What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

searchnu/410 removal help [Solved]

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi, I hope of done right so far. I posted a baseline log although I am already infected. I have downloaded the various tools and will attach logs here. I seemed to download this while downloading WMA conversion software as I have read others have done too. I will have a second machine to clean as I was only downloading the software here to check it for the other machine. Unfortunately the other one runs Windows 7 63bit while this first machine is XP. We both use firefox. I have attached the logs. Thanks in advance

Attachments:

Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-

Please download aswMBR to your desktop.

  • Double click the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-
Post #4
Hi,

Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
DRV - (utm5njc2) – C:\Windows\System32\drivers\utm5njc2.sys ()
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=113&systemid=406&sr=0&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,start page = http://www.startpage/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=113&systemid=406&sr=0&q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2856415&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..extensions.enabledItems: [removed]:3.2.5.2
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=113&systemid=406&sr=0&q="
[2010/12/10 15:24:11 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Carlos\AppData\Roaming\Mozilla\Firefox\Profiles\er3ng7dg.default\extensions\[removed]
[2010/12/01 18:22:54 | 000,000,913 | —- | M] () – C:\Users\Carlos\AppData\Roaming\Mozilla\Firefox\Profiles\er3ng7dg.default\searchplugins\conduit.xml
[2012/03/10 14:02:18 | 000,002,519 | —- | M] () – C:\Users\Carlos\AppData\Roaming\Mozilla\Firefox\Profiles\er3ng7dg.default\searchplugins\Search_Results.xml
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O33 - MountPoints2\{216b4ce1-b4e5-11de-b64f-001921fac27d}\Shell - "" = AutoRun
O33 - MountPoints2\{216b4ce1-b4e5-11de-b64f-001921fac27d}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\{738c7c0a-bd96-11de-a50b-001921fac27d}\Shell - "" = AutoRun
O33 - MountPoints2\{738c7c0a-bd96-11de-a50b-001921fac27d}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
[2012/03/22 19:43:16 | 000,000,000 | —D | C] – C:\Users\Carlos\AppData\Roaming\GetRightToGo
[2012/03/10 14:08:47 | 000,000,000 | —D | C] – C:\Users\Carlos\AppData\Local\Ilivid Player
[2012/03/11 00:27:32 | 000,162,304 | —- | M] () – C:\Users\Carlos\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Post #6
Hi,

Seems that the OTL fix didn't take.

Please follow the instructions given for OTL in post 4 again carefully and when the new logs are created please post those. :)
Post #7
Here they are again. I'm pretty sure I did everything before except at the end it didn't seem to be rebooting so I may have done it. This time I made sure to let it reboot on it's own sweet time which it did eventually. I ran another scan and am attaching that although it created it's own log at the end so not entirely sure when you say 'when new logs are created please post those'. I'm assuming you mean the ones that I request to create. I didn't check anything but maybe I should have checked 'minimal output' as I think it was on standard. Hope this works… the machine does seem to be running better and the fake search engine is gone so thanks for that.

Attachments:

Post #8
Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt for further review.
Post #10
Hi,
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    File::
c:\program files\Ask.com\GenericAskToolbar.dll
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
c:\program files\Ask.com\UpdateTask.exe

Firefox::
FF - ProfilePath - c:\documents and settings\Jim Uffelmann\Application Data\Mozilla\Firefox\Profiles\hlbqfglm.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000027&locale=en_US&apn_uid=BE6A9A93-3B36-461C-AFEE-C6CCEDB7270B&apn_ptnrs=U3&apn_sauid=967B71C9-A9E4-4FFF-8F16-0A1979EE9829&apn_dtid=YYYYYYYYCA&&q=
FF - user.js: yahoo.homepage.dontask - true);user_pref(extensions.funmoods_i.newTab, false
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=adknlg&q=
FF - user.js: extensions.funmoods_i.id - 8a3cc9030000000000000c607607b8da
FF - user.js: extensions.funmoods_i.instlDay - 15428
FF - user.js: extensions.funmoods_i.vrsn - [removed]
FF - user.js: extensions.funmoods_i.vrsni - [removed]
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.1616:21
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - adknlg
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef -
FF - user.js: extensions.funmoods_i.dfltLng -
FF - user.js: extensions.funmoods_i.excTlbr - false
FF - user.js: security.csp.enable - false
FF - user.js: extensions.autoDisableScopes - 14//iBryte

Folder::
c:\program files\Ask.com
c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\AskToolbar
c:\documents and settings\All Users\Application Data\Ask
c:\documents and settings\Jim Uffelmann\Application Data\searchquband
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=-
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #11
And another log.

Just so you know the last couple of times I guess after reboots I have had to reset firefox as my default browser. I'm guessing you know this would happen but I'm just pointing it out in case it's a surprise



ComboFix 12-04-03.02 - Jim Uffelmann 03/04/2012 13:02:10.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3033.2533 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jim Uffelmann\Desktop\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
FILE ::
"c:\program files\Ask.com\GenericAskToolbar.dll"
"c:\program files\Ask.com\UpdateTask.exe"
"c:\windows\Tasks\Scheduled Update for Ask Toolbar.job"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Ask
c:\documents and settings\Jim Uffelmann\Application Data\searchquband
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar\dtx.ini
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar\geoip.xml
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar\guid.dat
c:\documents and settings\Jim Uffelmann\Application Data\searchqutoolbar\setupCfg.xml
c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\AskToolbar
c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\AskToolbar\APNU\extensions.sqlite
c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\AskToolbar\cache.dat
c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\AskToolbar\config.xml
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\precache.exe
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\Updater\config.xml
c:\program files\Ask.com\Updater\Updater.exe
c:\program files\Ask.com\UpdateTask.exe
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
.
.
((((((((((((((((((((((((( Files Created from 2012-03-03 to 2012-04-03 )))))))))))))))))))))))))))))))
.
.
2012-04-03 17:15 . 2012-04-03 17:15 ——– d—–w- c:\program files\Common Files\Java
2012-04-03 17:15 . 2012-04-03 17:14 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-04-02 19:34 . 2012-04-02 19:34 ——– d—–w- C:\_OTL
2012-04-02 19:24 . 2012-04-02 19:24 ——– d—–w- c:\program files\ERUNT
2012-03-30 20:17 . 2012-03-30 20:17 ——– d—–w- c:\documents and settings\Jim Uffelmann\AppData
2012-03-29 22:25 . 2012-03-29 22:25 ——– d—–w- c:\documents and settings\Jim Uffelmann\Local Settings\Application Data\Zoom_Downloader
2012-03-29 22:24 . 2012-03-29 22:35 ——– d-sh–w- c:\windows\system32\AI_RecycleBin
2012-03-29 22:24 . 2012-03-29 22:24 ——– d—–w- c:\program files\Common Files\Adobe AIR
2012-03-29 22:21 . 2012-03-29 22:21 50 —-a-w- C:\user.js
2012-03-29 22:17 . 2012-03-29 22:17 ——– d—–w- c:\documents and settings\All Users\Application Data\AVS4YOU
2012-03-29 22:17 . 2012-03-29 22:17 ——– d—–w- c:\documents and settings\Jim Uffelmann\Application Data\AVS4YOU
2012-03-29 22:15 . 2010-07-08 18:25 1700352 —-a-w- c:\windows\system32\GdiPlus.dll
2012-03-29 22:15 . 2010-07-08 18:25 24576 —-a-w- c:\windows\system32\msxml3a.dll
2012-03-29 22:15 . 2012-03-29 22:18 ——– d—–w- c:\program files\AVS4YOU
2012-03-29 22:15 . 2012-03-29 22:18 ——– d—–w- c:\program files\Common Files\AVSMedia
2012-03-23 19:35 . 2012-04-03 18:44 ——– d—–w- c:\documents and settings\Jim Uffelmann\Application Data\Skype
2012-03-23 19:34 . 2012-03-23 19:34 ——– d—–w- c:\program files\Common Files\Skype
2012-03-23 19:34 . 2012-03-23 19:35 ——– d—–r- c:\program files\Skype
2012-03-23 19:34 . 2012-03-23 19:34 ——– d—–w- c:\documents and settings\All Users\Application Data\Skype
2012-03-08 16:40 . 2012-03-08 16:40 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-03-08 16:40 . 2012-03-08 16:40 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-03-08 16:40 . 2012-03-22 17:45 187320 —-a-w- c:\program files\Mozilla Firefox\nspr4.dll
2012-03-08 16:40 . 2012-03-08 16:40 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-03-08 16:40 . 2012-03-22 17:45 646072 —-a-w- c:\program files\Mozilla Firefox\nss3.dll
2012-03-08 16:40 . 2012-03-22 17:45 371640 —-a-w- c:\program files\Mozilla Firefox\nssckbi.dll
2012-03-08 16:40 . 2012-03-22 17:45 109496 —-a-w- c:\program files\Mozilla Firefox\nssdbm3.dll
2012-03-08 16:40 . 2012-03-22 17:45 105400 —-a-w- c:\program files\Mozilla Firefox\nssutil3.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-03 17:14 . 2010-05-03 17:32 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-03-14 22:49 . 2011-06-13 15:44 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:26 . 2008-04-25 16:16 1869184 —-a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-16 16:02 3072 ——w- c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2008-04-25 21:26 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-22 17:45 . 2012-03-08 16:40 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-03_17.55.50 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-03 18:42 . 2012-04-03 18:42 16384 c:\windows\Temp\Perflib_Perfdata_388.dat
+ 2008-04-25 16:16 . 2012-04-03 18:47 80638 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2012-04-03 17:28 80638 c:\windows\system32\perfc009.dat
+ 2008-04-25 16:16 . 2012-04-03 18:47 466804 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2012-04-03 17:28 466804 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2012-02-29 17148552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-31 217088]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-02-22 483420]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-22 729088]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-18 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-18 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-18 150040]
"EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2009-04-30 2396160]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-23 1318816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\documents and settings\the Others\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\Jim Uffelmann\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2010-10-15 114688]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\ASUS\\RT-N56U Wireless Router Utilities\\Discovery.exe"=
"c:\\Program Files\\ASUS\\RT-N56U Wireless Router Utilities\\Rescue.exe"=
"c:\\Program Files\\ASUS\\RT-N56U Wireless Router Utilities\\Download.exe"=
"c:\\Program Files\\ASUS\\RT-N56U Wireless Router Utilities\\LiveUpdate.exe"=
"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [21/10/2011 4:48 PM 89792]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [21/10/2011 4:48 PM 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [21/10/2011 4:48 PM 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [21/10/2011 4:48 PM 214904]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [21/10/2011 4:49 PM 160608]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [21/10/2011 4:32 PM 150856]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [05/10/2009 10:07 AM 112512]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [21/10/2011 4:48 PM 57600]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [21/10/2011 4:48 PM 338176]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [21/10/2011 4:48 PM 83856]
R3 O2MDGRDR;O2MDGRDR;c:\windows\system32\drivers\o2mdg.sys [05/10/2009 10:07 AM 51616]
R3 O2SDGRDR;O2SDGRDR;c:\windows\system32\drivers\o2sdg.sys [05/10/2009 10:07 AM 41760]
S2 0315101333395563mcinstcleanup;McAfee Application Installer Cleanup (0315101333395563);c:\windows\TEMP\031510~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service –> c:\windows\TEMP\031510~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [23/04/2010 1:47 PM 136176]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 –> c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [?]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [29/02/2012 8:50 AM 158856]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [23/04/2010 1:47 PM 136176]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [21/10/2011 4:48 PM 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [21/10/2011 4:48 PM 87656]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2012-03-14 c:\windows\Tasks\backup 1.job
- c:\windows\system32\ntbackup.exe [2008-04-25 12:00]
.
2012-03-31 c:\windows\Tasks\backup.job
- c:\windows\system32\ntbackup.exe [2008-04-25 12:00]
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-23 19:46]
.
2012-04-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-23 19:46]
.
2012-03-22 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2012-02-07 23:02]
.
2012-04-03 c:\windows\Tasks\SyncBack backup 1.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2009-10-14 21:42]
.
2012-04-03 c:\windows\Tasks\SyncBack backup1.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2009-10-14 21:42]
.
2012-04-03 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-10-20 04:18]
.
.
——- Supplementary Scan ——-
.
uStart Page =
mStart Page = hxxp://www1.ca.dell.com/content/default.aspx?c=ca&l=en&s=gen
uSearchAssistant = hxxp://dts.search-results.com/sr?src=ieb&appid=100&systemid=410&sr=0&q={searchTerms}
uSearchURL,(Default) = hxxp://ca.search.yahoo.com/search?fr=mcafee&p=%s%s
IE: Download All by ASUS Download - c:\program files\ASUS\RT-N56U Wireless Router Utilities\ASDownloadAll.htm
IE: Download using ASUS Download - c:\program files\ASUS\RT-N56U Wireless Router Utilities\ASDownload.htm
TCP: DhcpNameServer = 192.168.1.1 [removed]
FF - ProfilePath - c:\documents and settings\Jim Uffelmann\Application Data\Mozilla\Firefox\Profiles\hlbqfglm.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
AddRemove-{79A765E1-C399-405B-85AF-466F52E918B0} - c:\program files\Ask.com\Updater\Updater.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-03 13:08
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
Completion time: 2012-04-03 13:09:44
ComboFix-quarantined-files.txt 2012-04-03 19:09
ComboFix2.txt 2012-04-03 18:00
.
Pre-Run: 138,855,485,440 bytes free
Post-Run: 138,830,163,968 bytes free
.
- - End Of File - - 1664766CC9F93BD71F5A6C8876BAC759
Post #12
Hi,

Just so you know the last couple of times I guess after reboots I have had to reset firefox as my default browser.

Yes that is fine…ComboFix reset it. If you want to just wait until we have finished up it won't keep changing. :)
———

Please download Malwarebytes' Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.


  • Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs made by Malwarebytes and ESET online scanner.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI