What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

win32.AutoRun.tmp trojan

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have just run an S&D check and it gave the above result. The full result is below. SBI$751B1850 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Taskman. I went to the registry key mentioned, but after I got to Winlogon there is just a long list of numbers each in brackets { }. Can anyone tell me if I should go ahead and 'fix the problem' in S&D, or is there something else I should check\run first? I also ran an Anti Spyware & MBAM and they found nothing. MSE hasn't shown up anything either. Thanks in advance for any help offered.
Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Having said that….Let's get going!! :thumbup:
———-

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries.
———-

In your next reply please post the logs created by DDS and GMER. :)
Post #3
Thanks for the reply. Sorry to be so long in replying, I have been away for a day or two. You say in your post to 'disable any script blocking protection'. Silly question: does this mean to have 'disable script debugging (IE)' and 'disable script debugging (other)' checked or unchecked. I ask because of the way it is worded in Internet Options. Thank you for the help. Much appreciated. hedley
Post #4
No no you don't need to do that. Just disable your actively running antivirus, antimalware and firewall programs. Once you have that done go ahead and run those programs I posted for you. :)
Post #6
Hi hedley93,

Yep those were just fine. Would you be able to just cut and paste the logs into your future replies? It makes it easier for me to read. Thanks. :)
———-

Please do the following:

Hold down the Windows key and press R to open a run box
type the following text into the run box

appwiz.cpl

This will open your Programs And Features. A list of installed programs will populate

Remove the following programs:

Conduit Engine

———-

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.

In your next reply please post the log created by ComboFix. :)
Post #7
Thanks for the reply. The combofix log is shown below:

ComboFix 11-10-15.04 - Andrea 16/10/2011 14:01:52.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3199.1886 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Andrea\GoToAssistDownloadHelper.exe
c:\users\Andrea\WINDOWS
T:\Autorun.inf
T:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-16 to 2011-10-16 )))))))))))))))))))))))))))))))
.
.
2011-10-16 13:12 . 2011-10-16 13:12 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-16 13:12 . 2011-10-16 13:12 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp
2011-10-16 13:12 . 2011-10-16 13:12 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-16 13:12 . 2011-10-16 13:12 ——– d—–w- c:\users\Andrea\AppData\Local\temp
2011-10-16 13:12 . 2011-10-16 13:12 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-10-16 12:28 . 2011-10-16 12:28 28752 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB318B56-81CC-4063-ABF0-52014E973C97}\MpKsl0ed1c89e.sys
2011-10-16 12:28 . 2011-10-16 12:28 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB318B56-81CC-4063-ABF0-52014E973C97}\offreg.dll
2011-10-16 12:28 . 2011-09-12 15:14 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB318B56-81CC-4063-ABF0-52014E973C97}\mpengine.dll
2011-10-13 20:47 . 2011-08-17 04:19 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-10-13 20:47 . 2011-08-17 04:24 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-10-13 20:47 . 2011-08-27 04:26 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-10-13 20:47 . 2011-08-27 04:26 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-10-13 20:47 . 2011-09-06 02:28 2334720 —-a-w- c:\windows\system32\win32k.sys
2011-10-13 20:47 . 2011-08-20 04:31 981504 —-a-w- c:\windows\system32\wininet.dll
2011-10-13 20:47 . 2011-08-20 04:26 860672 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2011-10-13 20:46 . 2011-10-01 02:42 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-13 20:46 . 2011-08-20 04:26 163328 —-a-w- c:\program files\Internet Explorer\ieproxy.dll
2011-10-12 18:31 . 2011-10-12 18:31 ——– d—–w- c:\users\Andrea\AppData\Local\4kdownload.com
2011-10-12 18:21 . 2011-10-12 18:21 ——– d—–w- c:\program files\4kDownload
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\program files\Kastor Free Video Converter
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\users\Andrea\AppData\Roaming\KastorVideoConverter
2011-10-12 16:04 . 2011-10-12 16:03 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1257F976-61C2-4D01-942F-44A7F1580C11}\gapaengine.dll
2011-10-10 15:53 . 2011-10-12 15:51 ——– d—–w- c:\program files\Ask.com
2011-09-26 18:12 . 2011-10-12 15:51 ——– d—–w- c:\program files\WinTips, Inc
2011-09-22 16:19 . 2011-09-22 16:19 ——– d—–w- c:\users\Andrea\AppData\Local\Taggtool
2011-09-22 14:44 . 2011-09-22 14:44 ——– d—–w- c:\program files\DVDVideoSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-28 08:47 . 2011-06-11 07:14 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 15:14 . 2011-04-26 07:21 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-31 16:00 . 2011-06-15 17:41 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 09:03 . 2011-08-09 09:04 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-08-04 14:50 . 2011-08-04 14:50 114 —-a-w- c:\windows\Printdir.bat
2011-08-03 11:50 . 2011-08-15 14:55 914024 —-a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 875112 —-a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 57960 —-a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:50 . 2011-08-15 14:55 5404776 —-a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:50 . 2011-08-15 14:55 2391656 —-a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:50 . 2011-08-15 14:55 2090088 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:50 . 2011-08-15 14:55 17193576 —-a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:50 . 2011-08-15 14:55 16595560 —-a-w- c:\windows\system32\nvoglv32.dll
2011-08-03 11:50 . 2011-08-15 14:55 10304104 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-08-03 11:50 . 2011-01-25 19:33 2412136 —-a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:50 . 2011-01-07 21:06 600680 —-a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-08-03 11:50 . 2011-01-07 21:06 3730024 —-a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:50 . 2011-01-07 21:06 2558568 —-a-w- c:\windows\system32\nvsvc.dll
2011-08-03 11:50 . 2011-01-07 21:06 599144 —-a-w- c:\windows\system32\nvvsvc.exe
2011-08-03 11:50 . 2011-01-07 21:06 111208 —-a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:50 . 2010-07-09 16:37 66664 —-a-w- c:\windows\system32\nvshext.dll
2011-08-03 11:50 . 2009-06-10 21:19 12636776 —-a-w- c:\windows\system32\nvd3dum.dll
2011-07-27 07:49 . 2011-06-05 18:21 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-27 07:49 . 2011-06-05 18:21 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-27 07:49 . 2011-07-27 07:49 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-15 4615552]
"DriverCure"="c:\program files\ParetoLogic\DriverCure\DriverCure.exe" [2009-08-07 3993368]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...r=9.0.894" [?]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2011-1-25 303104]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKslb99bc62c;MpKslb99bc62c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9826131-DFD8-4AC1-B1DA-30E273132B5C}\MpKslb99bc62c.sys [x]
R1 MpKsldb37771b;MpKsldb37771b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3BE2F0D6-E0FF-4776-BC35-945C4A245E69}\MpKsldb37771b.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2011-04-27 11232]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-20 1343400]
S1 MpKsl0ed1c89e;MpKsl0ed1c89e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB318B56-81CC-4063-ABF0-52014E973C97}\MpKsl0ed1c89e.sys [2011-10-16 28752]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-18 116608]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
S3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-08-15 552448]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-03-21 362600]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL0ED1C89E
*NewlyCreated* - MPKSLF4DD6563
*Deregistered* - MpKslf4dd6563
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-01-23 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]
.
2011-10-15 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Andrea\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Andrea\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: genewatsonmusic.com\www
Trusted Zone: whatthetech.com\forums
Trusted Zone: yahoo.com\uk.mc238.mail
TCP: DhcpNameServer = 192.168.1.254
DPF: {B947BD34-91CC-4590-9BA0-6F0F0D2028E8} - hxxp://www.productsandservices.bt.com/consumer/consumerProducts/js/BTSetupTools.cab
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
ShellExecuteHooks-{4F07DA45-8170-4859-9B5F-037EF2970034} - (no file)
AddRemove-WinTricks v6.0a - c:\program files\WinTips
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-3662072760-2516787200-2672912011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-3662072760-2516787200-2672912011-1000)
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3662072760-2516787200-2672912011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (S-1-5-21-3662072760-2516787200-2672912011-1000)
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-16 14:25:24
ComboFix-quarantined-files.txt 2011-10-16 13:25
.
Pre-Run: 9,206,878,208 bytes free
Post-Run: 9,044,500,480 bytes free
.
- - End Of File - - B0A651984E89EFCBFD988BEA640971F5
Post #8
Hi hedley93,

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    DDS::
    uSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
    uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
    BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
    Trusted Zone: genewatsonmusic.com\www
    Trusted Zone: whatthetech.com\forums
    Trusted Zone: yahoo.com\uk.mc238.mail

    Folder::
    c:\program files\Ask.com

    RegLock::
    [HKEY_USERS\S-1-5-21-3662072760-2516787200-2672912011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (S-1-5-21-3662072760-2516787200-2672912011-1000)
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"

    [HKEY_USERS\S-1-5-21-3662072760-2516787200-2672912011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (S-1-5-21-3662072760-2516787200-2672912011-1000)
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #9
Thanks for the reply. I'm afraid I don't quite follow. With reference to your first sentence, opening notepad gives me a blank notepad screen? What text should be in it?
Post #10 last edited
Hi, Just copy/paste everything within the code box below the instructions on how to open notepad. It starts with "DDS::" Put all of that information into Notepad.
Post #11
Combo log below:

ComboFix 11-10-15.04 - Andrea 17/10/2011 14:32:37.2.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3199.1981 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Andrea\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\mupcfg.xml
.
.
((((((((((((((((((((((((( Files Created from 2011-09-17 to 2011-10-17 )))))))))))))))))))))))))))))))
.
.
2011-10-17 13:40 . 2011-10-17 13:40 ——– d—–w- c:\users\Andrea\AppData\Local\temp
2011-10-17 13:40 . 2011-10-17 13:40 ——– d—–w- c:\users\UpdatusUser\AppData\Local\temp
2011-10-17 13:40 . 2011-10-17 13:40 ——– d—–w- c:\users\DefaultAppPool\AppData\Local\temp
2011-10-17 13:40 . 2011-10-17 13:40 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-17 13:40 . 2011-10-17 13:40 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-10-17 07:05 . 2011-10-17 07:05 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{33D7783A-8A74-4D69-8E45-76A31B0B0DCE}\offreg.dll
2011-10-16 13:35 . 2011-09-12 15:14 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{33D7783A-8A74-4D69-8E45-76A31B0B0DCE}\mpengine.dll
2011-10-13 20:47 . 2011-08-17 04:19 75776 —-a-w- c:\windows\system32\psisrndr.ax
2011-10-13 20:47 . 2011-08-17 04:24 465408 —-a-w- c:\windows\system32\psisdecd.dll
2011-10-13 20:47 . 2011-08-27 04:26 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-10-13 20:47 . 2011-08-27 04:26 233472 —-a-w- c:\windows\system32\oleacc.dll
2011-10-13 20:47 . 2011-09-06 02:28 2334720 —-a-w- c:\windows\system32\win32k.sys
2011-10-13 20:47 . 2011-08-20 04:31 981504 —-a-w- c:\windows\system32\wininet.dll
2011-10-13 20:47 . 2011-08-20 04:26 860672 —-a-w- c:\program files\Internet Explorer\iedvtool.dll
2011-10-13 20:46 . 2011-10-01 02:42 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-13 20:46 . 2011-08-20 04:26 163328 —-a-w- c:\program files\Internet Explorer\ieproxy.dll
2011-10-12 18:31 . 2011-10-12 18:31 ——– d—–w- c:\users\Andrea\AppData\Local\4kdownload.com
2011-10-12 18:21 . 2011-10-12 18:21 ——– d—–w- c:\program files\4kDownload
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\program files\Kastor Free Video Converter
2011-10-12 18:02 . 2011-10-12 18:02 ——– d—–w- c:\users\Andrea\AppData\Roaming\KastorVideoConverter
2011-10-12 16:04 . 2011-10-12 16:03 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1257F976-61C2-4D01-942F-44A7F1580C11}\gapaengine.dll
2011-09-26 18:12 . 2011-10-12 15:51 ——– d—–w- c:\program files\WinTips, Inc
2011-09-22 16:19 . 2011-09-22 16:19 ——– d—–w- c:\users\Andrea\AppData\Local\Taggtool
2011-09-22 14:44 . 2011-09-22 14:44 ——– d—–w- c:\program files\DVDVideoSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-28 08:47 . 2011-06-11 07:14 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-12 15:14 . 2011-04-26 07:21 7269712 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-31 16:00 . 2011-06-15 17:41 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-09 09:03 . 2011-08-09 09:04 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-08-04 14:50 . 2011-08-04 14:50 114 —-a-w- c:\windows\Printdir.bat
2011-08-03 11:50 . 2011-08-15 14:55 914024 —-a-w- c:\windows\system32\nvdispco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 875112 —-a-w- c:\windows\system32\nvgenco32.dll
2011-08-03 11:50 . 2011-08-15 14:55 57960 —-a-w- c:\windows\system32\OpenCL.dll
2011-08-03 11:50 . 2011-08-15 14:55 5404776 —-a-w- c:\windows\system32\nvcuda.dll
2011-08-03 11:50 . 2011-08-15 14:55 2391656 —-a-w- c:\windows\system32\nvcuvid.dll
2011-08-03 11:50 . 2011-08-15 14:55 2090088 —-a-w- c:\windows\system32\nvcuvenc.dll
2011-08-03 11:50 . 2011-08-15 14:55 17193576 —-a-w- c:\windows\system32\nvcompiler.dll
2011-08-03 11:50 . 2011-08-15 14:55 16595560 —-a-w- c:\windows\system32\nvoglv32.dll
2011-08-03 11:50 . 2011-08-15 14:55 10304104 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-08-03 11:50 . 2011-01-25 19:33 2412136 —-a-w- c:\windows\system32\nvapi.dll
2011-08-03 11:50 . 2011-01-07 21:06 600680 —-a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-08-03 11:50 . 2011-01-07 21:06 3730024 —-a-w- c:\windows\system32\nvcpl.dll
2011-08-03 11:50 . 2011-01-07 21:06 2558568 —-a-w- c:\windows\system32\nvsvc.dll
2011-08-03 11:50 . 2011-01-07 21:06 599144 —-a-w- c:\windows\system32\nvvsvc.exe
2011-08-03 11:50 . 2011-01-07 21:06 111208 —-a-w- c:\windows\system32\nvmctray.dll
2011-08-03 11:50 . 2010-07-09 16:37 66664 —-a-w- c:\windows\system32\nvshext.dll
2011-08-03 11:50 . 2009-06-10 21:19 12636776 —-a-w- c:\windows\system32\nvd3dum.dll
2011-07-27 07:49 . 2011-06-05 18:21 2301208 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-07-27 07:49 . 2011-06-05 18:21 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-07-27 07:49 . 2011-07-27 07:49 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-15 4615552]
"DriverCure"="c:\program files\ParetoLogic\DriverCure\DriverCure.exe" [2009-08-07 3993368]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-02-18 79192]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-03-28 10029672]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...r=9.0.894" [?]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2011-1-25 303104]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKslb99bc62c;MpKslb99bc62c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A9826131-DFD8-4AC1-B1DA-30E273132B5C}\MpKslb99bc62c.sys [x]
R1 MpKsldb37771b;MpKsldb37771b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3BE2F0D6-E0FF-4776-BC35-945C4A245E69}\MpKsldb37771b.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2011-04-27 11232]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-01-20 1343400]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-08-18 116608]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [2010-06-24 28256]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-08-15 552448]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-03-21 362600]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-01-23 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]
.
2011-10-16 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://uk.yahoo.com
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Andrea\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Andrea\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.1.254
DPF: {B947BD34-91CC-4590-9BA0-6F0F0D2028E8} - hxxp://www.productsandservices.bt.com/consumer/consumerProducts/js/BTSetupTools.cab
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-10-17 14:43:24
ComboFix-quarantined-files.txt 2011-10-17 13:43
ComboFix2.txt 2011-10-16 13:25
.
Pre-Run: 9,141,612,544 bytes free
Post-Run: 8,685,096,960 bytes free
.
- - End Of File - - 026E78FD7B8DC81B2D2A51453CD9A262

I got a couple of messages up while combobox was running. The first one I couldn't completely read because it disappeared so fast, but the words I caught were 'could not all be deleted'. This was just when a restore point was being created.

The second message was at Stage 2 that pev.3XE had stopped running and the programme would close.
Post #12
Hi,

Good job getting ComboFix ran. :)

I notice that you have Malwarebytes on your system already. Please open Malwarebytes, update it and then run a Quick Scan. There will be a log produced that I will need in your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
http://www.eset.com/onlinescan/
———-

Now I would like for you to delete the ComboFix icon from your desktop using right-click > delete and then download a new copy using either of these two links :
Link 1
Link 2

Once you get that downloaded just leave it alone. We may need it later. :)
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner.
Post #15
MBytes & Esetscan shown below: Malware Bytes Pro 08:48:24 User MESSAGE Protection started successfully 08:48:29 User MESSAGE IP Protection started successfully 17:16:41 User MESSAGE Scheduled update executed successfully 17:18:34 User MESSAGE IP Protection stopped 17:18:37 User MESSAGE Database updated successfully 17:18:38 User MESSAGE IP Protection started successfully 18:31:37 User MESSAGE Protection started successfully 18:31:41 User MESSAGE IP Protection started successfully I changed the name to user if that is okay. ESETscan D:\Programme Setup Files\Easeus ToDo v2.5 backup.exe a variant of Win32/SoftonicDownloader.A application D:\Programme Setup Files\FreeRecorderSetup.exe multiple threats D:\Programme Setup Files\FreeWAVMP3ConverterSetup.exe multiple threats D:\Programme Setup Files\FreeWMAMP3ConverterSetup.exe multiple threats D:\Programme Setup Files\pdf_converter.exe a variant of Win32/SweetIM.A application D:\Programme Setup Files\Recent Folders Setup 1.0.1.zip probably a variant of Win32/Spy.Agent.MGPYSFQ trojan D:\Programme Setup Files\Setup_FreeVideoConverter.exe Win32/Adware.Toolbar.Dealio application D:\Programme Setup Files\Softonic Downloader_for_free-youtube-download.exe a variant of Win32/SoftonicDownloader.A application D:\Programme Setup Files\Softonic Downloader_for_free-youtube-to-mp3-converter.exe a variant of Win32/SoftonicDownloader.A application D:\Programme Setup Files\Softonic Downloader_for_wavosaur.exe a variant of Win32/SoftonicDownloader.A application D:\Programme Setup Files\Windows 7 Compatible Programmes\FreeRecorderSetup.exe multiple threats D:\Programme Setup Files\Windows 7 Compatible Programmes\FreeWAVMP3ConverterSetup.exe multiple threats D:\Programme Setup Files\Windows 7 Compatible Programmes\FreeWMAMP3ConverterSetup.exe multiple threats D:\Programme Setup Files\Windows 7 Compatible Programmes\Setup_FreeVideoConverter.exe Win32/Adware.Toolbar.Dealio application L:\My Documents\Security prog setup files\spy eraser plb.exe a variant of Win32/UbSpyEraser application Having seen what these files are, I will say that these exe's were downloaded but none of them have actually been installed on my pc. They were mainly downloaded to check them out, but hadn't got around to it yet. Thanks for the help. hedley

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI