Malware and Redirects

Question

This computer was once assigned to someone else and I need to make sure this laptop is clean. I have experienced programs operating poorly and have had redirects. My HighJackThis log is: Logfile of Trend Micro HijackThis v2.0.4Scan saved at 7:54:50 PM, on 1/25/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.17093)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\program files\idt\dellxpm09b_6017v022\wdm\stacsv.exeC:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exeC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\Program Files\DesktopAuthority\DaMaint.exeC:\Program Files\DesktopAuthority\DesktopAuthority.exeC:\WINDOWS\SYSTEM32\DWRCS.EXEC:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exeC:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPSvc.exeC:\Program Files\Nero\Nero8\InCD\InCDsrv.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\McAfee\Audit Manager\AuditManagerService.exeC:\Program Files\McAfee\DLP\Agent\fcags.exeC:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exeC:\Program Files\McAfee\Common Framework\FrameworkService.exeC:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exeC:\WINDOWS\system32\mfevtps.exeC:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\System32\svchost.exec:\WINDOWS\system32\Prot_srv.exec:\WINDOWS\system32\pstartSr.exeC:\WINDOWS\system32\sessmgr.exeC:\WINDOWS\ProPatches\Scheduler\STSchedEx.exeC:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exeC:\WINDOWS\system32\SearchIndexer.exeC:\Program Files\McAfee\DLP\Agent\fcagswd.exeC:\WINDOWS\system32\CCM\CcmExec.exeC:\Program Files\McAfee\RSD Sensor\RSSensor.exeC:\Program Files\McAfee\DLP\Agent\fcag.exeC:\WINDOWS\SYSTEM32\DWRCST.exeC:\Program Files\McAfee\DLP\Agent\FCAGTE.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\RunDLL32.exeC:\WINDOWS\system32\AESTFltr.exeC:\Program Files\IDT\WDM\sttray.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exeC:\Program Files\Nero\Nero8\InCD\NBHGui.exeC:\Program Files\Nero\Nero8\InCD\InCD.exeC:\Program Files\DesktopAuthoritymgui.exeC:\Program Files\Pointsec\Pointsec for PC\P95Tray.exeC:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exeC:\Program Files\ActivIdentity\ActivClient\acevents.exeC:\Program Files\ActivIdentity\ActivClient\accrdsub.exeC:\Program Files\McAfee\Common Framework\udaterui.exeC:\Program Files\McAfee\Policy Auditor Agent\PASysTray.exeC:\Program Files\McAfee\Common Framework\McTray.exeC:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exeC:\Program Files\ActivIdentity\ActivClient\acsagent.exeC:\Program Files\D-Link\AirPlus G Wireless Adapter Utility\AirPlus.exeC:\Program Files\Windows Desktop Search\WindowsSearch.exeC:\Program Files\Common Files\Nero\Lib\NMIndexingService.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Program Files\Microsoft Office\Office12\ONENOTEM.EXEC:\WINDOWS\system32\CCM\SMSCliUI.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\McAfee\Common Framework\McScript_InUse.exeC:\Documents and Settings\MartinTE\Local Settings\Temporary Internet Files\Content.IE5\4HA4JGZ2\HijackThis[1].exeC:\Program Files\Safari\Safari.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet/Pages/default.aspxR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet/Pages/default.aspxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet/Pages/default.aspxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://intranet/Pages/default.aspxO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dllO2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,StartO4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlgO4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre6\bin\jusched.exe'O4 - HKLM\..\Run: [GrooveMonitor] 'C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe'O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] 'C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe'O4 - HKLM\..\Run: [Acrobat Assistant 8.0] 'C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe'O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.5\masqform.exe -RunOnceO4 - HKLM\..\Run: [AprvRemoveLegacyExcelKeys] 'C:\Program Files\ApproveIt\Support\Tools\AprvClean.exe' -k HKCU SOFTWARE\Microsoft\Office\Excel\Addins\OfficeAddIn.OfficeAddInO4 - HKLM\..\Run: [AprvRemoveLegacyWordKeys] 'C:\Program Files\ApproveIt\Support\Tools\AprvClean.exe' -k HKCU SOFTWARE\Microsoft\Office\Word\Addins\OfficeAddIn.OfficeAddInO4 - HKLM\..\Run: [DVConfigUpdate] C:\Program Files\Valicert\Desktop Validator\dvconfigupdate.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exeO4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero8\InCD\InCD.exeO4 - HKLM\..\Run: [Prolific_OneButton] C:\Program Files\USBFast\OneBtn.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [DA Remote Management GUI] 'C:\Program Files\DesktopAuthoritymgui.exe'O4 - HKLM\..\Run: [Pointsec Tray] c:\Program Files\Pointsec\Pointsec for PC\P95Tray.exeO4 - HKLM\..\Run: [McAfee Host Intrusion Prevention Tray] 'C:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exe'O4 - HKLM\..\Run: [ShStatEXE] 'C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE' /STANDALONEO4 - HKLM\..\Run: [Adobe ARM] 'C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe'O4 - HKLM\..\Run: [acevents] 'C:\Program Files\ActivIdentity\ActivClient\acevents.exe'O4 - HKLM\..\Run: [accrdsub] 'C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe'O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\QTTask.exe' -atboottimeO4 - HKLM\..\Run: [McAfeeUpdaterUI] 'C:\Program Files\McAfee\Common Framework\udaterui.exe' /StartedFromRunKeyO4 - HKLM\..\Run: [McAfee Policy Auditor Tray Icon] 'C:\Program Files\McAfee\Policy Auditor Agent\PASysTray.exe'O4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exeO4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 'C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe' ASO-616B5711-6DAE-4795-A05F-39A1E5104020O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnkO4 - Global Startup: ActivClient Agent.lnkO4 - Global Startup: D-Link AirPlus G Wireless Utility.lnkO4 - Global Startup: D-Link REG Utility.lnkO4 - Global Startup: VPN Client.lnkO4 - Global Startup: Windows Search.lnkO4 - Global Startup: WinZip Quick Pick.lnkO8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} (CentraUpdaterAxCtl Class) - http://capitol.centra.com/SiteRoots/main/Install/win32/CentraUpdaterAx.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237317063171O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = jcse.privateO17 - HKLM\Software\..\Telephony: DomainName = jcse.privateO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = jcse.privateO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO20 - AppInit_DLLs: DAinit.dllO20 - Winlogon Notify: ackpbsc - C:\Program Files\ActivIdentity\ActivClient\ackpbsc.dllO20 - Winlogon Notify: acunlock - C:\Program Files\ActivIdentity\ActivClient\acunlock.dllO20 - Winlogon Notify: FCAGWL - fcagwl.dll (file missing)O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: ActivIdentity Shared Store Service (ac.sharedstore) - ActivIdentity - C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exeO23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exeO23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exeO23 - Service: DA Remote Management Maintenance Service (DAMaint) - ScriptLogic Corporation - C:\Program Files\DesktopAuthority\DaMaint.exeO23 - Service: DA Remote Management Service (DesktopAuthority) - ScriptLogic Corporation - C:\Program Files\DesktopAuthority\DesktopAuthority.exeO23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXEO23 - Service: McAfee Host Intrusion Prevention Service (enterceptAgent) - McAfee, Inc. - C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: McAfee HIPSCore Service (hips) - McAfee, Inc. - C:\Program Files\McAfee\Host Intrusion Prevention\HIPSCore\HIPSvc.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: McAfee Audit Manager Service (McAfeeAuditManager) - McAfee, Inc. - C:\Program Files\McAfee\Audit Manager\AuditManagerService.exeO23 - Service: McAfee DLP Agent Service (McAfeeDLPAgentService) - McAfee Inc. - C:\Program Files\McAfee\DLP\Agent\fcags.exeO23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exeO23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exeO23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exeO23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exeO23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exeO23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pointsec - Unknown owner - c:\WINDOWS\system32\Prot_srv.exeO23 - Service: Pointsec Service Start (Pointsec_start) - Unknown owner - c:\WINDOWS\system32\pstartSr.exeO23 - Service: McAfee Rogue System Sensor (RSSensor) - McAfee, Inc. - C:\Program Files\McAfee\RSD Sensor\RSSensor.exeO23 - Service: Shavlik Remote Scheduler Service (Shavlik Scheduler) - Shavlik Technologies, LLC - C:\WINDOWS\ProPatches\Scheduler\STSchedEx.exeO23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\dellxpm09b_6017v022\wdm\stacsv.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/MartinTE/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.jpg --End of file - 15442 bytes

kevin27_b3d29f · Answer

Hi LiveFreeOrDie,

Welcome to Dell Community Malware Removal Forums,

Sorry for the delay in getting to you, I'm K27 and i will be reviewing your log for you.

Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.

Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.

Please DO NOT use this system for anything apart from visiting this forum and other sites I direct you too, as this will only make the cleanup process all the more diffecult.

Failure to reply in three (3) days will result in this topic being closed and I will remove it from my notifications, If you require more time then that is fine but please let me know.

1) Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

Make sure the "Perform Quick Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

Click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

2) I need to see some additional information about what is happening in your machine.
Please perform the following scan:

Download DDS by sUBs from one of the following links. Save it to your desktop.
Double click on the DDS icon, allow it to run.
A small box will open, with an explanation about the tool.
When done, DDS will open two (2) logs
1. DDS.txt
2. Attach.txt
Save both reports to your desktop.
The instructions here ask you to attach the Attach.txt.
Instead of attaching, please copy/past both logs into your next reply.
Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run.
After downloading the tool, disconnect from the internet and disable all antivirus protection.
Run the scan, enable your A/V and reconnect to the internet.
Information on A/V control here

3) YOU MUST DISABLE ALL REAL TIME PROTECTION BEFORE RUNNING THE NEXT TOOL,

Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage.

Please Disable all Anti-virus/Anti-Spyware/FireWall on your machine(instructions via links below)

Next, please perform a rootkit scan:

Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to launch it
When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.
When the "quick" scan is finished (a few seconds), click the Rootkit/Malware tab,and then select the Scan button.
Leave your system completely idle while this longer scan is in progress.
When the scan is done, save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Exit the Program
Save the Scan log as ARK.txt and post it in your next reply.
Now, re-enable the active protection component of any antivirus/antimalware programs you disabled before performing the scan.

.
If the ARK tool crashes your machine or causes a Blue Screen error, please post the log results from the first inital quick scan,this can be saved in the same way as the full scan in the above instructions.

Please COPY/PASTE the MBAM log, BOTH DDS logs and the ARK log back to this thread,
Thanks
K27

kevin27_b3d29f · Answer

This topic is Inactive..... The fixes in this topic were written specifically for this user, following them may cause harm to your machine and render it a brick (useless) If you are the original poster and would like further assistance please post a fresh HJT log and details of the problems you are having. All other user's, please read THIS page and then please start a New Topic at the top of the Malware Removal Forum by clicking the button.

Virus & Spyware

Malware and Redirects

Was this post helpful?