Redirects and multiple instances of iexplore.exe

As usual, the logs from the below are what we need and they do not ask for a HJT log since they are not that helpful anymore.

Please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide

and attach the requested logs when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
​

 

The instructions in the READ & RUN explained that you need to disable or uninstall your protection software to run ComboFix and possibly other scans.


You skipped a bunch of instructions!!!!!

• You also need to attach the logs from SUPERAntiSpyware and Malwarebytes. You did not even install SUPERAntiSpyware which is the first scan we asked you to run.
• You also did not uninstall the old Sun Java versions and update to the new version as requested.
• You did not put your PC into Normal Startup mode with MSconfig as requested in step 4.

If you skip steps, we cannot help you.

You need to do all of the above and then get a new log from MGtools and attach it.

 

Our instructions specify to attach logs even if nothing is found. It is how we verify that you are running correct versions of programs.

You need to attach the new log from MGtools.

 

You did not attach anything.

 

You should not be running anything we do not ask you to run. i.e., We did not ask you to run Norman and would not have. It has too many false detections like all of the registry items in your log. They were already set to the correct values. And the hide.reg patch in the MGtools folder is necessary and part of MGtools. It is just used to rehide hidden and system files when we finish. Norman is not detecting anything valid.

Have you disabled your Daemon Tools drive emulation software as requested in the READ & RUN ME?? It appears that you skipped this step too and you need to do this right now before continuing. See step 6 of the READ & RUN ME.


Please delete any copies of TDSSkiller you have since it is out of date and then do the below.


Download TDSSKiller from Kaspersky to your directly onto your Desktop

• Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7 do not double click on it but rather, right click and select Run As Administrartor. )
• Allow the application to run if prompted by Windows or any security programs you have installed
• It will start the scan and run rather quickly and will notify you of whether anything is found or not.
• Follow the instructions to delete/quarantine if asks you what to do when if finds something.
• Whether an infection is found or not, a log file should be created on your C: drive ( or whatever drive you boot from) in the root folder named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

 

Okay running defogger cleared up a bunch of things in your logs that were looking like possible malware/rookits. Your logs look good now.

Are you still having problems?

 

You need to remove ComboFix from the below folder and put it directly on your Desktop as requested:
c:\users\Les\Desktop\antivirus\ComboFix.exe

Normal for IE7 and above which added tabbed browsing.

Are you sure hit is just not related to a website you are on? Your logs are clean. What I will suggest since some malware has been know to affect routers and modems is that you do the below:

• If you have a router hooked up then you need to follow the instructions for your hardware and reset it to factory default settings. Normally there is a recessed push button type switch that needs to be held down for some number of seconds to do this. After resetting to factory defaults on your router, you will need to reconfigure the router for your network if you have made any changes to the default network setup.
• Now physically power down your router and DSL or Cable modems for a minute and then turn them back on.

Now see if you still have a problem with redirects.

Don't get too spoiled! You currently have no protection software installed and things will run faster without any installed. However you are living dangerously if you keep running in that mode for too long.

 

What do you mean by "it blocks me"?

There are many many reasons for problems with Windows Update and many of these are not due to malware. Frequently it is problems within Windows itself. Try running Internet Explorer with no addons ( right click the icon on your Desktop and select this option ) then see if you can get updates. Is your copy of Windows legit and licensed to you.

This is for Windows Media Player Network Sharing Configuration. You can post about this and Windows Update issues in the Software Forum.

 

Oh and just as an FYI, a nice description of what wmpnscfg.exe and wmpnetwk.exe are and why they run and how to stop them, can be found in the below:

http://www.howtogeek.com/howto/windows-vista/what-are-wmpnscfgexe-and-wmpnetwkexe-and-why-are-they-running/

 

You're welcome.

Many of the new infections that are around impact external hardware devices like routers and modems and can cause the DNS settings to be modified to the malware sites. Sometimes a simple power cycle is enough to fix it and sometimes you may have to reburn the firmware into the devices too.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!