Vundo? - Help with Virus Removal - Internet connection blocked -- See hijackthis log

Have you checked for a proxy server in Internet Options?

Yes. none.

I would fix the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=GRfox000&ptb=CIwWZzJK7mifAUOGt53rwQ

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

Reset hosts file:

http://www.funkytoad.com/index.php?option=com_content&id=13

Defensive hosts file:

http://www.mvps.org/winhelp2002/hosts.htm

"...ran eset online scanner, malwarebytes scan and hitman pro..." Did they all come up clean?

On my way home last night I picked up a can of compressed air, came home and blew out the laptop's fans in case the random restarts/shutdowns were a feature of overheating as a result of poor ventilation. I haven't seen the problem since so I think I guessed right.

After solving that problem, I ran combofix (even though I know I'm not supposed to without guidance) and as far as I can tell everything looked in order. I became convinced that there was no infection on the computer. The incomplete internet connection issue was still happening... I started to suspect norton internet security 2010. I tried uninstalling... wouldn't even run. Downloaded norton removal tool. Reboot. Success. Problem solved. Did updates, installed avast. I think I'm good.

Thanks for all the help!

Optoma -- I'm going to post a cf log in a minute if you don't mind taking a look just for safe measure. Thanks!

Good stuff with the compressed air!

ComboFix 10-12-11.06 - owner 12/12/2010  11:18:19.2.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.1790.1101 [GMT -5:00]
Running from: c:\users\owner\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}
SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((   Files Created from 2010-11-12 to 2010-12-12  )))))))))))))))))))))))))))))))
.

2010-12-12 16:28 . 2010-12-12 16:28      --------      d-----w-      c:\users\Default\AppData\Local\temp
2010-12-12 14:21 . 2010-09-07 15:47      17744      ----a-w-      c:\windows\system32\drivers\aswFsBlk.sys
2010-12-12 14:21 . 2010-09-07 15:52      165584      ----a-w-      c:\windows\system32\drivers\aswSP.sys
2010-12-12 14:21 . 2010-09-07 15:47      23376      ----a-w-      c:\windows\system32\drivers\aswRdr.sys
2010-12-12 14:21 . 2010-09-07 15:52      46672      ----a-w-      c:\windows\system32\drivers\aswTdi.sys
2010-12-12 14:21 . 2010-09-07 15:47      50768      ----a-w-      c:\windows\system32\drivers\aswMonFlt.sys
2010-12-12 14:19 . 2010-09-07 16:12      38848      ----a-w-      c:\windows\avastSS.scr
2010-12-12 14:19 . 2010-09-07 16:11      167592      ----a-w-      c:\windows\system32\aswBoot.exe
2010-12-12 14:18 . 2010-12-12 14:18      --------      d-----w-      c:\programdata\Alwil Software
2010-12-12 14:18 . 2010-12-12 14:18      --------      d-----w-      c:\program files\Alwil Software
2010-12-11 22:25 . 2010-12-11 22:28      --------      d-----w-      c:\windows\system32\SmitfraudFix
2010-12-11 22:16 . 2010-12-11 22:16      --------      d-----w-      C:\VundoFix Backups
2010-12-11 20:41 . 2010-12-11 20:41      --------      d-----w-      c:\program files\ESET
2010-12-11 20:40 . 2010-12-11 20:40      12872      ----a-w-      c:\windows\system32\bootdelete.exe
2010-12-11 20:36 . 2010-12-11 20:36      16968      ----a-w-      c:\windows\system32\drivers\hitmanpro35.sys
2010-12-11 20:35 . 2010-12-11 20:35      --------      d-----w-      c:\users\owner\AppData\Local\Adobe
2010-12-11 17:16 . 2010-12-11 17:16      --------      d-----w-      c:\program files\Hitman Pro 3.5
2010-12-11 17:15 . 2010-12-11 20:40      --------      d-----w-      c:\programdata\Hitman Pro
2010-12-11 17:12 . 2010-12-11 17:12      --------      d-----w-      c:\users\owner\AppData\Roaming\Malwarebytes
2010-12-11 17:12 . 2010-11-29 22:42      38224      ----a-w-      c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-11 17:12 . 2010-12-11 17:12      --------      d-----w-      c:\programdata\Malwarebytes
2010-12-11 17:12 . 2010-12-11 17:12      --------      d-----w-      c:\program files\Malwarebytes' Anti-Malware
2010-12-11 17:12 . 2010-11-29 22:42      20952      ----a-w-      c:\windows\system32\drivers\mbam.sys
2010-11-26 13:57 . 2010-10-19 04:27      7680      ----a-w-      c:\program files\Internet Explorer\iecompat.dll
2010-11-16 21:57 . 2010-11-16 21:57      --------      d-----w-      c:\program files\Olympus
2010-11-16 21:57 . 2005-03-25 20:57      217088      ----a-w-      c:\windows\system32\DSSCORE.DLL

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-15 09:50 . 2010-06-03 00:19      472808      ----a-w-      c:\windows\system32\deployJava1.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 972080]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-11 136176]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2008-05-09 43040]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation      REG_MULTI_SZ         FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-11 20:59]

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-11 20:59]

2010-12-11 c:\windows\Tasks\HPCeeScheduleForowner.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-25 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.comcast.net/
mWindow Title = Windows Internet Explorer provided by Comcast
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: real.com\rhap-app-4-0
Trusted Zone: real.com\rhapreg
FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\tr4oll9l.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\users\owner\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\owner\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\owner\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll
FF - HiddenExt: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\tr4oll9l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\users\owner\AppData\Roaming\Move Networks

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-12 11:29
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...  

scanning hidden autostart entries ...

scanning hidden files ...  

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-12-12  11:32:30
ComboFix-quarantined-files.txt  2010-12-12 16:32
ComboFix2.txt  2010-12-12 04:19

Pre-Run: 170,327,412,736 bytes free
Post-Run: 170,338,013,184 bytes free

- - End Of File - - 3B893A59DCA61132B187CD27ECF37775

Looks good!

This isn't really it but I didn't give enough info to determine that Norton was the problem. Awarded to optoma for suggesting overheating and for checking my combofix log.

Ps... optoma - where did you learn combofix?