I have the google redirect virus which is really annoying as I can't access my email as I constantly get redirected. How do I fix this? Thanks in advance!

Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 Rename the setup file, mbam-setup.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename mbam-setup.exe to tool.exe> click save. 1. Double Click tool.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. If Malwarebytes installed but will not run navigate to this folder: C:\Programs Files\Malwarebytes' AntiMalware Rename all the .exe files in the MAlwarebytes' Anti-Malware folder and try to run it again. Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This Rename the setup file, HJTInstall.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename HJTInstall.exe to tools.exe> click save. 1. Save " tools.exe" to your desktop. 2. Double click on tools.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Hi thanks for your help. I have done as requested. Here is the Malwarebytes report Malwarebytes' Anti-Malware 1.36 Database version: 2035 Windows 5.1.2600 Service Pack 3 30/04/2009 10:49:28 mbam-log-2009-04-30 (10-49-28).txt Scan type: Quick Scan Objects scanned: 179073 Time elapsed: 37 minute(s), 45 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 2 Registry Values Infected: 4 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 15 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\__c00D36D7.dat (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00d36d7 (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a00fef681.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\Temp\_A00FEF681.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Delete on reboot. C:\Documents and Settings\Will\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Will\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\__c00D36D7.dat (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Chris\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Will\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Will\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\Temp\msb.dll (Trojan.FakeAlert) -> Delete on reboot. And here is the hijack this report Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:39:16, on 30/04/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.exe C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\TalkTalk\bin\sprtsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEGE.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe \?\globalroot\C:\WINDOWS\system32\rundll32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Opera\opera.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytalktalk.co.uk R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus SX400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEGE.exe /FU "C:\WINDOWS\TEMP\E_S1F3.tmp" /EF "HKCU" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\Will\protect.dll,_IWMPEvents@16 O4 - .DEFAULT Startup: ChkDisk.dll (User 'Default user') O4 - Startup: ChkDisk.dll O4 - Startup: ChkDisk.lnk = ? O16 - DPF: {4e62c4de-627d-4604-b157-4b7d6b09f02e} (Egg Money Manager Digital Safe) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab O20 - AppInit_DLLs: , O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.exe O23 - Service: Google Update Service (gupdate1c9b518bcf02b8e) (gupdate1c9b518bcf02b8e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service (ipod service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SupportSoft Sprocket Service (TalkTalk) (sprtsvc_TalkTalk) - SupportSoft, Inc. - C:\Program Files\TalkTalk\bin\sprtsvc.exe O23 - Service: SupportSoft Repair Service (TalkTalk) (tgsrvc_TalkTalk) - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe O23 - Service: TVersityMediaServer (tversitymediaserver) - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe Thanks.

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Rename the setup file, combofix.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename combofix.exe to toolb.exe> click save. Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your AVG antivirus, and any other antispyware that you may have.(To get AVG completely turned off after you click the systray icon and click exit...click the desktop AVG icon> click resident shield> uncheck the box to the left of "resident shield active"> click save changes.) Be sure to recheck the box before you get on line again. 2. Run Combofix by double clicking the toolb.exe icon on your desktop and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet.

Here is the Combo fix report omboFix 09-04-30.05 - Will 01/05/2009 10:10.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1279.838 [GMT 1:00] Running from: c:\documents and settings\Will\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Alice\protect.dll c:\documents and settings\Alice\Start Menu\Programs\Startup\ChkDisk.dll c:\documents and settings\Alice\Start Menu\Programs\Startup\ChkDisk.lnk c:\documents and settings\Char\protect.dll c:\documents and settings\Char\Start Menu\Programs\Startup\ChkDisk.dll c:\documents and settings\Char\Start Menu\Programs\Startup\ChkDisk.lnk c:\documents and settings\Chris\protect.dll c:\documents and settings\Chris\Start Menu\Programs\Startup\ChkDisk.dll c:\documents and settings\Chris\Start Menu\Programs\Startup\ChkDisk.lnk c:\documents and settings\Harriet\protect.dll c:\documents and settings\Harriet\Start Menu\Programs\Startup\ChkDisk.dll c:\documents and settings\Harriet\Start Menu\Programs\Startup\ChkDisk.lnk c:\documents and settings\LocalService\protect.dll c:\documents and settings\Will\protect.dll c:\documents and settings\Will\Start Menu\Programs\Startup\ChkDisk.dll c:\documents and settings\Will\Start Menu\Programs\Startup\ChkDisk.lnk c:\windows\system32\autochk.dll c:\windows\system32\config\systemprofile\protect.dll c:\windows\system32\drivers\ovfsthkmlkbxbispoymuhxvkmonbnnhrohcttj.sys c:\windows\system32\dz1.txt c:\windows\system32\gibedevo.exe c:\windows\system32\hafoyara.exe c:\windows\system32\inform.dat c:\windows\system32\lmppcsetup.exe c:\windows\system32\loader49.exe c:\windows\system32\ovfsthadeuwqpfeagfwsbqukqghsbnrwxttbnh.dat c:\windows\system32\ovfsthakapinmdqvkyiyonrfcyjlxuukgfmvjn.dll c:\windows\system32\ovfsthdvpkjtqkhruwtrvlklrfpgvugesigntq.dat c:\windows\system32\ovfsthgxfuwgorjxlhxabgkvoqjcgqtwkedlfk.dll c:\windows\system32\ovfsthjvtkmfiyuisnoahrdrocdytytceonlnd.dll c:\windows\system32\p1.txt c:\windows\system32\r24.txt c:\windows\system32\winglsetup.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ovfsthbqllvtooduhtoqvppjeypjtmovibudxm ((((((((((((((((((((((((( Files Created from 2009-04-01 to 2009-05-01 ))))))))))))))))))))))))))))))) . 2009-04-29 18:33 . 2009-04-29 18:33 -------- d-----w c:\documents and settings\Chris\Local Settings\Application Data\Opera 2009-04-29 08:20 . 2009-04-29 08:20 -------- d-----w c:\documents and settings\Will\Local Settings\Application Data\Opera 2009-04-29 08:20 . 2009-04-29 08:20 -------- d-----w c:\program files\Opera 2009-04-24 08:13 . 2009-04-24 08:13 -------- d-----w c:\documents and settings\Char\Application Data\Malwarebytes 2009-04-19 20:42 . 2009-04-19 20:42 -------- d-----w c:\documents and settings\Will\Application Data\Malwarebytes 2009-04-19 20:42 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-19 20:42 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-19 20:42 . 2009-04-19 20:42 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-04-19 20:42 . 2009-04-19 20:42 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-19 19:59 . 2009-04-19 19:56 102664 ----a-w c:\windows\system32\drivers\tmcomm.sys 2009-04-19 19:56 . 2009-04-19 20:00 -------- d-----w c:\documents and settings\Will\.housecall6.6 2009-04-18 19:47 . 2009-04-18 19:47 -------- d-----w c:\documents and settings\Alice\Local Settings\Application Data\{B02A8586-8175-414F-BE5D-8775DC01A3D8} 2009-04-18 11:07 . 2009-05-01 09:28 89448 ----a-w c:\windows\system32\drivers\9caf57ea.sys 2009-04-18 09:58 . 2009-04-18 09:58 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\{0CFDB2E3-F747-4C27-BA25-7BCE49FB56B1} 2009-04-16 18:39 . 2009-04-16 18:39 185680 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-04-16 18:38 . 2009-04-16 18:38 -------- d-----w c:\program files\MSBuild 2009-04-16 18:38 . 2009-04-16 18:38 -------- d-----w c:\windows\system32\XPSViewer 2009-04-16 18:38 . 2009-04-16 18:38 -------- d-----w c:\program files\Reference Assemblies 2009-04-16 18:37 . 2006-06-29 12:07 14048 ------w c:\windows\system32\spmsg2.dll 2009-04-15 19:53 . 2009-04-15 19:58 -------- d-----w c:\documents and settings\Char\Application Data\Spotify 2009-04-15 19:53 . 2009-04-15 19:53 -------- d-----w c:\documents and settings\Char\Local Settings\Application Data\Spotify 2009-04-15 18:57 . 2009-04-15 18:57 -------- d-----w c:\program files\CCleaner 2009-04-11 22:29 . 2009-05-01 09:28 100590 ----a-w c:\windows\system32\drivers\352d12a4.sys 2009-04-10 09:36 . 2009-04-10 09:36 213120 -c--a-w c:\windows\system32\dllcache\ndis.sys 2009-04-10 09:36 . 2009-04-10 09:36 -------- d-----w c:\documents and settings\Harriet\Local Settings\Application Data\{D1BBD044-49D8-4DCD-A294-69A644CC4133} 2009-04-10 07:53 . 2009-04-10 07:53 -------- d-----w c:\documents and settings\Will\Local Settings\Application Data\{FF11CE62-8791-46CD-B7DB-F3B73C8D1080} 2009-04-09 15:00 . 2009-04-24 17:08 -------- d--h--w C:\$AVG8.VAULT$ 2009-04-09 12:20 . 2009-04-09 12:20 -------- d-----w c:\documents and settings\Char\Local Settings\Application Data\{989E5494-72BD-439C-8D43-A037EC65B54D} 2009-04-09 12:16 . 2009-04-19 18:56 16 ----a-w c:\windows\Wkesifukinem.bin 2009-04-09 12:16 . 2009-04-09 12:16 -------- d-----w c:\documents and settings\Chris\Local Settings\Application Data\{39DDA305-92C2-493A-A413-24E38D215BD3} 2009-04-09 12:16 . 2009-04-16 20:34 1420 ----a-w c:\windows\Ixopapup.dat 2009-04-09 10:48 . 2009-04-09 10:48 10520 ----a-w c:\windows\system32\avgrsstx.dll 2009-04-09 10:48 . 2009-04-09 10:48 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-04-09 10:48 . 2009-04-09 10:48 325640 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-04-09 10:48 . 2009-05-01 08:51 -------- d-----w c:\windows\system32\drivers\Avg 2009-04-09 10:47 . 2009-04-09 10:47 -------- d-----w c:\program files\AVG 2009-04-09 10:47 . 2009-04-18 18:01 -------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-04-08 19:58 . 2009-05-01 09:28 85102 ----a-w c:\windows\system32\drivers\d9777091.sys 2009-04-08 19:43 . 2009-04-08 19:43 -------- d-----w C:\FavoriteVideo 2009-04-08 19:42 . 2009-04-08 19:42 -------- d-----w c:\documents and settings\Will\Application Data\PPLiveVA 2009-04-08 19:41 . 2009-04-08 19:41 -------- d-----w c:\documents and settings\Will\Local Settings\Application Data\VirtualStore 2009-04-08 19:41 . 2009-04-08 19:44 -------- d-----w c:\program files\PPLiveVA 2009-04-08 19:38 . 2009-04-08 19:44 -------- d-----w c:\documents and settings\All Users\Application Data\PPLiveVA 2009-04-08 19:36 . 2009-04-08 19:36 -------- d-----w c:\documents and settings\All Users\Application Data\Jlcm 2009-04-08 19:36 . 2009-04-08 19:44 -------- d-----w c:\documents and settings\All Users\Application Data\PPLive 2009-04-08 19:36 . 2009-04-08 19:45 -------- d-----w c:\program files\PPLive 2009-04-08 13:27 . 2009-04-08 13:27 -------- d-----w c:\program files\Common Files\DivX Shared 2009-04-08 13:21 . 2009-04-23 22:25 155 ----a-w c:\windows\system32\SelfDel.bat 2009-04-08 13:06 . 2009-05-01 09:28 89426 ----a-w c:\windows\system32\drivers\454fa7f3.sys 2009-04-07 10:20 . 2009-04-07 10:20 -------- d-----w c:\program files\Windows Defender . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-24 09:50 . 2006-09-25 15:40 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-21 21:40 . 2006-09-25 19:46 68888 ----a-w c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-20 16:03 . 2006-10-01 08:49 68888 ----a-w c:\documents and settings\Harriet\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-20 09:39 . 2006-09-25 22:33 68888 ----a-w c:\documents and settings\Char\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-19 23:13 . 2006-09-25 16:44 68888 ----a-w c:\documents and settings\Will\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-18 19:48 . 2006-09-25 18:36 68888 ----a-w c:\documents and settings\Alice\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-16 21:46 . 2008-09-02 15:05 -------- d-----w c:\program files\Circle Developement 2009-04-13 21:35 . 2006-09-25 17:08 -------- d-----w c:\program files\EPSON 2009-04-10 09:36 . 2001-08-18 12:00 213120 ----a-w c:\windows\system32\drivers\ndis.sys 2009-04-08 13:27 . 2007-09-22 19:28 -------- d-----w c:\program files\DivX 2009-04-04 11:32 . 2006-09-25 14:39 -------- d-----w c:\program files\Google 2009-04-04 10:05 . 2006-11-02 09:07 -------- d-----w c:\program files\Replay7 2009-04-04 09:19 . 2009-03-15 22:51 -------- d-----w c:\program files\AviSynth 2.5 2009-03-27 23:00 . 2009-03-06 11:14 -------- d-----w c:\program files\AWOMO 2009-03-24 20:17 . 2009-03-24 20:17 -------- d-----w c:\program files\Anquet Technology Ltd 2009-03-15 22:19 . 2009-03-15 22:19 -------- d-----w c:\program files\mkv2vob 2009-03-15 22:19 . 2009-01-02 14:47 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-14 13:10 . 2009-03-14 13:10 -------- d-----w c:\program files\TVUPlayer 2009-03-14 13:10 . 2008-11-07 17:12 -------- d-----w c:\program files\USB Pedometer 2009-03-12 21:29 . 2006-10-02 06:52 -------- d-----w c:\program files\Common Files\Adobe 2009-03-10 19:41 . 2009-03-10 19:07 -------- d-----w c:\program files\Logitech 2009-03-10 19:41 . 2006-09-25 14:37 -------- d--h--w c:\program files\InstallShield Installation Information 2009-03-10 19:07 . 2009-03-10 19:07 -------- d-----w c:\program files\Common Files\Logitech 2009-03-10 17:31 . 2009-03-10 17:31 -------- d-----w c:\program files\Audible 2009-03-08 12:07 . 2009-03-03 12:41 -------- d-----w c:\program files\Paint Shop Pro 6 2009-03-06 11:38 . 2009-03-06 11:38 -------- d-----w c:\program files\Spotify 2009-03-03 16:47 . 2009-03-01 13:38 -------- d-----w c:\program files\PhotoPerfect 2009-03-03 16:39 . 2009-03-01 13:33 -------- d-----w c:\program files\Photolightning 2009-03-03 12:18 . 2009-03-03 12:12 -------- d-----w c:\program files\PhotoRescue Wizard PC 3.1.8.11543 2009-03-01 21:11 . 2009-03-01 15:02 188896 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-01 20:47 . 2009-03-01 15:02 70968 ----a-w c:\windows\system32\PnkBstrA.exe 2009-03-01 15:02 . 2009-03-01 15:02 22328 ----a-w c:\documents and settings\Will\Application Data\PnkBstrK.sys 2009-03-01 15:02 . 2009-03-01 15:02 2246144 ----a-w c:\windows\system32\pbsvc.exe 2009-02-26 17:18 . 2009-03-06 11:15 46992 ----a-w c:\windows\system32\drivers\vcache.sys 2009-02-26 17:18 . 2009-03-06 11:15 28944 ----a-w c:\windows\system32\drivers\vfilter.sys 2009-02-09 11:13 . 2001-08-18 12:00 1846784 ----a-w c:\windows\system32\win32k.sys 2008-12-29 11:07 . 2008-12-29 11:07 5709944 ----a-w c:\program files\jZipV1c.exe 2006-10-02 06:56 . 2006-10-02 06:52 21290704 ----a-w c:\program files\AdbeRdr708_en_US.exe 2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w c:\program files\mozilla firefox\plugins\libdivx.dll 2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w c:\program files\mozilla firefox\plugins\ssldivx.dll 2009-02-20 10:11 . 2008-04-08 10:24 67688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2009-02-20 10:11 . 2008-04-08 10:24 54368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2009-02-20 10:11 . 2008-04-08 10:24 34944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2009-02-20 10:11 . 2008-04-08 10:24 46712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2009-02-20 10:11 . 2008-04-08 10:24 172136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2007-07-25 19:45 . 2007-04-06 09:39 168 --sh--r c:\windows\system32\D0003FE602.sys 2007-07-26 08:10 . 2007-04-06 09:39 3402 --sha-w c:\windows\system32\KGyGaAvL.sys . ------- Sigcheck ------- [7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys [7] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys [-] 2009-04-10 09:36 213120 F822B76094D2F27EE01A4399A64EF934 c:\windows\system32\dllcache\ndis.sys [-] 2009-04-10 09:36 213120 F822B76094D2F27EE01A4399A64EF934 c:\windows\system32\drivers\ndis.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-09 68856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "EPSON Stylus SX400 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIEGE.exe" [2007-12-17 188928] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-04-09 10:48 10520 ----a-w c:\windows\system32\avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"= "c:\\Program Files\\BitLord\\BitLord.exe"= "c:\\Program Files\\Adobe\\Acrobat.com\\Acrobat.com.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\TalkTalk\\agent\\bin\\bcont.exe"= "c:\\Program Files\\Common Files\\SupportSoft\\bin\\tgsrvc.exe"= "c:\\Program Files\\TalkTalk\\agent\\bin\\bcont_nm.exe"= "c:\\Program Files\\TalkTalk\\bin\\sprtcmd.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Spotify\\spotify.exe"= "c:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "c:\\Program Files\\PPLive\\PPLive.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "20078:TCP"= 20078:TCP:BitComet 20078 TCP "20078:UDP"= 20078:UDP:BitComet 20078 UDP R2 gupdate1c9b518bcf02b8e;Google Update Service (gupdate1c9b518bcf02b8e);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 133104] R3 vcache;vcache;c:\windows\system32\DRIVERS\vcache.sys [2009-02-26 46992] R3 vfilter;vfilter;c:\windows\system32\DRIVERS\vfilter.sys [2009-02-26 28944] S1 avgldx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-09 325640] S1 avgtdix;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-09 108552] S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-09 908056] S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-09 298264] S2 sprtsvc_TalkTalk;SupportSoft Sprocket Service (TalkTalk);c:\program files\TalkTalk\bin\sprtsvc.exe [2007-10-12 202016] S2 tgsrvc_TalkTalk;SupportSoft Repair Service (TalkTalk);c:\program files\Common Files\Supportsoft\bin\tgsrvc.exe [2007-08-02 148768] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8cdab85a-0672-11dd-8207-009096cd7708}] \Shell\AutoRun\command - F:\InstallTomTomHOME.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dcfa4f04-57b1-11db-8c72-009096cd7708}] \Shell\AutoRun\command - F:\setupSNK.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1a43b51d-2671-4bcc-89f0-9bc42db29016}] rundll32 infow32.dll,InitO . Contents of the 'Scheduled Tasks' folder 2009-04-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 11:34] 2009-05-01 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 11:29] 2009-05-01 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] 2009-04-30 c:\windows\Tasks\User_Feed_Synchronization-{6034E811-4DD2-448F-8FE2-6EA95EA08455}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 11:58] . - - - - ORPHANS REMOVED - - - - HKU-Default-Run-autochk - c:\docume~1\LOCALS~1\protect.dll . ------- Supplementary Scan ------- . uStart Page = hxxp://www.mytalktalk.co.uk uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab DPF: {4e62c4de-627d-4604-b157-4b7d6b09f02e} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab FF - ProfilePath - c:\documents and settings\Will\Application Data\Mozilla\Firefox\Profiles\274715tq.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - www.holmesdale.net FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar.dll FF - component: c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metrics.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-01 10:28 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2009-05-01 10:32 ComboFix-quarantined-files.txt 2009-05-01 09:30 Pre-Run: 13,086,556,160 bytes free Post-Run: 18,194,690,048 bytes free 265 --- E O F --- 2009-03-12 22:43 Thanks for the help!!!

Please go to Virus Total and upload the following files one at the time for analysis: c:\windows\system32\drivers\9caf57ea.sys c:\windows\system32\drivers\352d12a4.sys c:\windows\system32\drivers\d9777091.sys c:\windows\system32\drivers\454fa7f3.sys Use the browse button at the site to find the file, once you find the file double click it and it should appear in the empty space to the left of the browse button> click "send file". Post the results in your reply.

Each time I try to upload one of those files to the website I get the message 0 bytes size received / Se ha recibido un archivo vacio How can I send them to that website?