We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide

Virus? Google search not going where it should

24

Comments

  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    After youve followed the rest of the instructions you really need to run COMBOFIX as browntoa has posted
    :idea:
  • ABARKIE
    ABARKIE Posts: 191 Forumite
    Part of the Furniture 100 Posts
    Hi,

    Ran Combo Fix

    Do I need to post log?

    Thanks
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    yes ~ post the WHOLE of the log (Split into sections if need be)

    have you run hostsXpert and spybot too?
    :idea:
  • ABARKIE
    ABARKIE Posts: 191 Forumite
    Part of the Furniture 100 Posts
    Hi,

    Not ran Hosts & Spybot

    Log below

    Thanks

    ComboFix 09-11-07.03 - ALAN B 08/11/2009 14:38.1.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1013.433 [GMT 0:00]
    Running from: c:\documents and settings\ALAN B\Desktop\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\ALAN B\Application Data\020000003fd457ab665C.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab665O.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab665P.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab665S.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab691C.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab691O.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab691P.manifest
    c:\documents and settings\ALAN B\Application Data\020000003fd457ab691S.manifest
    c:\recycler\S-1-5-21-2032476989-1719147997-232525545-1003
    c:\recycler\S-1-5-21-2503354670-1791699941-3916209463-1003
    c:\recycler\S-1-5-21-3082976988-452476368-555577705-1003
    c:\recycler\S-1-5-21-881928563-739989086-344691524-1003
    c:\windows\system32\1SjO8.vbs
    c:\windows\system32\1XMyVsP.vbs
    c:\windows\system32\2sOPIByoewI75Li.vbs
    c:\windows\system32\6JW4idRY77LxXfd.vbs
    c:\windows\system32\A5bne.vbs
    c:\windows\system32\c6mVNgVkEwmn6Cy.vbs
    c:\windows\system32\ebu2L.vbs
    c:\windows\system32\ki81WN7WBYXgyXl.vbs
    c:\windows\system32\MzybI.vbs
    c:\windows\system32\queLOUm.vbs
    c:\windows\system32\rucMBTp.vbs
    c:\windows\system32\S8oCLZZQEDVrK.vbs
    c:\windows\system32\scoDlndG7sGqv.vbs
    c:\windows\system32\sm20tzW.vbs
    c:\windows\system32\winitn.dll

    .
    ((((((((((((((((((((((((( Files Created from 2009-10-08 to 2009-11-08 )))))))))))))))))))))))))))))))
    .

    2009-11-08 14:08 . 2009-11-08 14:08
    d
    w- c:\program files\CCleaner
    2009-11-07 14:31 . 2009-11-07 14:31 152576 ----a-w- c:\documents and settings\ALAN B\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-06 23:39 . 2009-11-06 23:39
    d
    w- c:\documents and settings\ALAN B\Application Data\Malwarebytes
    2009-11-06 23:39 . 2009-09-10 14:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-11-06 23:39 . 2009-11-06 23:39
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-11-06 23:39 . 2009-09-10 14:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-11-06 23:39 . 2009-11-06 23:39
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-11-05 19:31 . 2009-07-28 16:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2009-11-05 19:31 . 2009-03-30 10:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2009-11-05 19:31 . 2009-02-13 12:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2009-11-05 19:31 . 2009-02-13 12:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2009-11-05 19:31 . 2009-11-05 19:31
    d
    w- c:\program files\Avira
    2009-11-05 19:31 . 2009-11-05 19:31
    d
    w- c:\documents and settings\All Users\Application Data\Avira
    2009-10-30 08:39 . 2009-10-26 10:21 94208 ----a-w- c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
    2009-10-30 08:39 . 2009-10-26 10:21 50176 ----a-w- c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
    2009-10-22 21:32 . 2009-10-22 21:32 61 ----a-w- c:\windows\system32\stsf.bat
    2009-10-22 21:02 . 2009-10-22 21:02 90112 ----a-w- c:\windows\system32\agsaami.dll
    2009-10-22 21:02 . 2009-10-22 21:02 610304 ----a-w- c:\windows\system32\agsaamg.dll
    2009-10-22 21:02 . 2009-10-22 21:02 2535424 ----a-w- c:\windows\system32\agsaamj.dll
    2009-10-22 21:02 . 2009-10-22 21:02 372736 ----a-w- c:\windows\system32\agsaamc.dll
    2009-10-22 21:02 . 2009-10-22 21:02 53760 ----a-w- c:\windows\system\ppacklib.dll
    2009-10-22 21:02 . 2005-06-21 16:48 1 ----a-w- c:\windows\sslzdlt.dll
    2009-10-22 21:02 . 2002-01-05 10:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
    2009-10-22 21:02 . 2002-01-05 04:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
    2009-10-22 21:02 . 2002-01-05 05:48 974848 ----a-w- c:\windows\system32\mfc70.dll
    2009-10-22 21:02 . 2003-08-07 14:01 237568 ----a-w- c:\windows\system32\lame_enc.dll
    2009-10-22 21:01 . 2009-10-22 21:01
    d
    w- c:\program files\AML Products
    2009-10-17 08:30 . 2009-10-17 08:30
    d
    w- c:\documents and settings\ALAN B\Local Settings\Application Data\PCHealth

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-11-08 12:02 . 2009-09-06 08:30
    d
    w- c:\documents and settings\ALAN B\Application Data\FrostWire
    2009-11-07 14:32 . 2008-05-26 11:38
    d
    w- c:\program files\Java
    2009-11-06 22:35 . 2009-05-17 19:14
    d
    w- c:\program files\SUPERAntiSpyware
    2009-11-05 23:29 . 2009-07-24 21:36
    d
    w- c:\program files\COMODO
    2009-11-03 20:57 . 2009-04-21 22:33
    d
    w- c:\program files\ProgDVB
    2009-11-03 07:28 . 2009-03-21 11:03 1 ----a-w- c:\documents and settings\ALAN B\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2009-10-24 19:41 . 2009-08-09 19:26
    d
    w- c:\documents and settings\ALAN B\Application Data\FileZilla
    2009-10-16 07:41 . 2009-09-03 05:58
    d
    w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-10-11 04:17 . 2009-03-21 10:21 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-10-05 17:30 . 2009-03-21 12:43
    d
    w- c:\documents and settings\ALAN B\Application Data\uTorrent
    2009-09-11 16:30 . 2009-04-05 21:12
    d
    w- c:\program files\Microsoft Silverlight
    2009-09-11 14:18 . 2008-04-14 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-09-10 22:55 . 2009-09-10 22:55
    d
    w- c:\documents and settings\ALAN B\Application Data\Lexmark Productivity Studio
    2009-09-10 18:52 . 2009-07-25 08:23 493425 ----a-w- c:\windows\system32\drivers\sfi.dat
    2009-09-10 18:10 . 2009-05-17 19:16 117760 ----a-w- c:\documents and settings\ALAN B\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2009-09-06 08:47 . 2009-09-06 08:47 0 ----a-w- c:\documents and settings\ALAN B\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
    2009-09-06 08:32 . 2009-09-06 08:30 12588752 ----a-w- c:\documents and settings\ALAN B\Application Data\OpenCandy\pal_install_r83035.exe
    2009-09-04 21:03 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
    2009-09-03 18:02 . 2009-03-10 21:27 94976 ----a-w- c:\documents and settings\ALAN B\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-29 07:36 . 2008-04-14 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
    2009-08-29 07:36 . 2008-04-14 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-08-29 07:36 . 2008-04-14 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
    2009-08-27 23:12 . 2009-03-21 10:58 952 --sha-w- c:\windows\system32\KGyGaAvL.sys
    2009-08-26 08:00 . 2008-04-14 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
    2009-08-23 14:47 . 2009-08-23 14:47 152576 ----a-w- c:\documents and settings\ALAN B\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
    2009-08-17 22:33 . 2009-08-17 22:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-11 39408]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-10-15 2000112]
    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-11 1028096]
    "QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 83568]
    "UCam_Menu"="c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
    "LanguageShortcut"="c:\program files\HomeCinema\PowerDVD\Language\Language.exe" [2007-01-08 52256]
    "MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-06-10 782336]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-10 220160]
    "toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "lxdimon.exe"="c:\program files\Lexmark 3500-4500 Series\lxdimon.exe" [2007-07-16 434864]
    "lxdiamon"="c:\program files\Lexmark 3500-4500 Series\lxdiamon.exe" [2007-07-16 25264]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Mobile User VPN.lnk - c:\program files\WatchGuard\Mobile User VPN\SafeCfg.exe [2009-4-1 65588]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-06 08:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\system32\\fxsclnt.exe"=
    "c:\\Program Files\\NetMeeting\\Conf.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Documents and Settings\\ALAN B\\My Documents\\SATELLITE FOLDER\\dcc295\\DCC.exe"=
    "c:\\WINDOWS\\system32\\lxdicoms.exe"=
    "c:\\Program Files\\Lexmark 3500-4500 Series\\lxdimon.exe"=
    "c:\\Program Files\\Lexmark 3500-4500 Series\\App4R.exe"=
    "c:\\Program Files\\Lexmark 3500-4500 Series\\lxdiamon.exe"=
    "c:\\WINDOWS\\system32\\lxdicfg.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdipswx.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxditime.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdijswx.exe"=
    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\FrostWire\\FrostWire.exe"=
    "c:\\Program Files\\WatchGuard\\Mobile User VPN\\IreIKE.exe"=
    "c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe"= c:\program files\WatchGuard\Mobile User VPN\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog
    "c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe"= c:\program files\WatchGuard\Mobile User VPN\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp
    "c:\program files\WatchGuard\Mobile User VPN\vpn.exe"= c:\program files\WatchGuard\Mobile User VPN\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [17/02/2009 10:43 9968]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [17/02/2009 10:43 74480]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [05/11/2009 19:31 108289]
    R2 Crypto;Crypto;c:\windows\system32\drivers\Crypto.sys [01/04/2009 19:22 521786]
    R2 IPSECDRV;SafeNet IPSec Plugin;c:\windows\system32\drivers\IpSecDrv.sys [01/04/2009 19:22 119864]
    R2 lxdi_device;lxdi_device;c:\windows\system32\lxdicoms.exe -service --> c:\windows\system32\lxdicoms.exe -service [?]
    R3 DniVap;SafeNet WAN Miniport (VA);c:\windows\system32\drivers\vap.sys [01/04/2009 19:18 36188]
    R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [10/06/2008 10:36 156160]
    R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [26/05/2008 11:10 572416]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [17/02/2009 10:43 7408]
    S2 lxdiCATSCustConnectService;lxdiCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdiserv.exe [21/04/2009 22:05 99248]
    S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [10/06/2008 09:14 159744]
    S3 BGRaSvc;BGRaSvc;"c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe" --> c:\program files\BullGuard Software\BullGuard\support\bgrasvc.exe [?]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - MBR
    *NewlyCreated* - PROCEXP113
    *Deregistered* - mbr
    *Deregistered* - PROCEXP113
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.co.uk/
    mStart Page = hxxp://www.medion.com
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
    IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
    FF - ProfilePath - c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\
    FF - prefs.js: browser.search.selectedEngine - Yahoo.co.uk
    FF - component: c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
    FF - component: c:\documents and settings\ALAN B\Application Data\Mozilla\Firefox\Profiles\t8y4dtan.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-11-08 14:46
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
    "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

    [HKEY_LOCAL_MACHINE\software\Microsoft\Driver Signing]
    @Denied: (2) (Administrators)
    @Allowed: (2) (Administrators)
    "Policy"=hex:00,00,00,00

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    @DACL=(02 0000)
    "Installed"="1"
    @=""

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    @DACL=(02 0000)
    "NoChange"="1"
    "Installed"="1"
    @=""

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    @DACL=(02 0000)
    "Installed"="1"
    @=""
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(1092)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    .
    Completion time: 2009-11-08 14:48
    ComboFix-quarantined-files.txt 2009-11-08 14:48

    Pre-Run: 40,215,027,712 bytes free
    Post-Run: 40,669,032,448 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - C323823EA4E29B4E27882BB719C51BDD
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Well I really suggest you do run them
    Your hosts file has been changed (More than likely)
    :idea:
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    I can also tell you your computer is 'seriously' infected
    Your best option would be to format the drives and reinstall windows
    :idea:
  • ABARKIE
    ABARKIE Posts: 191 Forumite
    Part of the Furniture 100 Posts
    aliEnRIK wrote: »
    Your hosts file has been changed (More than likely)

    What does that mean please?
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    ABARKIE wrote: »
    What does that mean please?

    http://www.accs-net.com/hosts/what_is_hosts.html
    :idea:
  • ABARKIE
    ABARKIE Posts: 191 Forumite
    Part of the Furniture 100 Posts
    Hi,

    Ok, understand that.

    How can you tell my computer is seriusly infected?

    Thanks
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    ABARKIE wrote: »
    Hi,

    Ok, understand that.

    How can you tell my computer is seriusly infected?

    Thanks

    Because of some of the items that are running that are showing up in the combofix log
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 353.9K Banking & Borrowing
  • 254.3K Reduce Debt & Boost Income
  • 455.2K Spending & Discounts
  • 246.9K Work, Benefits & Business
  • 603.5K Mortgages, Homes & Bills
  • 178.3K Life & Family
  • 261K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture