Redirection Problems

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Stokecity, Nov 9, 2011.

  1. Stokecity

    Stokecity Private E-2

    I have run through all the steps in 'Fixing google redirection/hijacking etc' and 'READ AND RUN ME FIRST' threads to no avail. My problems started 4-5 days ago, at first some pages wouldnt not load and would be left on a blank white screen until i refreshed the page several times. Now I get redirect to other websites that open in new tabs, I have also been redirect to ebay a few times.

    Also, my kaspersky keeps denying thats trying to download something containing a malicious URL.

    I haven't run ComboFix as im abit dubious abotu using it, im also having difficulty locating my MG tools log.
     

    Attached Files:

    Stokecity, Nov 9, 2011
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You need to go back through the instructions in the READ and Run Me First. I need to see a log from TDSSKiller.

    You should also run the below

    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

    I do want you to go ahead and run the Combofix step, and the zipped file from running MGTools should be at: C:\MGlogs.zip. :)
     
    Kestrel13!, Nov 9, 2011
    #2
  3. Stokecity

    Stokecity Private E-2

    Still couldnt find the MGTools log.
     

    Attached Files:

    Stokecity, Nov 9, 2011
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Then you must run it again in order to produce one.
     
    Kestrel13!, Nov 9, 2011
    #4
  5. Stokecity

    Stokecity Private E-2

    I have ran it twice before you even asked and got no log. SteelWerX WhoAmI unable to run and waited for and clicked on Close button also got another message but cant remember what i said. I'll run it again and let you know.
     
    Stokecity, Nov 9, 2011
    #5
  6. Stokecity

    Stokecity Private E-2

    Finally got a log.
     

    Attached Files:

    Stokecity, Nov 9, 2011
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Download and run Win32kDiag per the below instructions:
    • Download this Win32kDiag and save to C:\Win32kDiag.exe. You must save it here!!!!
    • Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please attach this log
    C:\win32kdiag.exe -f -r


    Now we need to scan the system with this special tool.
    • Please download Junction.zip and save it to your root folder (C:\Junction.zip)
    • Unzip it and put junction.exe in the root folder (C:\junction.exe)
    • Now click Start => Run... => Copy and paste the following command in the run box and click OK:
      cmd /c junction -s c:\ >C:\log.txt
      ​
    • A command prompt window opens and also a license agreement from SysInternals will appear.
    • Accept the license agreement and the scan will begin.
    • Wait until a log file opens. Attach this C:\log.txt when it finishes (the command prompt window will close when it finishes). (How to attach items to your post)
    • NOTE: It scans your whole hard disk so if can take a long time. Be patient and don't do anything else while it is scanning.


    Now we need to use ComboFix by sUBs

    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::

DirLook::
C:\Users\Ralphs Family\AppData\Local\Chromium
C:\Users\Ralphs Family\AppData\Local\SKIDROW
C:\Users\Ralphs Family\AppData\Local\{00D23DB7-DDCC-4097-A3A4-0937A61B32BD}
C:\Users\Ralphs Family\AppData\Local\{00D8F9C7-54F5-42D4-BA19-E174A6D7C779}
C:\Users\Ralphs Family\AppData\Local\{01FDB334-D5D0-47B1-A92A-A4CE0B4E3065}
C:\Users\Ralphs Family\AppData\Local\{0895A867-8B08-43F1-B475-90B811EEA4E2}
C:\Users\Ralphs Family\AppData\Local\{0A8AED71-602D-4C77-B5E0-F7372B40BEC6}
C:\Users\Ralphs Family\AppData\Local\{0AD1CD6C-1456-47B9-960F-3DB8667DDFD2}
C:\Users\Ralphs Family\AppData\Local\{0CD1F7F2-01DD-4635-8123-8A1677F9BA50}
C:\Users\Ralphs Family\AppData\Local\{0E3D1A67-3641-443B-837F-56EDAC06B454}
C:\Users\Ralphs Family\AppData\Local\{10E03297-F5E3-4D89-B61E-1A121D199620}
C:\Users\Ralphs Family\AppData\Local\{1357D661-C828-46C8-91A2-8E8C43EF7F48}
C:\Users\Ralphs Family\AppData\Local\{181573E8-A390-4077-ADF3-0713C73E5B52}
C:\Users\Ralphs Family\AppData\Local\{198B212A-EC1C-41BE-A49B-6C5D79F85940}
C:\Users\Ralphs Family\AppData\Local\{1A863DFF-C6BD-4DCD-AB59-7A45CF3188BC}
C:\Users\Ralphs Family\AppData\Local\{1D17196B-DF46-404F-9E31-2E24DB872AD1}
C:\Users\Ralphs Family\AppData\Local\{1EE53A4B-B0D8-400F-AFDD-5D8F6D125759}
C:\Users\Ralphs Family\AppData\Local\{2087A68B-8765-4FB7-8EC5-F90C81B409F7}
C:\Users\Ralphs Family\AppData\Local\{20A3EC0D-810A-40A3-B2A4-EDA6A90551A9}
C:\Users\Ralphs Family\AppData\Local\{2408FC63-CD14-4F50-9B1A-63CFBC598834}
C:\Users\Ralphs Family\AppData\Local\{25A4755B-97FE-4CB8-9A74-B57ADDABA6A1}
C:\Users\Ralphs Family\AppData\Local\{25BE2CC7-C8FE-4851-8CAB-A78017B5D899}
C:\Users\Ralphs Family\AppData\Local\{267CEB44-3347-41B7-A48A-77A50AAD75C5}
C:\Users\Ralphs Family\AppData\Local\{2C77DD49-17B6-4E83-9390-39F1019F4809}
C:\Users\Ralphs Family\AppData\Local\{2D62DEEE-E09B-457B-A7CA-AEACDCF5F6D9}
C:\Users\Ralphs Family\AppData\Local\{2E614144-A14D-4A53-8012-12F4668DCE1E}
C:\Users\Ralphs Family\AppData\Local\{301AA21B-C848-4418-BD07-8DA4663467C2}
C:\Users\Ralphs Family\AppData\Local\{31688475-D123-4444-A13C-E69D5F659C21}
C:\Users\Ralphs Family\AppData\Local\{32CC676C-93CF-4704-9C59-D5389DB0896D}
C:\Users\Ralphs Family\AppData\Local\{3385D964-272A-4326-AA96-767287188620}
C:\Users\Ralphs Family\AppData\Local\{3449BA7C-C6E7-466F-8BEB-9B3AD5EBB48C}
C:\Users\Ralphs Family\AppData\Local\{35B2DCD0-567F-4550-BEFF-723D05105DAE}
C:\Users\Ralphs Family\AppData\Local\{3720B3B0-97C5-43ED-8D6D-B4A6E3B3E6E6}
C:\Users\Ralphs Family\AppData\Local\{384A58CE-E613-4EA1-B613-9DAE1F036260}
C:\Users\Ralphs Family\AppData\Local\{38E06E3E-9F83-44A8-84B1-B8E0D37B7A90}
C:\Users\Ralphs Family\AppData\Local\{3C1B6DBE-0CF0-4A08-9F68-38027F2AC0AD}
C:\Users\Ralphs Family\AppData\Local\{3CD38562-EDFE-4E39-9FFB-F942F2481960}
C:\Users\Ralphs Family\AppData\Local\{3DA827F6-C14C-4292-B55E-661AAB10C165}
C:\Users\Ralphs Family\AppData\Local\{3E1882ED-E769-4CCB-A836-3C81ACDADAD9}
C:\Users\Ralphs Family\AppData\Local\{3FD626C3-66F5-4AE9-8A35-61C3D625DE40}
C:\Users\Ralphs Family\AppData\Local\{4025C21E-C381-4CF2-B6C5-007E0D0C33B0}
C:\Users\Ralphs Family\AppData\Local\{42633EB2-C0B9-424E-A4D9-C25108A98A99}
C:\Users\Ralphs Family\AppData\Local\{42B3FE77-FAD9-4690-9355-A67F92E3029A}
C:\Users\Ralphs Family\AppData\Local\{435E9D61-64C9-48E7-AC80-2263D852B2EE}
C:\Users\Ralphs Family\AppData\Local\{44CB56F4-F067-48F7-B265-11B73710769C}
C:\Users\Ralphs Family\AppData\Local\{45F25944-6837-4335-B2D3-B8999E0EA61A}
C:\Users\Ralphs Family\AppData\Local\{467A5AFC-2CD0-4AD1-9AC7-CC8161967E41}
C:\Users\Ralphs Family\AppData\Local\{46DD339D-FD9C-4CA7-BC63-BB415263A5DF}
C:\Users\Ralphs Family\AppData\Local\{490EB5DE-9913-44D1-888F-64700BAC0A16}
C:\Users\Ralphs Family\AppData\Local\{4A7F4160-C55C-481B-876B-01A78CE50EC9}
C:\Users\Ralphs Family\AppData\Local\{4AE11334-A47E-4365-A042-8FE1D2B39717}
C:\Users\Ralphs Family\AppData\Local\{4C65B5E0-7425-4FB6-AE3B-EFB9486D4FC4}
C:\Users\Ralphs Family\AppData\Local\{4C9883D8-1987-4D34-A6B8-24206227906E}
C:\Users\Ralphs Family\AppData\Local\{54717A01-9BD8-4E95-A7F5-828A8AD34762}
C:\Users\Ralphs Family\AppData\Local\{5634B820-F0E6-4DE1-8E63-B28D7726226F}
C:\Users\Ralphs Family\AppData\Local\{57DAE5D6-7C42-41BB-83AD-47795E9B077D}
C:\Users\Ralphs Family\AppData\Local\{57EDCCE0-2D2F-43F2-92FB-CD7D121AF12F}
C:\Users\Ralphs Family\AppData\Local\{5A023DF5-99D5-44AD-935A-02560BACC20D}
C:\Users\Ralphs Family\AppData\Local\{5A53629D-7E98-4EDC-A559-2BA8AD6E2D96}
C:\Users\Ralphs Family\AppData\Local\{5AC615CA-3488-4253-85A9-7E6549A65027}
C:\Users\Ralphs Family\AppData\Local\{5B2B2E1C-C2C9-4C74-A386-8C0ADC87B32B}
C:\Users\Ralphs Family\AppData\Local\{5C00DBF0-F7AC-4E4D-A9BF-6F07A19821A9}
C:\Users\Ralphs Family\AppData\Local\{5F69FBAA-098F-44B9-8F42-CF6CBBB2DB86}
C:\Users\Ralphs Family\AppData\Local\{61305AAC-F700-4E5A-9DA1-00A97EEF2375}
C:\Users\Ralphs Family\AppData\Local\{639BCC76-8913-4291-9A10-54A5A9E7D8F3}
C:\Users\Ralphs Family\AppData\Local\{642741F4-00A1-4014-AB9D-55ADC9BB16DA}
C:\Users\Ralphs Family\AppData\Local\{645A995F-486A-4853-B312-A2016D1982AF}
C:\Users\Ralphs Family\AppData\Local\{6498DE9F-724C-4515-9A42-A63433F50AB7}
C:\Users\Ralphs Family\AppData\Local\{674307B9-EC0A-4D1A-BAE0-2B28FDC977C2}
C:\Users\Ralphs Family\AppData\Local\{67CAFB21-D1C4-4FDE-BBB9-28CE8C1F5302}
C:\Users\Ralphs Family\AppData\Local\{6937EAFB-E208-48C8-B1E5-3C35DCB30C84}
C:\Users\Ralphs Family\AppData\Local\{6A7DAA44-46E9-4D1A-B059-0A4A5901DC84}
C:\Users\Ralphs Family\AppData\Local\{6ADD3EB1-BF5D-4A42-94BA-C72D7CCF77AA}
C:\Users\Ralphs Family\AppData\Local\{70559D5C-3AB1-4422-81F8-88C4251FC854}
C:\Users\Ralphs Family\AppData\Local\{7A7A671E-5B8C-4279-962D-3A868A586B31}
C:\Users\Ralphs Family\AppData\Local\{7C52786F-BDA9-4DDB-ADA4-B91365B9C24A}
C:\Users\Ralphs Family\AppData\Local\{7DADE556-BA0B-44F7-9670-9A4D752EE408}
C:\Users\Ralphs Family\AppData\Local\{7FEB8164-AD85-4E16-B2B0-7A191185E151}
C:\Users\Ralphs Family\AppData\Local\{80433C5E-0979-43FF-A9E9-B282E71A2ABF}
C:\Users\Ralphs Family\AppData\Local\{80C302E3-15EF-4C4E-A8C0-E59FC3398EAE}
C:\Users\Ralphs Family\AppData\Local\{80FD40FB-F8EB-40CA-9F3F-D84058AABCB2}
C:\Users\Ralphs Family\AppData\Local\{82E99350-ED9A-4739-99A8-5CA3B5957259}
C:\Users\Ralphs Family\AppData\Local\{849115BC-1268-4C28-B4B9-D6B22D17D541}
C:\Users\Ralphs Family\AppData\Local\{85C42AE4-FAE5-487D-9074-A6C1486BCF05}
C:\Users\Ralphs Family\AppData\Local\{8664E968-3AB3-46AB-AD50-115E8C14BCFA}
C:\Users\Ralphs Family\AppData\Local\{8E410C2E-66DC-4ABC-AEE5-3B0220FE33DE}
C:\Users\Ralphs Family\AppData\Local\{8F15FF58-45CB-41D8-A0B2-6856BA93EF3D}
C:\Users\Ralphs Family\AppData\Local\{8F8823D8-3B8B-4845-9A1E-BD197930FD4D}
C:\Users\Ralphs Family\AppData\Local\{90ED5D82-F2AE-44C2-B8BB-DBDAD2164340}
C:\Users\Ralphs Family\AppData\Local\{91AE312A-FE5C-4249-B9EF-99A1CFF710B2}
C:\Users\Ralphs Family\AppData\Local\{93EAB7B8-E310-4C82-AE31-0A02674E730E}
C:\Users\Ralphs Family\AppData\Local\{9436E996-3376-4109-8AE4-799401D5AB79}
C:\Users\Ralphs Family\AppData\Local\{944763E1-1B0F-4354-8063-01C34672F410}
C:\Users\Ralphs Family\AppData\Local\{956B3DD9-5EB9-4502-B536-AFD3721807E3}
C:\Users\Ralphs Family\AppData\Local\{9B14C291-3A03-4E5D-83F6-A0E837093B44}
C:\Users\Ralphs Family\AppData\Local\{9B66FD3A-928C-4C70-ADFB-5697AC0C669F}
C:\Users\Ralphs Family\AppData\Local\{9C6755AC-922C-4E6F-B409-0C103802F429}
C:\Users\Ralphs Family\AppData\Local\{9CC2B307-F223-42CB-9257-1764E3DAFDBF}
C:\Users\Ralphs Family\AppData\Local\{9D7D13B6-5248-4D14-9F64-EFB709C052AF}
C:\Users\Ralphs Family\AppData\Local\{9FCDA3DA-91FE-49A3-A760-F952BFA6AE71}
C:\Users\Ralphs Family\AppData\Local\{A03C6D34-C924-4D06-BE99-A8D55F55D924}
C:\Users\Ralphs Family\AppData\Local\{A28B45FA-4B6B-48E4-AB63-C01A3548E208}
C:\Users\Ralphs Family\AppData\Local\{A2DF561D-91E1-409B-B7AC-9D45238F640E}
C:\Users\Ralphs Family\AppData\Local\{A71496A3-D77A-498C-8378-F148BF88C496}
C:\Users\Ralphs Family\AppData\Local\{A783C2AF-946C-4C17-BB15-8E30971CF744}
C:\Users\Ralphs Family\AppData\Local\{A8FB9953-C93F-4AF7-86EC-6E2512D6CCD0}
C:\Users\Ralphs Family\AppData\Local\{A92254B9-5A05-4CCA-8460-91DE63637098}
C:\Users\Ralphs Family\AppData\Local\{A930BF69-08D2-4737-8E3A-7ADDD74C4872}
C:\Users\Ralphs Family\AppData\Local\{A946B7CA-C6C8-4F63-9815-62CD18ECA6B0}
C:\Users\Ralphs Family\AppData\Local\{AAF35F8B-92EC-4E76-B913-16DDB61D5203}
C:\Users\Ralphs Family\AppData\Local\{AC72C6FD-B66F-41B3-80BE-5F94DFFF4153}
C:\Users\Ralphs Family\AppData\Local\{AEB2EC6B-11BF-496F-A68E-F482F198B595}
C:\Users\Ralphs Family\AppData\Local\{B0E547D4-FE3A-4F55-B397-471F83909E93}
C:\Users\Ralphs Family\AppData\Local\{B3D5EE85-7A60-4814-A216-799FBCF92DD6}
C:\Users\Ralphs Family\AppData\Local\{B42EF6FE-C105-4873-A7E4-327C0B69394D}
C:\Users\Ralphs Family\AppData\Local\{B5E6DF49-6F28-46A2-BC8E-7A48EC985901}
C:\Users\Ralphs Family\AppData\Local\{B7596050-EB6B-4EDD-931F-D4B5F971B8EA}
C:\Users\Ralphs Family\AppData\Local\{BA8D641B-0103-41EC-8B87-1FC54C492420}
C:\Users\Ralphs Family\AppData\Local\{BB3D8D58-CD4E-42E9-B8E2-578A111B9E0A}
C:\Users\Ralphs Family\AppData\Local\{BBFEEE80-C97A-47F6-BB32-1CA954AD90B9}
C:\Users\Ralphs Family\AppData\Local\{BD096E30-1627-42A9-A314-A19CDB6B85FA}
C:\Users\Ralphs Family\AppData\Local\{BD222FD3-33AB-4735-94CE-E74C686069D9}
C:\Users\Ralphs Family\AppData\Local\{BE4DE99C-22D6-47BE-88EC-83B18AE7BE62}
C:\Users\Ralphs Family\AppData\Local\{BEB4FCA0-CA3B-49DA-B5A1-C807CA53E51E}
C:\Users\Ralphs Family\AppData\Local\{BFDBBCC3-CE63-4AAB-AA27-F5472BA34F9B}
C:\Users\Ralphs Family\AppData\Local\{C0122797-67A3-4DE0-B57F-30FCAF1C5870}
C:\Users\Ralphs Family\AppData\Local\{C0484F77-16F0-4B19-900C-35AB8A4316D7}
C:\Users\Ralphs Family\AppData\Local\{C0F2FEBA-2896-4425-BAEB-102A09846159}
C:\Users\Ralphs Family\AppData\Local\{C127E304-8A68-4062-A1F4-D25697705A17}
C:\Users\Ralphs Family\AppData\Local\{C2D2FE68-C952-4623-BDE4-C439EFCA7076}
C:\Users\Ralphs Family\AppData\Local\{C32A1B66-3783-45EF-82D5-445D0887D36A}
C:\Users\Ralphs Family\AppData\Local\{C3680453-838C-4DBB-BC13-4497BC1A1079}
C:\Users\Ralphs Family\AppData\Local\{C560C759-422E-4E96-A3E1-6D978516DBC7}
C:\Users\Ralphs Family\AppData\Local\{C6C0FC53-83B4-41E8-9922-ABC83A8B3099}
C:\Users\Ralphs Family\AppData\Local\{CA0C3875-1481-48DD-A3ED-59442C34989A}
C:\Users\Ralphs Family\AppData\Local\{CD9428FC-AF0B-47BE-A514-14C3B87AD8EE}
C:\Users\Ralphs Family\AppData\Local\{D09BBB9B-108F-4B12-9403-36E69C3FC436}
C:\Users\Ralphs Family\AppData\Local\{D157A56A-6C54-48F8-B4EC-1AB7232A4264}
C:\Users\Ralphs Family\AppData\Local\{D29E5A57-909E-4E4B-8B56-9F3CEBBC7783}
C:\Users\Ralphs Family\AppData\Local\{D567AB76-96A7-46DB-B067-513767C6DAE9}
C:\Users\Ralphs Family\AppData\Local\{D6CBA209-238A-45F8-9A6F-13210958518C}
C:\Users\Ralphs Family\AppData\Local\{D7E79722-CE0A-4737-85F5-FFF8FCF1A457}
C:\Users\Ralphs Family\AppData\Local\{D8958ED4-AFEB-4E4E-9B6C-D4DD130975F6}
C:\Users\Ralphs Family\AppData\Local\{D9ADF3F1-1BC6-4DE1-9BBC-DB42B7D28B4B}
C:\Users\Ralphs Family\AppData\Local\{DBD8F636-D1C9-40A3-99EE-D69BC8E4AC27}
C:\Users\Ralphs Family\AppData\Local\{DEBCEFE6-EC2B-4CFC-A9B8-9B9B89E57ECD}
C:\Users\Ralphs Family\AppData\Local\{DEE68674-D4E1-43B9-90E4-844B70A8E9AF}
C:\Users\Ralphs Family\AppData\Local\{E09AFDFA-3F49-4C95-B769-D19B5D4B0E18}
C:\Users\Ralphs Family\AppData\Local\{E435BEC6-4965-44D3-92FE-D1AE704D16F7}
C:\Users\Ralphs Family\AppData\Local\{E5C5495F-23D0-4107-8495-51458B5161D2}
C:\Users\Ralphs Family\AppData\Local\{E66F0E73-A597-452D-AFEB-6D4967BC75BC}
C:\Users\Ralphs Family\AppData\Local\{E78F1DF2-4ABF-4A62-8B16-0C6698A96E2D}
C:\Users\Ralphs Family\AppData\Local\{EA7AA69F-DE8B-4D14-902F-D4CCEA8FCFD1}
C:\Users\Ralphs Family\AppData\Local\{EB17EF5B-CDF8-4D43-AD3A-896A052FF43B}
C:\Users\Ralphs Family\AppData\Local\{EDB6E69B-269A-41FF-A617-37E0D0F00792}
C:\Users\Ralphs Family\AppData\Local\{EEB61A9E-BFDF-4BB6-95C6-3BB4C99D37FD}
C:\Users\Ralphs Family\AppData\Local\{EEC14DCF-7466-4474-B80E-A5205500AC94}
C:\Users\Ralphs Family\AppData\Local\{F0857016-7A3D-4F95-A523-1EA19742CC4C}
C:\Users\Ralphs Family\AppData\Local\{F1309311-9CAD-4D03-87CF-582914DB3A88}
C:\Users\Ralphs Family\AppData\Local\{F1FCCD5C-39A3-4FAD-BD4B-107EC78F2DA7}
C:\Users\Ralphs Family\AppData\Local\{F34DA476-BA04-4D20-8D03-8BD19590A388}
C:\Users\Ralphs Family\AppData\Local\{F6CABD50-F0A4-49BB-BFA3-E74047300A21}
C:\Users\Ralphs Family\AppData\Local\{F7DECC33-A057-4F80-B974-B5EEBF1FB188}
C:\Users\Ralphs Family\AppData\Local\{F848BCC7-BC7A-44EC-8469-64671392F439}
C:\Users\Ralphs Family\AppData\Local\{FA5AFADB-A57D-4980-BBC7-BF2238D1F04D}
C:\Users\Ralphs Family\AppData\Local\{FC717D16-79E0-44FD-A6F2-3C4FC9B79124}
C:\Users\Ralphs Family\AppData\Local\{FECD2E93-256F-40AD-9123-712A37825B75}
C:\Users\Ralphs Family\AppData\Local\{FF0DBAB3-6F3C-4EAB-99F1-88B7F450EF12}
C:\Users\Ralphs Family\AppData\Local\{FF40B5F2-C25E-446B-A728-670EE20C5BF4}
C:\Users\Ralphs Family\AppData\Local\{FF5FAEC7-131D-44B1-80FF-82C431159C97}

File::
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Windows\system32\sho1105.tmp
C:\Windows\system32\sho1539.tmp
C:\Windows\system32\sho20D3.tmp
C:\Windows\system32\sho38F9.tmp
C:\Windows\system32\sho7446.tmp
C:\Windows\system32\sho7C58.tmp
C:\Windows\system32\sho991F.tmp
C:\Windows\system32\shoAD11.tmp
C:\Windows\system32\shoDFB1.tmp
C:\Windows\system32\shoF049.tmp
C:\Windows\system32\shoF7F3.tmp
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\temp\@
C:\Windows\assembly\temp\U
C:\Windows\assembly\temp\U\00000001.@
C:\Windows\assembly\temp\U\00000002.@
C:\Windows\assembly\temp\U\00000004.@
C:\Windows\assembly\temp\U\000000c0.@
C:\Windows\assembly\temp\U\000000cb.@
C:\Windows\assembly\temp\U\000000cf.@
C:\Windows\assembly\temp\U\80000000.@
C:\Windows\assembly\temp\U\80000004.@
C:\Windows\assembly\temp\U\80000032.@
C:\Windows\assembly\temp\U\80000064.@
C:\Windows\assembly\temp\U\800000c0.@
C:\Windows\assembly\temp\U\800000cb.@
C:\Windows\assembly\temp\U\800000cf.@
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      [​IMG]

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.




    And one more scanning tool I want to use to collect more information is OTL per the below.

    Please download OTL by Old Timer to your desktop.
    See the download links under this icon: [​IMG]
    1. Double-click OTL.exe to run (Vista and Win7 right click and select Run as Administrator)
    2. When OTL opens, change the Output (at the top-right portion of the program) to Minimal Output.
    3. Put check-marks in LOP Check and Purity Check.
    4. Now click the [​IMG] button.
    • When the scan is complete, two logs entitled OTL.txt and Extras.txt will be created on your desktop.
    • Attach both of these logs to your next message as well as any other requested logs.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

    Does your internet connection still work? You have a zeroaccess infection which, when tackled, usually results in a broken internet connection.
     
    Kestrel13!, Nov 10, 2011
    #7
  8. Stokecity

    Stokecity Private E-2

    Not had any problems since my MGTools log post, do you you still want me to run the above?
     
    Stokecity, Nov 11, 2011
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I want you to run all of my instructions and attach the requested logs, yes please.
     
    Kestrel13!, Nov 11, 2011
    #9
  10. Stokecity

    Stokecity Private E-2

    Copied and pasted the command prompt for the junction.exe and nothing happens? Only ran Win32KDiag as I wasnt sure if I should skip the junction.exe step or not before proceeding.

    Internet connection has been fine.
     
    Stokecity, Nov 12, 2011
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes, please proceed.
     
    Kestrel13!, Nov 12, 2011
    #11
  12. Stokecity

    Stokecity Private E-2

    Requested logs.
     

    Attached Files:

    Stokecity, Nov 13, 2011
    #12
  13. Stokecity

    Stokecity Private E-2

    Last of the logs.
     

    Attached Files:

    Stokecity, Nov 13, 2011
    #13
  14. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode

    We need to run an OTL Fix

    • Right-click OTL.exe And select " Run as administrator " to run it. If Windows UAC prompts you, please allow it.
    • Copy and Paste the following code into the textbox. Do not include the word Code
    Code:
    Code:
    :otl
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:2B11E0DF

:files
c:\windows\SysWow64\shoC82E.tmp
c:\windows\SysWow64\shoD5DA.tmp
c:\windows\SysWow64\sho7446.tmp
c:\windows\SysWow64\shoAD11.tmp
C:\Windows\assembly\temp\U
C:\Windows\assembly\temp\keywords
C:\Users\Ralphs Family\AppData\Local\Chromium
C:\Users\Ralphs Family\AppData\Local\SKIDROW
C:\Users\Ralphs Family\AppData\Local\{00D23DB7-DDCC-4097-A3A4-0937A61B32BD}
C:\Users\Ralphs Family\AppData\Local\{00D8F9C7-54F5-42D4-BA19-E174A6D7C779}
C:\Users\Ralphs Family\AppData\Local\{01FDB334-D5D0-47B1-A92A-A4CE0B4E3065}
C:\Users\Ralphs Family\AppData\Local\{0895A867-8B08-43F1-B475-90B811EEA4E2}
C:\Users\Ralphs Family\AppData\Local\{0A8AED71-602D-4C77-B5E0-F7372B40BEC6}
C:\Users\Ralphs Family\AppData\Local\{0AD1CD6C-1456-47B9-960F-3DB8667DDFD2}
C:\Users\Ralphs Family\AppData\Local\{0CD1F7F2-01DD-4635-8123-8A1677F9BA50}
C:\Users\Ralphs Family\AppData\Local\{0E3D1A67-3641-443B-837F-56EDAC06B454}
C:\Users\Ralphs Family\AppData\Local\{10E03297-F5E3-4D89-B61E-1A121D199620}
C:\Users\Ralphs Family\AppData\Local\{1357D661-C828-46C8-91A2-8E8C43EF7F48}
C:\Users\Ralphs Family\AppData\Local\{181573E8-A390-4077-ADF3-0713C73E5B52}
C:\Users\Ralphs Family\AppData\Local\{198B212A-EC1C-41BE-A49B-6C5D79F85940}
C:\Users\Ralphs Family\AppData\Local\{1A863DFF-C6BD-4DCD-AB59-7A45CF3188BC}
C:\Users\Ralphs Family\AppData\Local\{1D17196B-DF46-404F-9E31-2E24DB872AD1}
C:\Users\Ralphs Family\AppData\Local\{1EE53A4B-B0D8-400F-AFDD-5D8F6D125759}
C:\Users\Ralphs Family\AppData\Local\{2087A68B-8765-4FB7-8EC5-F90C81B409F7}
C:\Users\Ralphs Family\AppData\Local\{20A3EC0D-810A-40A3-B2A4-EDA6A90551A9}
C:\Users\Ralphs Family\AppData\Local\{2408FC63-CD14-4F50-9B1A-63CFBC598834}
C:\Users\Ralphs Family\AppData\Local\{25A4755B-97FE-4CB8-9A74-B57ADDABA6A1}
C:\Users\Ralphs Family\AppData\Local\{25BE2CC7-C8FE-4851-8CAB-A78017B5D899}
C:\Users\Ralphs Family\AppData\Local\{267CEB44-3347-41B7-A48A-77A50AAD75C5}
C:\Users\Ralphs Family\AppData\Local\{2C77DD49-17B6-4E83-9390-39F1019F4809}
C:\Users\Ralphs Family\AppData\Local\{2D62DEEE-E09B-457B-A7CA-AEACDCF5F6D9}
C:\Users\Ralphs Family\AppData\Local\{2E614144-A14D-4A53-8012-12F4668DCE1E}
C:\Users\Ralphs Family\AppData\Local\{301AA21B-C848-4418-BD07-8DA4663467C2}
C:\Users\Ralphs Family\AppData\Local\{31688475-D123-4444-A13C-E69D5F659C21}
C:\Users\Ralphs Family\AppData\Local\{32CC676C-93CF-4704-9C59-D5389DB0896D}
C:\Users\Ralphs Family\AppData\Local\{3385D964-272A-4326-AA96-767287188620}
C:\Users\Ralphs Family\AppData\Local\{3449BA7C-C6E7-466F-8BEB-9B3AD5EBB48C}
C:\Users\Ralphs Family\AppData\Local\{35B2DCD0-567F-4550-BEFF-723D05105DAE}
C:\Users\Ralphs Family\AppData\Local\{3720B3B0-97C5-43ED-8D6D-B4A6E3B3E6E6}
C:\Users\Ralphs Family\AppData\Local\{384A58CE-E613-4EA1-B613-9DAE1F036260}
C:\Users\Ralphs Family\AppData\Local\{38E06E3E-9F83-44A8-84B1-B8E0D37B7A90}
C:\Users\Ralphs Family\AppData\Local\{3C1B6DBE-0CF0-4A08-9F68-38027F2AC0AD}
C:\Users\Ralphs Family\AppData\Local\{3CD38562-EDFE-4E39-9FFB-F942F2481960}
C:\Users\Ralphs Family\AppData\Local\{3DA827F6-C14C-4292-B55E-661AAB10C165}
C:\Users\Ralphs Family\AppData\Local\{3E1882ED-E769-4CCB-A836-3C81ACDADAD9}
C:\Users\Ralphs Family\AppData\Local\{3FD626C3-66F5-4AE9-8A35-61C3D625DE40}
C:\Users\Ralphs Family\AppData\Local\{4025C21E-C381-4CF2-B6C5-007E0D0C33B0}
C:\Users\Ralphs Family\AppData\Local\{42633EB2-C0B9-424E-A4D9-C25108A98A99}
C:\Users\Ralphs Family\AppData\Local\{42B3FE77-FAD9-4690-9355-A67F92E3029A}
C:\Users\Ralphs Family\AppData\Local\{435E9D61-64C9-48E7-AC80-2263D852B2EE}
C:\Users\Ralphs Family\AppData\Local\{44CB56F4-F067-48F7-B265-11B73710769C}
C:\Users\Ralphs Family\AppData\Local\{45F25944-6837-4335-B2D3-B8999E0EA61A}
C:\Users\Ralphs Family\AppData\Local\{467A5AFC-2CD0-4AD1-9AC7-CC8161967E41}
C:\Users\Ralphs Family\AppData\Local\{46DD339D-FD9C-4CA7-BC63-BB415263A5DF}
C:\Users\Ralphs Family\AppData\Local\{490EB5DE-9913-44D1-888F-64700BAC0A16}
C:\Users\Ralphs Family\AppData\Local\{4A7F4160-C55C-481B-876B-01A78CE50EC9}
C:\Users\Ralphs Family\AppData\Local\{4AE11334-A47E-4365-A042-8FE1D2B39717}
C:\Users\Ralphs Family\AppData\Local\{4C65B5E0-7425-4FB6-AE3B-EFB9486D4FC4}
C:\Users\Ralphs Family\AppData\Local\{4C9883D8-1987-4D34-A6B8-24206227906E}
C:\Users\Ralphs Family\AppData\Local\{54717A01-9BD8-4E95-A7F5-828A8AD34762}
C:\Users\Ralphs Family\AppData\Local\{5634B820-F0E6-4DE1-8E63-B28D7726226F}
C:\Users\Ralphs Family\AppData\Local\{57DAE5D6-7C42-41BB-83AD-47795E9B077D}
C:\Users\Ralphs Family\AppData\Local\{5A023DF5-99D5-44AD-935A-02560BACC20D}
C:\Users\Ralphs Family\AppData\Local\{5A53629D-7E98-4EDC-A559-2BA8AD6E2D96}
C:\Users\Ralphs Family\AppData\Local\{5AC615CA-3488-4253-85A9-7E6549A65027}
C:\Users\Ralphs Family\AppData\Local\{5B2B2E1C-C2C9-4C74-A386-8C0ADC87B32B}
C:\Users\Ralphs Family\AppData\Local\{5C00DBF0-F7AC-4E4D-A9BF-6F07A19821A9}
C:\Users\Ralphs Family\AppData\Local\{5F69FBAA-098F-44B9-8F42-CF6CBBB2DB86}
C:\Users\Ralphs Family\AppData\Local\{61305AAC-F700-4E5A-9DA1-00A97EEF2375}
C:\Users\Ralphs Family\AppData\Local\{639BCC76-8913-4291-9A10-54A5A9E7D8F3}
C:\Users\Ralphs Family\AppData\Local\{642741F4-00A1-4014-AB9D-55ADC9BB16DA}
C:\Users\Ralphs Family\AppData\Local\{645A995F-486A-4853-B312-A2016D1982AF}
C:\Users\Ralphs Family\AppData\Local\{6498DE9F-724C-4515-9A42-A63433F50AB7}
C:\Users\Ralphs Family\AppData\Local\{674307B9-EC0A-4D1A-BAE0-2B28FDC977C2}
C:\Users\Ralphs Family\AppData\Local\{67CAFB21-D1C4-4FDE-BBB9-28CE8C1F5302}
C:\Users\Ralphs Family\AppData\Local\{6937EAFB-E208-48C8-B1E5-3C35DCB30C84}
C:\Users\Ralphs Family\AppData\Local\{6A7DAA44-46E9-4D1A-B059-0A4A5901DC84}
C:\Users\Ralphs Family\AppData\Local\{6ADD3EB1-BF5D-4A42-94BA-C72D7CCF77AA}
C:\Users\Ralphs Family\AppData\Local\{70559D5C-3AB1-4422-81F8-88C4251FC854}
C:\Users\Ralphs Family\AppData\Local\{7A7A671E-5B8C-4279-962D-3A868A586B31}
C:\Users\Ralphs Family\AppData\Local\{7C52786F-BDA9-4DDB-ADA4-B91365B9C24A}
C:\Users\Ralphs Family\AppData\Local\{7DADE556-BA0B-44F7-9670-9A4D752EE408}
C:\Users\Ralphs Family\AppData\Local\{7FEB8164-AD85-4E16-B2B0-7A191185E151}
C:\Users\Ralphs Family\AppData\Local\{80433C5E-0979-43FF-A9E9-B282E71A2ABF}
C:\Users\Ralphs Family\AppData\Local\{80C302E3-15EF-4C4E-A8C0-E59FC3398EAE}
C:\Users\Ralphs Family\AppData\Local\{80FD40FB-F8EB-40CA-9F3F-D84058AABCB2}
C:\Users\Ralphs Family\AppData\Local\{82E99350-ED9A-4739-99A8-5CA3B5957259}
C:\Users\Ralphs Family\AppData\Local\{849115BC-1268-4C28-B4B9-D6B22D17D541}
C:\Users\Ralphs Family\AppData\Local\{85C42AE4-FAE5-487D-9074-A6C1486BCF05}
C:\Users\Ralphs Family\AppData\Local\{8664E968-3AB3-46AB-AD50-115E8C14BCFA}
C:\Users\Ralphs Family\AppData\Local\{8E410C2E-66DC-4ABC-AEE5-3B0220FE33DE}
C:\Users\Ralphs Family\AppData\Local\{8F15FF58-45CB-41D8-A0B2-6856BA93EF3D}
C:\Users\Ralphs Family\AppData\Local\{8F8823D8-3B8B-4845-9A1E-BD197930FD4D}
C:\Users\Ralphs Family\AppData\Local\{90ED5D82-F2AE-44C2-B8BB-DBDAD2164340}
C:\Users\Ralphs Family\AppData\Local\{91AE312A-FE5C-4249-B9EF-99A1CFF710B2}
C:\Users\Ralphs Family\AppData\Local\{93EAB7B8-E310-4C82-AE31-0A02674E730E}
C:\Users\Ralphs Family\AppData\Local\{9436E996-3376-4109-8AE4-799401D5AB79}
C:\Users\Ralphs Family\AppData\Local\{944763E1-1B0F-4354-8063-01C34672F410}
C:\Users\Ralphs Family\AppData\Local\{956B3DD9-5EB9-4502-B536-AFD3721807E3}
C:\Users\Ralphs Family\AppData\Local\{9B14C291-3A03-4E5D-83F6-A0E837093B44}
C:\Users\Ralphs Family\AppData\Local\{9B66FD3A-928C-4C70-ADFB-5697AC0C669F}
C:\Users\Ralphs Family\AppData\Local\{9C6755AC-922C-4E6F-B409-0C103802F429}
C:\Users\Ralphs Family\AppData\Local\{9CC2B307-F223-42CB-9257-1764E3DAFDBF}
C:\Users\Ralphs Family\AppData\Local\{9D7D13B6-5248-4D14-9F64-EFB709C052AF}
C:\Users\Ralphs Family\AppData\Local\{9FCDA3DA-91FE-49A3-A760-F952BFA6AE71}
C:\Users\Ralphs Family\AppData\Local\{A03C6D34-C924-4D06-BE99-A8D55F55D924}
C:\Users\Ralphs Family\AppData\Local\{A28B45FA-4B6B-48E4-AB63-C01A3548E208}
C:\Users\Ralphs Family\AppData\Local\{A2DF561D-91E1-409B-B7AC-9D45238F640E}
C:\Users\Ralphs Family\AppData\Local\{A71496A3-D77A-498C-8378-F148BF88C496}
C:\Users\Ralphs Family\AppData\Local\{A783C2AF-946C-4C17-BB15-8E30971CF744}
C:\Users\Ralphs Family\AppData\Local\{A8FB9953-C93F-4AF7-86EC-6E2512D6CCD0}
C:\Users\Ralphs Family\AppData\Local\{A92254B9-5A05-4CCA-8460-91DE63637098}
C:\Users\Ralphs Family\AppData\Local\{A930BF69-08D2-4737-8E3A-7ADDD74C4872}
C:\Users\Ralphs Family\AppData\Local\{A946B7CA-C6C8-4F63-9815-62CD18ECA6B0}
C:\Users\Ralphs Family\AppData\Local\{AAF35F8B-92EC-4E76-B913-16DDB61D5203}
C:\Users\Ralphs Family\AppData\Local\{AC72C6FD-B66F-41B3-80BE-5F94DFFF4153}
C:\Users\Ralphs Family\AppData\Local\{AEB2EC6B-11BF-496F-A68E-F482F198B595}
C:\Users\Ralphs Family\AppData\Local\{B0E547D4-FE3A-4F55-B397-471F83909E93}
C:\Users\Ralphs Family\AppData\Local\{B3D5EE85-7A60-4814-A216-799FBCF92DD6}
C:\Users\Ralphs Family\AppData\Local\{B42EF6FE-C105-4873-A7E4-327C0B69394D}
C:\Users\Ralphs Family\AppData\Local\{B5E6DF49-6F28-46A2-BC8E-7A48EC985901}
C:\Users\Ralphs Family\AppData\Local\{B7596050-EB6B-4EDD-931F-D4B5F971B8EA}
C:\Users\Ralphs Family\AppData\Local\{BA8D641B-0103-41EC-8B87-1FC54C492420}
C:\Users\Ralphs Family\AppData\Local\{BB3D8D58-CD4E-42E9-B8E2-578A111B9E0A}
C:\Users\Ralphs Family\AppData\Local\{BBFEEE80-C97A-47F6-BB32-1CA954AD90B9}
C:\Users\Ralphs Family\AppData\Local\{BD096E30-1627-42A9-A314-A19CDB6B85FA}
C:\Users\Ralphs Family\AppData\Local\{BD222FD3-33AB-4735-94CE-E74C686069D9}
C:\Users\Ralphs Family\AppData\Local\{BE4DE99C-22D6-47BE-88EC-83B18AE7BE62}
C:\Users\Ralphs Family\AppData\Local\{BEB4FCA0-CA3B-49DA-B5A1-C807CA53E51E}
C:\Users\Ralphs Family\AppData\Local\{BFDBBCC3-CE63-4AAB-AA27-F5472BA34F9B}
C:\Users\Ralphs Family\AppData\Local\{C0122797-67A3-4DE0-B57F-30FCAF1C5870}
C:\Users\Ralphs Family\AppData\Local\{C0484F77-16F0-4B19-900C-35AB8A4316D7}
C:\Users\Ralphs Family\AppData\Local\{C0F2FEBA-2896-4425-BAEB-102A09846159}
C:\Users\Ralphs Family\AppData\Local\{C127E304-8A68-4062-A1F4-D25697705A17}
C:\Users\Ralphs Family\AppData\Local\{C2D2FE68-C952-4623-BDE4-C439EFCA7076}
C:\Users\Ralphs Family\AppData\Local\{C32A1B66-3783-45EF-82D5-445D0887D36A}
C:\Users\Ralphs Family\AppData\Local\{C3680453-838C-4DBB-BC13-4497BC1A1079}
C:\Users\Ralphs Family\AppData\Local\{C560C759-422E-4E96-A3E1-6D978516DBC7}
C:\Users\Ralphs Family\AppData\Local\{C6C0FC53-83B4-41E8-9922-ABC83A8B3099}
C:\Users\Ralphs Family\AppData\Local\{CA0C3875-1481-48DD-A3ED-59442C34989A}
C:\Users\Ralphs Family\AppData\Local\{CD9428FC-AF0B-47BE-A514-14C3B87AD8EE}
C:\Users\Ralphs Family\AppData\Local\{D09BBB9B-108F-4B12-9403-36E69C3FC436}
C:\Users\Ralphs Family\AppData\Local\{D157A56A-6C54-48F8-B4EC-1AB7232A4264}
C:\Users\Ralphs Family\AppData\Local\{D29E5A57-909E-4E4B-8B56-9F3CEBBC7783}
C:\Users\Ralphs Family\AppData\Local\{D567AB76-96A7-46DB-B067-513767C6DAE9}
C:\Users\Ralphs Family\AppData\Local\{D6CBA209-238A-45F8-9A6F-13210958518C}
C:\Users\Ralphs Family\AppData\Local\{D7E79722-CE0A-4737-85F5-FFF8FCF1A457}
C:\Users\Ralphs Family\AppData\Local\{D8958ED4-AFEB-4E4E-9B6C-D4DD130975F6}
C:\Users\Ralphs Family\AppData\Local\{D9ADF3F1-1BC6-4DE1-9BBC-DB42B7D28B4B}
C:\Users\Ralphs Family\AppData\Local\{DBD8F636-D1C9-40A3-99EE-D69BC8E4AC27}
C:\Users\Ralphs Family\AppData\Local\{DEBCEFE6-EC2B-4CFC-A9B8-9B9B89E57ECD}
C:\Users\Ralphs Family\AppData\Local\{DEE68674-D4E1-43B9-90E4-844B70A8E9AF}
C:\Users\Ralphs Family\AppData\Local\{E09AFDFA-3F49-4C95-B769-D19B5D4B0E18}
C:\Users\Ralphs Family\AppData\Local\{E435BEC6-4965-44D3-92FE-D1AE704D16F7}
C:\Users\Ralphs Family\AppData\Local\{E5C5495F-23D0-4107-8495-51458B5161D2}
C:\Users\Ralphs Family\AppData\Local\{E66F0E73-A597-452D-AFEB-6D4967BC75BC}
C:\Users\Ralphs Family\AppData\Local\{E78F1DF2-4ABF-4A62-8B16-0C6698A96E2D}
C:\Users\Ralphs Family\AppData\Local\{EA7AA69F-DE8B-4D14-902F-D4CCEA8FCFD1}
C:\Users\Ralphs Family\AppData\Local\{EB17EF5B-CDF8-4D43-AD3A-896A052FF43B}
C:\Users\Ralphs Family\AppData\Local\{EDB6E69B-269A-41FF-A617-37E0D0F00792}
C:\Users\Ralphs Family\AppData\Local\{EEB61A9E-BFDF-4BB6-95C6-3BB4C99D37FD}
C:\Users\Ralphs Family\AppData\Local\{EEC14DCF-7466-4474-B80E-A5205500AC94}
C:\Users\Ralphs Family\AppData\Local\{F0857016-7A3D-4F95-A523-1EA19742CC4C}
C:\Users\Ralphs Family\AppData\Local\{F1309311-9CAD-4D03-87CF-582914DB3A88}
C:\Users\Ralphs Family\AppData\Local\{F1FCCD5C-39A3-4FAD-BD4B-107EC78F2DA7}
C:\Users\Ralphs Family\AppData\Local\{F34DA476-BA04-4D20-8D03-8BD19590A388}
C:\Users\Ralphs Family\AppData\Local\{F6CABD50-F0A4-49BB-BFA3-E74047300A21}
C:\Users\Ralphs Family\AppData\Local\{F7DECC33-A057-4F80-B974-B5EEBF1FB188}
C:\Users\Ralphs Family\AppData\Local\{F848BCC7-BC7A-44EC-8469-64671392F439}
C:\Users\Ralphs Family\AppData\Local\{FA5AFADB-A57D-4980-BBC7-BF2238D1F04D}
C:\Users\Ralphs Family\AppData\Local\{FC717D16-79E0-44FD-A6F2-3C4FC9B79124}
C:\Users\Ralphs Family\AppData\Local\{FECD2E93-256F-40AD-9123-712A37825B75}
C:\Users\Ralphs Family\AppData\Local\{FF0DBAB3-6F3C-4EAB-99F1-88B7F450EF12}
C:\Users\Ralphs Family\AppData\Local\{FF40B5F2-C25E-446B-A728-670EE20C5BF4}
C:\Users\Ralphs Family\AppData\Local\{FF5FAEC7-131D-44B1-80FF-82C431159C97}
  
:commands
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click Image.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. ATTACH that report in your next reply.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
    Kestrel13!, Nov 13, 2011
    #14
  15. Stokecity

    Stokecity Private E-2

    Having trouble with OTL, I get an error message which I will attach a screenshot of and after I click OK on the error message the scan stays at the same point for hours and will not change.

    Also, why are folder like My Picture dupilcated both sort of greyed out and one has a padlock next to it. (See screenshot)
     

    Attached Files:

    Stokecity, Nov 14, 2011
    #15
  16. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Run the script again but disinclude [RESETHOSTS] under :commands section. Tell me how that goes.
     
    Kestrel13!, Nov 14, 2011
    #16
  17. Stokecity

    Stokecity Private E-2

    The first two logs are when I recieved the error and closed OTL then rebooted manually, the third log is without the reset hosts command.
     

    Attached Files:

    Stokecity, Nov 14, 2011
    #17
  18. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    OK. Run OTL again like you did in post number 7, and attach the log, then run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
     
    Kestrel13!, Nov 14, 2011
    #18
  19. Stokecity

    Stokecity Private E-2

    Done, without any problems so far.
     

    Attached Files:

    Stokecity, Nov 14, 2011
    #19
  20. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Delete these folders:

    C:\Users\Ralphs Family\AppData\Local\{128AEB7A-C033-4475-9FF0-98C7AF3C82B4}
    C:\Users\Ralphs Family\AppData\Local\{1A787A33-DA29-4782-8A48-6CAF31FE912E}
    C:\Users\Ralphs Family\AppData\Local\{202DB256-79F6-4F21-A678-43FD4F31FBD2}
    C:\Users\Ralphs Family\AppData\Local\{34A83EC4-65FC-4A71-9BE1-97EB46A2BA6D}
    C:\Users\Ralphs Family\AppData\Local\{395743A3-68F6-4CE1-8C8F-80A0CB380FBD}
    C:\Users\Ralphs Family\AppData\Local\{4926FCEF-E900-4D3E-9E4E-1ABCC900E280}
    C:\Users\Ralphs Family\AppData\Local\{57EDCCE0-2D2F-43F2-92FB-CD7D121AF12F}
    C:\Users\Ralphs Family\AppData\Local\{78688AD1-0D65-4990-8311-1CDCA3DEAC7E}
    C:\Users\Ralphs Family\AppData\Local\{829AA0F5-7565-4D4F-9E93-FB67875876EA}
    C:\Users\Ralphs Family\AppData\Local\{8C58F195-DDF7-46D2-94FA-C354210E1C90}
    C:\Users\Ralphs Family\AppData\Local\{93B51D25-BA8D-4F2A-9861-1907201E1893}
    C:\Users\Ralphs Family\AppData\Local\{944D61BC-4014-4AF7-AFE6-BF54CBB2742D}
    C:\Users\Ralphs Family\AppData\Local\{A602D4D0-56DE-432F-A018-8C610522F98D}
    C:\Users\Ralphs Family\AppData\Local\{B023F8D6-45DA-4FDE-8F14-43B7287A004C}
    C:\Users\Ralphs Family\AppData\Local\{CBBC08ED-1508-44DD-982D-04B65FF05D38}
    C:\Users\Ralphs Family\AppData\Local\{CF4C0C01-CCD7-4FCD-86C0-DF9F379F7979}
    C:\Users\Ralphs Family\AppData\Local\{E6F3C3C3-9201-4B81-A8BD-07303D7C91DB}
    C:\Users\Ralphs Family\AppData\Local\{EAC1C812-FB50-4CB3-8015-BB8FF048692D}
    C:\Users\Ralphs Family\AppData\Local\{F7DC966C-FEB1-4309-ACB7-5274CD5113C5}

    Are you still being redirected?
     
    Kestrel13!, Nov 15, 2011
    #20
  21. Stokecity

    Stokecity Private E-2

    Done, havent been redirected for a long time so all seems well. Thanks
     
    Stokecity, Nov 15, 2011
    #21
  22. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You're welcome. :)

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required (If we renamed it please rename it back to Combofix.exe.
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Nov 15, 2011
    #22
  23. Stokecity

    Stokecity Private E-2

    Thanks again for all your help:)
     
    Stokecity, Nov 15, 2011
    #23
  24. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    No problem! Safe surfing! :)
     
    Kestrel13!, Nov 15, 2011
    #24

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds