November 9th, 2009, 09:06 AM
#1
Crunchie, Avenger did not find anything, here is the Avenger log and a new HiJack this log:http://swandog46.geekstogo.com http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.hp.com/ https://mygmgw.gm.com/http://usabhem...m/iNotes6W.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://cdn.scan.onecare.live.com/res...scbase5036.cab http://www.update.microsoft.com/wind...?1253794816171 http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
November 9th, 2009, 04:38 PM
#2
Can you open a comand prompt and type in ipconfig /flushdns and include the space. See if the redirects still occur.
November 9th, 2009, 08:02 PM
#3
Crunchie,
November 10th, 2009, 12:22 AM
#4
Can you download Windows Defender and install, then update it. Run a full scan and remove what is found.
November 10th, 2009, 09:15 AM
#5
Crunchie,http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.hp.com/ https://mygmgw.gm.com/http://usabhem...m/iNotes6W.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://cdn.scan.onecare.live.com/res...scbase5036.cab http://www.update.microsoft.com/wind...?1253794816171 http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
November 10th, 2009, 04:33 PM
#6
Does Avira give a location for the file?
November 10th, 2009, 05:11 PM
#7
Yes it does, Avira saya that it wants to go into C:\Windows\system32
November 10th, 2009, 07:49 PM
#8
1. Please open Notepad Click Start , then Run Type notepad.exe in the Run Box. copy/paste the entire content of the codebox below into the Notepad window:
Code:
KillAll::
File::
C:\WINDOWS\system32\tdlwsp.dll
FixCSet::
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Save the above as CFScript.txt STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.re-enable all the programs that were disabled during the running of ComboFix:Combofix.txt A new HijackThis log .Please take note :CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.
November 10th, 2009, 08:17 PM
#9
Crunchie,
November 10th, 2009, 08:58 PM
#10
Did you uninstall, or just delete it? Really, until we are finished, you should leave everything alone. this link for combofix and follow my last instructions please.
November 11th, 2009, 09:39 AM
#11
Crunchie,http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://www.gmer.net
November 11th, 2009, 09:40 AM
#12
HijackThis log:http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.hp.com/ https://mygmgw.gm.com/http://usabhem...m/iNotes6W.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://cdn.scan.onecare.live.com/res...scbase5036.cab http://www.update.microsoft.com/wind...?1253794816171 http://vsp.closetmaid.com/vsp/cmaidc...downloader.cab
November 11th, 2009, 04:52 PM
#13
I see that combofix has been run five times. Can you locate the folder "C:\qoobox' and post any combofix.txt files there please. Attach them would probably be better.open Notepad Click Start , then Run Type notepad.exe in the Run Box. copy/paste the entire content of the codebox below into the Notepad window:
Code:
KillAll::
File::
c:\windows\system32\tdlrm.dll
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Save the above as CFScript.txt STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.re-enable all the programs that were disabled during the running of ComboFix:Combofix.txt A new HijackThis log .Please take note :CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.
November 11th, 2009, 05:14 PM
#14
Crunchie,
November 11th, 2009, 05:47 PM
#15
Crunchie,http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://www.gmer.net
Thread Information
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
Forum Rules
Reply With Quote
.
