Google search engine not workig ** dds report *** attach zip*** please help malware

[Blade81]

Hi again,

Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:

• Run Spybot-S&D in Advanced Mode
• If it is not already set to do this, go to the Mode menu
  select
  Advanced Mode
  
• On the left hand side, click on Tools
• Then click on the Resident icon in the list
• Uncheck
  Resident TeaTimer
  and OK any prompts.
• Restart your computer

Open notepad and copy/paste the text in the quotebox below into it:

DDS::
mStart Page = hxxp://start.funmoods.com/?f=1&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe (let the tool to update itself if prompted).
Then post the resultant log.


If you don't need Java it's recommended to uninstall it. Let me know if that's not an option for you.


* Go here to run an online scanner from ESET.

• Note: You will need to use Internet explorer for this scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
• Click Scan
• Wait for the scan to finish.

Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

[kidkrops]

Sorry, i couldnt uninstall JAVa, thats not really an option...Also everytime i run cobofix it says that i have somethign AVG update running but i dont even have AVG software installed on my computer..


Here is latest
COMBO FIX LOG::

ComboFix 12-09-06.02 - Joe 09/06/2012 12:59:19.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2403 [GMT -4:00]
Running from: c:\documents and settings\Joe\Desktop\help\ComboFix.exe
Command switches used :: c:\documents and settings\Joe\Desktop\CFScript.txt
AV: AVG Anti-Virus 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-08-06 to 2012-09-06 )))))))))))))))))))))))))))))))
.
.
2012-09-06 16:27 . 2012-09-06 16:27 -------- d-----w- c:\program files\ESET
2012-09-05 18:22 . 2012-09-05 18:22 -------- d-----w- C:\TDSSKiller_Quarantine
2012-09-05 18:21 . 2012-09-05 18:21 -------- d-----w- C:\tdsskiller
2012-09-05 18:20 . 2012-08-24 13:28 2211928 ----a-w- C:\TDSSKiller.exe
2012-09-03 17:35 . 2012-09-03 17:37 -------- d-----w- c:\windows\SxsCaPendDel
2012-08-25 19:56 . 2012-09-03 17:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2012-08-17 21:24 . 2012-09-05 19:48 -------- d-----w- c:\documents and settings\Joe\Local Settings\Application Data\Deployment
2012-08-08 00:21 . 2012-08-08 00:21 -------- d-----w- c:\program files\Common Files\Java
2012-08-08 00:21 . 2012-08-08 00:21 -------- d-----w- c:\documents and settings\Joe\Local Settings\Application Data\Sun
2012-08-08 00:20 . 2012-08-08 00:20 -------- d-----w- c:\program files\Oracle
2012-08-08 00:20 . 2012-08-08 00:20 -------- d-----w- c:\documents and settings\Joe\Application Data\Oracle
2012-08-08 00:20 . 2012-07-06 02:06 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-08-08 00:18 . 2012-08-08 00:18 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2012-08-08 00:12 . 2012-08-08 00:12 -------- d-----w- c:\program files\Citrix
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 13:58 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-06 02:07 . 2012-03-16 04:23 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-07-04 14:05 . 2011-11-01 20:25 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2004-08-04 12:00 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 12:00 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-11-02 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-26 16132608]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-09-08 98304]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-06-15 1532760]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 20992]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-12-23 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-6-22 984936]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
"c:\\Program Files\\Java\\jre7\\bin\\javaw.exe"=
.
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/2/2011 1:19 AM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/2/2011 1:19 AM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-02 05:19]
.
2012-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-02 05:19]
.
2012-09-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-789336058-725345543-1004Core.job
- c:\documents and settings\Joe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-11-02 05:24]
.
2012-09-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-823518204-789336058-725345543-1004UA.job
- c:\documents and settings\Joe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-11-02 05:24]
.
2012-09-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-823518204-789336058-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 21:02]
.
2012-09-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-823518204-789336058-725345543-1004.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 21:02]
.
2012-09-06 c:\windows\Tasks\User_Feed_Synchronization-{D288B110-DBAE-473C-9AF0-7ACA0638B08D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://start.funmoods.com/?f=1&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579
TCP: DhcpNameServer = 167.206.251.129 167.206.251.130
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-PDF Reader - c:\program files\PDFReader\Uninstall\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-06 13:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(3572)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-09-06 13:02:29
ComboFix-quarantined-files.txt 2012-09-06 17:02
ComboFix2.txt 2012-09-06 16:19
ComboFix3.txt 2012-09-05 19:19
ComboFix4.txt 2012-09-05 17:17
ComboFix5.txt 2012-09-06 16:58
.
Pre-Run: 292,170,928,128 bytes free
Post-Run: 292,181,770,240 bytes free
.
- - End Of File - - E4D5CE797A59B9DB63A27661BB736A34



DDS LOG:::


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1
Run by Joe at 12:53:18 on 2012-09-06
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.1843 [GMT -4:00]
.
AV: AVG Anti-Virus 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://start.funmoods.com/?f=1&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\docume~1\joe\desktop\help\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\docume~1\joe\desktop\help\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1320210431218
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1320215336734
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 167.206.251.129 167.206.251.130
TCP: Interfaces\{13DC235B-8EBF-4AFA-B4FD-6A3FF757B880} : DhcpNameServer = 167.206.251.129 167.206.251.130
Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-11-2 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-11-2 136176]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-09-06 16:27:47 -------- d-----w- c:\program files\ESET
2012-09-05 18:22:07 -------- d-----w- C:\TDSSKiller_Quarantine
2012-09-05 18:21:18 -------- d-----w- C:\tdsskiller
2012-09-05 18:20:56 2211928 ----a-w- C:\TDSSKiller.exe
2012-09-04 22:48:10 -------- d-sha-r- C:\cmdcons
2012-09-04 22:34:36 98816 ----a-w- c:\windows\sed.exe
2012-09-04 22:34:36 518144 ----a-w- c:\windows\SWREG.exe
2012-09-04 22:34:36 256000 ----a-w- c:\windows\PEV.exe
2012-09-04 22:34:36 208896 ----a-w- c:\windows\MBR.exe
2012-09-03 17:35:11 -------- d-----w- c:\windows\SxsCaPendDel
2012-08-25 19:56:27 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy
2012-08-17 21:24:19 -------- d-----w- c:\documents and settings\joe\local settings\application data\Deployment
2012-08-08 00:21:54 -------- d-----w- c:\documents and settings\joe\local settings\application data\Sun
2012-08-08 00:20:45 -------- d-----w- c:\program files\Oracle
2012-08-08 00:20:28 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-08-08 00:12:01 -------- d-----w- c:\program files\Citrix
.
==================== Find3M ====================
.
2012-07-06 13:58:51 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-06 02:07:08 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-07-04 14:05:18 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 ----a-w- c:\windows\system32\html.iec
.
============= FINISH: 12:53:33.10 ===============



Results of Online SCAN:

C:\Program Files\PDFReader\Uninstall\Uninstall.exe a variant of Win32/InstallCore.K application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP193\A0045786.exe Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP193\A0045787.dll a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP193\A0045788.exe a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP193\A0045791.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP199\A0050041.exe a variant of Win32/InstallCore.AG application cleaned by deleting - quarantined
C:\System Volume Information\_restore{FA6B17F2-B82A-4382-B17C-C53A923D7A54}\RP200\A0054761.exe a variant of Win32/InstallCore.K application cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0003.dta Win32/Olmarik.AYH trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0004.dta Win64/Olmarik.AL trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0005.dta a variant of Win32/Rootkit.Kryptik.NH trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0006.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0010.dta Win32/Olmarik.AFK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0011.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\05.09.2012_14.21.44\mbr0000\tdlfs0000\tsk0014.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined

[Blade81]

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 7 Update 7.
• Click the
  Download
  button to the right.
• Select Windows on platform combobox and check the box that says:
  Accept License Agreement. Click continue.
  
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7u7-windows-i586.exe to install the newest version.

Please download the Registry Search tool by clicking on the
hard drive icon halfway down this page:
http://www.billsway.com/vbspage/
Save it to the desktop and run it. If you get an alert from your antivirus about scripting, choose to allow the script to run. Search for start.funmoods.com and click OK. Post the logfile from the tool here for me.

[tashi]

New topic closed: http://forums.spybot.info/showthread...800#post430800

[kidkrops]

Hey, i just ran what you said and the registry log and it says that nothing was found,

[kidkrops]

Hey, i just ran what you said and the registry log and it says that nothing was found,

Opps, i lied..

here is the LOG you asked for:


REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "start.funmoods.com" 9/10/2012 1:05:07 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"="http://start.funmoods.com/?f=1&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BDABC278-C6D0-4DA1-8A6E-C98DA4593281}]
"FaviconURL"="http://start.funmoods.com/favicon.ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BDABC278-C6D0-4DA1-8A6E-C98DA4593281}]
"URL"="http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BDABC278-C6D0-4DA1-8A6E-C98DA4593281}]
"TopResultURLFallback"="http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BDABC278-C6D0-4DA1-8A6E-C98DA4593281}]
"FaviconURLFallback"="http://start.funmoods.com/favicon.ico"

[HKEY_USERS\S-1-5-21-823518204-789336058-725345543-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"URL"="http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579"

[HKEY_USERS\S-1-5-21-823518204-789336058-725345543-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURLFallback"="http://start.funmoods.com/favicon.ico"

[HKEY_USERS\S-1-5-21-823518204-789336058-725345543-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"TopResultURLFallback"="http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=test312&chnl=test312&cd=2XzuyEtN2Y1L1QzutDtDtBtCzy0BtD0CyDyE0B0DyC0B0A0BtN0D0Tzu0CtByEzztN1L2XzutBtFtCtFtCtFtAtCtB&cr=351168579"

[HKEY_USERS\S-1-5-21-823518204-789336058-725345543-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
"FaviconURL"="http://start.funmoods.com/favicon.ico"

[Blade81]

Hi,

In IE click tools->internet options and there settings button of search section. Manage Add-ons window opens up. Take a screenshot of the view having Search Providers selected.

[kidkrops]

here is the screenshot, i realized that i had funmodes as a provider, i removed it useing the remove button.


thanks for the help BlaDE

[kidkrops]

includes sceenshot in proper format!

here is the screenshot, i realized that i had funmodes as a provider, i removed it useing the remove button.


thanks for the help BlaDE

[kidkrops]

just screenshot this time.