What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google chrome redirects to searchqu.com/406

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am running Windows Vista and use Google chrome for Internet useage, all was working O.K until yesterday ( Wed 26th ) and now I find when I click onto Google it redirects me to the cursed 'serchqu'.
I don't know how it came into my computer as I run AVG 2011 and use the Windows Defender all the time , I ' ve run a scan and it does not show up, I even tried re-instaling Google chrome , but to no effect.
I also noticed Windows informs me that Defender is turned off , but when I check it is turned on and working correctly , ( I hope ! ).
I downloaded HijackThis as suggested in your forum advice and have attached the results, I might add that my computer knowledge is basic , but learning everyday on a very steep learning curve !!.
I am a bit wary of messing about with settings that I don't understand , that's why I am in your capable hands.
Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:49:25, on 27/04/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19048)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\System32\ATWTUSB.EXE
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Windows\sttray.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\`neale\Desktop\HiJackThis.exe
C:\Windows\system32\Taskmgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&…amp;ibd=2070422
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - {f4e6547e-325b-403c-a3bb-ad29ed37a92f} - (no file)
R3 - URLSearchHook: (no name) - {38542454-dfb6-44f5-b052-d4e071a3d073} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKLM\..\Run: [TQ566808] "E:\Setup.exe"
O4 - HKLM\..\Run: [basicsmssmenu] "C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [VirginMediaHUB.exe] "C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe" /AUTORUN
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [Google Update] "C:\Users\`neale\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [V Stuff Backup] "C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" /delayed
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: AVG Security Toolbar Service - Unknown owner - C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServicepointService - Radialpoint Inc. - C:\Program Files\Virgin Media\HUB\ServicepointService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe

–
End of file - 9118 bytes
Post #2
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

  • Absence of symptoms does not always mean the computer is clean
  • Please do not run any scans or fixes without my direction.
  • Finally, stay with this topic until I give you the final 'All clear' post.

1) aswMBR
Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

2) DDS
Please download DDS and save it to your desktop from here or here or here.
Double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    • DDS.txt
    • Attach.txt
  • Save both reports to your desktop.

3) GMER
Please download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and put it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

4) What You Will Need To Post:
  • aswMBR log
  • DDS log
  • GMER log
Post #3
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 13:38:04.94 on 27/04/2011
Internet Explorer: 8.0.6001.19048
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2037.812 [GMT 1:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\QuickTime\qttask.exe
C:\Windows\System32\ATWTUSB.EXE
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files\Virgin Media\HUB\VirginMediaHUB.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Windows\sttray.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\PSIService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Virgin Media\HUB\ServicepointService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\Pen_Tablet.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\`neale\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG10\avgcmgr.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.searchqu.com/406
uWindow Title = Internet Explorer provided by Dell
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
TB: {F4E6547E-325B-403C-A3BB-AD29ED37A92F} - No File
TB: {38542454-DFB6-44F5-B052-D4E071A3D073} - No File
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe" -NoStart
uRun: [Google Update] "c:\users\`neale\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [V Stuff Backup] "c:\program files\virginmedia\v stuff backup\v_stuff_backup.exe" /delayed
uRun: [AdobeBridge]
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0\bin\jusched.exe"
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [ECenter] c:\dell\e-center\EULALauncher.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [atwtusb] atwtusb.exe beta
mRun: [TQ566808] "E:\Setup.exe"
mRun: [basicsmssmenu] "c:\program files\seagate\basics\basics status\MaxMenuMgrBasics.exe"
mRun: [EEventManager] c:\program files\epson\creativity suite\event manager\EEventManager.exe
mRun: [VirginMediaHUB.exe] "c:\program files\virgin media\hub\VirginMediaHUB.exe" /AUTORUN
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
StartupFolder: c:\users\`neale\appdata\roaming\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 299984]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2011-3-14 21504]
R2 ServicepointService;ServicepointService;c:\program files\virgin media\hub\ServicepointService.exe [2011-3-8 668912]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-10-29 3032360]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-3 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-3 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-3 27216]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-10-29 15144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-3-9 517448]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-04-26 13:41:53 7071056 —-a-w- c:\progra~2\microsoft\windows defender\definition updates\{86979409-212b-430b-af4e-df4eb463d303}\mpengine.dll
2011-04-26 13:37:52 ——– d–h–w- C:\$AVG
2011-04-22 13:58:15 ——– d—–w- c:\program files\common files\Jasc Software Inc
2011-04-18 14:04:10 1409 —-a-w- c:\windows\QTFont.for
2011-04-15 16:52:57 305152 —-a-w- c:\windows\system32\drivers\srv.sys
2011-04-15 16:52:57 146432 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-04-15 16:52:57 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-15 16:52:54 2041856 —-a-w- c:\windows\system32\win32k.sys
2011-04-15 16:52:51 86528 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-04-15 16:52:51 25088 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-04-15 16:52:49 2409784 —-a-w- c:\program files\windows mail\OESpamFilter.dat
2011-04-15 16:52:46 739328 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-15 16:52:44 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-04-14 10:53:44 ——– d—–w- c:\program files\common files\Adobe AIR(4)
2011-04-14 09:41:38 ——– d—–w- C:\eLearn
2011-04-13 19:44:04 ——– d—–r- c:\program files\Vizros
2011-04-09 17:25:26 ——– d—–w- c:\program files\Windows Portable Devices
2011-04-09 16:51:27 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2011-04-09 16:51:23 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2011-04-09 16:51:23 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2011-04-09 16:48:36 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-04-09 16:48:28 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-04-09 16:48:28 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-04-09 16:48:27 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-04-09 16:48:27 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-04-09 16:48:27 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-04-09 16:48:26 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-04-09 16:43:08 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-04-09 16:43:06 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-04-09 16:43:06 234496 —-a-w- c:\windows\system32\oleacc.dll
2011-04-08 20:25:37 ——– d—–w- c:\progra~2\FileCure
2011-04-08 20:25:36 ——– d—–w- c:\program files\ParetoLogic
2011-04-08 10:28:34 797696 —-a-w- c:\windows\system32\FntCache.dll
2011-04-08 10:28:34 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-04-08 10:28:34 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-04-08 10:28:34 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-04-08 10:28:34 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-04-08 10:28:34 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-04-08 10:28:34 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-04-08 10:28:33 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-04-08 10:28:33 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-08 10:28:33 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-04-08 10:28:33 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-04-08 10:28:33 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-04-08 10:27:38 231424 —-a-w- c:\windows\system32\msshsq.dll
2011-04-07 12:25:16 ——– d—–w- c:\windows\system32\eu-ES
2011-04-07 12:25:16 ——– d—–w- c:\windows\system32\ca-ES
2011-04-07 12:25:15 ——– d—–w- c:\windows\system32\vi-VN
2011-04-07 11:27:06 ——– d—–w- c:\windows\system32\EventProviders
.
==================== Find3M ====================
.
2011-04-21 19:22:42 4858 –sha-w- c:\windows\system32\KGyGaAvL.sys
2011-03-16 11:39:28 101888 —-a-w- c:\windows\system32\ifxcardm.dll
2011-03-16 11:39:25 82432 —-a-w- c:\windows\system32\axaltocm.dll
2011-03-12 11:59:59 1801216 —-a-w- c:\windows\system32\NlsData0022.dll
2011-03-11 11:01:09 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2011-03-11 11:01:07 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2011-03-11 11:01:07 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2011-03-11 11:01:07 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2011-03-11 11:01:07 19968 —-a-w- c:\windows\system32\ARP.EXE
2011-03-11 11:01:07 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2011-03-11 11:01:07 105984 —-a-w- c:\windows\system32\netiohlp.dll
2011-03-11 11:01:07 10240 —-a-w- c:\windows\system32\finger.exe
2011-03-11 10:58:46 377344 —-a-w- c:\windows\system32\winhttp.dll
2011-03-10 17:03:51 1162240 —-a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03:51 1136640 —-a-w- c:\windows\system32\mfc42.dll
2011-03-10 11:11:52 60928 —-a-w- c:\windows\system32\msasn1.dll
2011-03-09 14:42:06 23552 —-a-w- c:\windows\system32\lpk.dll
2011-03-09 14:42:06 10240 —-a-w- c:\windows\system32\dciman32.dll
2011-03-09 14:36:52 61440 —-a-w- c:\windows\system32\winipsec.dll
2011-03-09 14:36:52 272896 —-a-w- c:\windows\system32\polstore.dll
2011-03-09 14:31:15 127488 —-a-w- c:\windows\system32\L2SecHC.dll
2011-03-09 14:31:14 68096 —-a-w- c:\windows\system32\wlanhlp.dll
2011-03-09 14:31:14 65024 —-a-w- c:\windows\system32\wlanapi.dll
2011-03-09 14:31:14 513536 —-a-w- c:\windows\system32\wlansvc.dll
2011-03-09 14:31:14 302592 —-a-w- c:\windows\system32\wlansec.dll
2011-03-09 14:31:14 293376 —-a-w- c:\windows\system32\wlanmsm.dll
2011-03-09 14:31:11 15181 —-a-w- c:\windows\system32\gatherWirelessInfo.vbs
2011-03-09 14:30:22 2048 —-a-w- c:\windows\system32\msxml3r.dll
2011-03-09 14:30:22 1401856 —-a-w- c:\windows\system32\msxml6.dll
2011-03-09 14:30:21 2048 —-a-w- c:\windows\system32\msxml6r.dll
2011-03-09 14:29:32 218624 —-a-w- c:\windows\system32\msv1_0.dll
2011-03-09 14:25:42 53248 —-a-w- c:\windows\system32\rrinstaller.exe
2011-03-09 14:25:41 24576 —-a-w- c:\windows\system32\mfpmp.exe
2011-03-09 14:25:41 2048 —-a-w- c:\windows\system32\mferror.dll
2011-03-09 14:20:38 71680 —-a-w- c:\windows\system32\atl.dll
2011-03-09 14:14:32 160256 —-a-w- c:\windows\system32\wkssvc.dll
2011-03-09 14:13:36 53248 —-a-w- c:\windows\system32\tsgqec.dll
2011-03-09 14:13:36 136192 —-a-w- c:\windows\system32\aaclient.dll
2011-03-09 14:10:19 714240 —-a-w- c:\windows\system32\timedate.cpl
2011-03-09 14:04:52 69632 —-a-w- c:\windows\system32\Mpeg2Data.ax
2011-03-09 14:01:21 623616 —-a-w- c:\windows\system32\localspl.dll
2011-03-09 13:58:42 172032 —-a-w- c:\windows\system32\wintrust.dll
2011-03-09 13:57:49 9728 —-a-w- c:\windows\system32\lsass.exe
2011-03-09 13:57:49 72704 —-a-w- c:\windows\system32\secur32.dll
2011-03-09 13:57:49 499712 —-a-w- c:\windows\system32\kerberos.dll
2011-03-09 13:57:49 175104 —-a-w- c:\windows\system32\wdigest.dll
2011-03-09 13:57:48 1259008 —-a-w- c:\windows\system32\lsasrv.dll
2011-03-09 13:54:44 6656 —-a-w- c:\windows\system32\kbd106n.dll
2011-03-09 13:52:32 62464 —-a-w- c:\windows\system32\l3codeca.acm
2011-03-09 13:52:32 220672 —-a-w- c:\windows\system32\l3codecp.acm
2011-03-09 13:51:37 200704 —-a-w- c:\windows\system32\iphlpsvc.dll
2011-03-09 13:49:53 293376 —-a-w- c:\windows\system32\browserchoice.exe
2011-03-09 13:47:24 98304 —-a-w- c:\windows\system32\cabview.dll
2011-03-09 13:46:32 37888 —-a-w- c:\windows\system32\printcom.dll
2011-03-09 13:44:54 14848 —-a-w- c:\windows\system32\wshrm.dll
2011-03-09 13:44:23 43520 —-a-w- c:\windows\system32\msdxm.tlb
2011-03-09 13:44:23 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2011-03-09 13:44:23 18432 —-a-w- c:\windows\system32\amcompat.tlb
2011-03-09 13:44:19 7680 —-a-w- c:\windows\system32\spwmp.dll
2011-03-09 13:44:18 4096 —-a-w- c:\windows\system32\dxmasf.dll
2011-03-09 13:44:17 4096 —-a-w- c:\windows\system32\msdxm.ocx
2011-03-09 13:43:15 347136 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2011-03-09 13:43:15 332288 —-a-w- c:\windows\system32\msdrm.dll
2011-03-09 13:43:14 526336 —-a-w- c:\windows\system32\RMActivate_isv.exe
2011-03-09 13:43:14 518144 —-a-w- c:\windows\system32\RMActivate.exe
2011-03-09 13:43:14 471552 —-a-w- c:\windows\system32\secproc_isv.dll
2011-03-09 13:43:14 471552 —-a-w- c:\windows\system32\secproc.dll
2011-03-09 13:43:14 346624 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2011-03-09 13:43:14 152576 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2011-03-09 13:43:14 152064 —-a-w- c:\windows\system32\secproc_ssp.dll
2011-03-09 13:40:57 2560 —-a-w- c:\windows\apppatch\AcRes.dll
2011-03-09 13:39:52 84480 —-a-w- c:\windows\system32\INETRES.dll
2011-03-09 13:39:15 784896 —-a-w- c:\windows\system32\rpcrt4.dll
2011-03-09 13:38:38 30720 —-a-w- c:\windows\system32\httpapi.dll
2011-03-09 13:38:38 24064 —-a-w- c:\windows\system32\nshhttp.dll
2011-03-09 13:36:19 243712 —-a-w- c:\windows\system32\rastls.dll
2011-03-09 13:35:48 355328 —-a-w- c:\windows\system32\WSDApi.dll
2011-03-09 13:33:35 82944 —-a-w- c:\windows\system32\mciavi32.dll
2011-03-09 13:33:35 65024 —-a-w- c:\windows\system32\avicap32.dll
2011-03-09 13:33:35 123904 —-a-w- c:\windows\system32\msvfw32.dll
2011-03-09 13:33:34 91136 —-a-w- c:\windows\system32\avifil32.dll
2011-03-09 13:33:34 31744 —-a-w- c:\windows\system32\msvidc32.dll
2011-03-09 13:33:34 13312 —-a-w- c:\windows\system32\msrle32.dll
2011-03-09 13:33:33 50176 —-a-w- c:\windows\system32\iyuv_32.dll
2011-03-09 13:33:33 22528 —-a-w- c:\windows\system32\msyuv.dll
2011-03-09 13:33:33 1314816 —-a-w- c:\windows\system32\quartz.dll
2011-03-09 13:33:33 12288 —-a-w- c:\windows\system32\tsbyuv.dll
2011-03-09 13:33:10 604672 —-a-w- c:\windows\system32\WMSPDMOD.DLL
2011-03-09 13:32:38 310784 —-a-w- c:\windows\system32\unregmp2.exe
2011-03-09 13:22:17 2421760 —-a-w- c:\windows\system32\wucltux.dll
2011-03-09 13:21:18 87552 —-a-w- c:\windows\system32\wudriver.dll
2011-03-09 13:20:04 33792 —-a-w- c:\windows\system32\wuapp.exe
2011-03-09 13:20:04 171608 —-a-w- c:\windows\system32\wuwebv.dll
2011-03-08 20:29:45 0 —-a-w- c:\windows\system32\ConduitEngine.tmp
2011-02-22 06:21:28 916480 —-a-w- c:\windows\system32\wininet.dll
2011-02-22 06:17:08 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-02-22 06:16:53 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-02-22 06:16:40 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-02-22 06:16:40 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-02-22 05:20:39 385024 —-a-w- c:\windows\system32\html.iec
.
============= FINISH: 13:39:08.31 ===============
aswMBR version 0.9.4 Copyright© 2011 AVAST Software
Run date: 2011-04-27 13:35:42
—————————–
13:35:42.601 OS Version: Windows 6.0.6002 Service Pack 2
13:35:42.601 Number of processors: 1 586 0x605
13:35:42.602 ComputerName: NEALEPC UserName: `neale
13:35:44.997 Initialize success
13:35:51.614 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
13:35:51.618 Disk 0 Vendor: ST325082 3.AD Size: 238418MB BusType: 3
13:35:51.690 Disk 0 MBR read successfully
13:35:51.695 Disk 0 MBR scan
13:35:51.758 Disk 0 scanning sectors +488278016
13:35:51.804 Disk 0 scanning C:\Windows\system32\drivers
13:35:58.643 Service scanning
13:35:59.989 Disk 0 trace - called modules:
13:36:00.019 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll
13:36:00.026 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8616c940]
13:36:00.033 3 CLASSPNP.SYS[883a38b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84861030]
13:36:00.041 Scan finished successfully
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-27 17:01:22
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST325082 rev.3.AD
Running: gmer.exe; Driver: C:\Users\`neale\AppData\Local\Temp\uxldqpod.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xA890D780]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xA890D830]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xA890D8D0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xA890D970]

INT 0x51 ? FFFFFFFF
INT 0x51 ? 86A8D9B0
INT 0x61 ? FFFFFFFF
INT 0x61 ? 00280026
INT 0x71 ? FFFFFFFF
INT 0x71 ? 86A8D9B0
INT 0x92 ? FFFFFFFF
INT 0x92 ? 86AC2140
INT 0xA2 ? FFFFFFFF
INT 0xA2 ? 86A8D9B0
INT 0xB0 ? FFFFFFFF
INT 0xB0 ? 86B75000
INT 0xB1 ? FFFFFFFF
INT 0xB1 ? 5F534750
INT 0xB2 ? FFFFFFFF
INT 0xB2 ? 86A8D9B0

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@CurrentVersion 6.0
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion@ProductName Windows Vista ™ Home Premium
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EBB198B0-9EC2-F43C-9F40-AD32794F927D}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EBB198B0-9EC2-F43C-9F40-AD32794F927D}@iagickhoeohbknknof 0x66 0x61 0x65 0x6E …

—- Files - GMER 1.0.15 —-

File C:\Users\`neale\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R5JCUUZT\data-aggregation-service-1[1].0 441 bytes

—- EOF - GMER 1.0.15 —-


Hello Raktor,
Thanks for your quick reply; I couldn't get the files to upload using the browser method , something simple but not simple enough for me !!
I hope this all makes sense to you !!
Thanks again
Post #4
Download Combofix from any of the links below and save it to your desktop.

Link 1
Link 2


==================================

Disable your antivirus software, then double click on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
Post #5
Hello Raktor, I have tried to run the Combofix , but will not let me as it sates that the AVG software is still active, I temporarily disabled it using AVG tools, but still no joy ! I don't know how to disable it for any longer length of time. Have I missed something ? Do I also have to disable Windows Defender as well ? Thanks in advance.
Post #6
My mistake - AVG and Combofix don't play nicely together. Can you please uninstall AVG and then run Combofix, we can reinstall AVG later.
Post #7
Hello Raktor, I just can't seem to be able to uninstall AVG software, I get an error report, detailed below. I think I may have missed something ,but what it is , I just don't know. Thanks. Message reads; Severity————- error Error code———- 0xCoo70643 Error message—-general internal error Additional message– Driver installation failed, (0x00000000) Context——————– MSI action failed.
Post #9
Hello Raktor,
I ' ve run the Combofix and this is the report as requested , I couldn't upload it , so I just copied and pasted the lot. It just looks like 'mumbo-jumbo' to me , I hope it makes more sense to you !!.
I ' ve just noticed that you are sending this from Australia , this really impressed me,helping me from halfway around the World !!
Thanks.



ComboFix 11-04-28.03 - `neale 29/04/2011 13:58:03.1.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2037.1205 [GMT 1:00]
Running from: c:\users\[removed]\Cars,Bikes,Planes\Downloads\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\restoration\Restoration.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-29 )))))))))))))))))))))))))))))))
.
.
2011-04-29 13:08 . 2011-04-29 13:08 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-29 10:35 . 2011-04-29 10:35 784136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-04-28 09:00 . 2011-03-03 15:40 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2011-04-28 09:00 . 2011-03-03 13:35 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-28 08:59 . 2011-03-12 21:55 876032 —-a-w- c:\windows\system32\XpsPrint.dll
2011-04-26 13:41 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{86979409-212B-430B-AF4E-DF4EB463D303}\mpengine.dll
2011-04-26 13:37 . 2011-04-26 13:37 ——– d—–w- C:\$AVG
2011-04-22 13:58 . 2011-04-22 13:59 ——– d—–w- c:\program files\Common Files\Jasc Software Inc
2011-04-18 14:04 . 2011-04-18 14:04 1409 —-a-w- c:\windows\QTFont.for
2011-04-15 16:52 . 2011-02-18 14:03 305152 —-a-w- c:\windows\system32\drivers\srv.sys
2011-04-15 16:52 . 2011-02-18 14:03 146432 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-04-15 16:52 . 2011-02-18 14:03 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-15 16:52 . 2011-03-03 13:25 2041856 —-a-w- c:\windows\system32\win32k.sys
2011-04-15 16:52 . 2011-03-02 15:44 86528 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-04-15 16:52 . 2009-05-04 09:59 25088 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-04-15 16:52 . 2011-03-03 10:50 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-15 16:52 . 2011-03-03 15:42 739328 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-15 16:52 . 2011-02-17 06:23 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-04-15 16:13 . 2011-04-15 16:13 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-04-14 10:56 . 2011-04-14 10:56 ——– d—–w- c:\program files\Adobe Media Player
2011-04-14 09:41 . 2011-04-14 09:45 ——– d—–w- C:\eLearn
2011-04-13 19:44 . 2011-04-13 19:44 ——– d—–r- c:\program files\Vizros
2011-04-09 17:25 . 2011-04-09 17:25 ——– d—–w- c:\program files\Windows Portable Devices
2011-04-09 16:51 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2011-04-09 16:51 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2011-04-09 16:51 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2011-04-09 16:48 . 2009-09-25 01:33 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-04-09 16:48 . 2009-09-25 02:10 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-04-09 16:48 . 2009-09-25 02:07 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-04-09 16:48 . 2009-09-25 02:04 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-04-09 16:48 . 2009-09-25 01:33 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-04-09 16:48 . 2009-09-25 01:32 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-04-09 16:48 . 2009-09-25 01:31 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-04-09 16:46 . 2009-10-01 01:02 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2011-04-09 16:46 . 2009-10-01 01:02 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2011-04-09 16:46 . 2009-10-01 01:01 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2011-04-09 16:46 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2011-04-09 16:46 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2011-04-09 16:46 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2011-04-09 16:46 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2011-04-09 16:46 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2011-04-09 16:46 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2011-04-09 16:46 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2011-04-09 16:46 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2011-04-09 16:46 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2011-04-09 16:43 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-04-09 16:43 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-04-09 16:43 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2011-04-08 20:25 . 2011-04-08 20:25 ——– d—–w- c:\programdata\FileCure
2011-04-08 20:25 . 2011-04-08 20:25 ——– d—–w- c:\program files\ParetoLogic
2011-04-08 10:28 . 2011-02-22 13:33 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-04-08 10:28 . 2011-02-22 13:33 797696 —-a-w- c:\windows\system32\FntCache.dll
2011-04-08 10:28 . 2011-01-20 16:08 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-04-08 10:28 . 2011-01-20 16:08 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-04-08 10:28 . 2011-01-20 14:12 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-04-08 10:28 . 2011-01-20 14:11 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-04-08 10:28 . 2011-01-20 13:47 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-04-08 10:28 . 2011-02-22 14:13 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-08 10:28 . 2011-01-20 16:08 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-04-08 10:28 . 2011-01-20 16:08 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-04-08 10:28 . 2011-01-20 14:28 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-04-08 10:28 . 2011-01-20 14:25 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-04-08 10:27 . 2010-05-04 19:13 231424 —-a-w- c:\windows\system32\msshsq.dll
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\ca-ES
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\eu-ES
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\vi-VN
2011-04-07 11:27 . 2011-04-14 17:03 ——– d—–w- c:\windows\system32\EventProviders
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-16 11:39 . 2006-11-02 10:32 101888 —-a-w- c:\windows\system32\ifxcardm.dll
2011-03-16 11:39 . 2006-11-02 10:32 82432 —-a-w- c:\windows\system32\axaltocm.dll
2011-03-12 12:00 . 2011-03-12 12:00 1793536 —-a-w- c:\windows\system32\NlsLexicons0045.dll
2011-03-12 12:00 . 2011-03-12 12:00 1808896 —-a-w- c:\windows\system32\NlsLexicons0046.dll
2011-03-12 12:00 . 2011-03-12 12:00 1782272 —-a-w- c:\windows\system32\NlsLexicons0039.dll
2011-03-12 12:00 . 2011-03-12 12:00 1558016 —-a-w- c:\windows\system32\NlsLexicons0049.dll
2011-03-12 12:00 . 2011-03-12 12:00 1411072 —-a-w- c:\windows\system32\NlsLexicons0047.dll
2011-03-12 12:00 . 2011-03-12 12:00 1236992 —-a-w- c:\windows\system32\NlsLexicons0020.dll
2011-03-12 12:00 . 2011-03-12 12:00 2136064 —-a-w- c:\windows\system32\NlsLexicons0021.dll
2011-03-12 12:00 . 2011-03-12 12:00 5499904 —-a-w- c:\windows\system32\NlsLexicons0022.dll
2011-03-12 12:00 . 2011-03-12 12:00 7964672 —-a-w- c:\windows\system32\NlsLexicons0024.dll
2011-03-12 12:00 . 2011-03-12 12:00 5791232 —-a-w- c:\windows\system32\NlsLexicons0026.dll
2011-03-12 12:00 . 2011-03-12 12:00 6224896 —-a-w- c:\windows\system32\NlsLexicons0027.dll
2011-03-12 12:00 . 2011-03-12 12:00 4175872 —-a-w- c:\windows\system32\NlsLexicons0010.dll
2011-03-12 12:00 . 2011-03-12 12:00 2466816 —-a-w- c:\windows\system32\NlsLexicons0011.dll
2011-03-12 12:00 . 2011-03-12 12:00 4981248 —-a-w- c:\windows\system32\NlsLexicons0013.dll
2011-03-12 12:00 . 2011-03-12 12:00 3331072 —-a-w- c:\windows\system32\NlsLexicons0018.dll
2011-03-12 12:00 . 2011-03-12 12:00 6781440 —-a-w- c:\windows\system32\NlsLexicons0019.dll
2011-03-12 12:00 . 2011-03-12 12:00 11722752 —-a-w- c:\windows\system32\NlsLexicons0001.dll
2011-03-12 12:00 . 2011-03-12 12:00 4164096 —-a-w- c:\windows\system32\NlsLexicons0002.dll
2011-03-12 12:00 . 2011-03-12 12:00 1452544 —-a-w- c:\windows\system32\NlsLexicons0003.dll
2011-03-12 12:00 . 2011-03-12 12:00 3419136 —-a-w- c:\windows\system32\NlsLexicons004a.dll
2011-03-12 12:00 . 2011-03-12 12:00 1702912 —-a-w- c:\windows\system32\NlsLexicons004b.dll
2011-03-12 12:00 . 2011-03-12 12:00 4093440 —-a-w- c:\windows\system32\NlsLexicons004c.dll
2011-03-12 12:00 . 2011-03-12 12:00 1972736 —-a-w- c:\windows\system32\NlsLexicons004e.dll
2011-03-12 12:00 . 2011-03-12 12:00 4045824 —-a-w- c:\windows\system32\NlsLexicons003e.dll
2011-03-12 12:00 . 2011-03-12 12:00 6014976 —-a-w- c:\windows\system32\NlsLexicons001a.dll
2011-03-12 12:00 . 2011-03-12 12:00 4096 —-a-w- c:\windows\system32\NlsLexicons002a.dll
2011-03-12 12:00 . 2011-03-12 12:00 6585856 —-a-w- c:\windows\system32\NlsLexicons001b.dll
2011-03-12 12:00 . 2011-03-12 12:00 6346240 —-a-w- c:\windows\system32\NlsLexicons001d.dll
2011-03-12 12:00 . 2011-03-12 12:00 9892864 —-a-w- c:\windows\system32\NlsLexicons000a.dll
2011-03-12 12:00 . 2011-03-12 12:00 6237696 —-a-w- c:\windows\system32\NlsLexicons000c.dll
2011-03-12 12:00 . 2011-03-12 12:00 1722368 —-a-w- c:\windows\system32\NlsLexicons000d.dll
2011-03-12 12:00 . 2011-03-12 12:00 5654528 —-a-w- c:\windows\system32\NlsLexicons000f.dll
2011-03-12 12:00 . 2011-03-12 12:00 5090816 —-a-w- c:\windows\system32\NlsLexicons0416.dll
2011-03-12 12:00 . 2011-03-12 12:00 4616192 —-a-w- c:\windows\system32\NlsLexicons0414.dll
2011-03-12 12:00 . 2011-03-12 12:00 5031936 —-a-w- c:\windows\system32\NlsLexicons0816.dll
2011-03-12 12:00 . 2011-03-12 12:00 7042560 —-a-w- c:\windows\system32\NlsLexicons081a.dll
2011-03-12 12:00 . 2011-03-12 12:00 5071872 —-a-w- c:\windows\system32\NlsModels0011.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0046.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0045.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0047.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0049.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0039.dll
2011-03-12 12:00 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData0020.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData0021.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData0022.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0026.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0024.dll
2011-03-12 11:59 . 2011-03-12 11:59 1966592 —-a-w- c:\windows\system32\NlsData0027.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0010.dll
2011-03-12 11:59 . 2011-03-12 11:59 2657280 —-a-w- c:\windows\system32\NlsData0011.dll
2011-03-12 11:59 . 2011-03-12 11:59 3466752 —-a-w- c:\windows\system32\NlsData0013.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0018.dll
2011-03-12 11:59 . 2011-03-12 11:59 1523712 —-a-w- c:\windows\system32\NlsData0000.dll
2011-03-12 11:59 . 2011-03-12 11:59 4497408 —-a-w- c:\windows\system32\NlsData0019.dll
2011-03-12 11:59 . 2011-03-12 11:59 2599936 —-a-w- c:\windows\system32\NlsData0001.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0002.dll
2011-03-12 11:59 . 2011-03-12 11:59 2243072 —-a-w- c:\windows\system32\NlsData0007.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0003.dll
2011-03-12 11:59 . 2011-03-12 11:59 4875776 —-a-w- c:\windows\system32\NlsData0009.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004b.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004a.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004c.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004e.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData003e.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData002a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData001b.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData001a.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData001d.dll
2011-03-12 11:59 . 2011-03-12 11:59 9847296 —-a-w- c:\windows\system32\NlsData000a.dll
2011-03-12 11:59 . 2011-03-12 11:59 2643456 —-a-w- c:\windows\system32\NlsData000c.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0414.dll
2011-03-12 11:59 . 2011-03-12 11:59 2342912 —-a-w- c:\windows\system32\NlsData000d.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData000f.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0416.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0816.dll
2011-03-12 11:59 . 2011-03-12 11:59 6917120 —-a-w- c:\windows\system32\NlsLexicons0c1a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0c1a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData081a.dll
2011-03-11 11:01 . 2011-03-11 11:01 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2011-03-11 11:01 . 2011-03-11 11:01 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2011-03-11 11:01 . 2011-03-11 11:01 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2011-03-11 11:01 . 2011-03-11 11:01 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2011-03-11 11:01 . 2011-03-11 11:01 19968 —-a-w- c:\windows\system32\ARP.EXE
2011-03-11 11:01 . 2011-03-11 11:01 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2011-03-11 11:01 . 2011-03-11 11:01 105984 —-a-w- c:\windows\system32\netiohlp.dll
2011-03-11 11:01 . 2011-03-11 11:01 10240 —-a-w- c:\windows\system32\finger.exe
2011-03-11 10:58 . 2011-03-11 10:58 377344 —-a-w- c:\windows\system32\winhttp.dll
2011-03-10 11:39 . 2011-03-10 11:39 36864 —-a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2011-03-10 11:11 . 2011-03-10 11:11 60928 —-a-w- c:\windows\system32\msasn1.dll
2011-03-09 14:42 . 2011-03-09 14:42 23552 —-a-w- c:\windows\system32\lpk.dll
2011-03-09 14:42 . 2011-03-09 14:42 10240 —-a-w- c:\windows\system32\dciman32.dll
2011-03-09 14:36 . 2011-03-09 14:36 61440 —-a-w- c:\windows\system32\winipsec.dll
2011-03-09 14:36 . 2011-03-09 14:36 272896 —-a-w- c:\windows\system32\polstore.dll
2011-03-09 14:31 . 2011-03-09 14:31 127488 —-a-w- c:\windows\system32\L2SecHC.dll
2011-03-09 14:31 . 2011-03-09 14:31 68096 —-a-w- c:\windows\system32\wlanhlp.dll
2011-03-09 14:31 . 2011-03-09 14:31 65024 —-a-w- c:\windows\system32\wlanapi.dll
2011-03-09 14:31 . 2011-03-09 14:31 513536 —-a-w- c:\windows\system32\wlansvc.dll
2011-03-09 14:31 . 2011-03-09 14:31 302592 —-a-w- c:\windows\system32\wlansec.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"V Stuff Backup"="c:\program files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" [2010-04-14 8263584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atwtusb"="atwtusb.exe beta" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-09 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-09 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-09 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-04-21 77824]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2006-11-17 17920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-25 98304]
"basicsmssmenu"="c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" [2007-10-09 169328]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"VirginMediaHUB.exe"="c:\program files\Virgin Media\HUB\VirginMediaHUB.exe" [2009-12-14 4277488]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 303104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
.
c:\users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\HUB\ServicepointService.exe [2009-12-14 668912]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-05-01 3032360]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2008-03-17 15144]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-29 c:\windows\Tasks\User_Feed_Synchronization-{2DC91E15-2885-4715-BC12-0690563723B8}.job
- c:\windows\system32\msfeedssync.exe [2011-04-15 04:43]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.searchqu.com/406
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{f4e6547e-325b-403c-a3bb-ad29ed37a92f} - (no file)
URLSearchHooks-{38542454-dfb6-44f5-b052-d4e071a3d073} - (no file)
Toolbar-10 - (no file)
WebBrowser-{F4E6547E-325B-403C-A3BB-AD29ED37A92F} - (no file)
WebBrowser-{38542454-DFB6-44F5-B052-D4E071A3D073} - (no file)
HKCU-Run-OM2_Monitor - c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-TQ566808 - E:\Setup.exe
AddRemove-HDMI - c:\windows\system32\igxpun.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-29 14:43
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
c:\users\`neale\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3123012570-1870344975-3280608661-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EBB198B0-9EC2-F43C-9F40-AD32794F927D}*]
"iagickhoeohbknknof"=hex:66,61,65,6e,62,66,6c,6e,65,65,66,65,00,00
.
Completion time: 2011-04-29 14:47:52
ComboFix-quarantined-files.txt 2011-04-29 13:47
.
Pre-Run: 93,787,983,872 bytes free
Post-Run: 94,844,612,608 bytes free
.
- - End Of File - - 72D95F97257E38A4E07374EE2B2E59B3
Post #10
In Google Chrome:
1. Click the wrench icon
2. Go to Options
3. Go to the Basics tab
4. Set "Default Search" to Google
5. Click close

Also change the homepage back to http://www.google.com/

Then…

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

DDS::
uStart Page = hxxp://www.searchqu.com/406


Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe


[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Please also post the contents of C:\Qoobox\Add-Remove Programs.txt.

And yes I am in Australia, which explains why I respond at strange times. ;)
Post #11
Hello Raktor,
I have run the Combofix as per your latest reply, I can't find the other part you require , (C:/Qoobox\Add-Remove Programs.txt ) , it may be right in front of me ,but I can't see where it is !
Thanks again.


ComboFix 11-04-29.04 - `neale 30/04/2011 17:23:39.2.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2037.1146 [GMT 1:00]
Running from: c:\users\[removed]\Cars,Bikes,Planes\Downloads\ComboFix.exe
Command switches used :: c:\users\`neale\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-30 )))))))))))))))))))))))))))))))
.
.
2011-04-30 16:33 . 2011-04-30 16:33 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-04-29 10:35 . 2011-04-29 10:35 784136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-04-28 09:00 . 2011-03-03 15:40 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2011-04-28 09:00 . 2011-03-03 13:35 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-28 08:59 . 2011-03-12 21:55 876032 —-a-w- c:\windows\system32\XpsPrint.dll
2011-04-26 13:41 . 2011-04-11 07:04 7071056 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{86979409-212B-430B-AF4E-DF4EB463D303}\mpengine.dll
2011-04-26 13:37 . 2011-04-26 13:37 ——– d—–w- C:\$AVG
2011-04-22 13:58 . 2011-04-22 13:59 ——– d—–w- c:\program files\Common Files\Jasc Software Inc
2011-04-18 14:04 . 2011-04-18 14:04 1409 —-a-w- c:\windows\QTFont.for
2011-04-15 16:52 . 2011-02-18 14:03 305152 —-a-w- c:\windows\system32\drivers\srv.sys
2011-04-15 16:52 . 2011-02-18 14:03 146432 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-04-15 16:52 . 2011-02-18 14:03 102400 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-15 16:52 . 2011-03-03 13:25 2041856 —-a-w- c:\windows\system32\win32k.sys
2011-04-15 16:52 . 2011-03-02 15:44 86528 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-04-15 16:52 . 2009-05-04 09:59 25088 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-04-15 16:52 . 2011-03-03 10:50 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-15 16:52 . 2011-03-03 15:42 739328 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-15 16:52 . 2011-02-17 06:23 420864 —-a-w- c:\windows\system32\vbscript.dll
2011-04-15 16:13 . 2011-04-15 16:13 ——– d—–w- c:\program files\Common Files\Adobe AIR
2011-04-14 10:56 . 2011-04-14 10:56 ——– d—–w- c:\program files\Adobe Media Player
2011-04-14 09:41 . 2011-04-14 09:45 ——– d—–w- C:\eLearn
2011-04-13 19:44 . 2011-04-13 19:44 ——– d—–r- c:\program files\Vizros
2011-04-09 17:25 . 2011-04-09 17:25 ——– d—–w- c:\program files\Windows Portable Devices
2011-04-09 16:51 . 2009-09-10 02:00 92672 —-a-w- c:\windows\system32\UIAnimation.dll
2011-04-09 16:51 . 2009-09-10 02:01 3023360 —-a-w- c:\windows\system32\UIRibbon.dll
2011-04-09 16:51 . 2009-09-10 02:00 1164800 —-a-w- c:\windows\system32\UIRibbonRes.dll
2011-04-09 16:48 . 2009-09-25 01:33 369664 —-a-w- c:\windows\system32\WMPhoto.dll
2011-04-09 16:48 . 2009-09-25 02:10 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll
2011-04-09 16:48 . 2009-09-25 02:07 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll
2011-04-09 16:48 . 2009-09-25 02:04 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll
2011-04-09 16:48 . 2009-09-25 01:33 195584 —-a-w- c:\windows\system32\dxdiagn.dll
2011-04-09 16:48 . 2009-09-25 01:32 252928 —-a-w- c:\windows\system32\dxdiag.exe
2011-04-09 16:48 . 2009-09-25 01:31 519680 —-a-w- c:\windows\system32\d3d11.dll
2011-04-09 16:46 . 2009-10-01 01:02 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2011-04-09 16:46 . 2009-10-01 01:02 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2011-04-09 16:46 . 2009-10-01 01:01 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2011-04-09 16:46 . 2009-10-01 01:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2011-04-09 16:46 . 2009-10-01 01:02 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2011-04-09 16:46 . 2009-10-01 01:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2011-04-09 16:46 . 2009-10-01 01:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2011-04-09 16:46 . 2009-10-01 01:02 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2011-04-09 16:46 . 2009-10-01 01:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2011-04-09 16:46 . 2009-10-01 01:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2011-04-09 16:46 . 2009-10-01 01:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2011-04-09 16:46 . 2009-10-01 01:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2011-04-09 16:43 . 2009-10-08 21:07 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2011-04-09 16:43 . 2009-10-08 21:08 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2011-04-09 16:43 . 2009-10-08 21:08 234496 —-a-w- c:\windows\system32\oleacc.dll
2011-04-08 20:25 . 2011-04-08 20:25 ——– d—–w- c:\programdata\FileCure
2011-04-08 20:25 . 2011-04-08 20:25 ——– d—–w- c:\program files\ParetoLogic
2011-04-08 10:28 . 2011-02-22 13:33 1068544 —-a-w- c:\windows\system32\DWrite.dll
2011-04-08 10:28 . 2011-02-22 13:33 797696 —-a-w- c:\windows\system32\FntCache.dll
2011-04-08 10:28 . 2011-01-20 16:08 160768 —-a-w- c:\windows\system32\d3d10_1.dll
2011-04-08 10:28 . 2011-01-20 16:08 1029120 —-a-w- c:\windows\system32\d3d10.dll
2011-04-08 10:28 . 2011-01-20 14:12 1172480 —-a-w- c:\windows\system32\d3d10warp.dll
2011-04-08 10:28 . 2011-01-20 14:11 486400 —-a-w- c:\windows\system32\d3d10level9.dll
2011-04-08 10:28 . 2011-01-20 13:47 683008 —-a-w- c:\windows\system32\d2d1.dll
2011-04-08 10:28 . 2011-02-22 14:13 288768 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-08 10:28 . 2011-01-20 16:08 219648 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-04-08 10:28 . 2011-01-20 16:08 189952 —-a-w- c:\windows\system32\d3d10core.dll
2011-04-08 10:28 . 2011-01-20 14:28 1554432 —-a-w- c:\windows\system32\xpsservices.dll
2011-04-08 10:28 . 2011-01-20 14:25 847360 —-a-w- c:\windows\system32\OpcServices.dll
2011-04-08 10:27 . 2010-05-04 19:13 231424 —-a-w- c:\windows\system32\msshsq.dll
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\ca-ES
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\eu-ES
2011-04-07 12:25 . 2011-04-07 12:25 ——– d—–w- c:\windows\system32\vi-VN
2011-04-07 11:27 . 2011-04-14 17:03 ——– d—–w- c:\windows\system32\EventProviders
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-16 11:39 . 2006-11-02 10:32 101888 —-a-w- c:\windows\system32\ifxcardm.dll
2011-03-16 11:39 . 2006-11-02 10:32 82432 —-a-w- c:\windows\system32\axaltocm.dll
2011-03-12 12:00 . 2011-03-12 12:00 1793536 —-a-w- c:\windows\system32\NlsLexicons0045.dll
2011-03-12 12:00 . 2011-03-12 12:00 1808896 —-a-w- c:\windows\system32\NlsLexicons0046.dll
2011-03-12 12:00 . 2011-03-12 12:00 1782272 —-a-w- c:\windows\system32\NlsLexicons0039.dll
2011-03-12 12:00 . 2011-03-12 12:00 1558016 —-a-w- c:\windows\system32\NlsLexicons0049.dll
2011-03-12 12:00 . 2011-03-12 12:00 1411072 —-a-w- c:\windows\system32\NlsLexicons0047.dll
2011-03-12 12:00 . 2011-03-12 12:00 1236992 —-a-w- c:\windows\system32\NlsLexicons0020.dll
2011-03-12 12:00 . 2011-03-12 12:00 2136064 —-a-w- c:\windows\system32\NlsLexicons0021.dll
2011-03-12 12:00 . 2011-03-12 12:00 5499904 —-a-w- c:\windows\system32\NlsLexicons0022.dll
2011-03-12 12:00 . 2011-03-12 12:00 7964672 —-a-w- c:\windows\system32\NlsLexicons0024.dll
2011-03-12 12:00 . 2011-03-12 12:00 5791232 —-a-w- c:\windows\system32\NlsLexicons0026.dll
2011-03-12 12:00 . 2011-03-12 12:00 6224896 —-a-w- c:\windows\system32\NlsLexicons0027.dll
2011-03-12 12:00 . 2011-03-12 12:00 4175872 —-a-w- c:\windows\system32\NlsLexicons0010.dll
2011-03-12 12:00 . 2011-03-12 12:00 2466816 —-a-w- c:\windows\system32\NlsLexicons0011.dll
2011-03-12 12:00 . 2011-03-12 12:00 4981248 —-a-w- c:\windows\system32\NlsLexicons0013.dll
2011-03-12 12:00 . 2011-03-12 12:00 3331072 —-a-w- c:\windows\system32\NlsLexicons0018.dll
2011-03-12 12:00 . 2011-03-12 12:00 6781440 —-a-w- c:\windows\system32\NlsLexicons0019.dll
2011-03-12 12:00 . 2011-03-12 12:00 11722752 —-a-w- c:\windows\system32\NlsLexicons0001.dll
2011-03-12 12:00 . 2011-03-12 12:00 4164096 —-a-w- c:\windows\system32\NlsLexicons0002.dll
2011-03-12 12:00 . 2011-03-12 12:00 1452544 —-a-w- c:\windows\system32\NlsLexicons0003.dll
2011-03-12 12:00 . 2011-03-12 12:00 3419136 —-a-w- c:\windows\system32\NlsLexicons004a.dll
2011-03-12 12:00 . 2011-03-12 12:00 1702912 —-a-w- c:\windows\system32\NlsLexicons004b.dll
2011-03-12 12:00 . 2011-03-12 12:00 4093440 —-a-w- c:\windows\system32\NlsLexicons004c.dll
2011-03-12 12:00 . 2011-03-12 12:00 1972736 —-a-w- c:\windows\system32\NlsLexicons004e.dll
2011-03-12 12:00 . 2011-03-12 12:00 4045824 —-a-w- c:\windows\system32\NlsLexicons003e.dll
2011-03-12 12:00 . 2011-03-12 12:00 6014976 —-a-w- c:\windows\system32\NlsLexicons001a.dll
2011-03-12 12:00 . 2011-03-12 12:00 4096 —-a-w- c:\windows\system32\NlsLexicons002a.dll
2011-03-12 12:00 . 2011-03-12 12:00 6585856 —-a-w- c:\windows\system32\NlsLexicons001b.dll
2011-03-12 12:00 . 2011-03-12 12:00 6346240 —-a-w- c:\windows\system32\NlsLexicons001d.dll
2011-03-12 12:00 . 2011-03-12 12:00 9892864 —-a-w- c:\windows\system32\NlsLexicons000a.dll
2011-03-12 12:00 . 2011-03-12 12:00 6237696 —-a-w- c:\windows\system32\NlsLexicons000c.dll
2011-03-12 12:00 . 2011-03-12 12:00 1722368 —-a-w- c:\windows\system32\NlsLexicons000d.dll
2011-03-12 12:00 . 2011-03-12 12:00 5654528 —-a-w- c:\windows\system32\NlsLexicons000f.dll
2011-03-12 12:00 . 2011-03-12 12:00 5090816 —-a-w- c:\windows\system32\NlsLexicons0416.dll
2011-03-12 12:00 . 2011-03-12 12:00 4616192 —-a-w- c:\windows\system32\NlsLexicons0414.dll
2011-03-12 12:00 . 2011-03-12 12:00 5031936 —-a-w- c:\windows\system32\NlsLexicons0816.dll
2011-03-12 12:00 . 2011-03-12 12:00 7042560 —-a-w- c:\windows\system32\NlsLexicons081a.dll
2011-03-12 12:00 . 2011-03-12 12:00 5071872 —-a-w- c:\windows\system32\NlsModels0011.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0046.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0045.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0047.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0049.dll
2011-03-12 12:00 . 2011-03-12 12:00 3104768 —-a-w- c:\windows\system32\NlsData0039.dll
2011-03-12 12:00 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData0020.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData0021.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData0022.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0026.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0024.dll
2011-03-12 11:59 . 2011-03-12 11:59 1966592 —-a-w- c:\windows\system32\NlsData0027.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0010.dll
2011-03-12 11:59 . 2011-03-12 11:59 2657280 —-a-w- c:\windows\system32\NlsData0011.dll
2011-03-12 11:59 . 2011-03-12 11:59 3466752 —-a-w- c:\windows\system32\NlsData0013.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0018.dll
2011-03-12 11:59 . 2011-03-12 11:59 1523712 —-a-w- c:\windows\system32\NlsData0000.dll
2011-03-12 11:59 . 2011-03-12 11:59 4497408 —-a-w- c:\windows\system32\NlsData0019.dll
2011-03-12 11:59 . 2011-03-12 11:59 2599936 —-a-w- c:\windows\system32\NlsData0001.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0002.dll
2011-03-12 11:59 . 2011-03-12 11:59 2243072 —-a-w- c:\windows\system32\NlsData0007.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0003.dll
2011-03-12 11:59 . 2011-03-12 11:59 4875776 —-a-w- c:\windows\system32\NlsData0009.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004b.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004a.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004c.dll
2011-03-12 11:59 . 2011-03-12 11:59 3104768 —-a-w- c:\windows\system32\NlsData004e.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData003e.dll
2011-03-12 11:59 . 2011-03-12 11:59 1801216 —-a-w- c:\windows\system32\NlsData002a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData001b.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData001a.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData001d.dll
2011-03-12 11:59 . 2011-03-12 11:59 9847296 —-a-w- c:\windows\system32\NlsData000a.dll
2011-03-12 11:59 . 2011-03-12 11:59 2643456 —-a-w- c:\windows\system32\NlsData000c.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0414.dll
2011-03-12 11:59 . 2011-03-12 11:59 2342912 —-a-w- c:\windows\system32\NlsData000d.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData000f.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0416.dll
2011-03-12 11:59 . 2011-03-12 11:59 4495360 —-a-w- c:\windows\system32\NlsData0816.dll
2011-03-12 11:59 . 2011-03-12 11:59 6917120 —-a-w- c:\windows\system32\NlsLexicons0c1a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData0c1a.dll
2011-03-12 11:59 . 2011-03-12 11:59 1965056 —-a-w- c:\windows\system32\NlsData081a.dll
2011-03-11 11:01 . 2011-03-11 11:01 11264 —-a-w- c:\windows\system32\MRINFO.EXE
2011-03-11 11:01 . 2011-03-11 11:01 9728 —-a-w- c:\windows\system32\TCPSVCS.EXE
2011-03-11 11:01 . 2011-03-11 11:01 8704 —-a-w- c:\windows\system32\HOSTNAME.EXE
2011-03-11 11:01 . 2011-03-11 11:01 27136 —-a-w- c:\windows\system32\NETSTAT.EXE
2011-03-11 11:01 . 2011-03-11 11:01 19968 —-a-w- c:\windows\system32\ARP.EXE
2011-03-11 11:01 . 2011-03-11 11:01 17920 —-a-w- c:\windows\system32\ROUTE.EXE
2011-03-11 11:01 . 2011-03-11 11:01 105984 —-a-w- c:\windows\system32\netiohlp.dll
2011-03-11 11:01 . 2011-03-11 11:01 10240 —-a-w- c:\windows\system32\finger.exe
2011-03-11 10:58 . 2011-03-11 10:58 377344 —-a-w- c:\windows\system32\winhttp.dll
2011-03-10 11:39 . 2011-03-10 11:39 36864 —-a-w- c:\windows\system32\drivers\en-US\http.sys.mui
2011-03-10 11:11 . 2011-03-10 11:11 60928 —-a-w- c:\windows\system32\msasn1.dll
2011-03-09 14:42 . 2011-03-09 14:42 23552 —-a-w- c:\windows\system32\lpk.dll
2011-03-09 14:42 . 2011-03-09 14:42 10240 —-a-w- c:\windows\system32\dciman32.dll
2011-03-09 14:36 . 2011-03-09 14:36 61440 —-a-w- c:\windows\system32\winipsec.dll
2011-03-09 14:36 . 2011-03-09 14:36 272896 —-a-w- c:\windows\system32\polstore.dll
2011-03-09 14:31 . 2011-03-09 14:31 127488 —-a-w- c:\windows\system32\L2SecHC.dll
2011-03-09 14:31 . 2011-03-09 14:31 68096 —-a-w- c:\windows\system32\wlanhlp.dll
2011-03-09 14:31 . 2011-03-09 14:31 65024 —-a-w- c:\windows\system32\wlanapi.dll
2011-03-09 14:31 . 2011-03-09 14:31 513536 —-a-w- c:\windows\system32\wlansvc.dll
2011-03-09 14:31 . 2011-03-09 14:31 302592 —-a-w- c:\windows\system32\wlansec.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"V Stuff Backup"="c:\program files\VirginMedia\V Stuff Backup\v_stuff_backup.exe" [2010-04-14 8263584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atwtusb"="atwtusb.exe beta" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-09 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-09 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-09 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0\bin\jusched.exe" [2007-04-21 77824]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2006-11-17 17920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-25 98304]
"basicsmssmenu"="c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" [2007-10-09 169328]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"VirginMediaHUB.exe"="c:\program files\Virgin Media\HUB\VirginMediaHUB.exe" [2009-12-14 4277488]
"SigmatelSysTrayApp"="sttray.exe" [2007-02-08 303104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
.
c:\users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x]
S2 ServicepointService;ServicepointService;c:\program files\Virgin Media\HUB\ServicepointService.exe [2009-12-14 668912]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-05-01 3032360]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2008-03-17 15144]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-30 c:\windows\Tasks\User_Feed_Synchronization-{2DC91E15-2885-4715-BC12-0690563723B8}.job
- c:\windows\system32\msfeedssync.exe [2011-04-15 04:43]
.
.
——- Supplementary Scan ——-
.
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-30 17:33
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3123012570-1870344975-3280608661-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{EBB198B0-9EC2-F43C-9F40-AD32794F927D}*]
"iagickhoeohbknknof"=hex:66,61,65,6e,62,66,6c,6e,65,65,66,65,00,00
.
Completion time: 2011-04-30 17:36:58
ComboFix-quarantined-files.txt 2011-04-30 16:36
ComboFix2.txt 2011-04-29 13:47
.
Pre-Run: 94,851,088,384 bytes free
Post-Run: 94,823,817,216 bytes free
.
- - End Of File - - B7EE6A37CF00B8F3DA14059D79B46AE5
Post #12
Something might have changed within Combofix, but I don't think so, the file should be there.

Hold the Windows Key, and press R.

In the Run box, copy and paste
notepad C:\Qoobox\Add-Remove Programs.txt
and press Enter.

See if the file comes up.
Post #13
Hello Raktor, Yes, you're right , I ' ve done as suggested and have attached the file for your examination. I logged onto Google chrome without thinking and it now seems to work O.K I didn't use anything that required a password for safety reasons, I ' m getting paranoid now !! I 've been checking the Forum advice for security and Windows Defender seems to be not too good . All the best for now and thanks again. , ABBYY FineReader 6.0 Sprint Adobe Acrobat 5.0 Adobe AIR Adobe Bridge 1.0 Adobe Common File Installer Adobe Flash Player 9 ActiveX Adobe Flash Player Plugin Adobe Help Center 1.0 Adobe Photoshop CS2 Adobe Photoshop CS5 Adobe Reader X (10.0.1) Adobe Stock Photos 1.0 Alien Skin Blow Up Alien Skin Eye Candy 5 Impact Alien Skin Eye Candy 5 Nature Alien Skin Eye Candy 5 Textures Alien Skin Image Doctor 1.0 Demo Alien Skin Xenofex 2.0 Demo Audacity 1.2.6 CDBurnerXP CdCoverCreator 2.5.3 Corel Paint Shop Pro Photo X2 Dell System Customization Wizard DellSupport Disketch CD Label Software Drive Manager EPSON Attach To Email EPSON Copy Utility 3 EPSON Event Manager EPSON PERFECTION V200 PHOTO Manual EPSON Scan EPSON Scan Assistant EPSON TWAIN 5 exPressit S.E. 3.0 FinalBurner Free v2.24.0.195 Focus 10,000 Photos Focus 30,000 Photos Google Chrome Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Intel® Matrix Storage Manager InterCover 1.24 Jasc Paint Shop Photo Album 5 Jasc Paint Shop Pro 9 Java™ SE Runtime Environment 6 LAME v3.98.3 for Audacity Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Works Microsoft_VC80_ATL_x86 Microsoft_VC80_CRT_x86 Microsoft_VC80_MFC_x86 Microsoft_VC80_MFCLOC_x86 Microsoft_VC90_ATL_x86 Microsoft_VC90_CRT_x86 Microsoft_VC90_MFC_x86 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK PDF Settings CS5 Pen Tablet QuickTime Roxio Creator Audio Roxio Creator BDAV Plugin Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Express Labeler Roxio MyDVD DE Roxio Update Manager Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Windows Media Encoder (KB2447961) Security Update for Windows Media Encoder (KB954156) SigmaTel Audio Simple Cover Printer Sonic Activation Module SSC Service Utility v4.30 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) URL Assistant User's Guides V Stuff Backup v1.6.2.18253 Virgin Media HUB 3.5.12 Windows Media Encoder 9 Series WinRAR archiver Wireless Tablet Series
Post #14
I would remove Windows Defender, it's no longer relevant. I'd recommend that you download and install Microsoft Security Essentials instead of Windows Defender and AVG. (You can do that now)

Then, please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

  • Then, please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Post the log from MBAM and from ESET, then we're nearly done!
Post #15
Hello Raktor, I have done as suggested , I hope both these files are correctly copied to this post , I have downloaded Microsoft Security Essentials and have it running. I did notice that the security program stated that Windows Defender was still active,but when I checked it wasn't anywhere to be found !! Do you recommend that I remove Internet Explorer? as it appears to be not very well protected, if I read the various articles correctly. I hope this all makes sense to you, thanks. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6500 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19048 03/05/2011 17:25:01 mbam-log-2011-05-03 (17-25-01).txt Scan type: Quick scan Objects scanned: 144166 Time elapsed: 8 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESET scanner. C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\PlugIns\Flaming Pear\Panopticum Fire 3.32+ ICE 1.0+Digitalizer.1.24+Engraver.1.25+Apl\Panopticum.Alpha.Strip.v1.32.for.Adobe.Photoshop.incl.KeyGen.rar probably a variant of Win32/TrojanDropper.Agent.FLSFSAX trojan C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\PlugIns\Flaming Pear\Panopticum Fire 3.32+ ICE 1.0+Digitalizer.1.24+Engraver.1.25+Apl\Panopticum.Engraver.v1.25.for.Adobe.Photoshop20060814185419.rar probably a variant of Win32/TrojanDropper.Agent.CKVTVGH trojan C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\PlugIns\Flaming Pear\Panopticum Fire 3.32+ ICE 1.0+Digitalizer.1.24+Engraver.1.25+Apl\Panopticum.Fire3.v3.32.for.Adobe.Photoshop20060814185505.rar probably a variant of Win32/TrojanDropper.Agent.BFXQHVZ trojan C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\PlugIns\Flaming Pear\Panopticum Fire 3.32+ ICE 1.0+Digitalizer.1.24+Engraver.1.25+Apl\Panticopium ice photoshop.rar probably a variant of Win32/Agent.HLRNOPF trojan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI