NutherStamper
2013-09-02, 20:46
I'm hoping I'm doing this correctly. We were getting pop ups from tumri.net (although at the moment we are not but I have a feeling it's lurking. Ran Microsoft Security essentials, microsoft safety scanner, spybot S&D, and microsoft malicious software removal tool (this last one was run in safe mode)and nothing popped up in any of them. Just before I got out of safe mode and AOL malware tool popped up (I don't know where that came from) and it detected two things IST bar and Mirar. I blocked both. Thought that fixed it but then tumri.net started popping up again. Then it just stopped popping up. I have my hosts and home page locked so I don't know if it just resided in a temp file somewhere that got deleted or what but I would like some help in checking to make sure we are clean.
Here's the dds.txt file:
nosGetPlusHelper [2004-8-26 14336]
.
=============== Created Last 30 ================
.
2013-09-02 16:34:24 388608 ----a-w- C:\HijackThis.exe
2013-09-02 07:04:40 60872 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\offreg.dll
2013-09-02 07:04:40 29904 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\MpKsl0cd89564.sys
2013-09-02 07:02:11 7166848 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\mpengine.dll
2013-09-01 22:07:49 -------- d-----w- c:\documents and settings\all
users\application data\Licenses
2013-09-01 20:21:53 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
.
==================== Find3M ====================
.
2010-10-01 11:07:10 28672752 ----a-w- c:\program
files\7zip-uber-setup.exe
.
============= FINISH: 13:11:19.51 ===============
I can't figure out how to attach the zipped attach.txt file to this post. If you can point me in the right direction on how to do that I can send that as well.
thanks for any help you can give me with this problem. I have no idea where this thing came from.
Here's the dds.txt file:
nosGetPlusHelper [2004-8-26 14336]
.
=============== Created Last 30 ================
.
2013-09-02 16:34:24 388608 ----a-w- C:\HijackThis.exe
2013-09-02 07:04:40 60872 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\offreg.dll
2013-09-02 07:04:40 29904 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\MpKsl0cd89564.sys
2013-09-02 07:02:11 7166848 ----a-w- c:\documents and settings\all
users\application data\microsoft\microsoft antimalware\definition
updates\{9078bb8f-b852-4859-948a-ed4cba7cc033}\mpengine.dll
2013-09-01 22:07:49 -------- d-----w- c:\documents and settings\all
users\application data\Licenses
2013-09-01 20:21:53 15384 ----a-w- c:\windows\system32\wuapi.dll.mui
.
==================== Find3M ====================
.
2010-10-01 11:07:10 28672752 ----a-w- c:\program
files\7zip-uber-setup.exe
.
============= FINISH: 13:11:19.51 ===============
I can't figure out how to attach the zipped attach.txt file to this post. If you can point me in the right direction on how to do that I can send that as well.
thanks for any help you can give me with this problem. I have no idea where this thing came from.