asked on

Internet Explorer Virus

I have a laptop which was infected by the av2009 virus. I've been trying to clear it up with some of the other suggestions on expert exchange. Have managed to get it mostly cleared up but i'm still having trouble with Internet Explorer. When an address is typed into the address bar everything works ok. When i search for something with google the results page shows but is in a slightly different format (it just doesn't look right). Click on the link for the page i'm searching for and different pages come up. I'm using Antivir PE Classic as my virus software. It is fully updated and fails to find any detections. Please help

travisgish

Have you used malwarebytes?

www.malwarebytes.com

syl_mac

ASKER

I enter the address www.malwarebytes.com into the address bar and I get the same funny google search results page. However if i enter a non virus page eg. www.ebay.com the page loads fine.

travisgish

you still have a virus. I uploaded malwarebytes for you. Just change the extension to .exe and run it.
mbam-setup.zip

rpggamergirl

These links should work:

Download MalwareBytes from either of these locations, update before scanning if you can.
If it won't run, you would need to re-download and rename it before saving to your desktop, or use another pc to download and rename it before installing it to the infected system.
MalwareBytes:
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button
http://projects.securitywonks.net/projects/details.php?file=158

If problem pesists
Look for the these FAKE file and delete them if present.(delete in Safe Mode if won't go easily)
C:\Windows\system32\wdmaud.sys <-- bad

Please do not delete the legit ones in the drivers folder:
C:\Windows\system32\drivers\wdmaud.sys <-- legit one
C:\Windows\system32\wdmaud.drv <-- legit file in system32 folder

johnb6767

Last testing I did for about 6 different Malware apps, showed MBAM to ineffectively clean (and stop in real time for that matter, the execution of the av2009 rogue av...). If this doesnt clear it for you, I would suggest SuperAntispyware.

SuperAnti Spyware
http://www.superantispyware.com

Also, a HijackThis logfile would help further.....
http://www.hijackthis.de

syl_mac

ASKER

Ok here is the Hijackthis logfile

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:32:31, on 7/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPM1LAK.EXE
C:\WINDOWS\system32\CAPM1RSK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPM1SWK.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\DRIVERS\o2flash.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com.au/ig/dell?hl=en&client=dell-row&channel=au&ibd=6081024
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [58467199436420897188303356532127] C:\Program Files\Antivirus 2009\av2009.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - Global Startup: Canon PC1200 iC D600 iR1200G Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPM1LAK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: O2FLASH - O2Micro International - C:\WINDOWS\system32\DRIVERS\o2flash.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 5804 bytes

The malwarebytes file didn't work even when the name was changed. Everything loaded like it was ok but the program wouldn't open.

syl_mac

ASKER

I am unable to get to http://www.superantispyware.com whatever is on the computer must be stopping pages with spyware references from opening.

syl_mac

ASKER

I have a wdmaud.sys @ C:\I386\SP3.CAB @ C:\WINDOWS\system32\drivers
@ C:\WINDOWS\Driver Cache\i386\sp3.cab

ASKER CERTIFIED SOLUTION

rpggamergirl

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

syl_mac

ASKER

The malwarebytes file was renamed before it was downloaded but still didn't work.
The antivirus 2009 file is not in the program file folder. Not anywhere I can see.
Will let you know how I get on with Combo fix.

rpggamergirl

Can you attach the combofix log when done?
Combofix will find the antivirus 2009 folder IFstill present in the system.

syl_mac

ASKER

Here is the combofix log.

ComboFix 09-01-06.01 - Michael MacMahon 2009-01-07 16:43:47.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2038.1686 [GMT 11:00]
Running from: c:\documents and settings\Michael MacMahon\Desktop\Solution.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
 
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\recycler\ADAPT_Installer.exe
c:\windows\system32\404Fix.exe
c:\windows\system32\drivers\TDSSmhct.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\w40cqsmQ.exe.a_a
c:\windows\system32\winsrc.dll.tmp
c:\windows\system32\WS2Fix.exe
c:\windows\system32\x64
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys
 
 
(((((((((((((((((((((((((   Files Created from 2008-12-07 to 2009-01-07  )))))))))))))))))))))))))))))))
.
 
2009-01-07 15:32 . 2009-01-07 15:32	<DIR>	d--------	c:\program files\Trend Micro
2009-01-07 15:27 . 2009-01-07 15:27	<DIR>	d--------	c:\program files\getsome
2009-01-07 15:27 . 2009-01-07 15:27	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-07 15:27 . 2009-01-04 18:38	38,496	--a------	c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-07 15:27 . 2009-01-04 18:38	15,504	--a------	c:\windows\system32\drivers\mbam.sys
2009-01-07 12:59 . 2009-01-07 12:59	0	--a------	c:\windows\system32\null
2008-12-16 07:56 . 2008-11-07 16:45	2,174,976	-----c---	c:\windows\system32\dllcache\WMVCore.dll
2008-12-16 07:56 . 2008-06-10 06:11	1,053,696	-----c---	c:\windows\system32\dllcache\WMNetmgr.dll
2008-12-16 07:56 . 2008-06-10 03:11	103,936	-----c---	c:\windows\system32\dllcache\logagent.exe
2008-12-15 10:25 . 2008-12-15 10:25	<DIR>	d--------	c:\program files\Avira
2008-12-15 10:25 . 2008-12-15 10:25	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Avira
2008-12-15 10:18 . 2008-10-03 21:02	247,326	-----c---	c:\windows\system32\dllcache\strmdll.dll
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 02:10	---------	d-----w	c:\program files\Google
2009-01-07 02:05	---------	d-----w	c:\documents and settings\All Users\Application Data\Dell
2008-12-05 23:23	---------	d-----w	c:\program files\Common Files\Symantec Shared
2008-12-05 00:39	---------	d-----w	c:\program files\Silvan
2008-12-04 23:35	1,996	----a-w	c:\documents and settings\Michael MacMahon\Application Data\wklnhst.dat
2008-11-25 02:22	---------	d-----w	c:\program files\Norton PC Checkup
2008-11-23 21:57	---------	d-----w	c:\documents and settings\Michael MacMahon\Application Data\Template
2008-11-23 21:43	---------	d-----w	c:\program files\Common Files\Adobe
2008-11-19 04:31	---------	d-----w	c:\program files\DIFX
2008-11-19 04:30	---------	d-----w	c:\documents and settings\All Users\Application Data\Symantec
2008-11-17 02:08	---------	d-----w	c:\program files\Tractor_Parts
2008-11-17 02:07	---------	d-----w	c:\documents and settings\Michael MacMahon\Application Data\Tractor_Parts
2008-11-14 04:14	---------	d-----w	c:\program files\Taarup
2008-10-23 12:36	286,720	----a-w	c:\windows\system32\gdi32.dll
2008-10-16 03:13	202,776	----a-w	c:\windows\system32\wuweb.dll
2008-10-16 03:13	1,809,944	----a-w	c:\windows\system32\wuaueng.dll
2008-10-16 03:12	561,688	----a-w	c:\windows\system32\wuapi.dll
2008-10-16 03:12	323,608	----a-w	c:\windows\system32\wucltui.dll
2008-10-16 03:09	92,696	----a-w	c:\windows\system32\cdm.dll
2008-10-16 03:09	51,224	----a-w	c:\windows\system32\wuauclt.exe
2008-10-16 03:09	43,544	----a-w	c:\windows\system32\wups2.dll
2008-10-16 03:08	34,328	----a-w	c:\windows\system32\wups.dll
2008-10-16 03:06	268,648	----a-w	c:\windows\system32\mucltui.dll
2008-10-16 03:06	208,744	----a-w	c:\windows\system32\muweb.dll
2008-10-16 01:00	666,112	----a-w	c:\windows\system32\wininet.dll
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-15 1695232]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-02-22 159744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-22 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-22 137752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-06-30 2220032]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2008-02-22 1245184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-22 c:\windows\RTHDCPL.EXE]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Canon PC1200 iC D600 iR1200G Status Window.LNK - c:\windows\system32\spool\drivers\w32x86\3\CAPM1LAK.EXE [2001-12-07 30208]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\UltraVNC\\winvnc.exe"=
 
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-10-24 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2008-10-24 43608]
R4 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2008-10-30 6016]
S4 RapidPortM1;RapidPortM1;c:\windows\system32\drivers\CAPM1LP.SYS [2008-11-20 22912]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056c-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056e-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95c6056f-aeab-11dd-8409-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b948-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b949-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b94b-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfc4b94e-a972-11dd-8405-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7ac2b8e-a60b-11dd-8403-002170bd4a6c}]
\Shell\AutoRun\command - E:\setupSNK.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e859331e-a94d-11dd-8404-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8593321-a94d-11dd-8404-002170bd4a6c}]
\Shell\AutoRun\command - E:\AutoRun.exe
.
- - - - ORPHANS REMOVED - - - -
 
HKLM-RunOnce-<NO NAME> - (no file)
 
 
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.au/
uInternet Connection Wizard,ShellNext = hxxp://www.google.com.au/ig/dell?hl=en&client=dell-row&channel=au&ibd=6081024
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
.
 
**************************************************************************
 
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 16:45:50
Windows 5.1.2600 Service Pack 3 NTFS
 
scanning hidden processes ... 
 
scanning hidden autostart entries ...
 
scanning hidden files ... 
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(1000)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2009-01-07 16:46:33
ComboFix-quarantined-files.txt  2009-01-07 05:46:29
 
Pre-Run: 145,888,927,744 bytes free
Post-Run: 145,953,009,664 bytes free
 
174	--- E O F ---	2009-01-07 00:13:12

Open in new window

jwelter

Can you go to www.mozilla.org and download & install firefox? I've had people with problems like yours that were able to get the tools they wanted using Firefox browser, clean up their systems, then remove firefox and go back to ie. Others were happy to stay w/ Firefox.

syl_mac

ASKER

Will try the firefox option and let you know how it goes.

SOLUTION

rpggamergirl

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

syl_mac

ASKER

The combo fix has appeared to work. The Google problems appear to have been sorted out. Thanks very much for your help