWORD 0x0
DhcpNameServer REG_SZ 192.168.1.1
DhcpDefaultGateway REG_MULTI_SZ 192.168.1.1\0\0
DhcpSubnetMaskOpt REG_MULTI_SZ 255.255.255.0\0\0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{EB879521-6354-4BC0-A544-81E745F8CB74}
UseZeroBroadcast REG_DWORD 0x0
EnableDHCP REG_DWORD 0x0
IPAddress REG_MULTI_SZ 0.0.0.0\0\0
SubnetMask REG_MULTI_SZ 0.0.0.0\0\0
DefaultGateway REG_MULTI_SZ \0
EnableDeadGWDetect REG_DWORD 0x1
DontAddDefaultGateway REG_DWORD 0x0

noahdfear · 2008/11/16

Looks fine. Click Start>Run and type cmd then hit Enter to open a command window. Type the following bolded command then hit Enter.

ipconfig /flushdns

Make sure a space is left between ipconfig and /flushdns
You should receive a message that the DNS cache was successfully flushed. Let me know if you do not.
Close the command window.

Next, search for and delete c:\windows\ntbtlog.txt if it exists.
Restart the computer and begin tapping the F8 key on startup to enable the Advanced Start Menu.
Select Enable Boot Logging from the list.
Once you've logged on, navigate to and open the c:\windows\ntbtlog.txt file then post it's contents here.

Check again to see if Google still redirects and let me know that as well.

gray916 · 2008/11/16

i did get the 'successful ' message when i rand the cmd line.

there was not originally an ntblog to delete.

I rebotted enabled logging and this is the file:

Google still redirects...

Service Pack 311 16 2008 19:43:08.500
Loaded driver \WINDOWS\system32\ntoskrnl.exe
Loaded driver \WINDOWS\system32\hal.dll
Loaded driver \WINDOWS\system32\KDCOM.DLL
Loaded driver \WINDOWS\system32\BOOTVID.dll
Loaded driver ACPI.sys
Loaded driver \WINDOWS\System32\DRIVERS\WMILIB.SYS
Loaded driver pci.sys
Loaded driver isapnp.sys
Loaded driver pciide.sys
Loaded driver \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Loaded driver aliide.sys
Loaded driver cmdide.sys
Loaded driver toside.sys
Loaded driver viaide.sys
Loaded driver intelide.sys
Loaded driver MountMgr.sys
Loaded driver ftdisk.sys
Loaded driver PartMgr.sys
Loaded driver VolSnap.sys
Loaded driver cpqarray.sys
Loaded driver \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
Loaded driver atapi.sys
Loaded driver aha154x.sys
Loaded driver sparrow.sys
Loaded driver symc810.sys
Loaded driver aic78xx.sys
Loaded driver dac960nt.sys
Loaded driver ql10wnt.sys
Loaded driver amsint.sys
Loaded driver asc.sys
Loaded driver asc3550.sys
Loaded driver mraid35x.sys
Loaded driver i2omp.sys
Loaded driver ini910u.sys
Loaded driver ql1240.sys
Loaded driver aic78u2.sys
Loaded driver symc8xx.sys
Loaded driver sym_hi.sys
Loaded driver sym_u3.sys
Loaded driver ABP480N5.SYS
Loaded driver asc3350p.sys
Loaded driver cd20xrnt.sys
Loaded driver ultra.sys
Loaded driver adpu160m.sys
Loaded driver dpti2o.sys
Loaded driver ql1080.sys
Loaded driver ql1280.sys
Loaded driver ql12160.sys
Loaded driver perc2.sys
Loaded driver perc2hib.sys
Loaded driver hpn.sys
Loaded driver cbidf2k.sys
Loaded driver dac2w2k.sys
Loaded driver disk.sys
Loaded driver \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver sr.sys
Loaded driver PxHelp20.sys
Loaded driver KSecDD.sys
Loaded driver Ntfs.sys
Loaded driver NDIS.sys
Loaded driver viaagp.sys
Loaded driver srescan.sys
Loaded driver sisagp.sys
Loaded driver Mup.sys
Loaded driver alim1541.sys
Loaded driver amdagp.sys
Loaded driver agp440.sys
Loaded driver agpCPQ.sys
Loaded driver \SystemRoot\System32\DRIVERS\intelppm.sys
Loaded driver \SystemRoot\System32\DRIVERS\ialmnt5.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbuhci.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\DRIVERS\ati2mtag.sys
Loaded driver \SystemRoot\System32\DRIVERS\e100b325.sys
Loaded driver \SystemRoot\System32\DRIVERS\imapi.sys
Loaded driver \SystemRoot\System32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\DRIVERS\redbook.sys
Loaded driver \SystemRoot\system32\drivers\stac97nh.sys
Loaded driver \SystemRoot\system32\drivers\stac97na.sys
Loaded driver \SystemRoot\System32\DRIVERS\SlWdmSup.sys
Loaded driver \SystemRoot\System32\DRIVERS\slntamr.sys
Loaded driver \SystemRoot\System32\DRIVERS\Mtlmnt5.sys
Loaded driver \SystemRoot\System32\Drivers\Modem.SYS
Loaded driver \SystemRoot\System32\DRIVERS\fdc.sys
Loaded driver \SystemRoot\System32\DRIVERS\serial.sys
Loaded driver \SystemRoot\System32\DRIVERS\serenum.sys
Loaded driver \SystemRoot\System32\DRIVERS\parport.sys
Loaded driver \SystemRoot\System32\DRIVERS\audstub.sys
Loaded driver \SystemRoot\System32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\System32\DRIVERS\msgpc.sys
Loaded driver \SystemRoot\System32\DRIVERS\psched.sys
Loaded driver \SystemRoot\System32\DRIVERS\ptilink.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspti.sys
Loaded driver \SystemRoot\System32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\System32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\System32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\System32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\System32\DRIVERS\update.sys
Loaded driver \SystemRoot\System32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\system32\drivers\ialmkchw.sys
Loaded driver \SystemRoot\system32\drivers\ialmsbw.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\System32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\System32\DRIVERS\flpydisk.sys
Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS
Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS
Loaded driver \SystemRoot\System32\Drivers\i2omgmt.SYS
Did not load driver \SystemRoot\System32\Drivers\Changer.SYS
Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Did not load driver \SystemRoot\System32\DRIVERS\i8042prt.sys
Did not load driver \SystemRoot\System32\DRIVERS\kbdhid.sys
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys
Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\System32\vsdatant.sys
Loaded driver \SystemRoot\System32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys
Did not load driver \SystemRoot\System32\DRIVERS\amdk7.sys
Did not load driver \SystemRoot\System32\DRIVERS\processr.sys
Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Did not load driver \SystemRoot\system32\drivers\InCDPass.sys
Did not load driver \SystemRoot\system32\drivers\InCDRm.sys
Loaded driver \SystemRoot\System32\Drivers\Fips.SYS
Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipnat.sys
Loaded driver \SystemRoot\System32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbprint.sys
Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys
Loaded driver \SystemRoot\System32\DRIVERS\hidusb.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbccgp.sys
Loaded driver \SystemRoot\System32\Drivers\LHidUsb.Sys
Loaded driver \SystemRoot\System32\Drivers\LCcFltr.Sys
Loaded driver \SystemRoot\System32\DRIVERS\kbdhid.sys
Loaded driver \SystemRoot\system32\DRIVERS\LHidFlt2.Sys
Loaded driver \SystemRoot\System32\DRIVERS\mouhid.sys
Loaded driver \SystemRoot\system32\DRIVERS\LMouFlt2.Sys
Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Udfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\ndisuio.sys
Loaded driver \SystemRoot\System32\Drivers\Fastfat.SYS
Did not load driver \SystemRoot\System32\DRIVERS\rdbss.sys
Did not load driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\drivers\wdmaud.sys
Loaded driver \SystemRoot\system32\drivers\sysaudio.sys
Loaded driver \SystemRoot\system32\drivers\splitter.sys
Loaded driver \SystemRoot\system32\drivers\aec.sys
Loaded driver \SystemRoot\system32\drivers\swmidi.sys
Loaded driver \SystemRoot\system32\drivers\DMusic.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys
Loaded driver \SystemRoot\system32\drivers\drmkaud.sys
Loaded driver \SystemRoot\System32\DRIVERS\mrxdav.sys
Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS
Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys
Loaded driver \SystemRoot\System32\Drivers\HTTP.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys

noahdfear · 2008/11/16

And are your google results still redirecting you? If so, where to?

gray916 · 2008/11/16

The same happens when i search by going to the google homepage or by using the google toolbar.

I do my search (this example the search was football, and click on a hit. i then get directed to:

hxxp://copy-book.com/search.php?q=football

then it redirects to:

hxxp://50371.smartbizsearch.com/xtr_new?q=football&sid=886957308&sa=3&p=2

then it redirects to

hxxp://main.exoclick.com/click.php?...MTNmNDIyZGM4MTg4YTdhZDk2ZDk5YzRjOGU1NTM5&js=1

then it redirects to

hxxp://5676.23667.blueseek.com/jump2/?affiliate=5676&subid=23667&terms=football

noahdfear · 2008/11/16

Please go to this proxy server, then access Google via it's search bar. Do another google search from there and see if the redirection persists.

Oh, and exactly which search result are you clicking on, or does it matter?

gray916 · 2008/11/16

this doesnt seem to work. i get an error 'Error: 100: (URL: football)'

When doing it the normal way, i search on google click on a hit then it goes through the redirect process (this happens for any hit i click on). If i click back and get back to the results page and then click on the same hit it works fine....?

However, when iopen a new IE7 window, and do the same search and click on the same hit, the problem reoccurs...

I have been told by a mate of mine that it sounds like the TDSS trojan? Does this sound familiar to you?

noahdfear · 2008/11/16

It sounds exactly like tdss ..... however, there is no sign of it. Please replace the copy of ComboFix.exe with a new download, then run it again. Post the resulting log here.

gray916 · 2008/11/16

Downloaded combofix again and here is the report

ComboFix 08-11-16.01 - Gray 2008-11-16 21:39:48.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.596 [GMT 0:00]
Running from: c:\documents and settings\Gray\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.

2008-11-16 20:21 . 2008-11-16 20:22 <DIR> d-------- c:\program files\malware
2008-11-16 20:21 . 2008-11-16 20:21 <DIR> d-------- c:\documents and settings\Gray\Application Data\Malwarebytes
2008-11-16 20:21 . 2008-11-16 20:21 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-16 20:21 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-16 20:21 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-16 17:34 . 2008-11-16 17:34 250 --a------ c:\windows\gmer.ini
2008-11-16 11:29 . 2008-11-16 17:31 <DIR> d-------- C:\rsit
2008-11-16 11:29 . 2008-11-16 17:31 <DIR> d-------- c:\program files\trend micro
2008-11-16 09:43 . 2008-11-16 09:43 <DIR> d-------- C:\!KillBox
2008-11-15 21:40 . 2008-11-15 21:43 <DIR> d-------- c:\program files\WinAVIVideoConverter
2008-11-15 21:37 . 2008-11-16 08:46 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-15 21:37 . 2008-11-16 09:35 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-15 20:52 . 2008-11-15 21:00 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-15 13:44 . 2008-11-15 13:44 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVS4YOU
2008-11-15 13:43 . 2008-11-15 13:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVS4YOU
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\Common Files\AVSMedia
2008-11-15 13:31 . 2008-11-15 20:59 <DIR> d-------- c:\program files\AVS4YOU
2008-11-15 13:31 . 2007-02-27 18:36 1,700,352 --a------ c:\windows\system32\GdiPlus.dll
2008-11-15 13:31 . 2007-02-27 18:36 974,848 --a------ c:\windows\system32\mfc70.dll
2008-11-15 13:31 . 2007-02-27 18:36 24,576 --a------ c:\windows\system32\msxml3a.dll
2008-11-15 12:29 . 2008-11-15 12:29 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-13 09:08 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 09:08 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-05 20:57 . 2006-05-03 11:57 520,192 --------- c:\windows\system32\ati2sgag.exe
2008-11-05 20:47 . 2008-11-05 20:58 <DIR> d-------- c:\program files\ATI Technologies
2008-11-05 20:18 . 2008-11-16 16:05 139 --a------ c:\windows\WININIT.INI
2008-11-05 18:55 . 2008-11-16 21:08 <DIR> d--h----- C:\$AVG8.VAULT$
2008-11-01 11:09 . 2008-11-01 11:09 <DIR> d-------- c:\program files\Alex Buturuga
2008-10-28 19:08 . 2008-10-28 19:08 <DIR> d-------- c:\windows\system32\scripting
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\en
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\system32\bits
2008-10-28 19:07 . 2008-10-28 19:07 <DIR> d-------- c:\windows\l2schemas
2008-10-27 21:01 . 2008-11-15 22:46 69 --a------ c:\windows\NeroDigital.ini
2008-10-27 20:55 . 2008-10-27 20:55 30,912 --a------ c:\documents and settings\Gray\Application Data\GDIPFONTCACHEV1.DAT
2008-10-27 20:33 . 2003-02-28 18:26 139,536 --a------ c:\windows\system32\javaee.dll
2008-10-27 20:33 . 2003-02-28 18:26 46,352 --a------ c:\windows\setdebug.exe
2008-10-27 20:33 . 2003-02-28 16:54 7,315 --a------ c:\windows\system32\javasup.vxd
2008-10-27 20:33 . 2003-02-28 16:35 6,550 --a------ c:\windows\jautoexp.dat
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedon.reg
2008-10-27 20:33 . 2003-02-28 16:38 113 --a------ c:\windows\system32\zonedoff.reg
2008-10-27 18:30 . 2008-10-27 18:30 <DIR> d-------- c:\program files\MSXML 4.0
2008-10-26 09:50 . 2008-10-26 09:50 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sonic
2008-10-26 09:49 . 2008-10-26 09:49 <DIR> d-------- c:\documents and settings\Gray\Application Data\Leadertech
2008-10-26 09:47 . 2008-10-26 09:47 <DIR> d-------- c:\program files\Belkin
2008-10-26 09:40 . 2008-11-05 21:04 <DIR> d-------- c:\documents and settings\Gray\Application Data\ATI
2008-10-26 09:28 . 2008-10-26 09:28 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-10-26 09:27 . 2008-10-26 09:27 <DIR> d-------- c:\program files\Common Files\Adobe
2008-10-25 21:16 . 2008-04-14 00:12 712,704 --------- c:\windows\system32\windowscodecs.dll
2008-10-25 21:16 . 2008-04-14 00:12 346,112 --------- c:\windows\system32\windowscodecsext.dll
2008-10-25 21:16 . 2008-04-14 00:12 276,992 --------- c:\windows\system32\wmphoto.dll
2008-10-25 21:16 . 2008-04-14 00:12 69,120 --------- c:\windows\system32\wlanapi.dll
2008-10-25 21:16 . 2008-04-14 00:12 53,248 --------- c:\windows\system32\tsgqec.dll
2008-10-25 21:16 . 2008-04-14 00:12 50,688 --------- c:\windows\system32\tspkg.dll
2008-10-25 21:16 . 2008-04-14 00:12 28,672 --------- c:\windows\system32\verclsid.exe
2008-10-25 21:14 . 2008-04-14 00:11 650,752 --------- c:\windows\system32\dot3ui.dll
2008-10-25 21:09 . 2008-10-25 21:10 <DIR> d-------- c:\documents and settings\Gray\Application Data\Teleca
2008-10-25 21:09 . 2007-04-23 14:54 108,680 -ra------ c:\windows\system32\drivers\s115mdm.sys
2008-10-25 21:09 . 2007-04-23 14:54 100,488 -ra------ c:\windows\system32\drivers\s115mgmt.sys
2008-10-25 21:09 . 2007-04-23 14:54 98,568 -ra------ c:\windows\system32\drivers\s115obex.sys
2008-10-25 21:09 . 2007-04-23 14:54 83,208 -ra------ c:\windows\system32\drivers\s115bus.sys
2008-10-25 21:09 . 2007-04-23 14:54 15,112 -ra------ c:\windows\system32\drivers\s115mdfl.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115whnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115wh.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cmnt.sys
2008-10-25 21:09 . 2007-04-23 14:54 12,424 -ra------ c:\windows\system32\drivers\s115cm.sys
2008-10-25 21:07 . 2008-10-25 21:08 <DIR> d----c--- c:\windows\system32\DRVSTORE
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Sony Ericsson
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\program files\Common Files\Sony Ericsson Shared
2008-10-25 21:05 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\Gray\Application Data\Sony Ericsson
2008-10-25 21:04 . 2008-10-25 21:04 <DIR> d-------- c:\windows\Downloaded Installations
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Teleca
2008-10-25 21:04 . 2008-10-25 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
2008-10-25 20:47 . 2008-10-25 21:07 <DIR> d-------- c:\program files\Common Files\Teleca Shared
2008-10-25 20:42 . 2008-10-25 20:42 <DIR> d-------- c:\program files\NOS
2008-10-25 20:42 . 2008-10-26 08:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\NOS
2008-10-25 20:35 . 2008-09-15 12:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-25 20:35 . 2008-09-08 10:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-25 20:35 . 2008-06-13 11:05 272,128 --------- c:\windows\system32\dllcache\bthport.sys
2008-10-25 20:35 . 2008-05-08 14:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys
2008-10-25 20:34 . 2008-08-14 10:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-25 20:34 . 2008-08-14 10:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-25 20:34 . 2008-08-14 09:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-25 20:34 . 2008-04-11 19:04 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll
2008-10-25 20:34 . 2008-05-01 14:33 331,776 --------- c:\windows\system32\dllcache\msadce.dll
2008-10-25 20:31 . 2008-10-15 16:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-25 20:25 . 2008-10-25 20:26 <DIR> d-------- c:\program files\Google
2008-10-25 20:21 . 2008-10-26 07:59 51 --a------ c:\windows\iTouch.ini
2008-10-25 20:17 . 2008-10-25 20:17 <DIR> d-------- c:\program files\Microsoft ActiveSync
2008-10-25 20:17 . 2008-10-25 20:17 376 --a------ c:\windows\ODBC.INI
2008-10-25 20:16 . 2008-10-25 20:17 <DIR> d-------- c:\windows\ShellNew
2008-10-25 20:09 . 2008-10-25 20:09 <DIR> d-------- c:\documents and settings\Gray\Application Data\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Nero
2008-10-25 20:06 . 2008-10-25 20:10 <DIR> d-------- c:\program files\Common Files\Ahead
2008-10-25 20:06 . 2008-10-25 20:06 81,920 -r------- c:\windows\bwUnin-6.1.4.36-8876480L.exe
2008-10-25 20:05 . 2002-11-21 08:50 155,648 --a------ c:\windows\system32\ifc21.dll
2008-10-25 20:05 . 2002-11-08 09:50 152,064 --------- c:\windows\system32\lmoufrc.dll
2008-10-25 20:05 . 2002-11-21 08:50 105,472 --a------ c:\windows\system32\COMNCTR.DLL
2008-10-25 20:05 . 2002-11-21 08:50 99,328 --a------ c:\windows\system32\LGUICOM.DLL
2008-10-25 20:05 . 2002-11-21 08:50 94,208 --a------ c:\windows\system32\FEELIT.DLL
2008-10-25 20:05 . 2002-11-08 09:50 70,238 --a------ c:\windows\system32\drivers\LMouFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 52,238 --------- c:\windows\system32\drivers\L8042PR2.SYS
2008-10-25 20:05 . 2002-11-08 09:50 23,838 --a------ c:\windows\system32\drivers\LHidFlt2.Sys
2008-10-25 20:05 . 2002-11-08 09:50 19,968 --------- c:\windows\LOGI_MWX.EXE
2008-10-25 20:05 . 2002-11-21 08:50 16,896 --a------ c:\windows\system32\LMOUSE32.DLL
2008-10-25 20:05 . 2002-11-08 09:50 4,524 --------- c:\windows\system32\LCOINST.DLL
2008-10-25 20:05 . 2002-11-21 08:50 3,568 --a------ c:\windows\system32\LMOUSE16.DLL
2008-10-25 20:04 . 2008-10-25 20:06 <DIR> d-------- c:\program files\Logitech
2008-10-25 20:04 . 2008-10-25 20:04 <DIR> d-------- c:\program files\Common Files\Logitech
2008-10-25 20:04 . 2002-11-23 11:15 322,832 --a------ c:\windows\system32\MFC30.DLL
2008-10-25 20:04 . 2002-11-08 09:50 41,420 --a------ c:\windows\system32\drivers\LHidUsb.sys
2008-10-25 20:04 . 2002-11-08 09:50 14,156 --a------ c:\windows\system32\drivers\LCcfltr.sys
2008-10-25 20:04 . 2002-11-15 02:15 12,640 --------- c:\windows\system32\drivers\itchfltr.sys
2008-10-25 13:33 . 2008-10-25 13:33 <DIR> d-------- C:\OEMCUST
2008-10-25 13:31 . 2008-11-14 12:32 <DIR> d--h----- c:\windows\$hf_mig$
2008-10-25 13:29 . 2008-11-16 14:46 <DIR> d-------- c:\windows\system32\drivers\Avg
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\program files\AVG
2008-10-25 13:29 . 2008-10-25 20:24 <DIR> d-------- c:\documents and settings\Gray\Application Data\AVGTOOLBAR
2008-10-25 13:29 . 2008-10-25 13:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2008-10-25 13:29 . 2008-10-26 09:42 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2008-10-25 13:29 . 2008-10-25 13:29 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
2008-10-25 13:29 . 2008-10-25 13:29 10,520 --a------ c:\windows\system32\avgrsstx.dll
2008-10-25 13:27 . 2008-10-25 13:27 <DIR> d-------- c:\windows\system32\LogFiles
2008-10-25 13:27 . 2008-10-25 13:28 <DIR> d-------- c:\windows\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 18:59 977,334 ----a-w c:\windows\Internet Logs\tvDebug.zip
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 14:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 14:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 14:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 14:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 14:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll
2008-10-03 17:41 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ------w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
.

((((((((((((((((((((((((((((( snapshot@2008-11-16_16.42.20.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-16 17:34:40 884,736 ----a-w c:\windows\gmer.dll
+ 2008-04-17 21:13:02 811,008 ----a-w c:\windows\gmer.exe
+ 2008-11-16 17:34:40 85,969 ----a-w c:\windows\system32\drivers\gmer.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-10-26 1234712]
"ATICCC "= "c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2008-10-25 77824]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE "= "c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Gray\Start Menu\Programs\Startup\
Flip.lnk - c:\program files\Belkin\Flip\flip.exe [2006-08-22 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2005-11-24 14:38 94208 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2002-12-13 06:10 114688 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2002-12-13 06:22 155648 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
--a------ 2008-10-25 20:06 16384 c:\program files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-06-13 07:16 528384 c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
--a------ 2002-11-23 01:15 631362 c:\program files\Logitech\iTouch\iTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
--------- 2002-11-08 09:50 19968 c:\windows\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-10-25 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-10-25 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-10-25 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-10-25 76040]
R3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2008-10-25 14156]
R3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-11-16 38496]
R3 STAC97NA;SigmaTel 3D Environmental Audio;c:\windows\system32\drivers\stac97na.sys [1979-12-31 296179]
R3 STAC97NH;STAC97NH;c:\windows\system32\drivers\stac97nh.sys [1979-12-31 231983]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-25 33752]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-15 27904]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);c:\windows\system32\DRIVERS\s115bus.sys [2008-10-25 83208]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s115mdfl.sys [2008-10-25 15112]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s115mdm.sys [2008-10-25 108680]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s115mgmt.sys [2008-10-25 100488]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s115obex.sys [2008-10-25 98568]

*Newly Created Service* - MBAMSWISSARMY
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = localhost
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 21:42:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-16 21:44:24
ComboFix-quarantined-files.txt 2008-11-16 21:44:19
ComboFix2.txt 2008-11-16 18:28:57
ComboFix3.txt 2008-11-16 16:43:06

Pre-Run: 26,989,232,128 bytes free
Post-Run: 27,000,324,096 bytes free

267 --- E O F --- 2008-11-14 12:34:11

noahdfear · 2008/11/16

What kind of connection do you have to the internet? Router?

Log in or Sign up

Inactive [InActive] Google Redirect Problem - Beginner

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

Share This Page

Log in or Sign up

Inactive [InActive] Google Redirect Problem - Beginner

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

gray916 Inactive Thread Starter

noahdfear Inactive

Share This Page

Useful Searches