Spyware / Malware / Virus Removal

www.searchqu.com 406 and backdoor.bifrose

19 min read

Looking for the outcome? Ask AI

brazen71

Post #31July 21, 2011, 12:36 PM UTC

I will wait for further instructions from you first Many thanks

Conspire

Post #32July 21, 2011, 12:38 PM UTC

Looks much better now. How is it running now?

Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here and save to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program. (Note to Vista users, please right-click and select Run as Administrator.)
At the end, be sure a checkmark is placed next to:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please copy and paste the log back into your next reply

Note:

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
Look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt. Include the contents of this report in your next reply.
Select Uninstall application on close check box and push [external image: Posted Image]

===================================================

On your next reply please post :
MBAM log
ESET log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

brazen71

Post #33July 21, 2011, 1:00 PM UTC

Before I follow any further instructions, I would like to inform you of one or two things.

Overall, I'd say that my laptop has been running normally. The only issues that it has are that all of my explorers (Google, Firefox etc) has been taken over by http://www.searchqu.com/406

This still hasn't changed, even after running the ComboFix scan and any that we have gone through previously. Every time I launch one of the above, my home page is changed to http://www.searchqu.com/406

That's my main concern. It still has an unwanted place on my laptop

I already have and use the Malwarebytes Anti Malware scanner and it isn't finding any issues

I'm going to try the ESET online scanner now

Thanks

Conspire

Post #34July 21, 2011, 1:03 PM UTC

Ok, stop that ESET for the mean time and run this.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

brazen71

Post #35July 21, 2011, 4:22 PM UTC

aswMBR version 0.9.7.777 Copyright© 2011 AVAST Software Run date: 2011-07-18 17:07:15 —————————– 17:07:15.153 OS Version: Windows 6.0.6002 Service Pack 2 17:07:15.154 Number of processors: 2 586 0xF0D 17:07:15.155 ComputerName: RICHARD-PC UserName: Richard 17:07:18.181 Initialize success 17:07:47.239 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 17:07:47.243 Disk 0 Vendor: WDC_WD2500BEVT-75ZCT2 11.01A11 Size: 238475MB BusType: 3 17:07:47.258 Disk 0 MBR read successfully 17:07:47.263 Disk 0 MBR scan 17:07:47.267 Disk 0 unknown MBR code 17:07:47.276 Disk 0 scanning sectors +488394752 17:07:47.369 Disk 0 scanning C:\Windows\system32\drivers 17:07:55.694 Service scanning 17:07:57.302 Disk 0 trace - called modules: 17:07:57.363 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys 17:07:57.370 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85dcf0e8] 17:07:57.379 3 CLASSPNP.SYS[8a3b58b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85490030] 17:07:57.389 Scan finished successfully 17:08:45.892 Disk 0 MBR has been saved successfully to "C:\Users\Richard\Downloads\MBR.dat" 17:08:45.905 The log file has been saved successfully to "C:\Users\Richard\Downloads\aswMBR.txt LOG.txt" aswMBR version 0.9.7.777 Copyright© 2011 AVAST Software Run date: 2011-07-21 14:05:11 —————————– 14:05:11.834 OS Version: Windows 6.0.6002 Service Pack 2 14:05:11.834 Number of processors: 2 586 0xF0D 14:05:11.836 ComputerName: RICHARD-PC UserName: Richard 14:05:43.718 Initialize success 14:05:44.744 AVAST engine defs: 11072100 14:05:49.988 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 14:05:49.991 Disk 0 Vendor: WDC_WD2500BEVT-75ZCT2 11.01A11 Size: 238475MB BusType: 3 14:05:50.004 Disk 0 MBR read successfully 14:05:50.008 Disk 0 MBR scan 14:05:50.014 Disk 0 unknown MBR code 14:05:50.021 Disk 0 scanning sectors +488394752 14:05:51.039 Disk 0 scanning C:\Windows\system32\drivers 14:06:01.804 Service scanning 14:06:06.518 Disk 0 trace - called modules: 14:06:06.535 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll PCIIDEX.SYS msahci.sys 14:06:06.542 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85add728] 14:06:06.551 3 CLASSPNP.SYS[89fba8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85271b98] 14:06:07.732 AVAST engine scan C:\Windows 14:06:11.279 AVAST engine scan C:\Windows\system32 14:07:43.410 AVAST engine scan C:\Windows\system32\drivers 14:07:54.506 AVAST engine scan C:\Users\Richard 14:17:17.126 AVAST engine scan C:\ProgramData 14:20:20.744 Scan finished successfully 17:20:02.542 Disk 0 MBR has been saved successfully to "C:\Users\Richard\Desktop\MBR.dat" 17:20:02.550 The log file has been saved successfully to "C:\Users\Richard\Desktop\aswMBR.txt LOG.txt" One completed aswMBR scan

Conspire

Post #36July 22, 2011, 3:24 AM UTC

Please run a fresh OTL scan again for me. I will have to take another look.

brazen71

Post #37July 22, 2011, 5:27 AM UTC

Good morning I cant remember, do I need to keep the Lop and Purity check boxes clear or not? Thank you

Conspire

Post #38July 22, 2011, 5:29 AM UTC

Yes

brazen71

Post #39July 22, 2011, 5:48 AM UTC

OTL logfile created on: 22/07/2011 06:36:34 - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Richard\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.87 Gb Total Physical Memory | 1.41 Gb Available Physical Memory | 49.17% Memory free
5.96 Gb Paging File | 4.56 Gb Available in Paging File | 76.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.85 Gb Total Space | 100.83 Gb Free Space | 43.30% Space Free | Partition Type: NTFS

Computer Name: RICHARD-PC | User Name: Richard | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Richard\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Soluto\SolutoService.exe (Soluto)
PRC - C:\Program Files\Soluto\Soluto.exe (Soluto)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe ()
PRC - C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - c:\Program Files\Windows Defender\MpCmdRun.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Richard\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SolutoService) – C:\Program Files\Soluto\SolutoService.exe (Soluto)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (BecHelperService) – C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe ()
SRV - (WinHttpAutoProxySvc) – winhttp.dll (Microsoft Corporation)
SRV - (ABBYY.Licensing.FineReader.Sprint.9.0) – C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (ABBYY)
SRV - (sprtsvc_O2) SupportSoft Sprocket Service (O2) – C:\Program Files\O2\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (EvtEng) – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (RegSrvc) – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SupportSoft RemoteAssist) – C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe (SupportSoft, Inc.)

========== Driver Services (SafeList) ==========

DRV - (Soluto) – C:\Windows\system32\DRIVERS\Soluto.sys (Soluto LTD.)
DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 19 0D 57 2D AE CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngineURL: "http://mp3tubetoolbarsearch.com/?tmp=toolbar_Mp3Tube_results&prt=pinballtb01ff&clid=00835886f3cf4162be797681a11622f5&subid=&Keywords={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {c2db4fe6-8409-45ce-8010-189a7b5cce86}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: [removed]:3.3.3.2
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.5
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q="

FF - user.js..keyword.enabled: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@rim.com/npappworld: C:\Program Files\Research In Motion Limited\BlackBerry App World Browser Plugin\npappworld.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/06/23 00:39:57 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011/07/21 13:08:23 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/08 20:51:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/23 00:40:28 | 000,000,000 | —D | M]

[2011/07/18 10:27:19 | 000,000,000 | —D | M] (No name found) – C:\Users\Richard\AppData\Roaming\Mozilla\Extensions
[2011/07/18 10:27:21 | 000,000,000 | —D | M] (No name found) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions
[2010/04/27 20:19:21 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/02 21:48:39 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/08 20:52:34 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/07/08 20:52:41 | 000,000,000 | —D | M] (NCH Community Toolbar) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}
[2011/01/16 22:45:02 | 000,000,000 | —D | M] (20-20 3D Viewer) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\[removed]
[2011/06/08 15:05:30 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\[removed]
[2010/10/16 17:50:01 | 000,000,000 | —D | M] (vShare Plugin) – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\extensions\vshare@toolbar
[2011/07/21 06:53:45 | 000,002,571 | —- | M] () – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\searchplugins\askcom.xml
[2010/02/15 03:52:13 | 000,002,163 | —- | M] () – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\searchplugins\bing.xml
[2010/11/20 23:38:52 | 000,000,863 | —- | M] () – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\searchplugins\conduit.xml
[2010/11/20 23:09:26 | 000,001,215 | —- | M] () – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\searchplugins\Mp3Tube.xml
[2011/07/18 00:23:31 | 000,002,501 | —- | M] () – C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\8qbhl3j1.default\searchplugins\SearchResults.xml
[2011/07/18 10:27:19 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/10/12 23:22:26 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/08 12:50:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/08 23:45:15 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/16 17:15:33 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/16 09:49:15 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/03/28 20:56:36 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/23 18:58:21 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/05/03 22:24:31 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/05/03 22:24:31 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File not found (No name found) –
[2011/07/21 13:08:23 | 000,000,000 | —D | M] (avast! WebRep) – C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2011/07/08 20:51:11 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/08 20:51:06 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/07/18 00:23:31 | 000,002,501 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2011/07/21 10:32:35 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (FrostWire Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: o2.co.uk ([*.broadband] http in Trusted sites)
O15 - HKCU\..Trusted Domains: o2.co.uk ([*.broadband] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\Soluto\soluto.exe /userinit) - C:\Program Files\Soluto\soluto.exe (Soluto)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/21 14:02:27 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/07/21 13:08:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011/07/21 13:08:46 | 000,309,848 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2011/07/21 13:08:46 | 000,019,544 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2011/07/21 13:08:43 | 000,043,608 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2011/07/21 13:08:43 | 000,025,432 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2011/07/21 13:08:42 | 000,441,176 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2011/07/21 13:08:40 | 000,054,104 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2011/07/21 13:08:22 | 000,199,304 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2011/07/21 13:08:22 | 000,040,112 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2011/07/21 13:08:10 | 000,000,000 | —D | C] – C:\ProgramData\AVAST Software
[2011/07/21 13:08:10 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2011/07/21 10:35:36 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/07/21 10:35:35 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/07/21 10:35:35 | 000,000,000 | —D | C] – C:\Users\Richard\AppData\Local\temp
[2011/07/21 06:52:39 | 000,000,000 | —D | C] – C:\Users\Richard\AppData\Roaming\Tific
[2011/07/20 12:21:22 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/07/20 12:21:22 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/07/20 12:21:22 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/07/20 12:21:13 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/07/20 12:20:05 | 000,000,000 | —D | C] – C:\Qoobox
[2011/07/19 18:05:27 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/07/18 13:01:16 | 000,000,000 | —D | C] – C:\Users\Richard\AppData\Local\NPE
[2011/07/18 00:23:32 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/07/18 00:23:08 | 000,000,000 | —D | C] – C:\Users\Richard\AppData\Local\PackageAware
[2011/07/13 16:12:26 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Soluto
[2011/07/13 16:12:25 | 000,000,000 | —D | C] – C:\Program Files\Soluto
[2011/07/13 10:04:18 | 002,043,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/07/13 10:04:13 | 000,375,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/07/13 10:04:13 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/07/08 19:22:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Companion
[2011/06/23 19:09:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/06/23 18:58:18 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/06/23 18:58:18 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/06/23 18:58:18 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/06/23 00:40:02 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/06/22 13:03:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth

========== Files - Modified Within 30 Days ==========

[2011/07/22 06:18:27 | 000,005,732 | —- | M] () – C:\Windows\System32\.rsp
[2011/07/22 06:18:27 | 000,001,479 | —- | M] () – C:\Windows\System32\.lck
[2011/07/22 06:16:31 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/22 06:15:47 | 000,004,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/22 06:15:47 | 000,004,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/22 06:15:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/22 06:15:31 | 220,505,544 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/07/22 00:27:46 | 000,004,268 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/07/21 23:59:00 | 000,000,888 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/21 17:20:02 | 000,000,512 | —- | M] () – C:\Users\Richard\Desktop\MBR.dat
[2011/07/21 13:08:47 | 000,001,829 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/07/21 13:08:40 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2011/07/21 10:32:35 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/07/20 22:22:24 | 000,355,606 | —- | M] () – C:\Users\Richard\Desktop\ComboFix safe mode.jpg
[2011/07/20 22:22:06 | 000,355,606 | —- | M] () – C:\Users\Richard\Desktop\ComboFix safe mode
[2011/07/20 17:09:23 | 000,595,444 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/20 17:09:23 | 000,000,000 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/20 17:09:05 | 000,001,239 | —- | M] () – C:\Users\Richard\Desktop\ComboFix.exe - Shortcut.lnk
[2011/07/20 16:16:27 | 000,340,030 | —- | M] () – C:\Users\Richard\Desktop\Combo Scan.jpg
[2011/07/20 13:18:38 | 000,001,597 | —- | M] () – C:\Users\Richard\Desktop\Bluetooth File Transfer Wizard.lnk
[2011/07/20 12:55:20 | 000,016,384 | —- | M] () – C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/19 17:37:35 | 012,784,962 | —- | M] () – C:\Users\Richard\AppData\Roaming\SMRBackup200.dat
[2011/07/18 12:42:05 | 000,002,968 | —- | M] () – C:\Users\Richard\Documents\Malwarebytes log July 18
[2011/07/17 23:48:22 | 003,050,919 | —- | M] () – C:\Users\Richard\Documents\16 - Sam The Sham And The Pharaohs - Wooly Bully.mp3
[2011/07/15 22:35:11 | 000,000,743 | —- | M] () – C:\Users\Public\Desktop\Gygan.lnk
[2011/07/15 22:23:20 | 002,988,905 | —- | M] () – C:\Users\Richard\Documents\Bach - Little Fugue In G Minor.mp3
[2011/07/15 22:22:46 | 003,185,015 | —- | M] () – C:\Users\Richard\Documents\Bach - Air on Strings in G.mp3
[2011/07/15 03:01:36 | 000,001,971 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/13 17:01:58 | 000,253,864 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/07/08 23:13:15 | 005,334,230 | —- | M] () – C:\Users\Richard\Documents\06-the_jim_jones_revue-burning_your_house_down.mp3
[2011/07/08 23:09:07 | 003,333,457 | —- | M] () – C:\Users\Richard\Documents\02-the_jim_jones_revue-high_horse.mp3
[2011/07/08 23:08:21 | 003,003,026 | —- | M] () – C:\Users\Richard\Documents\05-the_jim_jones_revue-premeditated.mp3
[2011/07/08 22:44:28 | 003,775,670 | —- | M] () – C:\Users\Richard\Documents\08-the_jim_jones_revue-elemental.mp3
[2011/07/08 22:44:26 | 003,729,957 | —- | M] () – C:\Users\Richard\Documents\09-the_jim_jones_revue-killin_spree.mp3
[2011/07/08 22:43:30 | 002,939,092 | —- | M] () – C:\Users\Richard\Documents\01-the_jim_jones_revue-dishonest_john.mp3
[2011/07/08 20:13:21 | 010,836,799 | —- | M] () – C:\Users\Richard\Documents\07 Junocide.mp3
[2011/07/08 20:10:35 | 006,226,750 | —- | M] () – C:\Users\Richard\Documents\06 XR2 (Silverlink V Kicks Like A Mule Aka 92juk).mp3
[2011/07/08 19:22:37 | 000,000,830 | —- | M] () – C:\Users\Public\Desktop\TuneUp Companion.lnk
[2011/07/07 08:34:08 | 000,051,144 | —- | M] (Soluto LTD.) – C:\Windows\System32\drivers\Soluto.sys
[2011/07/04 15:08:56 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/07/04 12:43:53 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr
[2011/07/04 12:43:51 | 000,199,304 | —- | M] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2011/07/04 12:36:43 | 000,441,176 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswSnx.sys
[2011/07/04 12:36:32 | 000,309,848 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2011/07/04 12:35:23 | 000,043,608 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2011/07/04 12:32:32 | 000,025,432 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2011/07/04 12:32:20 | 000,054,104 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2011/07/04 12:32:12 | 000,019,544 | —- | M] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2011/06/26 23:48:39 | 005,686,711 | —- | M] () – C:\Users\Richard\Documents\10 Cherish - Kool And The Gang.mp3
[2011/06/26 23:36:30 | 010,523,461 | —- | M] () – C:\Users\Richard\Documents\Beyonce - Halo.mp3
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – C:\Windows\PEV.exe
[2011/06/24 21:42:56 | 003,913,220 | —- | M] () – C:\Users\Richard\Documents\Aloe Blacc - I Need A Dollar.mp3
[2011/06/23 00:40:16 | 000,001,741 | —- | M] () – C:\Users\Public\Desktop\Free Offers.lnk
[2011/06/23 00:40:15 | 000,000,847 | —- | M] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/06/23 00:39:23 | 000,198,848 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2011/06/23 00:38:59 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/06/23 00:38:59 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/06/23 00:38:55 | 000,272,896 | —- | M] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/06/22 13:03:59 | 000,002,073 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk

========== Files Created - No Company Name ==========

[2011/07/21 17:20:02 | 000,000,512 | —- | C] () – C:\Users\Richard\Desktop\MBR.dat
[2011/07/21 13:08:47 | 000,001,829 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2011/07/20 22:22:23 | 000,355,606 | —- | C] () – C:\Users\Richard\Desktop\ComboFix safe mode.jpg
[2011/07/20 22:13:38 | 000,355,606 | —- | C] () – C:\Users\Richard\Desktop\ComboFix safe mode
[2011/07/20 16:16:27 | 000,340,030 | —- | C] () – C:\Users\Richard\Desktop\Combo Scan.jpg
[2011/07/20 13:58:48 | 000,001,239 | —- | C] () – C:\Users\Richard\Desktop\ComboFix.exe - Shortcut.lnk
[2011/07/20 13:18:38 | 000,001,597 | —- | C] () – C:\Users\Richard\Desktop\Bluetooth File Transfer Wizard.lnk
[2011/07/20 12:21:22 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/07/20 12:21:22 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/07/20 12:21:22 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/07/20 12:21:22 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/07/20 12:21:22 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/19 18:05:20 | 220,505,544 | —- | C] () – C:\Windows\MEMORY.DMP
[2011/07/19 17:36:53 | 012,784,962 | —- | C] () – C:\Users\Richard\AppData\Roaming\SMRBackup200.dat
[2011/07/18 23:06:18 | 003,164,369 | —- | C] () – C:\Users\Richard\Documents\Bob Marley - Jammin'.mp3
[2011/07/18 23:06:18 | 003,148,904 | —- | C] () – C:\Users\Richard\Documents\Bob Marley - Get Up, Stand Up.mp3
[2011/07/18 23:06:17 | 007,442,912 | —- | C] () – C:\Users\Richard\Documents\Black Eyed Peas - The Time (The Dirty Bit).mp3
[2011/07/18 23:06:17 | 002,721,422 | —- | C] () – C:\Users\Richard\Documents\Black Sabbath - Paranoid.mp3
[2011/07/18 23:06:16 | 008,780,383 | —- | C] () – C:\Users\Richard\Documents\Black Eyed Peas - My Humps.mp3
[2011/07/18 23:06:16 | 005,823,471 | —- | C] () – C:\Users\Richard\Documents\Black Eyed Peas - Don't Phunk With My Heart.mp3
[2011/07/18 23:06:16 | 004,147,458 | —- | C] () – C:\Users\Richard\Documents\Big Audio Dynamite - Rush.MP3
[2011/07/18 23:06:16 | 003,194,298 | —- | C] () – C:\Users\Richard\Documents\Biffy Clyro - Mountains.mp3
[2011/07/18 23:06:15 | 007,361,610 | —- | C] () – C:\Users\Richard\Documents\Beyounce - Halo.mp3
[2011/07/18 23:06:15 | 007,313,673 | —- | C] () – C:\Users\Richard\Documents\Biffy Clyro - Bubbles.mp3
[2011/07/18 23:06:15 | 006,511,517 | —- | C] () – C:\Users\Richard\Documents\Biffy Clyro - Many of Horror.mp3
[2011/07/18 23:06:14 | 010,523,461 | —- | C] () – C:\Users\Richard\Documents\Beyonce - Halo.mp3
[2011/07/18 23:06:14 | 008,383,263 | —- | C] () – C:\Users\Richard\Documents\Beyonce - Sweet Dreams.mp3
[2011/07/18 23:06:14 | 004,735,258 | —- | C] () – C:\Users\Richard\Documents\Beyonce - Single Ladies..mp3
[2011/07/18 23:06:13 | 003,670,175 | —- | C] () – C:\Users\Richard\Documents\Beck - Sexx Laws.mp3
[2011/07/18 23:06:13 | 003,538,905 | —- | C] () – C:\Users\Richard\Documents\Beyonce - ###### What I Said.mp3
[2011/07/18 23:06:12 | 007,082,322 | —- | C] () – C:\Users\Richard\Documents\Beck - Peaches and Cream.mp3
[2011/07/18 23:06:11 | 005,644,416 | —- | C] () – C:\Users\Richard\Documents\Beck - Loser.mp3
[2011/07/18 23:06:11 | 003,524,161 | —- | C] () – C:\Users\Richard\Documents\Beats International - Dub Be Good To Me.mp3
[2011/07/18 23:06:10 | 012,573,824 | —- | C] () – C:\Users\Richard\Documents\BB King & Bobby 'Blue' Bland - Thrill Is Gone.mp3
[2011/07/18 23:06:10 | 006,960,207 | —- | C] () – C:\Users\Richard\Documents\Baz Luhrmann Everybody's Free (To Wear Sunscreen).mp3
[2011/07/18 23:06:10 | 004,573,184 | —- | C] () – C:\Users\Richard\Documents\BBKing - Since I Met You Baby.mp3
[2011/07/18 23:06:10 | 004,436,152 | —- | C] () – C:\Users\Richard\Documents\BBKing & Muddy Waters - Champagne and Reefer.mp3
[2011/07/18 23:06:10 | 002,969,310 | —- | C] () – C:\Users\Richard\Documents\Beatles - Here Comes The Sun.mp3
[2011/07/18 23:06:09 | 003,716,402 | —- | C] () – C:\Users\Richard\Documents\Bachman Turner Overdrive - You Ain't Seen Nothing Yet.mp3
[2011/07/18 23:06:09 | 002,988,905 | —- | C] () – C:\Users\Richard\Documents\Bach - Little Fugue In G Minor.mp3
[2011/07/18 23:06:07 | 025,944,860 | —- | C] () – C:\Users\Richard\Documents\Bach - Classical Relaxation- Piano Concerto No.9.mp3
[2011/07/18 23:06:07 | 006,516,997 | —- | C] () – C:\Users\Richard\Documents\B.o.B. - Nothin' On You (Beautiful Girls).mp3
[2011/07/18 23:06:07 | 003,915,569 | —- | C] () – C:\Users\Richard\Documents\Atlantic Starr - Secret Lovers.mp3
[2011/07/18 23:06:07 | 003,613,479 | —- | C] () – C:\Users\Richard\Documents\Artfull Dodger - Moving Too Fast.mp3
[2011/07/18 23:06:07 | 003,185,015 | —- | C] () – C:\Users\Richard\Documents\Bach - Air on Strings in G.mp3
[2011/07/18 23:06:06 | 004,790,937 | —- | C] () – C:\Users\Richard\Documents\Apollo 440 - Time Is Running Out.mp3
[2011/07/18 23:06:06 | 003,869,727 | —- | C] () – C:\Users\Richard\Documents\Apollo 440 - Aint Talking Bout Dub.mp3
[2011/07/18 23:06:05 | 004,116,480 | —- | C] () – C:\Users\Richard\Documents\Allman Brothers Band - Statesboro Blues.mp3
[2011/07/18 23:06:05 | 003,975,808 | —- | C] () – C:\Users\Richard\Documents\Andrea Bocelli & Sarah Brightman - Time To Say Goodbye.mp3
[2011/07/18 23:06:05 | 003,913,220 | —- | C] () – C:\Users\Richard\Documents\Aloe Blacc - I Need A Dollar.mp3
[2011/07/18 23:06:05 | 003,135,751 | —- | C] () – C:\Users\Richard\Documents\Andy Williams - Happy Heart.mp3
[2011/07/18 23:06:05 | 002,922,624 | —- | C] () – C:\Users\Richard\Documents\Allman Brothers Band, The - Midnight Rider.mp3
[2011/07/18 23:06:04 | 012,650,008 | —- | C] () – C:\Users\Richard\Documents\Allman Brothers Band - In Memory Of Elizabeth Reed (Live).mp3
[2011/07/18 23:06:04 | 007,160,896 | —- | C] () – C:\Users\Richard\Documents\Allman Brothers Band - Jessica.mp3
[2011/07/18 23:06:03 | 004,631,930 | —- | C] () – C:\Users\Richard\Documents\Alexandra Burke - Bad boys (feat._flo_rida).mp3
[2011/07/18 23:06:03 | 004,631,126 | —- | C] () – C:\Users\Richard\Documents\Alannah Miles - Black Velvet.mp3
[2011/07/18 23:06:03 | 004,317,656 | —- | C] () – C:\Users\Richard\Documents\All Saints - Pure Shores.mp3
[2011/07/18 23:06:03 | 000,014,855 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{DD4BD36C-5F85-45CF-A32F-C2EF888E8C7B}_Large.jpg
[2011/07/18 23:06:03 | 000,014,022 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{1A0D98E4-7018-4602-897C-3E8BA3F52256}_Large.jpg
[2011/07/18 23:06:03 | 000,011,209 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{B0842682-36B4-4FB5-B6AB-A6936B262A46}_Large.jpg
[2011/07/18 23:06:03 | 000,010,068 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{DA55F1AB-B915-4CDD-BC04-9EE3F20D76C4}_Large.jpg
[2011/07/18 23:06:03 | 000,009,658 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{48C8CE5A-8A23-47EF-8295-F2C4711626AF}_Large.jpg
[2011/07/18 23:06:03 | 000,009,318 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{E99F9C7F-1F41-4A0F-88BC-8455887C9CD5}_Large.jpg
[2011/07/18 23:06:03 | 000,009,170 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{8FCBF974-4C63-4806-A0AD-D63D4033BD53}_Large.jpg
[2011/07/18 23:06:03 | 000,008,754 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{4409C503-D6E3-4012-9D94-A5C2110EDB7E}_Large.jpg
[2011/07/18 23:06:03 | 000,006,932 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{BC8DFCD6-D58B-41E7-97A2-58B3858BBC26}_Large.jpg
[2011/07/18 23:06:03 | 000,005,766 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{135961B4-0550-470F-A115-22A81163A9B2}_Large.jpg
[2011/07/18 23:06:03 | 000,003,696 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{DD4BD36C-5F85-45CF-A32F-C2EF888E8C7B}_Small.jpg
[2011/07/18 23:06:03 | 000,003,234 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{1A0D98E4-7018-4602-897C-3E8BA3F52256}_Small.jpg
[2011/07/18 23:06:03 | 000,002,676 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{B0842682-36B4-4FB5-B6AB-A6936B262A46}_Small.jpg
[2011/07/18 23:06:03 | 000,002,592 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{48C8CE5A-8A23-47EF-8295-F2C4711626AF}_Small.jpg
[2011/07/18 23:06:03 | 000,002,554 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{E99F9C7F-1F41-4A0F-88BC-8455887C9CD5}_Small.jpg
[2011/07/18 23:06:03 | 000,002,461 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{DA55F1AB-B915-4CDD-BC04-9EE3F20D76C4}_Small.jpg
[2011/07/18 23:06:03 | 000,002,257 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{4409C503-D6E3-4012-9D94-A5C2110EDB7E}_Small.jpg
[2011/07/18 23:06:03 | 000,002,207 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{8FCBF974-4C63-4806-A0AD-D63D4033BD53}_Small.jpg
[2011/07/18 23:06:03 | 000,002,094 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{BC8DFCD6-D58B-41E7-97A2-58B3858BBC26}_Small.jpg
[2011/07/18 23:06:03 | 000,001,777 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArtSmall.jpg
[2011/07/18 23:06:03 | 000,001,777 | -HS- | C] () – C:\Users\Richard\Documents\AlbumArt_{135961B4-0550-470F-A115-22A81163A9B2}_Small.jpg
[2011/07/18 23:06:02 | 008,803,317 | —- | C] () – C:\Users\Richard\Documents\Adele - Someone Like You.mp3
[2011/07/18 23:06:02 | 005,081,861 | —- | C] () – C:\Users\Richard\Documents\Al Greene - Simply Beautiful.mp3
[2011/07/18 23:06:02 | 004,452,352 | —- | C] () – C:\Users\Richard\Documents\Adele Cold Shoulder.mp3
[2011/07/18 23:06:02 | 002,658,787 | —- | C] () – C:\Users\Richard\Documents\Adele - Thats It I Quit Im Moving On.mp3
[2011/07/18 23:06:01 | 009,195,612 | —- | C] () – C:\Users\Richard\Documents\Adele - Rolling In The Deep.mp3
[2011/07/18 23:06:01 | 009,050,709 | —- | C] () – C:\Users\Richard\Documents\808 State - Pacific State.mp3
[2011/07/18 23:06:01 | 005,143,172 | —- | C] () – C:\Users\Richard\Documents\Adele - Chasing Pavements.mp3
[2011/07/18 23:06:01 | 004,468,736 | —- | C] () – C:\Users\Richard\Documents\Adele - 04 - Cold Shoulder.mp3
[2011/07/18 23:06:01 | 004,452,352 | —- | C] () – C:\Users\Richard\Documents\Adele - Cold Shoulder.mp3
[2011/07/18 23:06:01 | 004,270,080 | —- | C] () – C:\Users\Richard\Documents\Adele - Make You Feel My Love.mp3
[2011/07/18 23:06:01 | 004,265,344 | —- | C] () – C:\Users\Richard\Documents\Adele - Hometown Glory .mp3
[2011/07/18 23:06:00 | 005,276,924 | —- | C] () – C:\Users\Richard\Documents\109-example-kickstarts.mp3
[2011/07/18 23:06:00 | 005,012,336 | —- | C] () – C:\Users\Richard\Documents\50 Cent - P.I.M.P .mp3
[2011/07/18 23:06:00 | 004,834,450 | —- | C] () – C:\Users\Richard\Documents\10CC - Dreadlock Holiday.mp3
[2011/07/18 23:06:00 | 003,050,919 | —- | C] () – C:\Users\Richard\Documents\16 - Sam The Sham And The Pharaohs - Wooly Bully.mp3
[2011/07/18 23:05:59 | 010,836,799 | —- | C] () – C:\Users\Richard\Documents\07 Junocide.mp3
[2011/07/18 23:05:59 | 005,686,711 | —- | C] () – C:\Users\Richard\Documents\10 Cherish - Kool And The Gang.mp3
[2011/07/18 23:05:59 | 005,334,230 | —- | C] () – C:\Users\Richard\Documents\06-the_jim_jones_revue-burning_your_house_down.mp3
[2011/07/18 23:05:59 | 003,775,670 | —- | C] () – C:\Users\Richard\Documents\08-the_jim_jones_revue-elemental.mp3
[2011/07/18 23:05:59 | 003,729,957 | —- | C] () – C:\Users\Richard\Documents\09-the_jim_jones_revue-killin_spree.mp3
[2011/07/18 23:05:58 | 009,383,932 | —- | C] () – C:\Users\Richard\Documents\06. Alexandra Burke - Broken Heels.mp3
[2011/07/18 23:05:58 | 006,226,750 | —- | C] () – C:\Users\Richard\Documents\06 XR2 (Silverlink V Kicks Like A Mule Aka 92juk).mp3
[2011/07/18 23:05:58 | 004,511,744 | —- | C] () – C:\Users\Richard\Documents\2Pac - California Love.mp3
[2011/07/18 23:05:58 | 003,333,457 | —- | C] () – C:\Users\Richard\Documents\02-the_jim_jones_revue-high_horse.mp3
[2011/07/18 23:05:58 | 003,003,026 | —- | C] () – C:\Users\Richard\Documents\05-the_jim_jones_revue-premeditated.mp3
[2011/07/18 23:05:58 | 002,939,092 | —- | C] () – C:\Users\Richard\Documents\01-the_jim_jones_revue-dishonest_john.mp3
[2011/07/18 12:42:05 | 000,002,968 | —- | C] () – C:\Users\Richard\Documents\Malwarebytes log July 18
[2011/07/15 22:35:10 | 000,000,743 | —- | C] () – C:\Users\Public\Desktop\Gygan.lnk
[2011/07/08 19:22:37 | 000,000,830 | —- | C] () – C:\Users\Public\Desktop\TuneUp Companion.lnk
[2011/06/23 00:40:15 | 000,000,847 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/06/22 13:03:59 | 000,002,073 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2011/01/29 22:08:15 | 000,000,193 | —- | C] () – C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2010/11/22 14:05:04 | 000,000,000 | —- | C] () – C:\ProgramData\TEMP
[2010/11/02 15:21:04 | 000,000,105 | —- | C] () – C:\Windows\Lexstat.ini
[2010/11/02 00:53:41 | 000,000,728 | —- | C] () – C:\Windows\{4507868A-A9CD-4ECC-BD54-0EAB6EE81D42}_WiseFW.ini
[2010/10/12 23:24:16 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/02/18 21:21:31 | 000,016,384 | —- | C] () – C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/18 21:13:12 | 000,004,268 | —- | C] () – C:\Windows\bthservsdp.dat
[2010/02/12 22:03:38 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/02/12 22:03:38 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2010/02/10 17:59:58 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010/02/09 18:48:09 | 002,192,024 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/02/09 18:48:09 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1511.dll
[2010/02/09 18:48:08 | 000,492,496 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/02/09 18:48:08 | 000,147,172 | —- | C] () – C:\Windows\System32\igfcg550.bin
[2010/02/09 18:35:41 | 000,000,552 | —- | C] () – C:\Users\Richard\AppData\Local\d3d8caps.dat
[2010/02/09 18:13:35 | 000,001,356 | —- | C] () – C:\Users\Richard\AppData\Local\d3d9caps.dat
[2010/01/19 12:49:54 | 000,466,944 | —- | C] () – C:\Windows\System32\RemoveDevice.dll
[2010/01/19 12:49:54 | 000,466,944 | —- | C] () – C:\Windows\RemoveDevice.dll
[2009/10/21 12:22:00 | 000,312,832 | —- | C] () – C:\Windows\System32\drivers\yk60x86.sys
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,253,864 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,595,444 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:33:01 | 000,000,000 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 153 bytes -> C:\ProgramData\TEMP:07BF512B

< End of report >

Conspire

Post #40July 22, 2011, 9:12 AM UTC

Please run SystemLook again

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:file
C:\Qoobox\Quarantine\C\Windows\System32\userinit.exe.vir
C:\Windows\ERDNT\cache\userinit.exe
C:\Windows\System32\userinit.exe

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

brazen71

Post #41July 22, 2011, 9:23 AM UTC

SystemLook 04.09.10 by jpshortstuff Log created at 10:19 on 22/07/2011 by Richard Administrator - Elevation successful ========== file ========== C:\Qoobox\Quarantine\C\Windows\System32\userinit.exe.vir - File found and opened. MD5: 0E135526E9785D085BCD9AEDE6FBCBF9 Created at 02:24 on 21/01/2008 Modified at 02:24 on 21/01/2008 Size: 25088 bytes Attributes: –a—- FileDescription: Userinit Logon Application FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205) ProductVersion: 6.0.6000.16386 OriginalFilename: USERINIT.EXE.MUI InternalName: userinit ProductName: Microsoft® Windows® Operating System CompanyName: Microsoft Corporation LegalCopyright: © Microsoft Corporation. All rights reserved. C:\Windows\ERDNT\cache\userinit.exe - File found and opened. MD5: 0E135526E9785D085BCD9AEDE6FBCBF9 Created at 11:47 on 20/07/2011 Modified at 02:24 on 21/01/2008 Size: 25088 bytes Attributes: –a—- FileDescription: Userinit Logon Application FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205) ProductVersion: 6.0.6000.16386 OriginalFilename: USERINIT.EXE.MUI InternalName: userinit ProductName: Microsoft® Windows® Operating System CompanyName: Microsoft Corporation LegalCopyright: © Microsoft Corporation. All rights reserved. C:\Windows\System32\userinit.exe - File found and opened. MD5: 0E135526E9785D085BCD9AEDE6FBCBF9 Created at 02:24 on 21/01/2008 Modified at 02:24 on 21/01/2008 Size: 25088 bytes Attributes: –a—- FileDescription: Userinit Logon Application FileVersion: 6.0.6000.16386 (vista_rtm.061101-2205) ProductVersion: 6.0.6000.16386 OriginalFilename: USERINIT.EXE.MUI InternalName: userinit ProductName: Microsoft® Windows® Operating System CompanyName: Microsoft Corporation LegalCopyright: © Microsoft Corporation. All rights reserved. -= EOF =-

Conspire

Post #42July 22, 2011, 9:29 AM UTC last edited July 22, 2011, 9:29 AM UTC

I need you to make a batch file. After rebooting, check and see if you're still having the same problem.

Open a new Notepad session

Click the Start button, click Run
In the run box type notepad
Click OK
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

@Echo on
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "flush.bat"
Click Save

You should now have a file on your desktop with an icon like this [external image: Posted Image]

Double click on flush.bat & allow it to run. A small black screen may briefly flash on and off, that normal.

brazen71

Post #43July 22, 2011, 9:43 AM UTC

I have done that. Small black screen appeared briefly

brazen71

Post #44July 22, 2011, 9:55 AM UTC

Everything seems to be up and running again! No more searchqu.com hijacking my browsers. Thank you so much for all of your efforts over the last few days. I'm very grateful for the time that you have given up, you have saved me ££ I will be sure to make a donation to this website Many thanks brazen71

Conspire

Post #45July 22, 2011, 9:59 AM UTC

Good to hear that! Thanks for your donation

We still have a little more things to do to wrap things up. You may now delete SystemLook and among other tools that we used.

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Download Host.zip and Save it to your Desktop.
Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
Follow the prompts and click 'Finish'.
This will open the newly created hosts folder on your Desktop.
Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
Once updated you should see another prompt that the task was completed.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

www.searchqu.com 406 and backdoor.bifrose

✨ Ask AI

Ask AI