What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

iYogiSupportDock Module [Closed]

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi Sean

Your last files showed that you seem to have a Trojan that prevents you from watching movies so let's try and remove it. :)

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
File::
C:\Documents\Seán's Pics\SARA Ham Radio The Oasis 2011\iyogi.jpg
C:\Program Files\iYogi Support Dock\pccare\Template\SPC_Report\images\iyogi_logo.bmp
C:\ProgramData\Microsoft\User Account Pictures\I Yogi Test.dat
C:\Users\All Users\Microsoft\User Account Pictures\I Yogi Test.dat
C:\Users\Home\AppData\Roaming\Microsoft\Windows\Recent\iYogitoolbarUserSettings.XML.lnk
C:\Users\Home\AppData\Roaming\Microsoft\Windows\Recent\Support Dock Features - iYogi.rtf.lnk
C:\Users\Home\Desktop\Support Dock Features - iYogi.rtf
C:\Users\Home\Pictures\iyogi.jpg
C:\Users\I Yogi Test\Contacts\I Yogi Test.contact
C:\ProgramData\whbqkhjsz\FRed32.dll

Folder::
C:\program data\whbqkhjsz
C:\Program Files\iYogi Support Dock
C:\Users\I Yogi Test
C:\Users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-065743
C:\Users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-071658

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CreoLab"=-

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

===================================================

Re-run SystemLook

Please delete SystemLook.txt from your desktop.
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
*spoof.avi*

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Please do not attach the logs: just copy/paste them in the post

Thanks

Satchfan
Post #17
Hello Satchfan:

You asked me to not attach the logs in my reply. Therefore you will find the results of the logs:

1: ComboFix.exe

ComboFix 11-12-20.04 - Home 12/20/2011 10:54:31.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.439 [GMT -8:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\Home\Downloads\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\documents\Seán's Pics\SARA Ham Radio The Oasis 2011\iyogi.jpg"
"c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\iyogi_logo.bmp"
"c:\programdata\Microsoft\User Account Pictures\I Yogi Test.dat"
"c:\programdata\whbqkhjsz\FRed32.dll"
"c:\users\All Users\Microsoft\User Account Pictures\I Yogi Test.dat"
"c:\users\Home\AppData\Roaming\Microsoft\Windows\Recent\iYogitoolbarUserSettings.XML.lnk"
"c:\users\Home\AppData\Roaming\Microsoft\Windows\Recent\Support Dock Features - iYogi.rtf.lnk"
"c:\users\Home\Desktop\Support Dock Features - iYogi.rtf"
"c:\users\Home\Pictures\iyogi.jpg"
"c:\users\I Yogi Test\Contacts\I Yogi Test.contact"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\iYogi Support Dock
c:\program files\iYogi Support Dock\pccare\antispy.ini
c:\program files\iYogi Support Dock\pccare\ASEng.dll
c:\program files\iYogi Support Dock\pccare\AsInvoker.exe
c:\program files\iYogi Support Dock\pccare\aso.ini
c:\program files\iYogi Support Dock\pccare\asohtm.dll
c:\program files\iYogi Support Dock\pccare\asores.dll
c:\program files\iYogi Support Dock\pccare\atl90.dll
c:\program files\iYogi Support Dock\pccare\categories.ini
c:\program files\iYogi Support Dock\pccare\checkupdate.ini
c:\program files\iYogi Support Dock\pccare\database.dat
c:\program files\iYogi Support Dock\pccare\DefragReport\footer_left.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\footer_middle.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\footer_right.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\left_border.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\line3px_Blue.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\Report_header_left_image.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\Report_header_leftText.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\Report_header_top_middle.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\Report_header_top_right.jpg
c:\program files\iYogi Support Dock\pccare\DefragReport\right_border.jpg
c:\program files\iYogi Support Dock\pccare\difxapi.dll
c:\program files\iYogi Support Dock\pccare\DiskOpt.ini
c:\program files\iYogi Support Dock\pccare\Downloader.dll
c:\program files\iYogi Support Dock\pccare\driveropt.ini
c:\program files\iYogi Support Dock\pccare\HighestAvailable.exe
c:\program files\iYogi Support Dock\pccare\iyso.exe
c:\program files\iYogi Support Dock\pccare\iysoBeforeUninstall.exe
c:\program files\iYogi Support Dock\pccare\iysoCheckUpdate.exe
c:\program files\iYogi Support Dock\pccare\iysoDefragServiceManager.exe
c:\program files\iYogi Support Dock\pccare\iysoDefragSrv.exe
c:\program files\iYogi Support Dock\pccare\iysoDefragSrv64.exe
c:\program files\iYogi Support Dock\pccare\iysoDiskOptimizer.exe
c:\program files\iYogi Support Dock\pccare\iysoDriverUpdater.exe
c:\program files\iYogi Support Dock\pccare\iysoHelper.dll
c:\program files\iYogi Support Dock\pccare\iysoMemoryOptimizer.exe
c:\program files\iYogi Support Dock\pccare\iysoNewScheduler.exe
c:\program files\iYogi Support Dock\pccare\iysoPrivacyProtector.exe
c:\program files\iYogi Support Dock\pccare\iysoRegClean.exe
c:\program files\iYogi Support Dock\pccare\iysoRegistryOptimizer.exe
c:\program files\iYogi Support Dock\pccare\iysosys.dll
c:\program files\iYogi Support Dock\pccare\iysoSystemCleaner.exe
c:\program files\iYogi Support Dock\pccare\iysosystemprotector.exe
c:\program files\iYogi Support Dock\pccare\KillIYSOProcesses.exe
c:\program files\iYogi Support Dock\pccare\lang.lng
c:\program files\iYogi Support Dock\pccare\license.txt
c:\program files\iYogi Support Dock\pccare\memopt.ini
c:\program files\iYogi Support Dock\pccare\MFC90CHS.dll
c:\program files\iYogi Support Dock\pccare\MFC90CHT.dll
c:\program files\iYogi Support Dock\pccare\MFC90DEU.dll
c:\program files\iYogi Support Dock\pccare\MFC90ENU.dll
c:\program files\iYogi Support Dock\pccare\MFC90ESN.dll
c:\program files\iYogi Support Dock\pccare\MFC90ESP.dll
c:\program files\iYogi Support Dock\pccare\MFC90FRA.dll
c:\program files\iYogi Support Dock\pccare\MFC90ITA.dll
c:\program files\iYogi Support Dock\pccare\MFC90JPN.dll
c:\program files\iYogi Support Dock\pccare\MFC90KOR.dll
c:\program files\iYogi Support Dock\pccare\mfc90u.dll
c:\program files\iYogi Support Dock\pccare\Microsoft.VC90.ATL.manifest
c:\program files\iYogi Support Dock\pccare\Microsoft.VC90.CRT.manifest
c:\program files\iYogi Support Dock\pccare\Microsoft.VC90.MFC.manifest
c:\program files\iYogi Support Dock\pccare\Microsoft.VC90.MFCLOC.manifest
c:\program files\iYogi Support Dock\pccare\msvcp90.dll
c:\program files\iYogi Support Dock\pccare\msvcr90.dll
c:\program files\iYogi Support Dock\pccare\Network.dll
c:\program files\iYogi Support Dock\pccare\newscheduler.ini
c:\program files\iYogi Support Dock\pccare\privprotector.ini
c:\program files\iYogi Support Dock\pccare\regclean.ini
c:\program files\iYogi Support Dock\pccare\regopt.ini
c:\program files\iYogi Support Dock\pccare\RequireAdministrator.exe
c:\program files\iYogi Support Dock\pccare\sqlite3.dll
c:\program files\iYogi Support Dock\pccare\sysclean.ini
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\alert_icon.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\gradient.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\icon-3.png
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\icon-tick.png
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\Icon1-big.png
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\Icon1.png
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\iyogi_logo.bmp
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\logo.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\minus.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\perfect_icon.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\Plus.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\problem_icon.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\images\scanning-img.jpg
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\spcoptreport.htm
c:\program files\iYogi Support Dock\pccare\Template\SPC_Report\spcscanreport.htm
c:\program files\iYogi Support Dock\pccare\unins000.dat
c:\program files\iYogi Support Dock\pccare\unins000.exe
c:\program files\iYogi Support Dock\pccare\unrar.dll
c:\program files\iYogi Support Dock\pccare\updater\amd64\DriverRestore.exe
c:\program files\iYogi Support Dock\pccare\updater\amd64\DriverRestore.manifest
c:\program files\iYogi Support Dock\pccare\updater\extract\7z.dll
c:\program files\iYogi Support Dock\pccare\updater\extract\7z.exe
c:\program files\iYogi Support Dock\pccare\updater\extract\copying.txt
c:\program files\iYogi Support Dock\pccare\updater\extract\History.txt
c:\program files\iYogi Support Dock\pccare\updater\extract\license.txt
c:\program files\iYogi Support Dock\pccare\updater\extract\readme.txt
c:\program files\iYogi Support Dock\pccare\updater\vista\DriverRestore.exe
c:\program files\iYogi Support Dock\pccare\updater\vista\DriverRestore.manifest
c:\program files\iYogi Support Dock\pccare\updater\win7amd64\DriverRestore.exe
c:\program files\iYogi Support Dock\pccare\updater\win7amd64\DriverRestore.manifest
c:\program files\iYogi Support Dock\pccare\updater\win7i386\DriverRestore.exe
c:\program files\iYogi Support Dock\pccare\updater\win7i386\DriverRestore.manifest
c:\program files\iYogi Support Dock\pccare\updater\xp\DriverRestore.exe
c:\program files\iYogi Support Dock\pccare\XceedZip.dll
c:\program files\iYogi Support Dock\pccare\xmllite.dll
c:\program files\iYogi Support Dock\pccare\zlibwapi.dll
c:\program files\iYogi Support Dock\PushToTalk5.0.exe
c:\users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-065743
c:\users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-065743\regdata.dat
c:\users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-071658
c:\users\Home\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\iYogiSupportDock Module-27112010-071658\regdata.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-11-20 to 2011-12-20 )))))))))))))))))))))))))))))))
.
.
2011-12-20 19:04 . 2011-12-20 19:04 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-20 19:04 . 2011-12-20 19:04 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-12-20 19:04 . 2011-12-20 19:04 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2011-12-20 19:04 . 2011-12-20 19:04 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-20 19:04 . 2011-12-20 19:04 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-12-20 18:19 . 2011-12-20 18:19 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\offreg.dll
2011-12-20 18:19 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\mpengine.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-10-03 12:06 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 22:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-19 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2011-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2011-12-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-20 11:04
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{C7768536-96F8-4001-B1A2-90EE21279187}"=hex:51,66,7a,6c,4c,1d,38,12,58,86,65,
c3,ca,d8,6f,05,ce,b4,d3,ae,24,79,d5,93
"{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29}"=hex:51,66,7a,6c,4c,1d,38,12,21,d4,68,
4a,bf,65,f0,03,eb,a8,be,20,be,c4,ea,3d
"{2E5E800E-6AC0-411E-940A-369530A35E43}"=hex:51,66,7a,6c,4c,1d,38,12,60,83,4d,
2a,f2,24,70,04,eb,1c,75,d5,35,fd,1a,57
"{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}"=hex:51,66,7a,6c,4c,1d,38,12,28,b9,b1,
5e,21,d7,a9,08,e9,36,2a,eb,0a,ff,3e,f3
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{30CEEEA2-3742-40E4-85DD-812BF1CBB83D}"=hex:51,66,7a,6c,4c,1d,38,12,cc,ed,dd,
34,70,79,8a,05,fa,cb,c2,6b,f4,95,fc,29
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{9D425283-D487-4337-BAB6-AB8354A81457}"=hex:51,66,7a,6c,4c,1d,38,12,ed,51,51,
99,b5,9a,59,06,c5,a0,e8,c3,51,f6,50,43
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"=hex:51,66,7a,6c,4c,1d,38,12,e5,04,8a,
17,85,30,14,02,f6,29,d0,94,a9,bc,6b,ce
"{D84A64A0-F2B2-4975-B264-3A3BCE8D57D6}"=hex:51,66,7a,6c,4c,1d,38,12,ce,67,59,
dc,80,bc,1b,0c,cd,72,79,7b,cb,d3,13,c2
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97,
02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7
"{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}"=hex:51,66,7a,6c,4c,1d,38,12,91,e9,dd,
10,ef,d8,6f,04,d1,21,96,ac,d9,7d,87,e2
"{1631550F-191D-4826-B069-D9439253D926}"=hex:51,66,7a,6c,4c,1d,38,12,61,56,22,
12,2f,57,48,0d,cf,7f,9a,03,97,0d,9d,32
"{512ACF1B-64D9-4928-B382-A80556F28DB4}"=hex:51,66,7a,6c,4c,1d,38,12,75,cc,39,
55,eb,2a,46,0c,cc,94,eb,45,53,ac,c9,a0
"{656EC4B7-072B-4698-B504-2A414C1F0037}"=hex:51,66,7a,6c,4c,1d,38,12,d9,c7,7d,
61,19,49,f6,03,ca,12,69,01,49,41,44,23
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{9579D574-D4D8-4335-9560-FE8641A013BD}"=hex:51,66,7a,6c,4c,1d,38,12,1a,d6,6a,
91,ea,9a,5b,06,ea,76,bd,c6,44,fe,57,a9
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,38,12,2d,dd,7a,
ab,6a,33,56,03,c9,ec,8d,26,b0,f3,64,49
"{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}"=hex:51,66,7a,6c,4c,1d,38,12,92,9a,85,
b0,57,58,7a,01,de,dd,87,e2,a1,ff,7a,f8
"{CA5306DD-361C-4291-BEE3-9E0A9D9E5CB6}"=hex:51,66,7a,6c,4c,1d,38,12,b3,05,40,
ce,2e,78,ff,07,c1,f5,dd,4a,98,c0,18,a2
"{CA6319C0-31B7-401E-A518-A07C3DB8F777}"=hex:51,66,7a,6c,4c,1d,38,12,ae,1a,70,
ce,85,7f,70,05,da,0e,e3,3c,38,e6,b3,63
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{D8D716F2-AA5C-4406-9C39-C8FF582023E6}"=hex:51,66,7a,6c,4c,1d,38,12,9c,15,c4,
dc,6e,e4,68,01,e3,2f,8b,bf,5d,7e,67,f2
"{D93EC24D-8741-4D41-B83D-A5793B998416}"=hex:51,66,7a,6c,4c,1d,38,12,23,c1,2d,
dd,73,c9,2f,08,c7,2b,e6,39,3e,c7,c0,02
"{DAC028C6-2A41-4730-B91F-DFBCB26C82B3}"=hex:51,66,7a,6c,4c,1d,38,12,a8,2b,d3,
de,73,64,5e,02,c6,09,9c,fc,b7,32,c6,a7
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E08861FE-8847-4B2A-8EC2-08EDB20E4020}"=hex:51,66,7a,6c,4c,1d,38,12,90,62,9b,
e4,75,c6,44,0e,f1,d4,4b,ad,b7,50,04,34
"{E713904C-DF05-4C79-BBAD-02DB923253BE}"=hex:51,66,7a,6c,4c,1d,38,12,22,93,00,
e3,37,91,17,09,c4,bb,41,9b,97,6c,17,aa
"{F0DA78E9-6B60-42FB-BC26-EF2CFB8C8FF3}"=hex:51,66,7a,6c,4c,1d,38,12,87,7b,c9,
f4,52,25,95,07,c3,30,ac,6c,fe,d2,cb,e7
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-12-20 11:08:42
ComboFix-quarantined-files.txt 2011-12-20 19:08
ComboFix2.txt 2011-12-20 03:22
ComboFix3.txt 2011-12-18 21:17
.
Pre-Run: 55,747,407,872 bytes free
Post-Run: 55,507,267,584 bytes free
.
- - End Of File - - D7F22F527B4D3D01F4036A6024990675

================================================================================
======================

2: SystemLook.exe

SystemLook 30.07.11 by jpshortstuff
Log created at 11:14 on 20/12/2011 by Home
Administrator - Elevation successful

========== filefind ==========

Searching for "*spoof.avi*"
C:\ProgramData\whbqkhjsz\spoof.avi –ah— 970752 bytes [20:26 18/12/2011] [18:11 20/12/2011] C01D0D11D1576ADB111A0EFEBDD14FA8
C:\Users\All Users\whbqkhjsz\spoof.avi –ah— 970752 bytes [20:26 18/12/2011] [18:11 20/12/2011] C01D0D11D1576ADB111A0EFEBDD14FA8

-= EOF =-

================================================================================
======================

Satchfan,

1: I noticed that many of the iYogi folders were being deleted as the ComboFix.exe program was running. However, I have still found an iYogi folder with subfolders in the following path: "C:\Users\Home\iYogi"

2: There is one additional computer related problem I didn't think about last night when I replied to you. For some reason my "time setting" will not stay accurate. It losing time constantly and I am always having to go into the system and update the time. Now, having said that, I just looked and noticed that the time is correct. :woot:

Take care and God Bless.

Sean.
Post #18
We have one problem folder that we need to deal with and then we’ll look at the folder you are concerned with.

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
Folder::
C:\ProgramData\whbqkhjsz

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

================================================

Run OTL
  • Right click on OTL.exe and click "Run as administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • UNCheck the boxes beside LOP Check and Purity Check.
  • In the window under Custom Scans/Fixes copy and paste the following:

    C:\Users\Home\iYogi\*.* /s

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window, OTL.Txt

Please post that and the ComboFix log

Satchfan
Post #19
Good evening Satchfan: I have completed part one of your request, but I do not have "OTL.exe" on my computer nor is there an option to open/download from your post. Please let me know what to do. Thanks. Sean.
Post #20
My apologies: you don’t have OTL so we’ll use what you DO have. ^_^

Re-run SystemLook

Please delete SystemLook.txt from your desktop.
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :dir 
C:\Users\Home\iYogi\*.* /s

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Please include the "fix" log from ComboFix

Satchfan
Post #21
Top of the mornin Satchfan:

I ran SystemLook.exe and the .txt report is denoted as item no. 1 below.

I ran ComboFix.exe last evening and you will find the .txt report denoted as item no. 2 below.

I noticed that the SystemLook.txt indicated that it was "Unable to find folder" for "C:\Users\Home\iYogi\*.*" I did a search on my computer and found three things related to iYogi: They are as follows:

a: "Support Dock Features - i Yogi.rft" (It appears to be a Micro-soft Word Document)
b: "iYogitoolbarUserSettings.XML"
c: I also found a folder for iYogi: the folder is: "C:\Users\I Yogi Test". I clicked on this folder to see what is in it, but I got a message indicating that I did not have permission to access the folder.

NOTE: I could not find a folder for "C:\Users\Home\iYogi"

One final comment: I received a telephone call from the iYogi company yesterday. They wanted me to sign up for their service at a discounted rate. When I told them I was not interested, they got very persistent that I agree to their service. When I told them no a second time, they become angry. I ended the phone conversation. They were very rude.

Sean.

=======================================================================

1: SystemLook.txt

SystemLook 30.07.11 by jpshortstuff
Log created at 04:52 on 21/12/2011 by Home
Administrator - Elevation successful

========== dir ==========

C:\Users\Home\iYogi\*.* - Unable to find folder.

-= EOF =-

======================================================================

2: ComboFix.txt

ComboFix 11-12-20.04 - Home 12/20/2011 19:19:52.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.546 [GMT -8:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\Home\Downloads\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\whbqkhjsz
c:\programdata\whbqkhjsz\FRed32.dll
c:\programdata\whbqkhjsz\gzxzc.exe
c:\programdata\whbqkhjsz\SmartGeargzxzc.exe
c:\programdata\whbqkhjsz\spoof.avi
.
.
((((((((((((((((((((((((( Files Created from 2011-11-21 to 2011-12-21 )))))))))))))))))))))))))))))))
.
.
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-12-21 01:40 . 2011-12-21 01:40 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\offreg.dll
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 18:19 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\mpengine.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-08-24 05:20 1515688 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-08-24 887976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-19 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-20 19:29
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{C7768536-96F8-4001-B1A2-90EE21279187}"=hex:51,66,7a,6c,4c,1d,38,12,58,86,65,
c3,ca,d8,6f,05,ce,b4,d3,ae,24,79,d5,93
"{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29}"=hex:51,66,7a,6c,4c,1d,38,12,21,d4,68,
4a,bf,65,f0,03,eb,a8,be,20,be,c4,ea,3d
"{2E5E800E-6AC0-411E-940A-369530A35E43}"=hex:51,66,7a,6c,4c,1d,38,12,60,83,4d,
2a,f2,24,70,04,eb,1c,75,d5,35,fd,1a,57
"{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}"=hex:51,66,7a,6c,4c,1d,38,12,28,b9,b1,
5e,21,d7,a9,08,e9,36,2a,eb,0a,ff,3e,f3
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{30CEEEA2-3742-40E4-85DD-812BF1CBB83D}"=hex:51,66,7a,6c,4c,1d,38,12,cc,ed,dd,
34,70,79,8a,05,fa,cb,c2,6b,f4,95,fc,29
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{9D425283-D487-4337-BAB6-AB8354A81457}"=hex:51,66,7a,6c,4c,1d,38,12,ed,51,51,
99,b5,9a,59,06,c5,a0,e8,c3,51,f6,50,43
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"=hex:51,66,7a,6c,4c,1d,38,12,e5,04,8a,
17,85,30,14,02,f6,29,d0,94,a9,bc,6b,ce
"{D84A64A0-F2B2-4975-B264-3A3BCE8D57D6}"=hex:51,66,7a,6c,4c,1d,38,12,ce,67,59,
dc,80,bc,1b,0c,cd,72,79,7b,cb,d3,13,c2
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97,
02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7
"{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}"=hex:51,66,7a,6c,4c,1d,38,12,91,e9,dd,
10,ef,d8,6f,04,d1,21,96,ac,d9,7d,87,e2
"{1631550F-191D-4826-B069-D9439253D926}"=hex:51,66,7a,6c,4c,1d,38,12,61,56,22,
12,2f,57,48,0d,cf,7f,9a,03,97,0d,9d,32
"{512ACF1B-64D9-4928-B382-A80556F28DB4}"=hex:51,66,7a,6c,4c,1d,38,12,75,cc,39,
55,eb,2a,46,0c,cc,94,eb,45,53,ac,c9,a0
"{656EC4B7-072B-4698-B504-2A414C1F0037}"=hex:51,66,7a,6c,4c,1d,38,12,d9,c7,7d,
61,19,49,f6,03,ca,12,69,01,49,41,44,23
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2"{9579D574-D4D8-4335-9560-FE8641A013BD}"=hex:51,66,7a,6c,4c,1d,38,12,1a,d6,6a,
91,ea,9a,5b,06,ea,76,bd,c6,44,fe,57,a9
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,38,12,2d,dd,7a,
ab,6a,33,56,03,c9,ec,8d,26,b0,f3,64,49
"{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}"=hex:51,66,7a,6c,4c,1d,38,12,92,9a,85,
b0,57,58,7a,01,de,dd,87,e2,a1,ff,7a,f8
"{CA5306DD-361C-4291-BEE3-9E0A9D9E5CB6}"=hex:51,66,7a,6c,4c,1d,38,12,b3,05,40,
ce,2e,78,ff,07,c1,f5,dd,4a,98,c0,18,a2
"{CA6319C0-31B7-401E-A518-A07C3DB8F777}"=hex:51,66,7a,6c,4c,1d,38,12,ae,1a,70,
ce,85,7f,70,05,da,0e,e3,3c,38,e6,b3,63
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{D8D716F2-AA5C-4406-9C39-C8FF582023E6}"=hex:51,66,7a,6c,4c,1d,38,12,9c,15,c4,
dc,6e,e4,68,01,e3,2f,8b,bf,5d,7e,67,f2
"{D93EC24D-8741-4D41-B83D-A5793B998416}"=hex:51,66,7a,6c,4c,1d,38,12,23,c1,2d,
dd,73,c9,2f,08,c7,2b,e6,39,3e,c7,c0,02
"{DAC028C6-2A41-4730-B91F-DFBCB26C82B3}"=hex:51,66,7a,6c,4c,1d,38,12,a8,2b,d3,
de,73,64,5e,02,c6,09,9c,fc,b7,32,c6,a7
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E08861FE-8847-4B2A-8EC2-08EDB20E4020}"=hex:51,66,7a,6c,4c,1d,38,12,90,62,9b,
e4,75,c6,44,0e,f1,d4,4b,ad,b7,50,04,34
"{E713904C-DF05-4C79-BBAD-02DB923253BE}"=hex:51,66,7a,6c,4c,1d,38,12,22,93,00,
e3,37,91,17,09,c4,bb,41,9b,97,6c,17,aa
"{F0DA78E9-6B60-42FB-BC26-EF2CFB8C8FF3}"=hex:51,66,7a,6c,4c,1d,38,12,87,7b,c9,
f4,52,25,95,07,c3,30,ac,6c,fe,d2,cb,e7
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-12-20 19:34:16
ComboFix-quarantined-files.txt 2011-12-21 03:34
ComboFix2.txt 2011-12-20 19:08
ComboFix3.txt 2011-12-20 03:22
ComboFix4.txt 2011-12-18 21:17
.
Pre-Run: 55,879,393,280 bytes free
Post-Run: 55,799,169,024 bytes free
.
- - End Of File - - CCD925D0F474F94760C2571457B10FD0
Post #22
Top of the mornin Satchfan:

I ran SystemLook.exe and the .txt report is denoted as item no. 1 below.

I ran ComboFix.exe last evening and you will find the .txt report denoted as item no. 2 below.

I noticed that the SystemLook.txt indicated that it was "Unable to find folder" for "C:\Users\Home\iYogi\*.*" I did a search on my computer and found three things related to iYogi: They are as follows:

a: "Support Dock Features - i Yogi.rft" (It appears to be a Micro-soft Word Document)
b: "iYogitoolbarUserSettings.XML"
c: I also found a folder for iYogi: the folder is: "C:\Users\I Yogi Test". I clicked on this folder to see what is in it, but I got a message indicating that I did not have permission to access the folder.

NOTE: I could not find a folder for "C:\Users\Home\iYogi"

One final comment: I received a telephone call from the iYogi company yesterday. They wanted me to sign up for their service at a discounted rate. When I told them I was not interested, they got very persistent that I agree to their service. When I told them no a second time, they become angry. I ended the phone conversation. They were very rude.

Sean.

=======================================================================

1: SystemLook.txt

SystemLook 30.07.11 by jpshortstuff
Log created at 04:52 on 21/12/2011 by Home
Administrator - Elevation successful

========== dir ==========

C:\Users\Home\iYogi\*.* - Unable to find folder.

-= EOF =-

======================================================================

2: ComboFix.txt

ComboFix 11-12-20.04 - Home 12/20/2011 19:19:52.4.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.546 [GMT -8:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\Home\Downloads\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\whbqkhjsz
c:\programdata\whbqkhjsz\FRed32.dll
c:\programdata\whbqkhjsz\gzxzc.exe
c:\programdata\whbqkhjsz\SmartGeargzxzc.exe
c:\programdata\whbqkhjsz\spoof.avi
.
.
((((((((((((((((((((((((( Files Created from 2011-11-21 to 2011-12-21 )))))))))))))))))))))))))))))))
.
.
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-21 03:29 . 2011-12-21 03:29 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-12-21 01:40 . 2011-12-21 01:40 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\offreg.dll
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 18:19 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\mpengine.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-08-24 05:20 1515688 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-08-24 887976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-19 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-20 19:29
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{C7768536-96F8-4001-B1A2-90EE21279187}"=hex:51,66,7a,6c,4c,1d,38,12,58,86,65,
c3,ca,d8,6f,05,ce,b4,d3,ae,24,79,d5,93
"{4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29}"=hex:51,66,7a,6c,4c,1d,38,12,21,d4,68,
4a,bf,65,f0,03,eb,a8,be,20,be,c4,ea,3d
"{2E5E800E-6AC0-411E-940A-369530A35E43}"=hex:51,66,7a,6c,4c,1d,38,12,60,83,4d,
2a,f2,24,70,04,eb,1c,75,d5,35,fd,1a,57
"{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}"=hex:51,66,7a,6c,4c,1d,38,12,28,b9,b1,
5e,21,d7,a9,08,e9,36,2a,eb,0a,ff,3e,f3
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{30CEEEA2-3742-40E4-85DD-812BF1CBB83D}"=hex:51,66,7a,6c,4c,1d,38,12,cc,ed,dd,
34,70,79,8a,05,fa,cb,c2,6b,f4,95,fc,29
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{9D425283-D487-4337-BAB6-AB8354A81457}"=hex:51,66,7a,6c,4c,1d,38,12,ed,51,51,
99,b5,9a,59,06,c5,a0,e8,c3,51,f6,50,43
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"=hex:51,66,7a,6c,4c,1d,38,12,e5,04,8a,
17,85,30,14,02,f6,29,d0,94,a9,bc,6b,ce
"{D84A64A0-F2B2-4975-B264-3A3BCE8D57D6}"=hex:51,66,7a,6c,4c,1d,38,12,ce,67,59,
dc,80,bc,1b,0c,cd,72,79,7b,cb,d3,13,c2
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97,
02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7
"{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}"=hex:51,66,7a,6c,4c,1d,38,12,91,e9,dd,
10,ef,d8,6f,04,d1,21,96,ac,d9,7d,87,e2
"{1631550F-191D-4826-B069-D9439253D926}"=hex:51,66,7a,6c,4c,1d,38,12,61,56,22,
12,2f,57,48,0d,cf,7f,9a,03,97,0d,9d,32
"{512ACF1B-64D9-4928-B382-A80556F28DB4}"=hex:51,66,7a,6c,4c,1d,38,12,75,cc,39,
55,eb,2a,46,0c,cc,94,eb,45,53,ac,c9,a0
"{656EC4B7-072B-4698-B504-2A414C1F0037}"=hex:51,66,7a,6c,4c,1d,38,12,d9,c7,7d,
61,19,49,f6,03,ca,12,69,01,49,41,44,23
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2"{9579D574-D4D8-4335-9560-FE8641A013BD}"=hex:51,66,7a,6c,4c,1d,38,12,1a,d6,6a,
91,ea,9a,5b,06,ea,76,bd,c6,44,fe,57,a9
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,38,12,2d,dd,7a,
ab,6a,33,56,03,c9,ec,8d,26,b0,f3,64,49
"{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}"=hex:51,66,7a,6c,4c,1d,38,12,92,9a,85,
b0,57,58,7a,01,de,dd,87,e2,a1,ff,7a,f8
"{CA5306DD-361C-4291-BEE3-9E0A9D9E5CB6}"=hex:51,66,7a,6c,4c,1d,38,12,b3,05,40,
ce,2e,78,ff,07,c1,f5,dd,4a,98,c0,18,a2
"{CA6319C0-31B7-401E-A518-A07C3DB8F777}"=hex:51,66,7a,6c,4c,1d,38,12,ae,1a,70,
ce,85,7f,70,05,da,0e,e3,3c,38,e6,b3,63
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{D8D716F2-AA5C-4406-9C39-C8FF582023E6}"=hex:51,66,7a,6c,4c,1d,38,12,9c,15,c4,
dc,6e,e4,68,01,e3,2f,8b,bf,5d,7e,67,f2
"{D93EC24D-8741-4D41-B83D-A5793B998416}"=hex:51,66,7a,6c,4c,1d,38,12,23,c1,2d,
dd,73,c9,2f,08,c7,2b,e6,39,3e,c7,c0,02
"{DAC028C6-2A41-4730-B91F-DFBCB26C82B3}"=hex:51,66,7a,6c,4c,1d,38,12,a8,2b,d3,
de,73,64,5e,02,c6,09,9c,fc,b7,32,c6,a7
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E08861FE-8847-4B2A-8EC2-08EDB20E4020}"=hex:51,66,7a,6c,4c,1d,38,12,90,62,9b,
e4,75,c6,44,0e,f1,d4,4b,ad,b7,50,04,34
"{E713904C-DF05-4C79-BBAD-02DB923253BE}"=hex:51,66,7a,6c,4c,1d,38,12,22,93,00,
e3,37,91,17,09,c4,bb,41,9b,97,6c,17,aa
"{F0DA78E9-6B60-42FB-BC26-EF2CFB8C8FF3}"=hex:51,66,7a,6c,4c,1d,38,12,87,7b,c9,
f4,52,25,95,07,c3,30,ac,6c,fe,d2,cb,e7
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{32004B8A-44A9-43E7-84E9-808838809519}"=hex:51,66,7a,6c,4c,1d,38,12,e4,48,13,
36,9b,0a,89,06,fb,ff,c3,c8,3d,de,d1,0d
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-12-20 19:34:16
ComboFix-quarantined-files.txt 2011-12-21 03:34
ComboFix2.txt 2011-12-20 19:08
ComboFix3.txt 2011-12-20 03:22
ComboFix4.txt 2011-12-18 21:17
.
Pre-Run: 55,879,393,280 bytes free
Post-Run: 55,799,169,024 bytes free
.
- - End Of File - - CCD925D0F474F94760C2571457B10FD0
Post #23
The remnants that are left shouldn’t be a problem and you should be able to delete the rtf and xml files

Open ComboFix

Please do the following:
  • close any open browsers.
  • close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
  • open notepad and copy/paste the text in the codebox below into it:
Folder::
C:\Users\I Yogi Test

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}"=-
"{9D425283-D487-4337-BAB6-AB8354A81457}"=-
"{1399078B-7EB7-477A-893F-93D4ACE22FDA}"=-
"{14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6}"=-
"{1631550F-191D-4826-B069-D9439253D926}"=-
"{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}"=-
"{CA5306DD-361C-4291-BEE3-9E0A9D9E5CB6}"=-
"{D8D716F2-AA5C-4406-9C39-C8FF582023E6}"=
"{DAC028C6-2A41-4730-B91F-DFBCB26C82B3}"=


Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it produces a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

===============================================

Clear all your temporary files

Download ATF Cleaner
  • double-click ATF-Cleaner.exe (on your desktop) to run the program.
  • under Main choose: Select All
  • click the Empty Selected button.
If you use Firefox browser
  • click Firefox at the top and choose: Select All
  • click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
  • click Opera at the top and choose: Select All
  • click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu

===============================================

Run Security Check

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Satchfan
Post #24
Hi Satchfan.

I have performed your requested. The results are posted below.

Thank you.

Sean.

1: ComboFix.txt

ComboFix 11-12-21.02 - Home 12/21/2011 11:55:54.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1013.562 [GMT -8:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
Command switches used :: c:\users\Home\Downloads\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-21 to 2011-12-21 )))))))))))))))))))))))))))))))
.
.
2011-12-21 20:05 . 2011-12-21 20:05 ——– d—–w- c:\users\Home\AppData\Local\temp
2011-12-21 20:05 . 2011-12-21 20:05 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2011-12-21 20:05 . 2011-12-21 20:05 ——– d—–w- c:\users\I Yogi Test\AppData\Local\temp
2011-12-21 20:05 . 2011-12-21 20:05 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-21 20:05 . 2011-12-21 20:05 ——– d—–w- c:\users\Administrator\AppData\Local\temp
2011-12-21 18:31 . 2011-12-21 18:31 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\offreg.dll
2011-12-20 21:57 . 2011-12-20 21:57 ——– d—–w- c:\programdata\Ask
2011-12-20 21:38 . 2006-12-12 17:01 155648 —-a-w- c:\windows\system32\igfxres.dll
2011-12-20 18:19 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{623037EA-7579-446A-AEF7-FDF2D2900B74}\mpengine.dll
2011-12-20 00:53 . 2011-12-20 00:54 ——– d—–w- c:\program files\iTunes
2011-12-19 12:00 . 2009-12-30 18:21 27192 —-a-w- c:\windows\system32\drivers\revoflt.sys
2011-12-14 15:39 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 15:39 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 15:39 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-14 15:39 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-14 15:39 . 2011-11-08 12:10 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-12-14 15:39 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-14 15:39 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
2011-12-14 05:04 . 2011-12-14 05:04 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- C:\STOMP35
2011-12-10 22:43 . 2011-12-10 22:43 ——– d—–w- c:\program files\MVAPPS
2011-12-10 22:43 . 2011-12-10 23:14 ——– d—–w- c:\windows\MVUNINST
2011-12-03 04:29 . 2011-12-03 04:29 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Yahoo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-18 20:20 . 2011-02-25 16:50 6278328 —-a-w- c:\users\Administrator\AppData\Roaming\wruninstall.exe
2011-11-12 21:58 . 2011-06-28 20:14 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 13:54 . 2010-06-26 02:04 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-10-24 22:29 . 2011-10-24 22:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 22:29 . 2011-10-24 22:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-27 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 865840]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2008-01-19 40072]
.
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Uninstall Webroot RunOnce.lnk - c:\users\Administrator\AppData\Roaming\wruninstall.exe [2011-2-25 6278328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Device Monitor 3.lnk - c:\program files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe [2011-9-28 542064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKLM\~\startupfolder\C:^Users^Home^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ZooskMessenger.lnk]
backup=c:\windows\pss\ZooskMessenger.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-10-06 09:52 59240 —-a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATT-SST_McciTrayApp]
2010-07-27 10:15 1573888 —-a-w- c:\program files\ATT-SST\McciTrayApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2007-09-13 21:09 638976 —-a-w- c:\program files\Camera Assistant Software for Gateway\traybar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-06-23 16:18 30192 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 22:28 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-27 18:33 39408 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateFlow.ATT-SST]
2010-07-27 10:15 1057792 —-a-w- c:\program files\ATT-SST\McciBrowser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 acfva;acfva;c:\windows\system32\DRIVERS\ACFVA32.sys [2007-06-29 86656]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-03-01 183560]
R3 dgcfltr;DGC Filter Driver;c:\windows\system32\DRIVERS\ACFDCP32.sys [2007-07-10 28800]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-06-23 30192]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 135664]
R3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~1\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [x]
S2 lxbl_device;lxbl_device;c:\windows\system32\lxblcoms.exe [2007-04-20 537520]
S2 NSL;Norton Safe Web Lite;c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe [2010-05-23 126904]
S3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2007-01-31 205312]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-03 c:\windows\Tasks\Driver Robot.job
- c:\program files\Driver Robot\1.1.0.14\DriverRobot.exe [2009-10-30 00:51]
.
2011-12-19 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2010-06-17 21:28]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
2011-12-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 16:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\EarthLink\Toolbar\SearchUI.dll/search.html
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 10.0.0.1
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-21 12:05
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\1.0.1.8\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:26,b4,25,a3,22,13,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Completion time: 2011-12-21 12:11:15
ComboFix-quarantined-files.txt 2011-12-21 20:11
ComboFix2.txt 2011-12-21 03:34
ComboFix3.txt 2011-12-20 19:08
ComboFix4.txt 2011-12-20 03:22
ComboFix5.txt 2011-12-21 19:51
.
Pre-Run: 56,496,594,944 bytes free
Post-Run: 56,253,046,784 bytes free
.
- - End Of File - - 6996715C187E22FDEE3E61BC019ECABD


========================================================================

2: Checkup.txt

Results of screen317's Security Check version 0.99.30
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET Online Scanner v3
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java™ 6 Update 30
Adobe Flash Player 10.0.42.34 Flash Player out of Date!
Adobe Reader 8 Adobe Reader out of date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
``````````End of Log````````````
Post #25
Let's perform a final scan before deciding that all is now well.

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.
Post #26
Satchfan, here are the results of the ESETScan program run: Sean. C:\Qoobox\Quarantine\C\Program Files\EpicPlay\epICplaygames.dll.vir a variant of Win32/Adware.Gamevance.BI application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\ProgramData\whbqkhjsz\FRed32.dll.vir Win32/Agent.SFM trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\ProgramData\whbqkhjsz\gzxzc.exe.vir a variant of Win32/Kryptik.VED trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\ProgramData\whbqkhjsz\SmartGeargzxzc.exe.vir Win32/Agent.SWD trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\ProgramData\whbqkhjsz\spoof.avi.vir Win32/Agent.SWD trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\Users\Home\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\[removed]\chrome\gvtextlinks.jar.vir Win32/Adware.Gamevance.Gen application deleted - quarantined
Post #27
Good work Sean. :thumbup:

Your computer appears to be clean. The only things Eset found were the files/folders that ComboFix had quarantined.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix
  • click START then RUN
  • now type Combofix /uninstall in the runbox and click OK.
Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)
  • please follow the prompts to uninstall Combofix.
  • once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

Delete all other tools we've used and their resulting reports from your desktop. I would advise you to keep and use ATF Cleaner and use it regularly to clean up your temporary files.

Eset can be uninstalled via the Control Panel in the usual way.

===================================================

Update installed programs

Your version of Flash Player is out-of-date and the Flash player included with SP3 is also old.

Go here and download the latest version.

NEXT

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Install Spybot - Search and Destroy - Download and install Spybot Search and Destroy which provides real time spyware and hijacker protection .

You should scan your computer with the program on a regular basis as you would with your anti-virus software.

A tutorial on installing and using SS&D can be found here:

===================================================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan
Post #28
Hi Satchfan: Got your last post. Sorry it took me a couple of days to get back with you. I still have two concerns I need to talk with you about: 1: I have still an iYogi folder in my computer. The location is as follows: C:\users\I Yogi Test Just for interest, I looked at uninstalling the folder using Revo Uninstaller. It showed the following information once I startted the program: "Full path to program's file or folder: C:\Windows\Explorer.EXE Program's exact name: Microsoft Windows Operating System" 2: I was reading the download suggestion you made for "How to prevent malware by Miekiemoes. Item # 5 under the Miekiemoes' Blog, it meantions about not downloading "codec" related files for videos. Well, I did such a thing a while back :unsure: I get two different types of pop-ups constantly warning me and telling me that my codec files are out of date. Ever since I accepted that dowload, when I start-up my iTunes program, much of the screen is balck and it tells me that videos can't be played on this machine, or something to that effect. Is there any furher actions you can take to help me with these issues? I hope you have had a Very Merry Christmas Satchfan. God Bless. Sean.
Post #29
Hope you had a good Christmas Sean

We need to have a new look at your computer to see what is still present.

Run ComboFix

I overlooked something in your previous posts: ComboFix was not saved to your desktop.

Delete the version of ComboFix you have here:

c:\users\Home\ ComboFix.exe

Download a new version which MUST be saved directly to your desktop.

Download a new version from one of the following locations:

Link1
Link2
Link3

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Close any open browser windows
  • Double click on combofix.exe and follow the prompts.
When finished, it will produce a report for you. Please include it in your next reply.

Note:Do not mouseclick combofix's window while it's running. That may cause it to stall

Thanks

Satchfan
Post #30
Hi Satch: I have been unable to complete your latest directions. Will you please give me until Friday afternoon to complete and reply? Sean.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI