1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Redirect problem - Google

Discussion in 'Malware and Virus Removal Archive' started by jakemt85, 2009/12/12.

  1. 2009/12/12
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    [Resolved] Redirect problem - Google

    Hi,

    I've seen a few other people are experiencing the same problem, I have tried everything and scanned my computer using a number of spy/adware & virus scanners and haven't had any luck and really don't understand programs like hijack this. When I click on search results it sends me to a number of sites, some being Ask, Ebay, and even Google.

    Here are my DDS logs, I appreciate anything you can do to help. Thank you!

    DDS:

    DDS (Ver_09-12-01.01) - NTFSx86
    Run by Jacob at 2:18:40.40 on 13/12/2009
    Internet Explorer: 8.0.7600.16385
    Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3327.2044 [GMT 0:00]


    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\Explorer.EXE
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\Windows\System32\Ctxfihlp.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Smith Micro\StuffIt 2009\ArcNameService.exe
    C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    C:\Windows\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\DllHost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\UI0Detect.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Jacob\Desktop\dds.scr
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://news.bbc.co.uk/
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    mRun: [CTxfiHlp] "CTXFIHLP.EXE "
    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [McENUI] "c:\progra~1\mcafee\mhn\McENUI.exe" /hide
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [Launch LgDeviceAgent] "c:\program files\logitech\gamepanel software\LgDevAgt.exe "
    mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe "
    mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
    mRun: [Kernel and Hardware Abstraction Layer] "KHALMNPR.EXE "
    mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wn111v2\WN111v2.exe
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
    DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

    ============= SERVICES / DRIVERS ===============

    R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2008-10-1 20384]
    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-9-16 214664]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-12-2 93320]
    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-11-10 359952]
    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-11-10 144704]
    R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]
    R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-12-6 1201640]
    R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]
    R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]
    R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]
    R3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNISP50.sys [2006-11-16 20480]
    R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-7-14 19720]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-11-10 606736]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-11-10 79816]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-11-10 35272]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-11-10 40552]
    R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\drivers\Ph3xIB32.sys [2009-6-10 1311232]
    R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2v.sys [2009-1-13 453120]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-15 135664]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-11-10 79360]
    S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]
    S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]
    S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]
    S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNIMP50.sys [2006-11-16 21504]
    S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2009-11-10 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\netgear\wn111v2\jswpsapi.exe [2008-2-29 942080]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-11-10 34248]
    S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

    =============== Created Last 30 ================

    2009-12-12 08:29:32 0 d-----w- C:\HJT
    2009-12-11 23:00:50 0 d-----w- c:\programdata\Spybot - Search & Destroy
    2009-12-11 23:00:50 0 d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-10 21:17:02 0 d-----w- c:\program files\AVG
    2009-12-10 21:16:51 0 d-----w- c:\programdata\avg9
    2009-12-09 23:20:01 0 d-----w- c:\users\jacob\DoctorWeb
    2009-12-09 23:04:38 0 d-sh--w- C:\$RECYCLE.BIN
    2009-12-09 22:50:06 77312 ----a-w- c:\windows\MBR.exe
    2009-12-09 22:50:04 261632 ----a-w- c:\windows\PEV.exe
    2009-12-09 22:50:04 161792 ----a-w- c:\windows\SWREG.exe
    2009-12-09 22:50:03 98816 ----a-w- c:\windows\sed.exe
    2009-12-08 23:43:06 13952 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2009-12-08 23:43:01 0 d-----w- c:\programdata\Hitman Pro
    2009-12-08 23:43:00 0 d-----w- c:\program files\Hitman Pro 3.5
    2009-12-08 19:43:16 0 d-----w- c:\users\jacob\appdata\roaming\Malwarebytes
    2009-12-08 19:43:11 0 d-----w- c:\programdata\Malwarebytes
    2009-12-08 19:25:31 0 d-----w- c:\program files\Trend Micro
    2009-12-06 15:46:31 0 d-----w- c:\program files\MSXML 4.0
    2009-12-06 12:18:15 0 d-----w- c:\program files\MSSOAP
    2009-12-06 12:18:15 0 d-----w- c:\program files\common files\MSSoap
    2009-12-06 12:18:02 1563008 ----a-w- c:\windows\WRSetup.dll
    2009-12-06 12:18:02 0 d-----w- c:\users\jacob\appdata\roaming\Webroot
    2009-12-06 12:18:02 0 d-----w- c:\programdata\Webroot
    2009-12-06 12:18:02 0 d-----w- c:\program files\Webroot
    2009-12-06 12:10:09 164 ----a-w- c:\windows\install.dat
    2009-12-01 23:55:57 0 d-----w- c:\programdata\Office Genuine Advantage
    2009-12-01 23:55:54 0 d-----w- c:\users\jacob\Office Genuine Advantage
    2009-11-29 00:18:24 0 d-----w- c:\program files\VideoLAN
    2009-11-25 03:00:33 2048 ----a-w- c:\windows\system32\tzres.dll
    2009-11-17 22:12:42 0 d-----w- c:\programdata\CyberLink
    2009-11-17 22:12:19 0 d-----w- c:\program files\common files\CyberLink
    2009-11-17 22:10:02 505128 ----a-w- c:\windows\system32\msvcp71.dll
    2009-11-17 22:10:02 353576 ----a-w- c:\windows\system32\msvcr71.dll
    2009-11-17 22:10:02 29480 ----a-w- c:\windows\system32\msxml3a.dll
    2009-11-17 22:09:44 0 d-----w- c:\programdata\Temp
    2009-11-15 11:28:23 30568 ----a-w- c:\windows\system32\mdimon.dll
    2009-11-15 11:25:04 0 d-----w- c:\programdata\Microsoft Help
    2009-11-14 17:18:29 0 d-----w- c:\programdata\Hewlett-Packard
    2009-11-13 23:13:39 0 d-----w- c:\programdata\Messenger Plus!

    ==================== Find3M ====================

    2009-12-10 01:27:46 142416 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2009-11-11 07:52:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2009-11-11 07:52:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2009-11-11 01:01:50 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSBW_01_00_00.Wdf
    2009-11-11 01:01:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf
    2009-11-10 17:27:57 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
    2009-11-10 14:26:23 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-11-10 10:53:41 444952 ----a-w- c:\windows\system32\wrap_oal.dll
    2009-11-10 10:53:41 109080 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-11-06 12:00:36 23152 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-11-06 12:00:36 176752 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-11-06 12:00:34 29808 ----a-w- c:\windows\system32\drivers\ssfs0bbc.sys
    2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-09-27 17:47:30 2173544 ----a-w- c:\windows\system32\nvcplui.exe
    2009-09-27 17:47:00 92776 ----a-w- c:\windows\system32\nvmctray.dll
    2009-09-27 17:47:00 805480 ----a-w- c:\windows\system32\nvsvc.dll
    2009-09-27 17:47:00 4033128 ----a-w- c:\windows\system32\nvvitvs.dll
    2009-09-27 17:47:00 3553896 ----a-w- c:\windows\system32\nvgames.dll
    2009-09-27 17:47:00 3172968 ----a-w- c:\windows\system32\nvwss.dll
    2009-09-27 17:47:00 215656 ----a-w- c:\windows\system32\nvvsvc.exe
    2009-09-27 17:47:00 195176 ----a-w- c:\windows\system32\nvmccss.dll
    2009-09-27 17:47:00 150120 ----a-w- c:\windows\system32\nvshext.dll
    2009-09-27 17:47:00 1309288 ----a-w- c:\windows\system32\nvsvs.dll
    2009-09-27 17:47:00 1292904 ----a-w- c:\windows\system32\nvmobls.dll
    2009-09-27 17:46:00 4942440 ----a-w- c:\windows\system32\nvdisps.dll
    2009-09-27 17:46:00 13949544 ----a-w- c:\windows\system32\nvcpl.dll
    2009-09-25 16:41:28 90112 ----a-w- c:\windows\system32\dpl100.dll
    2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
    2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx07.dll
    2009-09-25 16:41:26 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
    2009-09-25 16:41:26 843776 ----a-w- c:\windows\system32\divx_xx16.dll
    2009-09-25 16:41:26 839680 ----a-w- c:\windows\system32\divx_xx11.dll
    2009-09-25 16:41:26 696320 ----a-w- c:\windows\system32\DivX.dll
    2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
    2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
    2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
    2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
    2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
    2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
    2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
    2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
    2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
    2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
    2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

    ============= FINISH: 2:19:51.60 ===============

    Attach:

    DDS (Ver_09-12-01.01) - NTFSx86
    Run by Jacob at 2:18:40.40 on 13/12/2009
    Internet Explorer: 8.0.7600.16385
    Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3327.2044 [GMT 0:00]


    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\Explorer.EXE
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\Windows\System32\Ctxfihlp.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Smith Micro\StuffIt 2009\ArcNameService.exe
    C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    C:\Windows\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\DllHost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\UI0Detect.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\Jacob\Desktop\dds.scr
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://news.bbc.co.uk/
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    mRun: [CTxfiHlp] "CTXFIHLP.EXE "
    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [McENUI] "c:\progra~1\mcafee\mhn\McENUI.exe" /hide
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [Launch LgDeviceAgent] "c:\program files\logitech\gamepanel software\LgDevAgt.exe "
    mRun: [Launch LCDMon] "c:\program files\logitech\gamepanel software\lcd manager\LCDMon.exe "
    mRun: [Launch LGDCore] "c:\program files\logitech\gamepanel software\g-series software\LGDCore.exe" /SHOWHIDE
    mRun: [Kernel and Hardware Abstraction Layer] "KHALMNPR.EXE "
    mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wn111v2\WN111v2.exe
    mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mif5ba~1\office12\REFIEBAR.DLL
    DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

    ============= SERVICES / DRIVERS ===============

    R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2008-10-1 20384]
    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-9-16 214664]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-12-2 93320]
    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-11-10 359952]
    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-11-10 144704]
    R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]
    R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-12-6 1201640]
    R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]
    R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]
    R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]
    R3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNISP50.sys [2006-11-16 20480]
    R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-7-14 19720]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-11-10 606736]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-11-10 79816]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-11-10 35272]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-11-10 40552]
    R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\drivers\Ph3xIB32.sys [2009-6-10 1311232]
    R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\WN111v2v.sys [2009-1-13 453120]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-15 135664]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-11-10 79360]
    S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [2009-6-4 171032]
    S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [2009-6-4 1324056]
    S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [2009-6-4 72728]
    S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\system32\drivers\DNIMP50.sys [2006-11-16 21504]
    S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2009-11-10 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\netgear\wn111v2\jswpsapi.exe [2008-2-29 942080]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-11-10 34248]
    S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

    =============== Created Last 30 ================

    2009-12-12 08:29:32 0 d-----w- C:\HJT
    2009-12-11 23:00:50 0 d-----w- c:\programdata\Spybot - Search & Destroy
    2009-12-11 23:00:50 0 d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-10 21:17:02 0 d-----w- c:\program files\AVG
    2009-12-10 21:16:51 0 d-----w- c:\programdata\avg9
    2009-12-09 23:20:01 0 d-----w- c:\users\jacob\DoctorWeb
    2009-12-09 23:04:38 0 d-sh--w- C:\$RECYCLE.BIN
    2009-12-09 22:50:06 77312 ----a-w- c:\windows\MBR.exe
    2009-12-09 22:50:04 261632 ----a-w- c:\windows\PEV.exe
    2009-12-09 22:50:04 161792 ----a-w- c:\windows\SWREG.exe
    2009-12-09 22:50:03 98816 ----a-w- c:\windows\sed.exe
    2009-12-08 23:43:06 13952 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2009-12-08 23:43:01 0 d-----w- c:\programdata\Hitman Pro
    2009-12-08 23:43:00 0 d-----w- c:\program files\Hitman Pro 3.5
    2009-12-08 19:43:16 0 d-----w- c:\users\jacob\appdata\roaming\Malwarebytes
    2009-12-08 19:43:11 0 d-----w- c:\programdata\Malwarebytes
    2009-12-08 19:25:31 0 d-----w- c:\program files\Trend Micro
    2009-12-06 15:46:31 0 d-----w- c:\program files\MSXML 4.0
    2009-12-06 12:18:15 0 d-----w- c:\program files\MSSOAP
    2009-12-06 12:18:15 0 d-----w- c:\program files\common files\MSSoap
    2009-12-06 12:18:02 1563008 ----a-w- c:\windows\WRSetup.dll
    2009-12-06 12:18:02 0 d-----w- c:\users\jacob\appdata\roaming\Webroot
    2009-12-06 12:18:02 0 d-----w- c:\programdata\Webroot
    2009-12-06 12:18:02 0 d-----w- c:\program files\Webroot
    2009-12-06 12:10:09 164 ----a-w- c:\windows\install.dat
    2009-12-01 23:55:57 0 d-----w- c:\programdata\Office Genuine Advantage
    2009-12-01 23:55:54 0 d-----w- c:\users\jacob\Office Genuine Advantage
    2009-11-29 00:18:24 0 d-----w- c:\program files\VideoLAN
    2009-11-25 03:00:33 2048 ----a-w- c:\windows\system32\tzres.dll
    2009-11-17 22:12:42 0 d-----w- c:\programdata\CyberLink
    2009-11-17 22:12:19 0 d-----w- c:\program files\common files\CyberLink
    2009-11-17 22:10:02 505128 ----a-w- c:\windows\system32\msvcp71.dll
    2009-11-17 22:10:02 353576 ----a-w- c:\windows\system32\msvcr71.dll
    2009-11-17 22:10:02 29480 ----a-w- c:\windows\system32\msxml3a.dll
    2009-11-17 22:09:44 0 d-----w- c:\programdata\Temp
    2009-11-15 11:28:23 30568 ----a-w- c:\windows\system32\mdimon.dll
    2009-11-15 11:25:04 0 d-----w- c:\programdata\Microsoft Help
    2009-11-14 17:18:29 0 d-----w- c:\programdata\Hewlett-Packard
    2009-11-13 23:13:39 0 d-----w- c:\programdata\Messenger Plus!

    ==================== Find3M ====================

    2009-12-10 01:27:46 142416 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2009-11-11 07:52:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2009-11-11 07:52:24 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2009-11-11 01:01:50 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSBW_01_00_00.Wdf
    2009-11-11 01:01:45 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf
    2009-11-10 17:27:57 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
    2009-11-10 14:26:23 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-11-10 10:53:41 444952 ----a-w- c:\windows\system32\wrap_oal.dll
    2009-11-10 10:53:41 109080 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-11-06 12:00:36 23152 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-11-06 12:00:36 176752 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-11-06 12:00:34 29808 ----a-w- c:\windows\system32\drivers\ssfs0bbc.sys
    2009-11-02 20:42:06 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-09-27 17:47:30 2173544 ----a-w- c:\windows\system32\nvcplui.exe
    2009-09-27 17:47:00 92776 ----a-w- c:\windows\system32\nvmctray.dll
    2009-09-27 17:47:00 805480 ----a-w- c:\windows\system32\nvsvc.dll
    2009-09-27 17:47:00 4033128 ----a-w- c:\windows\system32\nvvitvs.dll
    2009-09-27 17:47:00 3553896 ----a-w- c:\windows\system32\nvgames.dll
    2009-09-27 17:47:00 3172968 ----a-w- c:\windows\system32\nvwss.dll
    2009-09-27 17:47:00 215656 ----a-w- c:\windows\system32\nvvsvc.exe
    2009-09-27 17:47:00 195176 ----a-w- c:\windows\system32\nvmccss.dll
    2009-09-27 17:47:00 150120 ----a-w- c:\windows\system32\nvshext.dll
    2009-09-27 17:47:00 1309288 ----a-w- c:\windows\system32\nvsvs.dll
    2009-09-27 17:47:00 1292904 ----a-w- c:\windows\system32\nvmobls.dll
    2009-09-27 17:46:00 4942440 ----a-w- c:\windows\system32\nvdisps.dll
    2009-09-27 17:46:00 13949544 ----a-w- c:\windows\system32\nvcpl.dll
    2009-09-25 16:41:28 90112 ----a-w- c:\windows\system32\dpl100.dll
    2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
    2009-09-25 16:41:26 856064 ----a-w- c:\windows\system32\divx_xx07.dll
    2009-09-25 16:41:26 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
    2009-09-25 16:41:26 843776 ----a-w- c:\windows\system32\divx_xx16.dll
    2009-09-25 16:41:26 839680 ----a-w- c:\windows\system32\divx_xx11.dll
    2009-09-25 16:41:26 696320 ----a-w- c:\windows\system32\DivX.dll
    2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
    2009-07-14 04:56:42 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
    2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
    2009-07-14 04:56:42 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
    2009-07-14 04:41:57 174 --sha-w- c:\program files\desktop.ini
    2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
    2009-07-14 00:34:40 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
    2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
    2009-07-14 00:34:38 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
    2009-06-10 21:26:35 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
    2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

    ============= FINISH: 2:19:51.60 ===============
     
    jakemt85,
    #1
  2. 2009/12/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Which browser is getting redirected?
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/12/13
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Internet explorer 8.
     
    jakemt85,
    #3
  5. 2009/12/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Please, never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE. If Combofix asks you to install Recovery Console, please allow it.

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #4
  6. 2009/12/13
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    There seems to be a problem downloading combofix at the moment. In the meanwhile here is my hijack log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:05:46, on 13/12/2009
    Platform: Unknown Windows (WinNT 6.01.3504)
    MSIE: Internet Explorer v8.00 (8.00.7600.16385)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\Ctxfihlp.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
    C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
    C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
    C:\Windows\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\PROGRA~1\COMMON~1\McAfee\MSC\McUICnt.exe
    C:\HJT\HijackThis.exe
    C:\Windows\system32\SearchFilterHost.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [CTxfiHlp] "CTXFIHLP.EXE "
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [McENUI] "C:\PROGRA~1\McAfee\MHN\McENUI.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [Launch LgDeviceAgent] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe "
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe "
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] "KHALMNPR.EXE "
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt 2009\ArcNameService.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
    O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

    --
    End of file - 9250 bytes
     
    jakemt85,
    #5
  7. 2009/12/14
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Hi, really sorry but I've still not been able to download combofix.
     
    jakemt85,
    #6
  8. 2009/12/14
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Yes, Combofix has been pulled temporarily, due to some issues.
    I'm sending you PM.
     
    broni,
    #7
  9. 2009/12/15
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Here's the log, thank you again

    ComboFix 09-11-23.02 - Jacob 15/12/2009 23:08.2.4 - x86
    Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3327.1749 [GMT 0:00]
    Running from: c:\users\Jacob\Desktop\3c786fgt5.exe
    .
    - REDUCED FUNCTIONALITY MODE -
    .

    ((((((((((((((((((((((((( Files Created from 2009-11-15 to 2009-12-15 )))))))))))))))))))))))))))))))
    .

    2009-12-15 23:09 . 2009-12-15 23:09 -------- d-----w- c:\users\Public\AppData\Local\temp
    2009-12-15 23:09 . 2009-12-15 23:09 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-12-08 23:43 . 2009-12-08 23:43 13952 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2009-12-08 23:43 . 2009-12-08 23:43 -------- d-----w- c:\programdata\Hitman Pro
    2009-12-08 23:43 . 2009-12-08 23:43 -------- d-----w- c:\program files\Hitman Pro 3.5
    2009-12-08 19:43 . 2009-12-08 19:43 -------- d-----w- c:\users\Jacob\AppData\Roaming\Malwarebytes
    2009-12-08 19:43 . 2009-12-08 19:43 -------- d-----w- c:\programdata\Malwarebytes
    2009-12-08 19:25 . 2009-12-08 19:25 -------- d-----w- c:\program files\Trend Micro
    2009-12-06 15:46 . 2009-12-06 15:46 -------- d-----w- c:\program files\MSXML 4.0
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\program files\MSSOAP
    2009-12-06 12:18 . 2009-12-06 13:25 -------- d-----w- c:\programdata\Webroot
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\users\Jacob\AppData\Roaming\Webroot
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\program files\Webroot
    2009-12-06 12:18 . 2009-11-06 15:19 1563008 ----a-w- c:\windows\WRSetup.dll
    2009-12-06 12:10 . 2009-12-06 12:10 164 ----a-w- c:\windows\install.dat
    2009-12-05 17:04 . 2009-12-05 17:04 -------- d-----w- c:\windows\Sun
    2009-12-02 22:36 . 2009-12-02 22:36 -------- d-----w- c:\users\Jacob\AppData\Local\ElevatedDiagnostics
    2009-12-01 23:55 . 2009-12-01 23:55 -------- d-----w- c:\programdata\Office Genuine Advantage
    2009-12-01 23:55 . 2009-12-01 23:55 -------- d-----w- c:\users\Jacob\Office Genuine Advantage
    2009-11-29 00:19 . 2009-12-15 21:01 -------- d-----w- c:\users\Jacob\AppData\Roaming\vlc
    2009-11-29 00:18 . 2009-11-29 00:18 -------- d-----w- c:\program files\VideoLAN
    2009-11-25 03:00 . 2009-10-29 07:22 2048 ----a-w- c:\windows\system32\tzres.dll
    2009-11-21 10:47 . 2009-11-21 10:47 175 ----a-w- c:\users\Jacob\AppData\Roaming\Azureus\restart.bat
    2009-11-21 09:12 . 2008-05-29 06:03 37176 ----a-w- c:\users\Jacob\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2009-11-17 22:13 . 2009-11-24 02:11 -------- d-----w- c:\users\Jacob\AppData\Local\Cyberlink
    2009-11-17 22:13 . 2009-11-17 22:13 -------- d-----w- c:\users\Public\CyberLink
    2009-11-17 22:13 . 2009-11-17 22:14 -------- d-----w- c:\users\Jacob\AppData\Roaming\CyberLink
    2009-11-17 22:12 . 2009-12-09 22:16 -------- d-----w- c:\programdata\CyberLink
    2009-11-17 22:12 . 2009-11-17 22:12 -------- d-----w- c:\program files\Common Files\CyberLink
    2009-11-17 22:10 . 2009-11-17 22:09 505128 ----a-w- c:\windows\system32\msvcp71.dll
    2009-11-17 22:10 . 2009-11-17 22:09 353576 ----a-w- c:\windows\system32\msvcr71.dll
    2009-11-17 22:10 . 2009-11-17 22:09 29480 ----a-w- c:\windows\system32\msxml3a.dll
    2009-11-17 22:09 . 2009-12-09 22:03 53319 ----a-w- c:\programdata\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
    2009-11-16 01:33 . 2009-11-16 01:33 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-13 16:22 . 2009-11-10 15:45 16384 d-----w- c:\users\Jacob\AppData\Roaming\Azureus
    2009-12-13 02:09 . 2009-11-15 11:35 -------- d-----w- c:\program files\Google
    2009-12-12 08:24 . 2009-12-11 23:00 8192 d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-12 08:24 . 2009-12-11 23:00 4096 d-----w- c:\programdata\Spybot - Search & Destroy
    2009-12-11 07:26 . 2009-12-10 21:16 4096 d-----w- c:\programdata\avg9
    2009-12-10 21:17 . 2009-12-10 21:17 -------- d-----w- c:\program files\AVG
    2009-12-10 01:27 . 2009-06-10 21:19 142416 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2009-12-09 23:14 . 2009-11-15 11:25 8192 d-----w- c:\programdata\Microsoft Help
    2009-12-09 22:20 . 2009-11-10 10:09 4096 d--h--w- c:\program files\installshield installation information
    2009-12-02 18:37 . 2009-11-10 13:02 4096 d-----w- c:\program files\McAfee
    2009-12-02 07:38 . 2009-11-10 12:36 4096 d-----w- c:\programdata\McAfee
    2009-11-29 00:02 . 2009-11-10 15:38 4096 d-----w- c:\program files\Vuze
    2009-11-17 00:24 . 2009-11-10 15:02 4096 d-----w- c:\programdata\Apple Computer
    2009-11-16 07:46 . 2009-11-10 10:04 63944 ----a-w- c:\users\Jacob\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-11-16 01:33 . 2009-11-15 11:27 4096 d-----w- c:\program files\Microsoft Works
    2009-11-15 12:14 . 2009-11-10 13:28 -------- d-----w- c:\program files\Microsoft
    2009-11-15 11:26 . 2009-11-15 11:26 -------- d-----w- c:\program files\Microsoft.NET
    2009-11-15 09:42 . 2009-11-15 09:42 -------- d-----w- c:\users\Jacob\AppData\Roaming\DivX
    2009-11-14 17:18 . 2009-11-14 17:18 -------- d-----w- c:\programdata\Hewlett-Packard
    2009-11-13 23:13 . 2009-11-13 23:13 -------- d-----w- c:\programdata\Messenger Plus!
    2009-11-13 00:30 . 2009-11-13 00:30 4096 d-----w- c:\program files\Messenger Plus! Live
    2009-11-12 22:39 . 2009-11-12 22:39 -------- d-----w- c:\programdata\FLEXnet
    2009-11-12 22:36 . 2009-11-10 14:41 8192 d-----w- c:\program files\Common Files\Adobe
    2009-11-12 22:35 . 2009-11-12 22:35 4096 d-----w- c:\program files\Adobe Media Player
    2009-11-12 22:35 . 2009-11-10 15:07 4096 d-----w- c:\users\Jacob\AppData\Roaming\Apple Computer
    2009-11-12 22:33 . 2009-11-12 22:33 -------- d-----w- c:\program files\Common Files\Adobe AIR
    2009-11-12 22:30 . 2009-11-12 22:30 -------- d-----w- c:\program files\Common Files\Macrovision Shared
    2009-11-11 07:53 . 2009-11-11 07:53 -------- d-----w- c:\users\Jacob\AppData\Roaming\Logitech
    2009-11-11 07:53 . 2009-11-11 07:52 -------- d-----w- c:\programdata\LogiShrd
    2009-11-11 07:53 . 2009-11-11 01:01 -------- d-----w- c:\programdata\Logitech
    2009-11-11 07:53 . 2009-11-11 07:53 -------- d-----w- c:\users\Jacob\AppData\Roaming\Leadertech
    2009-11-11 07:53 . 2009-11-11 07:51 4096 d-----w- c:\program files\Common Files\Logishrd
    2009-11-11 07:52 . 2009-11-11 07:52 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2009-11-11 07:52 . 2009-11-11 07:52 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2009-11-11 07:51 . 2009-11-11 01:01 -------- d-----w- c:\program files\Logitech
    2009-11-11 03:16 . 2009-11-10 13:30 4096 d-----w- c:\program files\Microsoft Silverlight
    2009-11-11 01:01 . 2009-11-11 01:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSBW_01_00_00.Wdf
    2009-11-11 01:01 . 2009-11-11 01:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf
    2009-11-11 01:00 . 2009-11-11 00:59 8192 d-----w- c:\program files\DivX
    2009-11-11 01:00 . 2009-11-11 01:00 4096 d-----w- c:\program files\Common Files\PX Storage Engine
    2009-11-11 00:59 . 2009-11-11 00:59 4096 d-----w- c:\program files\Common Files\DivX Shared
    2009-11-11 00:49 . 2009-11-10 10:53 -------- d-----w- c:\programdata\Creative
    2009-11-10 23:08 . 2009-11-10 23:08 -------- d-----w- c:\programdata\Smith Micro
    2009-11-10 23:08 . 2009-11-10 23:08 -------- d-----w- c:\program files\Smith Micro
    2009-11-10 17:27 . 2009-11-10 17:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
    2009-11-10 15:51 . 2009-11-10 15:05 4096 d-----w- c:\program files\iTunes
    2009-11-10 15:46 . 2009-11-10 15:46 -------- d-----w- c:\programdata\Azureus
    2009-11-10 15:06 . 2009-11-10 15:05 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-11-10 15:05 . 2009-11-10 15:05 -------- d-----w- c:\program files\iPod
    2009-11-10 15:05 . 2009-11-10 14:53 -------- d-----w- c:\program files\Common Files\Apple
    2009-11-10 15:04 . 2009-11-10 15:04 -------- d-----w- c:\program files\Bonjour
    2009-11-10 15:03 . 2009-11-10 15:02 4096 d-----w- c:\program files\QuickTime
    2009-11-10 15:01 . 2009-11-10 15:01 4096 d-----w- c:\program files\Apple Software Update
    2009-11-10 14:53 . 2009-11-10 14:53 -------- d-----w- c:\programdata\Apple
    2009-11-10 14:26 . 2009-11-10 14:33 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-11-10 14:25 . 2009-11-10 14:25 -------- d-----w- c:\program files\Java
    2009-11-10 13:30 . 2009-11-10 13:27 4096 d-----w- c:\program files\Windows Live
    2009-11-10 13:30 . 2009-11-10 13:30 -------- d-----w- c:\program files\Microsoft Sync Framework
    2009-11-10 13:28 . 2009-11-10 13:28 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
    2009-11-10 13:27 . 2009-11-10 13:27 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-11-10 13:06 . 2009-11-10 13:06 -------- d-----w- c:\programdata\SiteAdvisor
    2009-11-10 13:03 . 2009-11-10 13:03 4096 d-----w- c:\program files\Common Files\McAfee
    2009-11-10 13:03 . 2009-11-10 13:03 -------- d-----w- c:\program files\McAfee.com
    2009-11-10 12:38 . 2009-11-10 12:38 -------- d-----w- c:\program files\Common Files\Windows Live
    2009-11-10 10:55 . 2009-11-10 10:54 -------- d-----w- c:\program files\Creative
    2009-11-10 10:55 . 2009-11-10 10:55 -------- d-----w- c:\program files\Common Files\Creative Labs Shared
    2009-11-10 10:53 . 2009-11-10 10:53 444952 ----a-w- c:\windows\system32\wrap_oal.dll
    2009-11-10 10:53 . 2009-11-10 10:53 109080 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-11-10 10:53 . 2009-11-10 10:53 -------- d-----w- c:\program files\OpenAL
    2009-11-10 10:51 . 2009-11-10 10:51 -------- d-----w- c:\program files\Common Files\InstallShield
    2009-11-10 10:28 . 2009-11-10 10:28 -------- d-----w- c:\programdata\NVIDIA
    2009-11-10 10:09 . 2009-11-10 10:09 -------- d-----w- c:\program files\NETGEAR
    2009-11-10 10:09 . 2009-11-10 10:09 -------- d-----w- c:\programdata\NETGEAR
    2009-11-06 12:00 . 2009-11-06 12:00 23152 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-11-06 12:00 . 2009-11-06 12:00 176752 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-11-06 12:00 . 2009-11-06 12:00 29808 ----a-w- c:\windows\system32\drivers\ssfs0bbc.sys
    2009-11-02 20:42 . 2009-11-10 10:19 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-10-28 20:58 . 2009-10-28 20:58 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2009-10-02 04:06 . 2009-11-10 10:20 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2009-09-27 17:47 . 2009-09-27 17:47 2173544 ----a-w- c:\windows\system32\nvcplui.exe
    2009-09-27 17:47 . 2009-09-27 17:47 92776 ----a-w- c:\windows\system32\nvmctray.dll
    2009-09-27 17:47 . 2009-09-27 17:47 805480 ----a-w- c:\windows\system32\nvsvc.dll
    2009-09-27 17:47 . 2009-09-27 17:47 4033128 ----a-w- c:\windows\system32\nvvitvs.dll
    2009-09-27 17:47 . 2009-09-27 17:47 3553896 ----a-w- c:\windows\system32\nvgames.dll
    2009-09-27 17:47 . 2009-09-27 17:47 3172968 ----a-w- c:\windows\system32\nvwss.dll
    2009-09-27 17:47 . 2009-09-27 17:47 215656 ----a-w- c:\windows\system32\nvvsvc.exe
    2009-09-27 17:47 . 2009-09-27 17:47 195176 ----a-w- c:\windows\system32\nvmccss.dll
    2009-09-27 17:47 . 2009-09-27 17:47 150120 ----a-w- c:\windows\system32\nvshext.dll
    2009-09-27 17:47 . 2009-09-27 17:47 1309288 ----a-w- c:\windows\system32\nvsvs.dll
    2009-09-27 17:47 . 2009-09-27 17:47 1292904 ----a-w- c:\windows\system32\nvmobls.dll
    2009-09-27 17:46 . 2009-09-27 17:46 4942440 ----a-w- c:\windows\system32\nvdisps.dll
    2009-09-27 17:46 . 2009-09-27 17:46 13949544 ----a-w- c:\windows\system32\nvcpl.dll
    2009-09-25 16:41 . 2009-09-25 16:41 90112 ----a-w- c:\windows\system32\dpl100.dll
    2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
    2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
    2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
    2009-09-25 16:41 . 2009-09-25 16:41 843776 ----a-w- c:\windows\system32\divx_xx16.dll
    2009-09-25 16:41 . 2009-09-25 16:41 839680 ----a-w- c:\windows\system32\divx_xx11.dll
    2009-09-25 16:41 . 2009-09-25 16:41 696320 ----a-w- c:\windows\system32\DivX.dll
    2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
    2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-12-09_23.01.15 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-12-09 21:58 . 2009-11-19 07:08 64512 c:\windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7600.20579_none_1776fc29cc29780f\msfeedsbs.dll
    + 2009-12-09 21:58 . 2009-11-19 07:22 64512 c:\windows\winsxs\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7600.16466_none_16f52e6cb306704f\msfeedsbs.dll
    + 2009-11-10 10:42 . 2009-12-15 19:47 39812 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 04:55 . 2009-12-15 19:47 28862 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
    - 2009-11-10 10:20 . 2009-09-05 05:56 64512 c:\windows\System32\msfeedsbs.dll
    + 2009-12-09 21:58 . 2009-11-19 07:22 64512 c:\windows\System32\msfeedsbs.dll
    + 2009-11-10 14:17 . 2009-12-11 07:24 84507 c:\windows\System32\Macromed\Flash\uninstall_activeX.exe
    + 2009-07-13 23:11 . 2009-07-14 01:17 18432 c:\windows\System32\drivers\qeyognmm.sys
    + 2009-11-10 17:56 . 2009-12-15 19:48 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-11-10 17:56 . 2009-12-09 18:52 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-12-12 00:05 . 2009-12-14 02:58 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
    + 2009-07-14 04:41 . 2009-12-15 19:48 65536 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-12-11 19:25 . 2009-12-11 19:25 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
    - 2009-11-10 10:16 . 2009-12-09 18:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:34 . 2009-12-12 08:41 85688 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-10 10:16 . 2009-12-09 18:50 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-10 10:16 . 2009-12-09 18:50 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-11-10 10:16 . 2009-12-09 18:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-11-10 13:05 . 2009-12-15 19:46 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-10 13:05 . 2009-12-09 18:51 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-10 13:05 . 2009-12-09 18:51 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
    + 2009-11-10 13:05 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
    - 2009-11-10 13:05 . 2009-12-09 18:51 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
    + 2009-11-10 13:05 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-10 10:16 . 2009-12-09 18:51 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-10 10:16 . 2009-12-09 18:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-11-10 10:16 . 2009-12-15 19:46 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-11-15 11:27 . 2009-12-09 23:14 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
    + 2009-11-10 11:01 . 2009-12-15 19:47 8832 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1609264853-1248349222-2704753068-1000_UserData.bin
    + 2009-12-14 20:31 . 2009-12-15 20:37 4096 c:\windows\System32\config\systemprofile\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GKJGB23L\s.ytimg.com
    - 2009-12-09 18:50 . 2009-12-09 18:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2009-12-15 19:46 . 2009-12-15 19:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2009-12-09 18:50 . 2009-12-09 18:50 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-12-15 19:46 . 2009-12-15 19:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2009-07-14 02:05 . 2009-12-09 18:55 619206 c:\windows\System32\perfh009.dat
    + 2009-07-14 02:05 . 2009-12-15 20:06 619206 c:\windows\System32\perfh009.dat
    - 2009-07-14 02:05 . 2009-12-09 18:55 107388 c:\windows\System32\perfc009.dat
    + 2009-07-14 02:05 . 2009-12-15 20:06 107388 c:\windows\System32\perfc009.dat
    + 2009-10-28 03:31 . 2009-10-28 03:31 257440 c:\windows\System32\Macromed\Flash\FlashUtil10d.exe
    + 2009-11-10 10:05 . 2009-12-15 22:47 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    - 2009-11-10 10:05 . 2009-12-09 20:45 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
    + 2009-11-10 17:56 . 2009-12-15 19:48 180224 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-11-15 11:27 . 2009-12-01 23:10 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
    - 2009-11-15 11:27 . 2009-12-01 23:10 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
    + 2009-12-09 21:58 . 2009-11-19 07:08 5959168 c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.20579_none_2e6c1fbc1390ef66\mshtml.dll
    + 2009-12-09 21:58 . 2009-11-19 07:22 5958656 c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16466_none_2dea51fefa6de7a6\mshtml.dll
    - 2009-07-14 02:03 . 2009-12-09 21:57 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
    + 2009-07-14 02:03 . 2009-12-15 22:03 6815744 c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
    + 2009-12-09 21:58 . 2009-11-19 07:22 5958656 c:\windows\System32\mshtml.dll
    - 2009-11-10 22:30 . 2009-10-19 14:10 5958656 c:\windows\System32\mshtml.dll
    + 2009-07-14 04:34 . 2009-12-10 07:22 3897560 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    - 2009-07-14 04:34 . 2009-12-06 20:10 3897560 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2009-10-16 07:09 . 2009-10-16 07:09 2518016 c:\windows\Installer\f27b1d.msp
    - 2009-11-15 11:27 . 2009-12-01 23:10 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
    + 2009-11-15 11:27 . 2009-12-09 23:14 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
    + 2009-03-06 04:26 . 2009-03-06 04:26 5291376 c:\windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6425\IPEDITOR.DLL
    + 2009-11-10 10:44 . 2009-12-01 20:06 25966024 c:\windows\System32\MRT.exe
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
    @= "{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD} "
    [HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
    2009-11-06 15:14 238968 ----a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-11 813584]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2009-3-25 1724416]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 0 (0x0)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableLUA "= 0 (0x0)
    "EnableUIADesktopToggle "= 0 (0x0)
    "PromptOnSecureDesktop "= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2009-07-20 12:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2 "=wdmaud.drv

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
    @= "Service "

    R0 ssfs0bbc;ssfs0bbc;c:\windows\System32\drivers\ssfs0bbc.sys [06/11/2009 12:00 29808]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [01/10/2008 16:44 20384]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [02/12/2009 07:38 93320]
    R2 Stuffit Archive Name Service;Stuffit Archive Name Service;c:\program files\Smith Micro\StuffIt 2009\ArcNameService.exe [19/12/2008 09:28 199000]
    R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30/03/2009 16:28 1533808]
    R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [06/12/2009 12:19 1201640]
    R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.sys [04/06/2009 02:46 171032]
    R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.sys [04/06/2009 02:46 1324056]
    R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.sys [04/06/2009 02:46 72728]
    R3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNISP50.sys [16/11/2006 14:36 20480]
    R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\System32\drivers\LGBusEnum.sys [14/07/2009 15:35 19720]
    R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\System32\drivers\Ph3xIB32.sys [10/06/2009 21:16 1311232]
    R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\System32\drivers\WN111v2v.sys [13/01/2009 10:30 453120]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [15/11/2009 11:36 135664]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [10/11/2009 10:55 79360]
    S3 CT20XUT;CT20XUT;c:\windows\System32\drivers\CT20XUT.sys [04/06/2009 02:46 171032]
    S3 CTEXFIFX;CTEXFIFX;c:\windows\System32\drivers\CTEXFIFX.sys [04/06/2009 02:46 1324056]
    S3 CTHWIUT;CTHWIUT;c:\windows\System32\drivers\CTHWIUT.sys [04/06/2009 02:46 72728]
    S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNIMP50.sys [16/11/2006 14:36 21504]
    S3 fssfltr;fssfltr;c:\windows\System32\drivers\fssfltr.sys [10/11/2009 13:30 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [29/02/2008 02:07 942080]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-15 11:35]

    2009-12-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-15 11:35]

    2009-12-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-10 12:22]

    2009-12-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-10 12:22]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://news.bbc.co.uk/
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
    IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    .
    - - - - ORPHANS REMOVED - - - -

    AddRemove-NVIDIA Drivers - c:\windows\system32\nvuninst.exe UninstallGUI


    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'lsass.exe'(556)
    max++.00.x86 35670000 49152 \\74.117.114.86\max++.x86.dll
    c:\program files\Bonjour\mdnsNSP.dll

    - - - - - - - > 'Explorer.exe'(4476)
    c:\progra~1\mcafee\SITEAD~1\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    max++.00.x86 35670000 49152 \\74.117.114.86\max++.x86.dll
    c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
    c:\program files\Bonjour\mdnsNSP.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\ADFSMenu.dll
    c:\progra~1\Webroot\WEBROO~1\SSCtxMnu.dll
    c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
    c:\program files\Webroot\WebrootSecurity\Backup\SOSClientApi.dll
    c:\program files\Webroot\WebrootSecurity\Backup\SOSTools.dll
    c:\program files\Smith Micro\StuffIt 2009\SxShellExtEN.dll
    .
    Completion time: 2009-12-15 23:13
    ComboFix-quarantined-files.txt 2009-12-15 23:13
    ComboFix2.txt 2009-12-09 23:04

    Pre-Run: 91,075,072,000 bytes free
    Post-Run: 91,447,541,760 bytes free

    - - End Of File - - B45182C029DDC081C9CC44D9116C080A
     
    jakemt85,
    #8
  10. 2009/12/17
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Seems to have got a little worse, over the last couple of days the links have started to pop up in separate windows...
     
    jakemt85,
    #9
  11. 2009/12/17
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    New version of Combofix just came out.
    Please, delete your Combofix file and....

    Please download ComboFix from [color= "Red"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Please, never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE. If Combofix asks you to install Recovery Console, please allow it.

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!


    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #10
  12. 2009/12/19
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Hi Broni, thanks again for your help so far.

    Combofix Log:
    ComboFix 09-12-18.03 - Jacob 20/12/2009 1:18.3.4 - x86
    Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3327.2315 [GMT 0:00]
    Running from: c:\users\Jacob\Desktop\KittyFix.exe
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Cursors\aero_link.cur

    Infected copy of c:\windows\system32\DRIVERS\nvstor.sys was found and disinfected
    Restored copy from - Kitty ate it :p
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_wercplsupport


    ((((((((((((((((((((((((( Files Created from 2009-11-20 to 2009-12-20 )))))))))))))))))))))))))))))))
    .

    2009-12-20 01:28 . 2009-12-20 01:31 -------- d-----w- c:\users\Jacob\AppData\Local\temp
    2009-12-20 01:28 . 2009-12-20 01:28 -------- d-----w- c:\users\Public\AppData\Local\temp
    2009-12-20 01:28 . 2009-12-20 01:28 -------- d-----w- c:\users\Default\AppData\Local\temp
    2009-12-12 08:29 . 2009-12-13 22:05 -------- d-----w- C:\HJT
    2009-12-11 23:00 . 2009-12-12 08:24 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-11 23:00 . 2009-12-12 08:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2009-12-10 21:17 . 2009-12-10 21:17 -------- d-----w- c:\program files\AVG
    2009-12-10 21:16 . 2009-12-11 07:26 -------- d-----w- c:\programdata\avg9
    2009-12-09 23:20 . 2009-12-09 23:20 -------- d-----w- c:\users\Jacob\DoctorWeb
    2009-12-08 23:43 . 2009-12-08 23:43 13952 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2009-12-08 23:43 . 2009-12-08 23:43 -------- d-----w- c:\programdata\Hitman Pro
    2009-12-08 23:43 . 2009-12-08 23:43 -------- d-----w- c:\program files\Hitman Pro 3.5
    2009-12-08 19:43 . 2009-12-08 19:43 -------- d-----w- c:\users\Jacob\AppData\Roaming\Malwarebytes
    2009-12-08 19:43 . 2009-12-08 19:43 -------- d-----w- c:\programdata\Malwarebytes
    2009-12-08 19:25 . 2009-12-08 19:25 -------- d-----w- c:\program files\Trend Micro
    2009-12-06 15:46 . 2009-12-06 15:46 -------- d-----w- c:\program files\MSXML 4.0
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\program files\MSSOAP
    2009-12-06 12:18 . 2009-12-06 13:25 -------- d-----w- c:\programdata\Webroot
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\users\Jacob\AppData\Roaming\Webroot
    2009-12-06 12:18 . 2009-12-06 12:18 -------- d-----w- c:\program files\Webroot
    2009-12-06 12:18 . 2009-11-06 15:19 1563008 ----a-w- c:\windows\WRSetup.dll
    2009-12-06 12:10 . 2009-12-06 12:10 164 ----a-w- c:\windows\install.dat
    2009-12-05 17:04 . 2009-12-05 17:04 -------- d-----w- c:\windows\Sun
    2009-12-02 22:36 . 2009-12-02 22:36 -------- d-----w- c:\users\Jacob\AppData\Local\ElevatedDiagnostics
    2009-12-01 23:55 . 2009-12-01 23:55 -------- d-----w- c:\programdata\Office Genuine Advantage
    2009-12-01 23:55 . 2009-12-01 23:55 -------- d-----w- c:\users\Jacob\Office Genuine Advantage
    2009-11-29 00:19 . 2009-12-15 21:01 -------- d-----w- c:\users\Jacob\AppData\Roaming\vlc
    2009-11-29 00:18 . 2009-11-29 00:18 -------- d-----w- c:\program files\VideoLAN
    2009-11-25 03:00 . 2009-10-29 07:22 2048 ----a-w- c:\windows\system32\tzres.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-20 01:10 . 2009-11-10 15:45 -------- d-----w- c:\users\Jacob\AppData\Roaming\Azureus
    2009-12-19 13:09 . 2009-11-10 15:38 -------- d-----w- c:\program files\Vuze
    2009-12-17 21:35 . 2009-11-10 13:02 -------- d-----w- c:\program files\McAfee
    2009-12-13 02:09 . 2009-11-15 11:35 -------- d-----w- c:\program files\Google
    2009-12-10 01:27 . 2009-06-10 21:19 142416 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2009-12-09 23:14 . 2009-11-15 11:25 -------- d-----w- c:\programdata\Microsoft Help
    2009-12-09 22:20 . 2009-11-10 10:09 -------- d--h--w- c:\program files\installshield installation information
    2009-12-09 22:16 . 2009-11-17 22:12 -------- d-----w- c:\programdata\CyberLink
    2009-12-09 22:03 . 2009-11-17 22:09 53319 ----a-w- c:\programdata\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe
    2009-12-02 07:38 . 2009-11-10 12:36 -------- d-----w- c:\programdata\McAfee
    2009-11-21 10:47 . 2009-11-21 10:47 175 ----a-w- c:\users\Jacob\AppData\Roaming\Azureus\restart.bat
    2009-11-17 22:14 . 2009-11-17 22:13 -------- d-----w- c:\users\Jacob\AppData\Roaming\CyberLink
    2009-11-17 22:12 . 2009-11-17 22:12 -------- d-----w- c:\program files\Common Files\CyberLink
    2009-11-17 22:09 . 2009-11-17 22:10 505128 ----a-w- c:\windows\system32\msvcp71.dll
    2009-11-17 22:09 . 2009-11-17 22:10 353576 ----a-w- c:\windows\system32\msvcr71.dll
    2009-11-17 22:09 . 2009-11-17 22:10 29480 ----a-w- c:\windows\system32\msxml3a.dll
    2009-11-17 00:24 . 2009-11-10 15:02 -------- d-----w- c:\programdata\Apple Computer
    2009-11-16 07:46 . 2009-11-10 10:04 63944 ----a-w- c:\users\Jacob\AppData\Local\GDIPFONTCACHEV1.DAT
    2009-11-16 01:33 . 2009-11-15 11:27 -------- d-----w- c:\program files\Microsoft Works
    2009-11-15 12:14 . 2009-11-10 13:28 -------- d-----w- c:\program files\Microsoft
    2009-11-15 11:26 . 2009-11-15 11:26 -------- d-----w- c:\program files\Microsoft.NET
    2009-11-15 09:42 . 2009-11-15 09:42 -------- d-----w- c:\users\Jacob\AppData\Roaming\DivX
    2009-11-14 17:18 . 2009-11-14 17:18 -------- d-----w- c:\programdata\Hewlett-Packard
    2009-11-13 23:13 . 2009-11-13 23:13 -------- d-----w- c:\programdata\Messenger Plus!
    2009-11-13 00:30 . 2009-11-13 00:30 -------- d-----w- c:\program files\Messenger Plus! Live
    2009-11-12 22:39 . 2009-11-12 22:39 -------- d-----w- c:\programdata\FLEXnet
    2009-11-12 22:36 . 2009-11-10 14:41 -------- d-----w- c:\program files\Common Files\Adobe
    2009-11-12 22:35 . 2009-11-12 22:35 -------- d-----w- c:\program files\Adobe Media Player
    2009-11-12 22:35 . 2009-11-10 15:07 -------- d-----w- c:\users\Jacob\AppData\Roaming\Apple Computer
    2009-11-12 22:33 . 2009-11-12 22:33 -------- d-----w- c:\program files\Common Files\Adobe AIR
    2009-11-12 22:30 . 2009-11-12 22:30 -------- d-----w- c:\program files\Common Files\Macrovision Shared
    2009-11-11 07:53 . 2009-11-11 07:53 -------- d-----w- c:\users\Jacob\AppData\Roaming\Logitech
    2009-11-11 07:53 . 2009-11-11 07:52 -------- d-----w- c:\programdata\LogiShrd
    2009-11-11 07:53 . 2009-11-11 01:01 -------- d-----w- c:\programdata\Logitech
    2009-11-11 07:53 . 2009-11-11 07:53 -------- d-----w- c:\users\Jacob\AppData\Roaming\Leadertech
    2009-11-11 07:53 . 2009-11-11 07:51 -------- d-----w- c:\program files\Common Files\Logishrd
    2009-11-11 07:52 . 2009-11-11 07:52 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2009-11-11 07:52 . 2009-11-11 07:52 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2009-11-11 07:51 . 2009-11-11 01:01 -------- d-----w- c:\program files\Logitech
    2009-11-11 03:16 . 2009-11-10 13:30 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-11-11 01:01 . 2009-11-11 01:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSBW_01_00_00.Wdf
    2009-11-11 01:01 . 2009-11-11 01:01 0 ---ha-w- c:\windows\system32\drivers\Msft_User_lgSSQVGA_01_00_00.Wdf
    2009-11-11 01:00 . 2009-11-11 00:59 -------- d-----w- c:\program files\DivX
    2009-11-11 01:00 . 2009-11-11 01:00 -------- d-----w- c:\program files\Common Files\PX Storage Engine
    2009-11-11 00:59 . 2009-11-11 00:59 -------- d-----w- c:\program files\Common Files\DivX Shared
    2009-11-11 00:49 . 2009-11-10 10:53 -------- d-----w- c:\programdata\Creative
    2009-11-10 23:08 . 2009-11-10 23:08 -------- d-----w- c:\programdata\Smith Micro
    2009-11-10 23:08 . 2009-11-10 23:08 -------- d-----w- c:\program files\Smith Micro
    2009-11-10 17:27 . 2009-11-10 17:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
    2009-11-10 15:51 . 2009-11-10 15:05 -------- d-----w- c:\program files\iTunes
    2009-11-10 15:46 . 2009-11-10 15:46 -------- d-----w- c:\programdata\Azureus
    2009-11-10 15:06 . 2009-11-10 15:05 -------- d-----w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-11-10 15:05 . 2009-11-10 15:05 -------- d-----w- c:\program files\iPod
    2009-11-10 15:05 . 2009-11-10 14:53 -------- d-----w- c:\program files\Common Files\Apple
    2009-11-10 15:04 . 2009-11-10 15:04 -------- d-----w- c:\program files\Bonjour
    2009-11-10 15:03 . 2009-11-10 15:02 -------- d-----w- c:\program files\QuickTime
    2009-11-10 15:01 . 2009-11-10 15:01 -------- d-----w- c:\program files\Apple Software Update
    2009-11-10 14:53 . 2009-11-10 14:53 -------- d-----w- c:\programdata\Apple
    2009-11-10 14:26 . 2009-11-10 14:33 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-11-10 14:25 . 2009-11-10 14:25 -------- d-----w- c:\program files\Java
    2009-11-10 13:30 . 2009-11-10 13:27 -------- d-----w- c:\program files\Windows Live
    2009-11-10 13:30 . 2009-11-10 13:30 -------- d-----w- c:\program files\Microsoft Sync Framework
    2009-11-10 13:28 . 2009-11-10 13:28 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
    2009-11-10 13:27 . 2009-11-10 13:27 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-11-10 13:06 . 2009-11-10 13:06 -------- d-----w- c:\programdata\SiteAdvisor
    2009-11-10 13:03 . 2009-11-10 13:03 -------- d-----w- c:\program files\Common Files\McAfee
    2009-11-10 13:03 . 2009-11-10 13:03 -------- d-----w- c:\program files\McAfee.com
    2009-11-10 12:38 . 2009-11-10 12:38 -------- d-----w- c:\program files\Common Files\Windows Live
    2009-11-10 10:55 . 2009-11-10 10:54 -------- d-----w- c:\program files\Creative
    2009-11-10 10:55 . 2009-11-10 10:55 -------- d-----w- c:\program files\Common Files\Creative Labs Shared
    2009-11-10 10:53 . 2009-11-10 10:53 444952 ----a-w- c:\windows\system32\wrap_oal.dll
    2009-11-10 10:53 . 2009-11-10 10:53 109080 ----a-w- c:\windows\system32\OpenAL32.dll
    2009-11-10 10:53 . 2009-11-10 10:53 -------- d-----w- c:\program files\OpenAL
    2009-11-10 10:51 . 2009-11-10 10:51 -------- d-----w- c:\program files\Common Files\InstallShield
    2009-11-10 10:28 . 2009-11-10 10:28 -------- d-----w- c:\programdata\NVIDIA
    2009-11-10 10:09 . 2009-11-10 10:09 -------- d-----w- c:\program files\NETGEAR
    2009-11-10 10:09 . 2009-11-10 10:09 -------- d-----w- c:\programdata\NETGEAR
    2009-11-06 12:00 . 2009-11-06 12:00 23152 ----a-w- c:\windows\system32\drivers\sshrmd.sys
    2009-11-06 12:00 . 2009-11-06 12:00 176752 ----a-w- c:\windows\system32\drivers\ssidrv.sys
    2009-11-06 12:00 . 2009-11-06 12:00 29808 ----a-w- c:\windows\system32\drivers\ssfs0bbc.sys
    2009-11-02 20:42 . 2009-11-10 10:19 195456 ------w- c:\windows\system32\MpSigStub.exe
    2009-10-28 20:58 . 2009-10-28 20:58 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    2009-10-02 04:06 . 2009-11-10 10:20 728648 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2009-09-27 17:47 . 2009-09-27 17:47 2173544 ----a-w- c:\windows\system32\nvcplui.exe
    2009-09-27 17:47 . 2009-09-27 17:47 92776 ----a-w- c:\windows\system32\nvmctray.dll
    2009-09-27 17:47 . 2009-09-27 17:47 805480 ----a-w- c:\windows\system32\nvsvc.dll
    2009-09-27 17:47 . 2009-09-27 17:47 4033128 ----a-w- c:\windows\system32\nvvitvs.dll
    2009-09-27 17:47 . 2009-09-27 17:47 3553896 ----a-w- c:\windows\system32\nvgames.dll
    2009-09-27 17:47 . 2009-09-27 17:47 3172968 ----a-w- c:\windows\system32\nvwss.dll
    2009-09-27 17:47 . 2009-09-27 17:47 215656 ----a-w- c:\windows\system32\nvvsvc.exe
    2009-09-27 17:47 . 2009-09-27 17:47 195176 ----a-w- c:\windows\system32\nvmccss.dll
    2009-09-27 17:47 . 2009-09-27 17:47 150120 ----a-w- c:\windows\system32\nvshext.dll
    2009-09-27 17:47 . 2009-09-27 17:47 1309288 ----a-w- c:\windows\system32\nvsvs.dll
    2009-09-27 17:47 . 2009-09-27 17:47 1292904 ----a-w- c:\windows\system32\nvmobls.dll
    2009-09-27 17:46 . 2009-09-27 17:46 4942440 ----a-w- c:\windows\system32\nvdisps.dll
    2009-09-27 17:46 . 2009-09-27 17:46 13949544 ----a-w- c:\windows\system32\nvcpl.dll
    2009-09-25 16:41 . 2009-09-25 16:41 90112 ----a-w- c:\windows\system32\dpl100.dll
    2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
    2009-09-25 16:41 . 2009-09-25 16:41 856064 ----a-w- c:\windows\system32\divx_xx07.dll
    2009-09-25 16:41 . 2009-09-25 16:41 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
    2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
    2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
    @= "{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD} "
    [HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
    2009-11-06 15:14 238968 ----a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-11-11 813584]
    NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111v2.exe [2009-3-25 1724416]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 0 (0x0)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableLUA "= 0 (0x0)
    "EnableUIADesktopToggle "= 0 (0x0)
    "PromptOnSecureDesktop "= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2009-07-20 12:28 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer2 "=wdmaud.drv

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=" "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
    @= "Service "

    R0 ssfs0bbc;ssfs0bbc;c:\windows\System32\drivers\ssfs0bbc.sys [06/11/2009 12:00 29808]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [01/10/2008 16:44 20384]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [17/12/2009 21:35 93320]
    R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [06/12/2009 12:19 1201640]
    R3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.sys [04/06/2009 02:46 171032]
    R3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.sys [04/06/2009 02:46 1324056]
    R3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.sys [04/06/2009 02:46 72728]
    R3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNISP50.sys [16/11/2006 14:36 20480]
    R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\System32\drivers\LGBusEnum.sys [14/07/2009 15:35 19720]
    R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\System32\drivers\Ph3xIB32.sys [10/06/2009 21:16 1311232]
    R3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\System32\drivers\WN111v2v.sys [13/01/2009 10:30 453120]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [15/11/2009 11:36 135664]
    S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [10/11/2009 10:55 79360]
    S3 CT20XUT;CT20XUT;c:\windows\System32\drivers\CT20XUT.sys [04/06/2009 02:46 171032]
    S3 CTEXFIFX;CTEXFIFX;c:\windows\System32\drivers\CTEXFIFX.sys [04/06/2009 02:46 1324056]
    S3 CTHWIUT;CTHWIUT;c:\windows\System32\drivers\CTHWIUT.sys [04/06/2009 02:46 72728]
    S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNIMP50.sys [16/11/2006 14:36 21504]
    S3 fssfltr;fssfltr;c:\windows\System32\drivers\fssfltr.sys [10/11/2009 13:30 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
    S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [29/02/2008 02:07 942080]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    AeLookupSvc
    CertPropSvc
    SCPolicySvc
    lanmanserver
    gpsvc
    IKEEXT
    AudioSrv
    FastUserSwitchingCompatibility
    Irmon
    Nla
    Ntmssvc
    NWCWorkstation
    Nwsapagent
    Rasauto
    Rasman
    Remoteaccess
    SENS
    Sharedaccess
    SRService
    Tapisrv
    Wmi
    WmdmPmSp
    TermService
    wuauserv
    BITS
    ShellHWDetection
    LogonHours
    PCAudit
    helpsvc
    uploadmgr
    iphlpsvc
    seclogon
    AppInfo
    msiscsi
    MMCSS
    EapHost
    ProfSvc
    schedule
    hkmsvc
    SessionEnv
    winmgmt
    browser
    Themes
    AppMgmt
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://news.bbc.co.uk/
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://uk.search.yahoo.com/search?fr=mcafee&p=%s
    IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'Explorer.exe'(5092)
    c:\progra~1\mcafee\SITEAD~1\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvvsvc.exe
    c:\program files\Creative\Shared Files\CTAudSvc.exe
    c:\windows\system32\WUDFHost.exe
    c:\windows\system32\nvvsvc.exe
    c:\windows\system32\WUDFHost.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    c:\windows\system32\rundll32.exe
    c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
    c:\program files\McAfee\MPF\MPFSrv.exe
    c:\program files\McAfee\MSK\MskSrver.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Smith Micro\StuffIt 2009\ArcNameService.exe
    c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
    c:\windows\system32\taskhost.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\windows\system32\conhost.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\program files\Windows Media Player\WMPSideShowGadget.exe
    c:\program files\Windows Media Player\wmplayer.exe
    c:\progra~1\McAfee\MSC\mcmscsvc.exe
    c:\windows\system32\WUDFHost.exe
    c:\progra~1\mcafee.com\agent\mcagent.exe
    c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    c:\windows\system32\taskhost.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\windows\system32\DllHost.exe
    c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\windows\system32\sppsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2009-12-20 01:37:15 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-12-20 01:37
    ComboFix2.txt 2009-12-15 23:13
    ComboFix3.txt 2009-12-09 23:04

    Pre-Run: 89,980,153,856 bytes free
    Post-Run: 89,886,900,224 bytes free

    - - End Of File - - C28E7080ECE800892B05C8B02DE5D66D

    Hijack This Log:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 01:37:29, on 20/12/2009
    Platform: Unknown Windows (WinNT 6.01.3504)
    MSIE: Internet Explorer v8.00 (8.00.7600.16385)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\Explorer.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\notepad.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt 2009\ArcNameService.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
    O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

    --
    End of file - 6000 bytes
     
    jakemt85,
    #11
  13. 2009/12/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    How is redirection?
     
    broni,
    #12
  14. 2009/12/21
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    So far no sign of it! Thank you!!!
     
    jakemt85,
    #13
  15. 2009/12/21
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very good :)

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start> "Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall "
    Restart computer.

    ===============================================================

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #14
  16. 2009/12/30
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Sorry I was away. Here they are:
    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 12/30/2009 at 06:34 PM

    Application Version : 4.32.1000

    Core Rules Database Version : 4421
    Trace Rules Database Version: 2247

    Scan type : Complete Scan
    Total Scan Time : 00:15:28

    Memory items scanned : 383
    Memory threats detected : 0
    Registry items scanned : 7590
    Registry threats detected : 0
    File items scanned : 20501
    File threats detected : 257

    Adware.Tracking Cookie
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ero-advertising[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@mnstat[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@careersadvice-findacourse1.direct.gov[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@malesexhouse.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@content.yieldmanager[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@uknakedmen[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adultfriendfinder[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@questionmarket[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.googleadservices[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@pornforpatric[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@247realmedia[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@bs.serving-sys[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ad.yieldmanager[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@himedia.individuad[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@counter14.sextracker[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@myroitracking[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@uk.at.atwola[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads2.ljworld[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@tradedoubler[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@timeinc.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@media6degrees[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@chitika[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adtech[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@d.mediaforceads[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@thomsonebiz.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@f.blogads[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@revsci[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@server.iad.liveperson[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@photobox.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.fulldls[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.googleadservices[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@stats.paypal[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@at.atwola[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@serving.xxxwebtraffic[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@paypal.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@doubleclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@serving-sys[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@eas.apm.emediate[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@msnportal.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adultadworld[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@clicktorrent[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.smartadserver[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.infinisource[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@mediaplex[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@cyberwarez[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@find-dvd.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@kontera[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@gay.pornbb[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.ad4game[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.telegraph.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@hotcourses.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.netrition[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@uk.sitestat[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads2.net-communities.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@atdmt[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@gayboyporn.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.techguy[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@statcounter[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@smartadserver[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adxpose[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@apmebf[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@advertising[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@pointroll[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adbrite[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@clicks.smartbizsearch[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.gameaccount[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@collective-media[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@gaybarcelonaporn3.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@advertstream[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@tribalfusion[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@imagepixxx.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@zedo[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.uknakedmen[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.audxch[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.find-dvd.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.googleadservices[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@highbeam.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@media.photobucket[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@fastclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@e-2dj6whlounc5gbo.stats.esomniture[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads2.qsoft.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.ookla[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www3.smartadserver[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@rambler[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ehg-tfl.hitbox[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adserver.adtechus[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@anpost.screenclick[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@uk.findstuff[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@rts.pgmediaserve[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.pornbb[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@openstat[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ice.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@bridge1.admarketplace[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adulttraffic[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@dmtracker[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@queerclick[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.pornforpatric[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@imrworldwide[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@g.blogads[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@cyberwarez[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@server.iad.liveperson[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@m1.webstats.motigo[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.burstnet[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@clicksor[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@tacoda[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@insightexpressai[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@sextracker[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@statse.webtrendslive[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@pro-market[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@yadro[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@bs.serving-sys[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@hitbox[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@avgtechnologies.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@hermaphroditeendormi.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@feed.validclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@nl.sitestat[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@thegay-pornblog.blogspot[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.pugetsoundsoftware[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adcentriconline[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adserver.aol[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ad.zanox[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.bootcampmedia[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.jizzflixxx[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@a.clickclicknetwork[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.queerclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.pointroll[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@content.yieldmanager[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@questionpro[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@overture[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@fr.sitestat[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.bleepingcomputer[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@specificclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@trafficmp[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ad2.doublepimp[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@casalemedia[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@xiti[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adviva[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@amazonms.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@clickshift[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ww57.smartadserver[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@spylog[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@cdn5.specificclick[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.clash-media[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ehg-logantod.hitbox[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@screenclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@burstnet[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@eyewonder[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@azjmp[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@aimfar.solution.weborama[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@t.pointroll[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@stat.dealtime[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@server.lon.liveperson[3].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@server.lon.liveperson[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@stats2.clicktracks[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@weborama[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@rts.pgmediaserve[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adviva[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@eas.apm.emediate[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@content.yieldmanager[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@serving.xxxwebtraffic[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@www.partypoker[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ero-advertising[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adtech[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@mediaplex[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@media6degrees[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@revsci[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@questionmarket[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@partyaccount[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@secure.partyaccount[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@partypoker[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@uk.at.atwola[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@cdn5.specificclick[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@ads.infinisource[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@adbrite[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@clicksor[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\jacob@gay.pornbb[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@112.2o7[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www.pornbb[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@pornolab[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@gayboyporn.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@eas.apm.emediate[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www5.addfreestats[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@malesexhouse.blogspot[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@clicktorrent[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@kontera[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@microsoftsto.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www.warez-max[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@serving.xxxwebtraffic[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@fastclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@myroitracking[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.techguy[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@microsoftwindows.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@menofporn.typepad[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@gay.pornbb[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@find-book.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@m1.webstats.motigo[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www.pornforpatric[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@thesexdenmedia.blogspot[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@premiumtv.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@revsci[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@interclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@find-dvd.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ascentmedia[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@adxpose[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ero-advertising[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www.find-dvd.co[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@www.queerclick[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads2.qsoft.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.ad4game[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@insightexpressai[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@hearstugo.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@winzip.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@microsoftinternetexplorer.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@chitika[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@collective-media[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.jobsite.co[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@f.blogads[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@divx.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.undertone[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@sonyeurope.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@a.clickclicknetwork[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@livenation.122.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@adbrite[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.bootcampmedia[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@ads.fulldls[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@adserver.adtechus[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@adultadworld[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@clicksor[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@media.photobucket[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@media6degrees[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@msnportal.112.2o7[1].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@pornforpatric[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@queerclick[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@smartadserver[2].txt
    C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Cookies\Low\jacob@timeinc.122.2o7[1].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@stat.dealtime[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@overture[1].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[3].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@clickpayz2.91462.blueseek[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@findit-quick[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@findology[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[4].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[3].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@zedo[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@zedo[4].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@zedo[1].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[2].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[3].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[1].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@www.findit-quick[1].txt
    C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@track.getjiggie[1].txt

    Malwarebytes' Anti-Malware 1.42
    Database version: 3456
    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    30/12/2009 19:50:09
    mbam-log-2009-12-30 (19-50-09).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 226867
    Time elapsed: 51 minute(s), 31 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\ProgramData\McAfee\MCLOGS\McInst\mpfLD.inf000.log (Rootkit.Agent) -> Quarantined and deleted successfully.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:53:06, on 30/12/2009
    Platform: Unknown Windows (WinNT 6.01.3504)
    MSIE: Internet Explorer v8.00 (8.00.7600.16385)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: NETGEAR WN111v2 Smart Wizard.lnk = C:\Program Files\NETGEAR\WN111v2\WN111v2.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: Stuffit Archive Name Service - Smith Micro Software, Inc. - C:\Program Files\Smith Micro\StuffIt 2009\ArcNameService.exe
    O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
    O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

    --
    End of file - 6271 bytes
     
    jakemt85,
    #15
  17. 2009/12/30
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Your computer is clean :)

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.

    2. Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    3. Restart computer.

    4. Turn System Restore on.

    5. Make sure, Windows Updates are current.

    [SIZE= "4"]6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

    7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    8. Run defrag at your convenience.

    9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    10. Please, let me know, how is your computer doing.
     
    broni,
    #16
  18. 2009/12/30
    jakemt85

    jakemt85 Inactive Thread Starter

    Joined:
    2009/12/12
    Messages:
    10
    Likes Received:
    0
    Thank you again for taking the time to help me Broni! :)
     
    jakemt85,
    #17
  19. 2009/12/30
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're very welcome :)
    Happy New Year :)
     
    broni,
    #18
  20. 2009/12/30
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're very welcome :)
    Happy New Year :)
     
    broni,
    #19

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...