We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide

Help google redirect virus?

124»

Comments

  • alm721
    alm721 Posts: 728 Forumite
    Part of the Furniture Combo Breaker
    Ok thanks for the above, have done combo fix the file is as follows.

    ComboFix 09-12-21.08 - MACKENZIEA 22/12/2009 21:29:57.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1370 [GMT 0:00]
    Running from: c:\documents and settings\MACKENZIEA\Desktop\ComboFix.exe
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\documents and settings\mackenziea.WSCAMPUS.000\Application Data\alot
    c:\documents and settings\mackenziea.WSCAMPUS.000\Application Data\Def\CnsMin.dsc
    c:\documents and settings\mackenziea.WSCAMPUS.000\Application Data\Def\CnsMin.prf
    c:\windows\EventSystem.log
    c:\windows\system\oeminfo.ini
    .
    ((((((((((((((((((((((((( Files Created from 2009-11-22 to 2009-12-22 )))))))))))))))))))))))))))))))
    .
    2009-12-22 20:34 . 2009-12-22 20:34
    d
    w- c:\program files\Trend Micro
    2009-12-22 18:49 . 2009-12-22 18:49
    d
    w- c:\documents and settings\MACKENZIEA\Application Data\Malwarebytes
    2009-12-22 18:49 . 2009-12-03 16:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-12-22 18:49 . 2009-12-22 18:49
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-12-22 18:49 . 2009-12-22 18:49
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-12-22 18:49 . 2009-12-03 16:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-21 16:00 . 2009-12-21 16:00
    d
    w- c:\documents and settings\MACKENZIEA\Local Settings\Application Data\Mozilla
    2009-12-21 15:52 . 2009-07-10 13:31 130104 ----a-w- c:\windows\system32\sdccoinstaller.dll
    2009-12-21 15:51 . 2009-12-21 15:51
    d
    w- c:\program files\Common Files\Cisco Systems
    2009-12-21 15:51 . 2008-08-21 13:23 23552 ----a-w- c:\windows\system32\SophosBootTasks.exe
    2009-12-19 15:16 . 2009-12-19 15:16 0 ----a-w- c:\windows\nsreg.dat
    2009-12-19 15:16 . 2009-12-19 15:16
    d
    w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
    2009-12-19 15:16 . 2009-12-19 15:16
    d
    w- c:\program files\Mozilla Firefox 3.6 Beta 5
    2009-12-19 15:07 . 2009-12-19 15:07
    d
    w- c:\documents and settings\Administrator\Application Data\Birdstep Technology
    2009-12-15 23:08 . 2009-12-15 23:08
    d
    w- c:\documents and settings\MACKENZIEA\Local Settings\Application Data\Apple Computer
    2009-12-09 14:19 . 2003-04-08 00:41 53248 ----a-w- c:\windows\system32\wndtls32.dll
    2009-12-09 14:19 . 2003-04-28 01:10 372736 ----a-w- c:\windows\system32\tx_word.dll
    2009-12-09 14:19 . 2003-04-28 01:01 200704 ----a-w- c:\windows\system32\tx_htm32.dll
    2009-12-09 14:19 . 2003-04-28 00:30 356352 ----a-w- c:\windows\system32\tx_css.dll
    2009-12-09 14:19 . 2003-04-28 00:20 380928 ----a-w- c:\windows\system32\tx_xml.dll
    2009-12-09 14:19 . 2003-04-28 00:10 471040 ----a-w- c:\windows\system32\tx_pdf.dll
    2009-12-09 14:19 . 2003-04-22 02:22 159744 ----a-w- c:\windows\system32\tx_rtf32.dll
    2009-12-09 14:19 . 2003-04-15 01:12 114688 ----a-w- c:\windows\system32\txtls32.dll
    2009-12-09 14:19 . 2002-01-23 00:14 327680 ----a-w- c:\windows\system32\txobj32.dll
    2009-12-09 14:19 . 2003-04-25 09:10 536576 ----a-w- c:\windows\system32\Tx32.dll
    2009-12-09 14:19 . 2003-04-16 02:02 102400 ----a-w- c:\windows\system32\ic32.dll
    2009-12-09 14:19 . 2009-12-09 14:19
    d
    w- c:\program files\Exampro32
    2009-12-09 09:43 . 2009-12-09 09:43 86208 ----a-w- c:\documents and settings\mackenziea.WSCAMPUS.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-12-09 09:36 . 2009-12-09 09:36
    d
    w- c:\documents and settings\mackenziea.WSCAMPUS.000\Local Settings\Application Data\Adobe
    2009-12-09 09:36 . 2009-12-09 10:57
    d
    w- c:\documents and settings\mackenziea.WSCAMPUS.000\Local Settings\Application Data\Microsoft
    2009-12-09 09:33 . 2009-12-09 09:33
    d
    w- c:\documents and settings\crothallg\Application Data\Birdstep Technology
    2009-12-01 16:01 . 2009-12-01 16:01
    d
    w- c:\program files\Cars Maths In Motion
    2009-12-01 15:58 . 2006-06-03 21:29 48640 ----a-w- c:\windows\system32\hpzll4pi.dll
    2009-12-01 15:58 . 2006-06-03 21:29 76288 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp4pi.dll
    2009-12-01 15:54 . 2006-03-03 21:03 282680 ----a-w- c:\windows\system32\HPZidr12.dll
    2009-12-01 15:54 . 2006-03-03 21:03 65536 ----a-w- c:\windows\system32\HPZinw12.exe
    2009-12-01 15:54 . 2006-03-03 21:03 69632 ----a-w- c:\windows\system32\HPZipm12.exe
    2009-12-01 15:54 . 2006-03-03 21:02 204800 ----a-w- c:\windows\system32\HPZipr12.dll
    2009-12-01 15:54 . 2006-03-03 21:02 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2009-12-01 15:54 . 2006-03-03 21:02 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2009-12-01 15:53 . 2009-12-01 15:54
    d
    w- c:\program files\HP
    2009-12-01 15:53 . 2009-12-01 15:57 123135 ----a-w- c:\windows\HPHins12.dat
    2009-12-01 15:53 . 2006-07-17 19:39 14916
    w- c:\windows\hphmdl12.dat
    2009-12-01 15:53 . 2006-05-16 20:25 77824 ----a-w- c:\windows\system32\hpzids01.dll
    2009-12-01 15:52 . 2006-06-22 03:03 56 ----a-w- C:\ut9x.bat
    2009-12-01 15:52 . 2006-06-19 21:08 54 ----a-w- C:\ut.bat
    2009-12-01 15:52 . 2009-12-01 15:51 68749904 ----a-w- C:\driver_only_webpack_enu_NB.exe
    2009-12-01 14:29 . 2009-02-03 09:37 31828528 ----a-w- C:\D2366 printer driver_only_webpack_enu.exe
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-22 21:41 . 2008-11-20 10:11 65536 ----a-w- c:\documents and settings\All Users\Application Data\Activ Software\ActivApplications\ActivFocusHook.dll
    2009-12-22 21:34 . 2009-12-09 09:35
    d
    w- c:\documents and settings\mackenziea.WSCAMPUS.000\Application Data\Def
    2009-12-19 10:37 . 2009-10-12 00:33 3695616 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
    2009-12-19 10:37 . 2009-10-12 00:33 2353992 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
    2009-12-09 13:47 . 2009-11-10 20:22 79488 ----a-w- c:\documents and settings\MACKENZIEA\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-12-01 13:41 . 2009-12-01 13:41
    d
    w- c:\documents and settings\supervisor\Application Data\Birdstep Technology
    2009-11-16 07:47 . 2009-12-09 09:35
    d
    w- c:\documents and settings\mackenziea.WSCAMPUS.000\Application Data\Birdstep Technology
    2009-10-12 00:32 . 2009-10-12 00:32 1028432 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1343488]
    "ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
    "THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2008-03-04 360448]
    "TPSMain"="TPSMain.exe" [2007-10-12 266240]
    "SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-05-11 143360]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-05 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-05 162328]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-05 137752]
    "RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-20 136600]
    "ActivControl"="c:\program files\Activ Software\Activdriver\ActivControl2.exe" [2007-11-09 1003520]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
    "Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [2008-11-20 295606]
    Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]
    AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-7-1 245760]
    Update Agent.lnk - c:\program files\3\3Connect\AutoUpdateSrv.exe [2009-8-22 479232]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1957994488-1935655697-682003330-4273\Scripts\Logon\0\0]
    "Script"=High School Admin Mapped Drives.bat
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
    @="service"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [07/08/2009 00:32 64160]
    R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [08/07/2009 11:03 110848]
    R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [08/07/2009 11:03 38528]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [03/07/2009 14:49 1028432]
    R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [05/10/2009 12:22 80936]
    R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [21/08/2008 13:04 98304]
    R3 ActivHidSerMini;Promethean Serial Board Driver;c:\windows\system32\drivers\activhidsermini.sys [09/11/2007 10:22 54656]
    R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [07/05/2008 09:50 5888]
    R3 prmvmouse;Promethean HID Mouse Service;c:\windows\system32\drivers\activmouse.sys [20/11/2008 10:10 4480]
    S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [22/08/2008 18:56 7680]
    S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [08/07/2009 11:03 14976]
    .
    Supplementary Scan
    .
    uStart Page = hxxp://forums.moneysavingexpert.com/
    IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\MACKENZIEA\Application Data\Mozilla\Firefox\Profiles\0i4jg23l.default\
    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.use_native_popup_windows", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.debug", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
    c:\program files\Mozilla Firefox 3.6 Beta 5\greprefs\all.js - pref("html5.enable", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
    c:\program files\Mozilla Firefox 3.6 Beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
    .
    - - - - ORPHANS REMOVED - - - -
    AddRemove-Ad-Aware - c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe
    AddRemove-{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} - c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe

    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-22 21:46
    Windows 5.1.2600 Service Pack 3 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
    "ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'explorer.exe'(1028)
    c:\documents and settings\All Users\Application Data\ACTIV Software\ActivApplications\ActivFocusHook.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\TPwrCfg.DLL
    c:\windows\system32\TPwrReg.dll
    c:\windows\system32\TPSTrace.DLL
    .
    Other Running Processes
    .
    c:\windows\system32\agrsmsvc.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\system32\HPZipm12.exe
    c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe
    c:\program files\Sophos\AutoUpdate\ALsvc.exe
    c:\program files\Sophos\Remote Management System\RouterNT.exe
    c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
    c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
    c:\program files\TightVNC\WinVNC.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\system32\TPSMain.exe
    c:\windows\system32\igfxsrvc.exe
    c:\windows\system32\TPSBattM.exe
    c:\windows\RTHDCPL.EXE
    c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-12-22 21:47:50 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-12-22 21:47
    Pre-Run: 92,497,289,216 bytes free
    Post-Run: 92,821,110,784 bytes free
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    - - End Of File - - A7CAAC4F65415681EC9B797C2C2939FC
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    All those ips are from holland (Or I should say being redirected to holland)



    Download HostsXpert
    http://www.softpedia.com/get/Security/Security-Related/Hoster.shtml
    and then follow the below steps.

    * Unzip HostsXpert.zip
    * It will create a folder named HostsXpert in whatever folder you extract it to.
    * Run HostsXpert.exe by double clicking on it.
    * click the Make Writeable? button.
    * click Restore Microsoft's Hosts File and then click OK.
    * Click the X to exit the program
    :idea:
  • alm721
    alm721 Posts: 728 Forumite
    Part of the Furniture Combo Breaker
    ok have done that but although not sure if its done anything? Should it have done something or would I not know iyswim? Have just been on google though and it seems to be working fine again so fingers crossed this means its ok now? or should I be worried about anything else?
    Thankls for all the replies
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    All youve done is reset the hosts file. Something ELSE will have created the problem. Hopefully malwarebytes and/or combofix has removed the problem

    Up to you really. You can see how you get on or run one more av as a tester


    Download and run the FREE version of DR WEB
    http://www.freedrweb.com/download+cureit/gr/
    Turn your anti virus OFF
    It will auto QUICK scan
    After that set to scan the WHOLE computer and press the 'play' icon
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 353.5K Banking & Borrowing
  • 254.1K Reduce Debt & Boost Income
  • 455K Spending & Discounts
  • 246.6K Work, Benefits & Business
  • 602.9K Mortgages, Homes & Bills
  • 178.1K Life & Family
  • 260.6K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture