Author Topic: [Inactive] IE8 Google, Yahoo, Bing searches being redirected  (Read 721 times)

0 Members and 1 Guest are viewing this topic.

Offline bandgap

  • Bronze Member
  • Posts: 6
[Inactive] IE8 Google, Yahoo, Bing searches being redirected
« on: November 15, 2011, 09:39:34 AM »
Google, Yahoo, and Bing are the only 3 search engines that I checked. All links get redirected. Clicking on links within a non-search engine browser session (e.g., while in espn.com) are not redirected. FireFox 8 also appears unaffected.

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:37:23 AM, on 11/15/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19154)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\OEM03Mon.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files\Ask.com\Updater\Updater.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\R_C\Downloads\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QFX Software KeyScrambler - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: DownloadHelper Class - {FF2573AE-E1ED-40e1-83BA-F544CB2EE135} - C:\Program Files\Common Files\Download Helper\DownloadHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [Bluetooth HCI Monitor] RunDll32 HCIMNTR.DLL,RunCheckHCIMode
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [OEM03Mon.exe] C:\Windows\OEM03Mon.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Sophos AutoUpdate Monitor] C:\Program Files\Sophos\AutoUpdate\almon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
O4 - HKLM\..\Run: [NI Background Service] C:\Program Files\National Instruments\Shared\Update Service\niupdate.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Jnmgqirae] rundll32 "C:\Users\R_C\AppData\Roaming\iccvid0.dll",slaqwubtp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Locate Spot on Map by GPS - C:\Program Files\Opanda\IExif 2.3\IExifMap.htm
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Program Files\Opanda\IExif 2.3\IExifCom.htm
O9 - Extra button: (no name) - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra 'Tools' menuitem: &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files\KeyScrambler\KeyScramblerIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (BitDefender QuickScan Control) - http://quickscan.bitdefender.com/qsax/qsax.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/3,0,0,6063/mcfscan.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\Windows\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments Corporation - C:\Windows\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments Corporation - C:\Windows\system32\lktsrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments Corporation - C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corporation - C:\Windows\system32\nisvcloc.exe
O23 - Service: Performance Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Sophos Web Intelligence Service (swi_service) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

--
End of file - 14963 bytes
« Last Edit: November 15, 2011, 11:46:22 AM by Hoov »



Offline Hoov

  • Malware Removal Mentors
  • Global Moderator
  • Diamond Member
  • Posts: 22632
  • Unwilling part owner of Gov't. Motors and Chrysler
    • Hoov's Personal Site
Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
« Reply #1 on: November 15, 2011, 11:49:34 AM »
Hello, welcome to SpywareHammer.

I go by Hoov, and I will be helping you with your problem. I must ask you to do a few things for me.

First, tell me everything that you have done, if anything, to try and fix this problem.Also tell me any other problems you are having, no matter how small or long you have been dealing with them.

Second, please only use 1 forum to help clear up your problem. Posting on more than 1 and following instructions from more than 1 forum will cause those helping you to pull out thier hair.

Third, follow my instructions - If you can't for some reason, or if you don't understand something, please tell me. If you deviate from my instructions, tell me, it may make a difference on where we go.

Fourth, Have faith. I will do all I can to get your computer working, and if I can't - someone else here will know something else to try.

Fifth, if we start this fix, I need you to stick with me until the end. Just because your computer is running better does not mean it is fixed.

Before we start trying to fix your computer, you need to make sure your data is backed up. Also let me know of any software you have running that encrypts your harddrive.

One last thing, I need you to tell me if this computer belongs to a school or to a company or orginization of some kind. If it does, please let me know. Also tell me if there is an IT department responsible for this computer.

Now onto trying to fix your computer.


Please run ccleaner to remove temporary files from your system, and to improve the scanning time of the other scans we may be running. Then please run Malwarebytes' Anti-Malware to check for malware.

1.Download and scan with CCleaner
When you get to the website, there is a dark grey box on the left side with two tabs along the top. Inside this Dark Grey box is a light grey box. Below that light grey box is where the download links are at. The pay amount is for paid support.
2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"
3. Then select the items you wish to clean up.
In the Windows Tab:

    • Clean all entries in the "Internet Explorer" section except Cookies if you want to keep those.
    • Clean all the entries in the "Windows Explorer" section.
    • Clean all entries in the "System" section.
    • Clean all entries in the "Advanced" section.
    • Clean any others that you choose.


    In the Applications Tab
      • Clean all except cookies in the Firefox/Mozilla section if you use it.
      • Clean all in the Opera section if you use it.
      • Clean Sun Java in the Internet Section.
      • Clean any others that you choose.


      4. Click the "Run Cleaner" button.
      5. A pop up box will appear advising this process will permanently delete files from your system.
      6. Click "OK" and it will scan and clean your system.
      7. Click "exit" when done.

      Now update Malwarebytes' Anti-Malware and run a quick scan with it. If it finds nothing, post the log. If it does find something, fix it and then post the resulting log.

      Next use the instructions below and run TDSSKiller.

      Please read carefully and follow these steps.
      • Download TDSSKiller and save it to your Desktop.
      • Extract its contents to your desktop.
      • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.





      • If an infected file is detected, the default action will be Cure, click on Continue.





      • If a suspicious file is detected, the default action will be Skip, click on Continue.





      • It may ask you to reboot the computer to complete the process. Click on Reboot Now.





      • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
      • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

      Offline bandgap

      • Bronze Member
      • Posts: 6
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #2 on: November 15, 2011, 03:04:50 PM »
      Before joining this board, I ran Spybot S&D, Ad-Aware Free, Microsoft Malicious Software Removal tool, Symantec online virus scanner, Sophos Endpoint Security and Control, and Malwarebytes' Anti-Malware, both in safe mode and normal boot.

      Since posting, I have noticed that Firefox 8 redirects itself back to the Google start page when trying to click on links found in a Google search. However, if I copy the link and paste it into the URL window, then Firefox 8 loads the desired link properly. Then, if I allow scripts for that URL (through Noscript), then Firefox 8 will load that page directly from  the same Google search.

      I downloaded and ran ccleaner as instructed.

      I downloaded, updated, and ran Malwarebytes' Anti-Malware. Nothing found:

      Malwarebytes' Anti-Malware 1.51.2.1300
      www.malwarebytes.org

      Database version: 8169

      Windows 6.0.6002 Service Pack 2
      Internet Explorer 8.0.6001.19154

      11/15/2011 3:49:52 PM
      mbam-log-2011-11-15 (15-49-52).txt

      Scan type: Quick scan
      Objects scanned: 166759
      Time elapsed: 4 minute(s), 54 second(s)

      Memory Processes Infected: 0
      Memory Modules Infected: 0
      Registry Keys Infected: 0
      Registry Values Infected: 0
      Registry Data Items Infected: 0
      Folders Infected: 0
      Files Infected: 0

      Memory Processes Infected:
      (No malicious items detected)

      Memory Modules Infected:
      (No malicious items detected)

      Registry Keys Infected:
      (No malicious items detected)

      Registry Values Infected:
      (No malicious items detected)

      Registry Data Items Infected:
      (No malicious items detected)

      Folders Infected:
      (No malicious items detected)

      Files Infected:
      (No malicious items detected)

      I downloaded and ran TDSSKiller.  Nothing found. I forgot to click on report, so I just ran TDSSKiller again.  Here is the report:

      16:08:23.0513 1852   TDSS rootkit removing tool 2.6.18.0 Nov 11 2011 15:47:15
      16:08:23.0879 1852   ============================================================
      16:08:23.0879 1852   Current date / time: 2011/11/15 16:08:23.0879
      16:08:23.0879 1852   SystemInfo:
      16:08:23.0879 1852   
      16:08:23.0879 1852   OS Version: 6.0.6002 ServicePack: 2.0
      16:08:23.0879 1852   Product type: Workstation
      16:08:23.0879 1852   ComputerName: AVATAR
      16:08:23.0879 1852   UserName: R_C
      16:08:23.0879 1852   Windows directory: C:\Windows
      16:08:23.0879 1852   System windows directory: C:\Windows
      16:08:23.0879 1852   Processor architecture: Intel x86
      16:08:23.0879 1852   Number of processors: 4
      16:08:23.0879 1852   Page size: 0x1000
      16:08:23.0879 1852   Boot type: Normal boot
      16:08:23.0880 1852   ============================================================
      16:08:24.0288 1852   Initialize success
      16:08:25.0433 5284   ============================================================
      16:08:25.0433 5284   Scan started
      16:08:25.0433 5284   Mode: Manual;
      16:08:25.0433 5284   ============================================================
      16:08:25.0701 5284   ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32

      \drivers\acpi.sys
      16:08:25.0703 5284   ACPI - ok
      16:08:25.0760 5284   adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32

      \drivers\adp94xx.sys
      16:08:25.0762 5284   adp94xx - ok
      16:08:25.0781 5284   adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32

      \drivers\adpahci.sys
      16:08:25.0783 5284   adpahci - ok
      16:08:25.0819 5284   adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32

      \drivers\adpu160m.sys
      16:08:25.0820 5284   adpu160m - ok
      16:08:25.0839 5284   adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32

      \drivers\adpu320.sys
      16:08:25.0840 5284   adpu320 - ok
      16:08:25.0912 5284   AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32

      \drivers\afd.sys
      16:08:25.0913 5284   AFD - ok
      16:08:25.0942 5284   agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32

      \drivers\agp440.sys
      16:08:25.0943 5284   agp440 - ok
      16:08:25.0962 5284   aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32

      \drivers\djsvs.sys
      16:08:25.0963 5284   aic78xx - ok
      16:08:25.0993 5284   aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32

      \drivers\aliide.sys
      16:08:25.0994 5284   aliide - ok
      16:08:26.0039 5284   amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32

      \drivers\amdagp.sys
      16:08:26.0040 5284   amdagp - ok
      16:08:26.0056 5284   amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32

      \drivers\amdide.sys
      16:08:26.0057 5284   amdide - ok
      16:08:26.0082 5284   AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32

      \drivers\amdk7.sys
      16:08:26.0082 5284   AmdK7 - ok
      16:08:26.0100 5284   AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32

      \drivers\amdk8.sys
      16:08:26.0100 5284   AmdK8 - ok
      16:08:26.0267 5284   amdkmdag        (d05cf4523e0c04ef82454abfd84fdc1d) C:\Windows\system32

      \DRIVERS\atikmdag.sys
      16:08:26.0308 5284   amdkmdag - ok
      16:08:26.0358 5284   amdkmdap        (92dc2e0ae49148f83b24d89c737b0c97) C:\Windows\system32

      \DRIVERS\atikmpag.sys
      16:08:26.0359 5284   amdkmdap - ok
      16:08:26.0403 5284   arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32

      \drivers\arc.sys
      16:08:26.0403 5284   arc - ok
      16:08:26.0429 5284   arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32

      \drivers\arcsas.sys
      16:08:26.0430 5284   arcsas - ok
      16:08:26.0479 5284   AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32

      \DRIVERS\asyncmac.sys
      16:08:26.0479 5284   AsyncMac - ok
      16:08:26.0518 5284   atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32

      \drivers\atapi.sys
      16:08:26.0519 5284   atapi - ok
      16:08:26.0700 5284   atikmdag        (d05cf4523e0c04ef82454abfd84fdc1d) C:\Windows\system32

      \DRIVERS\atikmdag.sys
      16:08:26.0743 5284   atikmdag - ok
      16:08:26.0809 5284   Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32

      \drivers\Beep.sys
      16:08:26.0810 5284   Beep - ok
      16:08:26.0848 5284   blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32

      \drivers\blbdrive.sys
      16:08:26.0848 5284   blbdrive - ok
      16:08:26.0929 5284   bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32

      \DRIVERS\bowser.sys
      16:08:26.0930 5284   bowser - ok
      16:08:26.0954 5284   BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32

      \drivers\brfiltlo.sys
      16:08:26.0954 5284   BrFiltLo - ok
      16:08:26.0986 5284   BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32

      \drivers\brfiltup.sys
      16:08:26.0987 5284   BrFiltUp - ok
      16:08:27.0007 5284   Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32

      \drivers\brserid.sys
      16:08:27.0008 5284   Brserid - ok
      16:08:27.0022 5284   BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32

      \drivers\brserwdm.sys
      16:08:27.0023 5284   BrSerWdm - ok
      16:08:27.0037 5284   BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32

      \drivers\brusbmdm.sys
      16:08:27.0037 5284   BrUsbMdm - ok
      16:08:27.0050 5284   BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32

      \drivers\brusbser.sys
      16:08:27.0051 5284   BrUsbSer - ok
      16:08:27.0115 5284   BthEnum         (6d39c954799b63ba866910234cf7d726) C:\Windows\system32

      \DRIVERS\BthEnum.sys
      16:08:27.0116 5284   BthEnum - ok
      16:08:27.0133 5284   BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32

      \drivers\bthmodem.sys
      16:08:27.0133 5284   BTHMODEM - ok
      16:08:27.0161 5284   BthPan          (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32

      \DRIVERS\bthpan.sys
      16:08:27.0162 5284   BthPan - ok
      16:08:27.0224 5284   BTHPORT         (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32

      \Drivers\BTHport.sys
      16:08:27.0227 5284   BTHPORT - ok
      16:08:27.0286 5284   BTHUSB          (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32

      \Drivers\BTHUSB.sys
      16:08:27.0287 5284   BTHUSB - ok
      16:08:27.0316 5284   btwaudio        (fc23e3a7ae18b02dcc1a34cbef3f80af) C:\Windows\system32

      \drivers\btwaudio.sys
      16:08:27.0317 5284   btwaudio - ok
      16:08:27.0367 5284   btwavdt         (5e14c92763e51130bfb9a670afd7eddf) C:\Windows\system32

      \drivers\btwavdt.sys
      16:08:27.0368 5284   btwavdt - ok
      16:08:27.0394 5284   btwrchid        (ac3fd5a3bbfa114098f75b80c4c1f3e7) C:\Windows\system32

      \DRIVERS\btwrchid.sys
      16:08:27.0395 5284   btwrchid - ok
      16:08:27.0447 5284   cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32

      \DRIVERS\cdfs.sys
      16:08:27.0448 5284   cdfs - ok
      16:08:27.0503 5284   cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32

      \DRIVERS\cdrom.sys
      16:08:27.0503 5284   cdrom - ok
      16:08:27.0523 5284   circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32

      \drivers\circlass.sys
      16:08:27.0523 5284   circlass - ok
      16:08:27.0583 5284   CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32

      \CLFS.sys
      16:08:27.0585 5284   CLFS - ok
      16:08:27.0615 5284   cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32

      \drivers\cmdide.sys
      16:08:27.0616 5284   cmdide - ok
      16:08:27.0651 5284   Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32

      \drivers\compbatt.sys
      16:08:27.0652 5284   Compbatt - ok
      16:08:27.0662 5284   crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32

      \drivers\crcdisk.sys
      16:08:27.0663 5284   crcdisk - ok
      16:08:27.0685 5284   Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32

      \drivers\crusoe.sys
      16:08:27.0686 5284   Crusoe - ok
      16:08:27.0769 5284   CSC             (9bdb2e89be8d0ef37b1f25c3d3fc192c) C:\Windows\system32

      \drivers\csc.sys
      16:08:27.0771 5284   CSC - ok
      16:08:27.0830 5284   cvintdrv        (dbd89bc0dbe00dcd245be8f61dbee291) C:\Windows\system32

      \drivers\cvintdrv.sys
      16:08:27.0830 5284   cvintdrv - ok
      16:08:27.0896 5284   DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32

      \Drivers\dfsc.sys
      16:08:27.0897 5284   DfsC - ok
      16:08:27.0946 5284   disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32

      \drivers\disk.sys
      16:08:27.0947 5284   disk - ok
      16:08:27.0997 5284   drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32

      \drivers\drmkaud.sys
      16:08:27.0997 5284   drmkaud - ok
      16:08:28.0062 5284   DXGKrnl         (fb85f7f69e9b109820409243f578cc4d) C:\Windows\System32

      \drivers\dxgkrnl.sys
      16:08:28.0066 5284   DXGKrnl - ok
      16:08:28.0090 5284   e1express       (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32

      \DRIVERS\e1e6032.sys
      16:08:28.0092 5284   e1express - ok
      16:08:28.0107 5284   E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32

      \DRIVERS\E1G60I32.sys
      16:08:28.0108 5284   E1G60 - ok
      16:08:28.0166 5284   Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32

      \drivers\ecache.sys
      16:08:28.0167 5284   Ecache - ok
      16:08:28.0192 5284   elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32

      \drivers\elxstor.sys
      16:08:28.0194 5284   elxstor - ok
      16:08:28.0213 5284   ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32

      \drivers\errdev.sys
      16:08:28.0213 5284   ErrDev - ok
      16:08:28.0265 5284   exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32

      \drivers\exfat.sys
      16:08:28.0266 5284   exfat - ok
      16:08:28.0318 5284   fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32

      \drivers\fastfat.sys
      16:08:28.0319 5284   fastfat - ok
      16:08:28.0330 5284   fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32

      \DRIVERS\fdc.sys
      16:08:28.0330 5284   fdc - ok
      16:08:28.0354 5284   FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32

      \drivers\fileinfo.sys
      16:08:28.0355 5284   FileInfo - ok
      16:08:28.0373 5284   Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32

      \drivers\filetrace.sys
      16:08:28.0373 5284   Filetrace - ok
      16:08:28.0389 5284   flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32

      \DRIVERS\flpydisk.sys
      16:08:28.0390 5284   flpydisk - ok
      16:08:28.0403 5284   FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32

      \drivers\fltmgr.sys
      16:08:28.0404 5284   FltMgr - ok
      16:08:28.0416 5284   Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32

      \drivers\Fs_Rec.sys
      16:08:28.0417 5284   Fs_Rec - ok
      16:08:28.0436 5284   gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32

      \drivers\gagp30kx.sys
      16:08:28.0437 5284   gagp30kx - ok
      16:08:28.0469 5284   GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32

      \DRIVERS\GEARAspiWDM.sys
      16:08:28.0469 5284   GEARAspiWDM - ok
      16:08:28.0536 5284   GPU-Z - ok
      16:08:28.0639 5284   HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32

      \drivers\HdAudio.sys
      16:08:28.0640 5284   HdAudAddService - ok
      16:08:28.0725 5284   HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32

      \DRIVERS\HDAudBus.sys
      16:08:28.0728 5284   HDAudBus - ok
      16:08:28.0740 5284   HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32

      \drivers\hidbth.sys
      16:08:28.0741 5284   HidBth - ok
      16:08:28.0756 5284   HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32

      \drivers\hidir.sys
      16:08:28.0756 5284   HidIr - ok
      16:08:28.0809 5284   HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32

      \DRIVERS\hidusb.sys
      16:08:28.0809 5284   HidUsb - ok
      16:08:28.0828 5284   HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32

      \drivers\hpcisss.sys
      16:08:28.0829 5284   HpCISSs - ok
      16:08:28.0879 5284   HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32

      \drivers\HTTP.sys
      16:08:28.0882 5284   HTTP - ok
      16:08:28.0904 5284   i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32

      \drivers\i2omp.sys
      16:08:28.0904 5284   i2omp - ok
      16:08:28.0923 5284   i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32

      \DRIVERS\i8042prt.sys
      16:08:28.0924 5284   i8042prt - ok
      16:08:28.0952 5284   iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32

      \drivers\iastorv.sys
      16:08:28.0953 5284   iaStorV - ok
      16:08:28.0973 5284   iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32

      \drivers\iirsp.sys
      16:08:28.0974 5284   iirsp - ok
      16:08:28.0991 5284   IntcAzAudAddService - ok
      16:08:29.0009 5284   intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32

      \drivers\intelide.sys
      16:08:29.0010 5284   intelide - ok
      16:08:29.0029 5284   intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32

      \DRIVERS\intelppm.sys
      16:08:29.0029 5284   intelppm - ok
      16:08:29.0070 5284   IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32

      \DRIVERS\ipfltdrv.sys
      16:08:29.0071 5284   IpFilterDriver - ok
      16:08:29.0081 5284   IpInIp - ok
      16:08:29.0100 5284   IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32

      \drivers\ipmidrv.sys
      16:08:29.0101 5284   IPMIDRV - ok
      16:08:29.0113 5284   IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32

      \DRIVERS\ipnat.sys
      16:08:29.0114 5284   IPNAT - ok
      16:08:29.0127 5284   IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32

      \drivers\irenum.sys
      16:08:29.0127 5284   IRENUM - ok
      16:08:29.0142 5284   isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32

      \drivers\isapnp.sys
      16:08:29.0142 5284   isapnp - ok
      16:08:29.0202 5284   iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32

      \DRIVERS\msiscsi.sys
      16:08:29.0204 5284   iScsiPrt - ok
      16:08:29.0212 5284   iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32

      \drivers\iteatapi.sys
      16:08:29.0213 5284   iteatapi - ok
      16:08:29.0232 5284   iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32

      \drivers\iteraid.sys
      16:08:29.0232 5284   iteraid - ok
      16:08:29.0251 5284   kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32

      \DRIVERS\kbdclass.sys
      16:08:29.0251 5284   kbdclass - ok
      16:08:29.0310 5284   kbdhid          (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32

      \DRIVERS\kbdhid.sys
      16:08:29.0310 5284   kbdhid - ok
      16:08:29.0349 5284   KeyScrambler    (c719c729ce65aad98d550458220b6d15) C:\Windows\system32

      \drivers\keyscrambler.sys
      16:08:29.0350 5284   KeyScrambler - ok
      16:08:29.0398 5284   KSecDD          (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32

      \Drivers\ksecdd.sys
      16:08:29.0400 5284   KSecDD - ok
      16:08:29.0478 5284   Lbd             (336abe8721cbc3110f1c6426da633417) C:\Windows\system32

      \DRIVERS\Lbd.sys
      16:08:29.0479 5284   Lbd - ok
      16:08:29.0511 5284   lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32

      \DRIVERS\lltdio.sys
      16:08:29.0511 5284   lltdio - ok
      16:08:29.0530 5284   LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32

      \drivers\lsi_fc.sys
      16:08:29.0531 5284   LSI_FC - ok
      16:08:29.0539 5284   LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32

      \drivers\lsi_sas.sys
      16:08:29.0540 5284   LSI_SAS - ok
      16:08:29.0561 5284   LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32

      \drivers\lsi_scsi.sys
      16:08:29.0562 5284   LSI_SCSI - ok
      16:08:29.0581 5284   luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32

      \drivers\luafv.sys
      16:08:29.0582 5284   luafv - ok
      16:08:29.0612 5284   MBAMProtector   (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32

      \drivers\mbam.sys
      16:08:29.0612 5284   MBAMProtector - ok
      16:08:29.0642 5284   megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32

      \drivers\megasas.sys
      16:08:29.0643 5284   megasas - ok
      16:08:29.0667 5284   MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32

      \drivers\megasr.sys
      16:08:29.0669 5284   MegaSR - ok
      16:08:29.0694 5284   Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32

      \drivers\modem.sys
      16:08:29.0695 5284   Modem - ok
      16:08:29.0731 5284   monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32

      \DRIVERS\monitor.sys
      16:08:29.0732 5284   monitor - ok
      16:08:29.0750 5284   mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32

      \DRIVERS\mouclass.sys
      16:08:29.0751 5284   mouclass - ok
      16:08:29.0765 5284   mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32

      \DRIVERS\mouhid.sys
      16:08:29.0766 5284   mouhid - ok
      16:08:29.0775 5284   MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32

      \drivers\mountmgr.sys
      16:08:29.0776 5284   MountMgr - ok
      16:08:29.0792 5284   mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32

      \drivers\mpio.sys
      16:08:29.0793 5284   mpio - ok
      16:08:29.0804 5284   mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32

      \drivers\mpsdrv.sys
      16:08:29.0805 5284   mpsdrv - ok
      16:08:29.0822 5284   Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32

      \drivers\mraid35x.sys
      16:08:29.0823 5284   Mraid35x - ok
      16:08:29.0873 5284   MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32

      \drivers\mrxdav.sys
      16:08:29.0873 5284   MRxDAV - ok
      16:08:29.0928 5284   mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32

      \DRIVERS\mrxsmb.sys
      16:08:29.0929 5284   mrxsmb - ok
      16:08:29.0977 5284   mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32

      \DRIVERS\mrxsmb10.sys
      16:08:29.0979 5284   mrxsmb10 - ok
      16:08:30.0024 5284   mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32

      \DRIVERS\mrxsmb20.sys
      16:08:30.0025 5284   mrxsmb20 - ok
      16:08:30.0050 5284   msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32

      \drivers\msahci.sys
      16:08:30.0050 5284   msahci - ok
      16:08:30.0072 5284   msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32

      \drivers\msdsm.sys
      16:08:30.0072 5284   msdsm - ok
      16:08:30.0094 5284   Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32

      \drivers\Msfs.sys
      16:08:30.0095 5284   Msfs - ok
      16:08:30.0118 5284   msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32

      \drivers\msisadrv.sys
      16:08:30.0119 5284   msisadrv - ok
      16:08:30.0184 5284   MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32

      \drivers\MSKSSRV.sys
      16:08:30.0184 5284   MSKSSRV - ok
      16:08:30.0204 5284   MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32

      \drivers\MSPCLOCK.sys
      16:08:30.0205 5284   MSPCLOCK - ok
      16:08:30.0213 5284   MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32

      \drivers\MSPQM.sys
      16:08:30.0214 5284   MSPQM - ok
      16:08:30.0271 5284   MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32

      \drivers\MsRPC.sys
      16:08:30.0272 5284   MsRPC - ok
      16:08:30.0282 5284   mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32

      \DRIVERS\mssmbios.sys
      16:08:30.0284 5284   mssmbios - ok
      16:08:30.0301 5284   MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32

      \drivers\MSTEE.sys
      16:08:30.0301 5284   MSTEE - ok
      16:08:30.0310 5284   Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32

      \Drivers\mup.sys
      16:08:30.0311 5284   Mup - ok
      16:08:30.0374 5284   NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32

      \DRIVERS\nwifi.sys
      16:08:30.0375 5284   NativeWifiP - ok
      16:08:30.0403 5284   NCHSSVAD        (0df9cc7b5cc173f545723f23e68fac93) C:\Windows\system32

      \drivers\nchssvad.sys
      16:08:30.0403 5284   NCHSSVAD - ok
      16:08:30.0452 5284   NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32

      \drivers\ndis.sys
      16:08:30.0455 5284   NDIS - ok
      16:08:30.0469 5284   NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32

      \DRIVERS\ndistapi.sys
      16:08:30.0470 5284   NdisTapi - ok
      16:08:30.0482 5284   Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32

      \DRIVERS\ndisuio.sys
      16:08:30.0482 5284   Ndisuio - ok
      16:08:30.0537 5284   NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32

      \DRIVERS\ndiswan.sys
      16:08:30.0538 5284   NdisWan - ok
      16:08:30.0553 5284   NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32

      \drivers\NDProxy.sys
      16:08:30.0554 5284   NDProxy - ok
      16:08:30.0570 5284   NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32

      \DRIVERS\netbios.sys
      16:08:30.0570 5284   NetBIOS - ok
      16:08:30.0619 5284   netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32

      \DRIVERS\netbt.sys
      16:08:30.0621 5284   netbt - ok
      16:08:30.0646 5284   nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32

      \drivers\nfrd960.sys
      16:08:30.0646 5284   nfrd960 - ok
      16:08:30.0686 5284   Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32

      \drivers\Npfs.sys
      16:08:30.0687 5284   Npfs - ok
      16:08:30.0725 5284   nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32

      \drivers\nsiproxy.sys
      16:08:30.0726 5284   nsiproxy - ok
      16:08:30.0797 5284   Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32

      \drivers\Ntfs.sys
      16:08:30.0804 5284   Ntfs - ok
      16:08:30.0821 5284   ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32

      \drivers\ntrigdigi.sys
      16:08:30.0821 5284   ntrigdigi - ok
      16:08:30.0840 5284   Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32

      \drivers\Null.sys
      16:08:30.0841 5284   Null - ok
      16:08:30.0914 5284   NVENETFD        (d958a2b5f6ad5c3b8ccdc4d7da62466c) C:\Windows\system32

      \DRIVERS\nvmfdx32.sys
      16:08:30.0921 5284   NVENETFD - ok
      16:08:30.0955 5284   NVR0Dev         (812f257ed1cd53fcb1f9f9cc910f4809)

      C:\Windows\nvoclock.sys
      16:08:30.0956 5284   NVR0Dev - ok
      16:08:30.0972 5284   nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32

      \drivers\nvraid.sys
      16:08:30.0973 5284   nvraid - ok
      16:08:30.0994 5284   nvrd32          (049e81b6fb41c73619ed3fe4df7d8638) C:\Windows\system32

      \drivers\nvrd32.sys
      16:08:30.0995 5284   nvrd32 - ok
      16:08:31.0014 5284   nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32

      \drivers\nvstor.sys
      16:08:31.0015 5284   nvstor - ok
      16:08:31.0024 5284   nvstor32        (7eba6c9a0a295b1559efb9062e701218) C:\Windows\system32

      \drivers\nvstor32.sys
      16:08:31.0026 5284   nvstor32 - ok
      16:08:31.0053 5284   nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32

      \drivers\nv_agp.sys
      16:08:31.0054 5284   nv_agp - ok
      16:08:31.0062 5284   NwlnkFlt - ok
      16:08:31.0071 5284   NwlnkFwd - ok
      16:08:31.0143 5284   OEM03Afx        (58f478fd0115012ceec75fb73628901c) C:\Windows\system32

      \Drivers\OEM03Afx.sys
      16:08:31.0144 5284   OEM03Afx - ok
      16:08:31.0163 5284   OEM03Vfx        (86326062a90494bdd79ce383511d7d69) C:\Windows\system32

      \DRIVERS\OEM03Vfx.sys
      16:08:31.0163 5284   OEM03Vfx - ok
      16:08:31.0191 5284   OEM03Vid        (d9ed95c6752cc59368e35927f7fc39f0) C:\Windows\system32

      \DRIVERS\OEM03Vid.sys
      16:08:31.0192 5284   OEM03Vid - ok
      16:08:31.0248 5284   ohci1394        (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32

      \DRIVERS\ohci1394.sys
      16:08:31.0249 5284   ohci1394 - ok
      16:08:31.0278 5284   Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32

      \drivers\parport.sys
      16:08:31.0279 5284   Parport - ok
      16:08:31.0318 5284   partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32

      \drivers\partmgr.sys
      16:08:31.0320 5284   partmgr - ok
      16:08:31.0368 5284   Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32

      \drivers\parvdm.sys
      16:08:31.0368 5284   Parvdm - ok
      16:08:31.0425 5284   pavboot         (3adb8bd6154a3ef87496e8fce9c22493) C:\Windows\system32

      \drivers\pavboot.sys
      16:08:31.0426 5284   pavboot - ok
      16:08:31.0460 5284   pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32

      \drivers\pci.sys
      16:08:31.0461 5284   pci - ok
      16:08:31.0505 5284   pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32

      \drivers\pciide.sys
      16:08:31.0506 5284   pciide - ok
      16:08:31.0533 5284   pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32

      \drivers\pcmcia.sys
      16:08:31.0534 5284   pcmcia - ok
      16:08:31.0594 5284   PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32

      \drivers\peauth.sys
      16:08:31.0599 5284   PEAUTH - ok
      16:08:31.0666 5284   PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32

      \DRIVERS\raspptp.sys
      16:08:31.0667 5284   PptpMiniport - ok
      16:08:31.0694 5284   Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32

      \drivers\processr.sys
      16:08:31.0695 5284   Processor - ok
      16:08:31.0747 5284   PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32

      \DRIVERS\pacer.sys
      16:08:31.0748 5284   PSched - ok
      16:08:31.0766 5284   PxHelp20        (03e0fe281823ba64b3782f5b38950e73) C:\Windows\system32

      \Drivers\PxHelp20.sys
      16:08:31.0767 5284   PxHelp20 - ok
      16:08:31.0810 5284   ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32

      \drivers\ql2300.sys
      16:08:31.0817 5284   ql2300 - ok
      16:08:31.0835 5284   ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32

      \drivers\ql40xx.sys
      16:08:31.0836 5284   ql40xx - ok
      16:08:31.0863 5284   QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32

      \drivers\qwavedrv.sys
      16:08:31.0864 5284   QWAVEdrv - ok
      16:08:32.0000 5284   R300            (d05cf4523e0c04ef82454abfd84fdc1d) C:\Windows\system32

      \DRIVERS\atikmdag.sys
      16:08:32.0042 5284   R300 - ok
      16:08:32.0063 5284   RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32

      \DRIVERS\rasacd.sys
      16:08:32.0064 5284   RasAcd - ok
      16:08:32.0092 5284   Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32

      \DRIVERS\rasl2tp.sys
      16:08:32.0093 5284   Rasl2tp - ok
      16:08:32.0153 5284   RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32

      \DRIVERS\raspppoe.sys
      16:08:32.0154 5284   RasPppoe - ok
      16:08:32.0199 5284   RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32

      \DRIVERS\rassstp.sys
      16:08:32.0200 5284   RasSstp - ok
      16:08:32.0249 5284   rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32

      \DRIVERS\rdbss.sys
      16:08:32.0250 5284   rdbss - ok
      16:08:32.0260 5284   RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32

      \DRIVERS\RDPCDD.sys
      16:08:32.0261 5284   RDPCDD - ok
      16:08:32.0320 5284   rdpdr           (943b18305eae3935598a9b4a3d560b4c) C:\Windows\system32

      \DRIVERS\rdpdr.sys
      16:08:32.0322 5284   rdpdr - ok
      16:08:32.0362 5284   RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32

      \drivers\rdpencdd.sys
      16:08:32.0363 5284   RDPENCDD - ok
      16:08:32.0384 5284   RDPWD           (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32

      \drivers\RDPWD.sys
      16:08:32.0385 5284   RDPWD - ok
      16:08:32.0438 5284   RFCOMM          (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32

      \DRIVERS\rfcomm.sys
      16:08:32.0439 5284   RFCOMM - ok
      16:08:32.0478 5284   RLDesignVirtualAudioCableWdm (f5cd7457fa2f0d1078992ccb77a546c4)

      C:\Windows\system32\DRIVERS\livecamv.sys
      16:08:32.0479 5284   RLDesignVirtualAudioCableWdm - ok
      16:08:32.0499 5284   rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32

      \DRIVERS\rspndr.sys
      16:08:32.0500 5284   rspndr - ok
      16:08:32.0563 5284   SASDIFSV        (39763504067962108505bff25f024345) C:\Program

      Files\SUPERAntiSpyware\SASDIFSV.SYS
      16:08:32.0563 5284   SASDIFSV - ok
      16:08:32.0575 5284   SASKUTIL        (77b9fc20084b48408ad3e87570eb4a85) C:\Program

      Files\SUPERAntiSpyware\SASKUTIL.SYS
      16:08:32.0575 5284   SASKUTIL - ok
      16:08:32.0599 5284   SAVOnAccess     (ae668d3f43fc90bc17f62e08ff82a446) C:\Windows\system32

      \DRIVERS\savonaccess.sys
      16:08:32.0601 5284   SAVOnAccess - ok
      16:08:32.0623 5284   sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32

      \drivers\sbp2port.sys
      16:08:32.0624 5284   sbp2port - ok
      16:08:32.0650 5284   secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32

      \drivers\secdrv.sys
      16:08:32.0651 5284   secdrv - ok
      16:08:32.0680 5284   Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32

      \drivers\serenum.sys
      16:08:32.0681 5284   Serenum - ok
      16:08:32.0700 5284   Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32

      \drivers\serial.sys
      16:08:32.0701 5284   Serial - ok
      16:08:32.0722 5284   sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32

      \drivers\sermouse.sys
      16:08:32.0723 5284   sermouse - ok
      16:08:32.0746 5284   sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32

      \drivers\sffdisk.sys
      16:08:32.0746 5284   sffdisk - ok
      16:08:32.0779 5284   sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32

      \drivers\sffp_mmc.sys
      16:08:32.0780 5284   sffp_mmc - ok
      16:08:32.0792 5284   sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32

      \drivers\sffp_sd.sys
      16:08:32.0793 5284   sffp_sd - ok
      16:08:32.0810 5284   sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32

      \drivers\sfloppy.sys
      16:08:32.0810 5284   sfloppy - ok
      16:08:32.0861 5284   silabenm        (4bd319bf5a4a273ae776afb9f1107d25) C:\Windows\system32

      \DRIVERS\silabenm.sys
      16:08:32.0862 5284   silabenm - ok
      16:08:32.0899 5284   silabser        (12c48d71cfd011d59fba28027341cc12) C:\Windows\system32

      \DRIVERS\silabser.sys
      16:08:32.0900 5284   silabser - ok
      16:08:32.0925 5284   sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32

      \drivers\sisagp.sys
      16:08:32.0926 5284   sisagp - ok
      16:08:32.0940 5284   SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32

      \drivers\sisraid2.sys
      16:08:32.0941 5284   SiSRaid2 - ok
      16:08:32.0976 5284   SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32

      \drivers\sisraid4.sys
      16:08:32.0977 5284   SiSRaid4 - ok
      16:08:32.0998 5284   slabbus - ok
      16:08:33.0008 5284   slabser - ok
      16:08:33.0072 5284   Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32

      \DRIVERS\smb.sys
      16:08:33.0072 5284   Smb - ok
      16:08:33.0097 5284   SophosBootDriver (f2b7bd04146b3e6a895a1919e1f5da89) C:\Windows\system32

      \DRIVERS\SophosBootDriver.sys
      16:08:33.0098 5284   SophosBootDriver - ok
      16:08:33.0112 5284   spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32

      \drivers\spldr.sys
      16:08:33.0113 5284   spldr - ok
      16:08:33.0180 5284   srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32

      \DRIVERS\srv.sys
      16:08:33.0182 5284   srv - ok
      16:08:33.0229 5284   srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32

      \DRIVERS\srv2.sys
      16:08:33.0230 5284   srv2 - ok
      16:08:33.0284 5284   srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32

      \DRIVERS\srvnet.sys
      16:08:33.0285 5284   srvnet - ok
      16:08:33.0359 5284   swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32

      \DRIVERS\swenum.sys
      16:08:33.0360 5284   swenum - ok
      16:08:33.0389 5284   Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32

      \drivers\symc8xx.sys
      16:08:33.0389 5284   Symc8xx - ok
      16:08:33.0419 5284   Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32

      \drivers\sym_hi.sys
      16:08:33.0419 5284   Sym_hi - ok
      16:08:33.0450 5284   Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32

      \drivers\sym_u3.sys
      16:08:33.0451 5284   Sym_u3 - ok
      16:08:33.0525 5284   Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32

      \drivers\tcpip.sys
      16:08:33.0532 5284   Tcpip - ok
      16:08:33.0558 5284   Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32

      \DRIVERS\tcpip.sys
      16:08:33.0564 5284   Tcpip6 - ok
      16:08:33.0621 5284   tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32

      \drivers\tcpipreg.sys
      16:08:33.0622 5284   tcpipreg - ok
      16:08:33.0651 5284   TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32

      \drivers\tdpipe.sys
      16:08:33.0651 5284   TDPIPE - ok
      16:08:33.0675 5284   TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32

      \drivers\tdtcp.sys
      16:08:33.0675 5284   TDTCP - ok
      16:08:33.0727 5284   tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32

      \DRIVERS\tdx.sys
      16:08:33.0727 5284   tdx - ok
      16:08:33.0779 5284   TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32

      \DRIVERS\termdd.sys
      16:08:33.0780 5284   TermDD - ok
      16:08:33.0809 5284   tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32

      \DRIVERS\tssecsrv.sys
      16:08:33.0809 5284   tssecsrv - ok
      16:08:33.0838 5284   tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32

      \DRIVERS\tunmp.sys
      16:08:33.0838 5284   tunmp - ok
      16:08:33.0885 5284   tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32

      \DRIVERS\tunnel.sys
      16:08:33.0886 5284   tunnel - ok
      16:08:33.0940 5284   uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32

      \drivers\uagp35.sys
      16:08:33.0940 5284   uagp35 - ok
      16:08:33.0993 5284   udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32

      \DRIVERS\udfs.sys
      16:08:33.0995 5284   udfs - ok
      16:08:34.0028 5284   uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32

      \drivers\uliagpkx.sys
      16:08:34.0029 5284   uliagpkx - ok
      16:08:34.0049 5284   uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32

      \drivers\uliahci.sys
      16:08:34.0050 5284   uliahci - ok
      16:08:34.0068 5284   UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32

      \drivers\ulsata.sys
      16:08:34.0069 5284   UlSata - ok
      16:08:34.0090 5284   ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32

      \drivers\ulsata2.sys
      16:08:34.0091 5284   ulsata2 - ok
      16:08:34.0128 5284   umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32

      \DRIVERS\umbus.sys
      16:08:34.0128 5284   umbus - ok
      16:08:34.0176 5284   usbaudio        (32db9517628ff0d070682aab61e688f0) C:\Windows\system32

      \drivers\usbaudio.sys
      16:08:34.0177 5284   usbaudio - ok
      16:08:34.0190 5284   usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32

      \DRIVERS\usbccgp.sys
      16:08:34.0191 5284   usbccgp - ok
      16:08:34.0217 5284   usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32

      \drivers\usbcir.sys
      16:08:34.0218 5284   usbcir - ok
      16:08:34.0260 5284   usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32

      \DRIVERS\usbehci.sys
      16:08:34.0261 5284   usbehci - ok
      16:08:34.0317 5284   usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32

      \DRIVERS\usbhub.sys
      16:08:34.0319 5284   usbhub - ok
      16:08:34.0367 5284   usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32

      \DRIVERS\usbohci.sys
      16:08:34.0367 5284   usbohci - ok
      16:08:34.0393 5284   usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32

      \drivers\usbprint.sys
      16:08:34.0394 5284   usbprint - ok
      16:08:34.0440 5284   USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32

      \DRIVERS\USBSTOR.SYS
      16:08:34.0441 5284   USBSTOR - ok
      16:08:34.0472 5284   usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32

      \DRIVERS\usbuhci.sys
      16:08:34.0472 5284   usbuhci - ok
      16:08:34.0516 5284   vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32

      \DRIVERS\vgapnp.sys
      16:08:34.0516 5284   vga - ok
      16:08:34.0570 5284   VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32

      \drivers\vga.sys
      16:08:34.0571 5284   VgaSave - ok
      16:08:34.0596 5284   viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32

      \drivers\viaagp.sys
      16:08:34.0597 5284   viaagp - ok
      16:08:34.0613 5284   ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32

      \drivers\viac7.sys
      16:08:34.0613 5284   ViaC7 - ok
      16:08:34.0646 5284   viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32

      \drivers\viaide.sys
      16:08:34.0647 5284   viaide - ok
      16:08:34.0662 5284   volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32

      \drivers\volmgr.sys
      16:08:34.0663 5284   volmgr - ok
      16:08:34.0720 5284   volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32

      \drivers\volmgrx.sys
      16:08:34.0722 5284   volmgrx - ok
      16:08:34.0738 5284   volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32

      \drivers\volsnap.sys
      16:08:34.0740 5284   volsnap - ok
      16:08:34.0777 5284   vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32

      \drivers\vsmraid.sys
      16:08:34.0778 5284   vsmraid - ok
      16:08:34.0820 5284   WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32

      \drivers\wacompen.sys
      16:08:34.0821 5284   WacomPen - ok
      16:08:34.0841 5284   Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32

      \DRIVERS\wanarp.sys
      16:08:34.0842 5284   Wanarp - ok
      16:08:34.0846 5284   Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32

      \DRIVERS\wanarp.sys
      16:08:34.0846 5284   Wanarpv6 - ok
      16:08:34.0870 5284   Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32

      \drivers\wd.sys
      16:08:34.0871 5284   Wd - ok
      16:08:34.0933 5284   Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32

      \drivers\Wdf01000.sys
      16:08:34.0936 5284   Wdf01000 - ok
      16:08:35.0022 5284   WinDriver6      (032793a8e6288c4c60ff30542eeab22b) C:\Windows\system32

      \drivers\windrvr6.sys
      16:08:35.0023 5284   WinDriver6 - ok
      16:08:35.0074 5284   WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32

      \drivers\wmiacpi.sys
      16:08:35.0074 5284   WmiAcpi - ok
      16:08:35.0119 5284   ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32

      \drivers\ws2ifsl.sys
      16:08:35.0120 5284   ws2ifsl - ok
      16:08:35.0179 5284   WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32

      \DRIVERS\WUDFRd.sys
      16:08:35.0180 5284   WUDFRd - ok
      16:08:35.0209 5284   MBR (0x1B8)     (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
      16:08:35.0223 5284   \Device\Harddisk0\DR0 - ok
      16:08:35.0239 5284   Boot (0x1200)   (6471343f45a43e904a7680a2f46c6b8a) \Device\Harddisk0

      \DR0\Partition0
      16:08:35.0240 5284   \Device\Harddisk0\DR0\Partition0 - ok
      16:08:35.0242 5284   Boot (0x1200)   (2176195d243f99a8f6fe2071ab15f89a) \Device\Harddisk0

      \DR0\Partition1
      16:08:35.0243 5284   \Device\Harddisk0\DR0\Partition1 - ok
      16:08:35.0244 5284   ============================================================
      16:08:35.0244 5284   Scan finished
      16:08:35.0244 5284   ============================================================
      16:08:35.0254 5872   Detected object count: 0
      16:08:35.0254 5872   Actual detected object count: 0
      « Last Edit: November 15, 2011, 03:14:25 PM by bandgap »

      Offline Hoov

      • Malware Removal Mentors
      • Global Moderator
      • Diamond Member
      • Posts: 22632
      • Unwilling part owner of Gov't. Motors and Chrysler
        • Hoov's Personal Site
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #3 on: November 15, 2011, 03:19:41 PM »
      Please turn off wordwrap in Notepad. It makes reading the logs easier, and the forum software will wrap the text if needed.

      Open a command prompt (all programs > Accessories > Command Prompt) and type in
      Ipconfig /all > ipconfig.txt and then hit enter. Then type in ipconfig.txt to open notepad with the log. Copy it and paste it in to your next response.


      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

      Offline bandgap

      • Bronze Member
      • Posts: 6
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #4 on: November 15, 2011, 04:28:38 PM »

      Windows IP Configuration

         Host Name . . . . . . . . . . . . : AVATAR
         Primary Dns Suffix  . . . . . . . :
         Node Type . . . . . . . . . . . . : Unknown
         IP Routing Enabled. . . . . . . . : No
         WINS Proxy Enabled. . . . . . . . : No
         DNS Suffix Search List. . . . . . : sainc.com

      Ethernet adapter Bluetooth Network Connection:

         Media State . . . . . . . . . . . : Media disconnected
         Connection-specific DNS Suffix  . :
         Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
         Physical Address. . . . . . . . . : 00-1E-4C-CC-97-C6
         DHCP Enabled. . . . . . . . . . . : Yes
         Autoconfiguration Enabled . . . . : Yes

      Ethernet adapter Local Area Connection:

         Connection-specific DNS Suffix  . : sainc.com
         Description . . . . . . . . . . . : NVIDIA nForce 10/100/1000 Mbps Ethernet
         Physical Address. . . . . . . . . : 00-1E-C9-54-DF-37
         DHCP Enabled. . . . . . . . . . . : Yes
         Autoconfiguration Enabled . . . . : Yes
         Link-local IPv6 Address . . . . . : fe80::f156:2820:3366:93b3%10(Preferred)
         IPv4 Address. . . . . . . . . . . : 172.18.6.107(Preferred)
         Subnet Mask . . . . . . . . . . . : 255.255.254.0
         Lease Obtained. . . . . . . . . . : Tuesday, November 15, 2011 11:30:36 AM
         Lease Expires . . . . . . . . . . : Wednesday, November 23, 2011 11:30:36 AM
         Default Gateway . . . . . . . . . : 172.18.6.1
         DHCP Server . . . . . . . . . . . : 172.18.0.7
         DHCPv6 IAID . . . . . . . . . . . : 251666121
         DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-10-34-5B-31-00-1E-C9-54-DF-37
         DNS Servers . . . . . . . . . . . : 172.18.0.2
                                             172.18.0.3
         NetBIOS over Tcpip. . . . . . . . : Enabled

      Tunnel adapter Local Area Connection* 7:

         Media State . . . . . . . . . . . : Media disconnected
         Connection-specific DNS Suffix  . : sainc.com
         Description . . . . . . . . . . . : isatap.sainc.com
         Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
         DHCP Enabled. . . . . . . . . . . : No
         Autoconfiguration Enabled . . . . : Yes

      Tunnel adapter Local Area Connection* 11:

         Media State . . . . . . . . . . . : Media disconnected
         Connection-specific DNS Suffix  . :
         Description . . . . . . . . . . . : isatap.{73D8AAB2-9D63-4E72-B901-7172CF3BB316}
         Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
         DHCP Enabled. . . . . . . . . . . : No
         Autoconfiguration Enabled . . . . : Yes

      Offline Hoov

      • Malware Removal Mentors
      • Global Moderator
      • Diamond Member
      • Posts: 22632
      • Unwilling part owner of Gov't. Motors and Chrysler
        • Hoov's Personal Site
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #5 on: November 15, 2011, 04:41:15 PM »
      Is this your personal computer? it seems to be connected to a corporate environment. Can you get into the router and tell me what the DNS servers are set to?

      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

      Offline bandgap

      • Bronze Member
      • Posts: 6
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #6 on: November 16, 2011, 01:32:28 PM »
      I believe I fixed it.

      I checked the sites I was being redirected to, and saw that a common one was night-no.com. Googling it, I found the following:

      http://community.spiceworks.com/topic/168768-http-night-no-com-redirection

      I ran Avast6 Free Edition and it found Threat: Win32:Malware-gen in C:\Users\R_C\Appdata\Roaming\iccvid0.dll.

      The Hijackthis log had flagged this as:

      O4 - HKCU\..\Run: [Jnmgqirae] rundll32 "C:\Users\R_C\AppData\Roaming\iccvid0.dll",slaqwubtp

      Offline bandgap

      • Bronze Member
      • Posts: 6
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #7 on: November 16, 2011, 03:12:13 PM »
      Hopefully, I was not premature in declaring victory. Avast recommended a boot scan following the full scan which found the Win32: Malware-gen threat. So far, 8 Java files infected with Java: Agent (-XO, -XQ, -XR, or -XS) have been detected. The infected files include Pipe.class and Socket.class (two instances each), Pointer.class, and SmartyPointer.class. I think I missed writing down two of the file names.

      Also, on bootup, Vista complains that it can't find iccvid0.dll any more. I re-ran ccleaner to fix that problem in the registry.
      « Last Edit: November 16, 2011, 03:16:40 PM by bandgap »

      Offline Hoov

      • Malware Removal Mentors
      • Global Moderator
      • Diamond Member
      • Posts: 22632
      • Unwilling part owner of Gov't. Motors and Chrysler
        • Hoov's Personal Site
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #8 on: November 16, 2011, 03:47:30 PM »
      Have you installed and Codecs? When I did my initial research I had that file pegged as a Cinepac Codec?

      Can you give me the logs that were generated and answer the questions I had in my previous post? Also I know you want to get your computer fixed faster, but if you start doing scans and removing files on your own, it makes it harder for me to help you.

      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

      Offline bandgap

      • Bronze Member
      • Posts: 6
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #9 on: November 16, 2011, 04:08:27 PM »
      I can't recall if I installed any codecs.

      When I googled iccvid0.dll, the hits I got said that iccvid.dll was a cinepak codec, not iccvid0.dll, which is what I have.

      I have no idea what the DNS servers are set to and unfortunately don't have access to the router.

      Which logs do you need? From Avast? Not sure where Avast stores logs. From ccleaner fixing the registry? Does ccleaner generate a log?

      Offline Hoov

      • Malware Removal Mentors
      • Global Moderator
      • Diamond Member
      • Posts: 22632
      • Unwilling part owner of Gov't. Motors and Chrysler
        • Hoov's Personal Site
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #10 on: November 16, 2011, 04:44:35 PM »
      Avast store its logs in C:/ProgramData/Alwil%20Software/Avast5/log/ from what I can find. And about that file, you are correct, I looked right over that.

      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!

      Offline Hoov

      • Malware Removal Mentors
      • Global Moderator
      • Diamond Member
      • Posts: 22632
      • Unwilling part owner of Gov't. Motors and Chrysler
        • Hoov's Personal Site
      Re: [In Progress] IE8 Google, Yahoo, Bing searches being redirected
      « Reply #11 on: November 27, 2011, 09:19:10 PM »
      This thread is being closed due to inactivity. If you need it reopened send me a PM. This applies to the originator only. Anyone else please start a new thread.


      Consumer Security

      If I am helping you and you don't hear from me for 24Hrs, send me a PM Please!