We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide

Hi Can someone please look at these logs?

245

Comments

  • Taffyscot
    Taffyscot Posts: 896 Forumite
    aliEnRIK wrote: »
    Everything youve done upto now is fine
    That said, if it really did detect over 700 'TROJANS' then your computer could well be beyond repair (are you absolutely SURE it was 'AVG' that said that?)

    Things are definitely looking up as your hijack log says you have Service Pack 1 (A major windows update)
    Then malwarebytes says you have Service Pack 2 , so a mjor windows update has happened inbetween
    The fact it did suggests to me that its quite fixable



    Please run COMBOFIX
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Shut down your anti virus
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be)

    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

    Hi Rik Thanks for your help. I really am a numpty when it comes to viruses, trojan horses etc with the computer. The first log that I posted was from my sony laptop because whilst I was waiting for the old pc to run the malware I decided I might as well do mine too. The next lot is from the old pc that is why there might be service pack 1 and service pack 2. Ok so I go and run that other command now on both pcs and post the ressults here? The second malware log on the old pc I tried to post but it would not let me cut and paste easily like the first one and it would not let me cut and paste the log for the hijack at all so I dunno I just trust you lot and thanks for all your help rik and fiddiweb.
    taffy
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    This is from the laptop Rik Thanks
    ComboFix 10-02-02.02 - Dorothy 03/02/2010 0:55.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2938.1404 [GMT 0:00]
    Running from: c:\users\Dorothy\Desktop\qwerty.exe
    SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\$recycle.bin\S-1-5-21-2728695031-2404178559-3271909872-500
    c:\$recycle.bin\S-1-5-21-2876590922-3642457216-2815206243-500
    c:\$recycle.bin\S-1-5-21-3802674362-668520206-2469377335-500
    c:\program files\alot
    .
    ((((((((((((((((((((((((( Files Created from 2010-01-03 to 2010-02-03 )))))))))))))))))))))))))))))))
    .
    2010-02-03 01:05 . 2010-02-03 01:05
    d
    w- c:\users\Default\AppData\Local\temp
    2010-02-02 13:31 . 2010-02-02 13:31
    d
    w- c:\programdata\Office Genuine Advantage
    2010-02-01 21:43 . 2010-02-01 21:43 388096 ----a-r- c:\users\Dorothy\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2010-02-01 21:43 . 2010-02-01 21:43
    d
    w- c:\program files\TrendMicro
    2010-02-01 20:12 . 2010-02-01 20:12
    d
    w- c:\users\Dorothy\AppData\Roaming\Malwarebytes
    2010-02-01 20:12 . 2010-01-07 16:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-02-01 20:12 . 2010-02-01 20:12
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-02-01 20:12 . 2010-02-01 20:12
    d
    w- c:\programdata\Malwarebytes
    2010-02-01 20:12 . 2010-01-07 16:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-01-31 14:32 . 2010-01-31 14:32 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbEA2.tmp.exe
    2010-01-27 18:20 . 2010-01-18 11:59 1260800 ----a-w- c:\programdata\avg9\update\backup\avgfrw.exe
    2010-01-27 18:20 . 2010-01-18 11:59 3777280 ----a-w- c:\programdata\avg9\update\backup\setup.exe
    2010-01-17 23:58 . 2010-01-17 23:58
    d
    w- C:\Sony Corporation
    2010-01-17 00:33 . 2010-01-17 09:05
    d
    w- c:\programdata\NOS
    2010-01-15 19:36 . 2010-01-15 19:36
    d
    w- c:\programdata\HP Product Assistant
    2010-01-15 19:33 . 2010-01-15 19:43 77353 ----a-w- c:\windows\hpqins05.dat
    2010-01-15 19:15 . 2010-01-15 19:36
    d
    w- c:\users\Dorothy\AppData\Roaming\HpUpdate
    2010-01-15 19:15 . 2010-01-15 19:15
    d
    w- c:\windows\Hewlett-Packard
    2010-01-14 03:04 . 2010-01-14 03:10
    d
    w- C:\0649b617491ce171c6c59578c225e6
    2010-01-13 16:01 . 2009-10-19 14:27 156672 ----a-w- c:\windows\system32\t2embed.dll
    2010-01-13 16:01 . 2009-10-19 14:24 72704 ----a-w- c:\windows\system32\fontsub.dll
    2010-01-13 16:00 . 2010-01-13 16:00
    d
    w- C:\94284cf1b5a826cadca0b20c89
    2010-01-08 15:21 . 2009-08-05 22:48 54632 ----a-w- c:\windows\system32\drivers\fssfltr.sys
    2010-01-05 00:44 . 2010-01-05 00:44
    d
    w- c:\program files\iPod
    2010-01-05 00:44 . 2010-01-05 00:45
    d
    w- c:\program files\iTunes
    2010-01-05 00:41 . 2010-01-05 00:42
    d
    w- c:\program files\QuickTime
    2010-01-05 00:39 . 2010-01-05 00:39 79144 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-31 23:59 . 2009-09-15 23:47 1 ----a-w- c:\users\Dorothy\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2010-01-22 10:41 . 2009-11-14 23:03
    d
    w- c:\program files\Microsoft Silverlight
    2010-01-21 00:59 . 2008-07-09 21:17
    d
    w- c:\program files\Google
    2010-01-19 15:28 . 2009-03-20 22:15
    d
    w- c:\program files\Picasa2
    2010-01-15 19:43 . 2009-12-08 15:09
    d
    w- c:\programdata\HP
    2010-01-15 19:42 . 2009-03-20 16:13 2032 ----a-w- c:\users\Dorothy\AppData\Local\d3d9caps.dat
    2010-01-15 19:39 . 2009-03-20 16:13 112112 ----a-w- c:\users\Dorothy\AppData\Local\GDIPFONTCACHEV1.DAT
    2010-01-15 19:33 . 2009-03-20 21:20
    d
    w- c:\users\Dorothy\AppData\Roaming\Skype
    2010-01-15 19:32 . 2009-04-05 21:38
    d
    w- c:\users\Dorothy\AppData\Roaming\skypePM
    2010-01-14 11:12 . 2009-10-03 01:22 181120
    w- c:\windows\system32\MpSigStub.exe
    2010-01-14 03:11 . 2009-03-20 22:07
    d
    w- c:\programdata\Microsoft Help
    2010-01-14 03:10 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2010-01-08 15:21 . 2009-03-24 00:58
    d
    w- c:\program files\Windows Live
    2010-01-05 00:44 . 2009-10-02 21:21
    d
    w- c:\program files\Common Files\Apple
    2010-01-02 06:38 . 2010-01-22 11:17 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-01-02 06:32 . 2010-01-22 11:17 71680 ----a-w- c:\windows\system32\iesetup.dll
    2010-01-02 06:32 . 2010-01-22 11:17 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2010-01-02 04:57 . 2010-01-22 11:17 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-12-15 19:21 . 2009-12-08 15:25
    d
    w- c:\users\Dorothy\AppData\Roaming\HP
    2009-12-14 19:15 . 2009-12-14 19:15 2146304 ----a-w- c:\windows\system32\GPhotos.scr
    2009-12-09 09:32 . 2009-12-09 09:32
    d
    w- c:\programdata\WEBREG
    2009-12-08 15:58 . 2009-12-08 15:10 158062 ----a-w- c:\windows\hpoins29.dat
    2009-12-08 15:23 . 2009-12-08 15:23
    d
    w- c:\programdata\Hewlett-Packard
    2009-12-08 15:15 . 2009-12-08 15:11
    d
    w- c:\program files\HP
    2009-12-08 15:13 . 2009-12-08 15:13
    d
    w- c:\program files\Common Files\HP
    2009-12-08 15:13 . 2009-12-08 15:13
    d
    w- c:\program files\Hewlett-Packard
    2009-12-08 15:13 . 2009-12-08 15:13
    d
    w- c:\program files\Common Files\Hewlett-Packard
    2009-12-08 08:25 . 2009-12-08 08:25
    d
    w- c:\users\Default\AppData\Roaming\Trusteer
    2009-12-05 16:18 . 2009-12-05 16:18 784136 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    2009-12-02 13:15 . 2009-12-02 13:15 484976 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb23A8.tmp.exe
    2009-11-19 02:17 . 2009-05-21 21:35 12464 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-11-19 02:17 . 2009-05-21 21:35 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-11-19 02:17 . 2009-05-21 21:35 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-11-19 02:17 . 2009-05-21 21:35 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-11-19 01:00 . 2009-11-19 01:00 439816 ----a-w- c:\users\Dorothy\AppData\Roaming\Real\Update\setup3.09\setup.exe
    2009-11-09 13:22 . 2009-12-10 08:57 24064 ----a-w- c:\windows\system32\nshhttp.dll
    2009-11-09 13:20 . 2009-12-10 08:57 31232 ----a-w- c:\windows\system32\httpapi.dll
    2009-11-09 11:04 . 2009-12-10 08:57 411136 ----a-w- c:\windows\system32\drivers\http.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
    [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2009-04-02 11:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2009-11-25 13:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
    "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
    "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-06-28 262144]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-26 39408]
    "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]
    "Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-04 150040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-04 170520]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-04 145944]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6295552]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-12 30192]
    "MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-03-20 24576]
    "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-06-22 68592]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-30 198160]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
    c:\users\Dorothy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
    2008-07-07 19:28 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [21/05/2009 21:35 333192]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [21/05/2009 21:35 360584]
    R1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [06/12/2009 15:09 58984]
    R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [06/12/2009 15:09 337000]
    R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [19/11/2009 02:16 285392]
    R2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [20/03/2009 22:39 299008]
    R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [06/12/2009 15:09 972008]
    R2 regi;regi;c:\windows\System32\drivers\regi.sys [18/04/2007 03:09 11032]
    R2 RtkAudioService;Realtek Audio Service;c:\windows\RTKAUDIOSERVICE.EXE [09/07/2008 21:35 104992]
    R2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [09/07/2008 23:21 411488]
    R2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [20/06/2008 15:56 415744]
    R3 SFEP;Sony Firmware Extension Parser;c:\windows\System32\drivers\SFEP.sys [09/07/2008 21:57 9344]
    S2 gupdate1c9b8991840ba4;Google Update Service (gupdate1c9b8991840ba4);c:\program files\Google\Update\GoogleUpdate.exe [08/04/2009 22:25 133104]
    S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [08/01/2010 15:21 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
    S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [20/03/2009 22:20 30192]
    S3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Sony\VAIO Media plus\SOHCImp.exe [20/03/2009 22:36 103712]
    S3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Sony\VAIO Media plus\SOHDms.exe [20/03/2009 22:36 353568]
    S3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Sony\VAIO Media plus\SOHDs.exe [20/03/2009 22:36 62752]
    S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [20/03/2009 22:32 337184]
    S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [20/03/2009 22:32 83232]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder
    2010-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 22:25]
    2010-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-08 22:25]
    2010-02-02 c:\windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
    - c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.com/
    uDefault_Search_URL = hxxp://www.google.com/ie
    mStart Page = hxxp://uk.yahoo.com
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    IE: Lookup on Merriam Webster - [URL]file://c:\program[/URL] files\ieSpell\Merriam Webster.HTM
    IE: Lookup on Wikipedia - [URL]file://c:\program[/URL] files\ieSpell\wikipedia.HTM
    .
    - - - - ORPHANS REMOVED - - - -
    HKCU-Run-UniblueSpeedUpMyPC - c:\program files\Uniblue\SpeedUpMyPC\Launcher.exe
    Notify-GoToAssist - c:\program files\Citrix\GoToAssist\482\G2AWinLogon.dll

    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-02-03 01:05
    Windows 6.0.6001 Service Pack 1 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    LOCKED REGISTRY KEYS
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'Explorer.exe'(21324)
    c:\program files\Trusteer\Rapport\bin\rooksbas.dll
    .
    Completion time: 2010-02-03 01:10:04
    ComboFix-quarantined-files.txt 2010-02-03 01:10
    Pre-Run: 129,701,102,592 bytes free
    Post-Run: 130,513,504,256 bytes free
    - - End Of File - - 01603BA2B0A9E262BEDC4EC946B86EBC
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    Hi helpers,

    It definately popped up in a window saying AVG had detected over 700 trojans and could not heal them. Now when I go into the other pc and look in the AVG file it says everything is protected and when I click on each individual file it says everything up to date and protected. I wonder if this was a very clever cover up of a rogue thing pretending to be AVG and wanting money to take out the supposed trojan horses. Just trying to run the other download thing on the old pc which is the one that is causing the problems. Just I thought I would do the same to my laptop too while I am waiting.
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    Oh boy this is from the old pc that had the warning of all the trojans.
    ComboFix 10-02-02.02 - Ian 03/02/2010 1:23.1.1 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.895.291 [GMT 0:00]
    Running from: c:\users\Ian\Desktop\qwerty.exe
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\$recycle.bin\S-1-5-21-1728959549-2325484452-1488521819-500
    c:\program files\Mozilla Firefox\components\npclntax.xpt
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\About Hotbar.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Hotbar Customer Support Center.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Hotbar Games!.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Hotbar Uninstall Instructions.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Hotbar Videos!.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Reset Cursor.lnk
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Hotbar\Weather.lnk
    c:\windows\CouponPrinter.ocx
    c:\windows\YAHELITE.INI
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_TDSSSERV.SYS

    ((((((((((((((((((((((((( Files Created from 2010-01-03 to 2010-02-03 )))))))))))))))))))))))))))))))
    .
    2010-02-03 01:40 . 2010-02-03 01:40
    d
    w- c:\users\LogMeInRemoteUser\AppData\Local\temp
    2010-02-03 01:40 . 2010-02-03 01:40
    d
    w- c:\users\Default\AppData\Local\temp
    2010-02-01 23:34 . 2010-02-01 23:34
    d
    w- c:\program files\TrendMicro
    2010-02-01 11:53 . 2010-02-01 12:14 19518 ----a-w- c:\windows\hpqins13.dat
    2010-01-19 15:27 . 2010-01-19 15:27
    d
    w- c:\programdata\Office Genuine Advantage
    2010-01-14 16:22 . 2010-01-20 20:50
    d
    w- c:\programdata\McAfee Security Scan
    2010-01-14 16:22 . 2010-01-14 16:22
    d
    w- c:\program files\McAfee Security Scan
    2010-01-14 14:53 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
    2010-01-14 14:53 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-02-03 01:47 . 2009-02-19 00:16
    d
    w- c:\users\Ian\AppData\Roaming\DNA
    2010-02-03 01:44 . 2009-02-15 21:07 720 ----a-w- c:\programdata\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll
    2010-02-02 23:59 . 2009-03-30 14:15
    d
    w- c:\programdata\Google Updater
    2010-02-01 23:34 . 2010-02-01 23:34 388096 ----a-r- c:\users\Ian\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2010-02-01 20:17 . 2008-05-31 00:39 5216 ----a-w- c:\users\Ian\AppData\Local\d3d9caps.dat
    2010-02-01 20:11 . 2009-02-26 11:56
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-02-01 19:48 . 2008-04-06 19:47 2260 ----a-w- c:\users\Ian\AppData\Roaming\wklnhst.dat
    2010-02-01 12:47 . 2008-04-09 01:14
    d
    w- c:\program files\YahELite
    2010-02-01 11:53 . 2010-02-01 11:53 262144 ----a-w- c:\programdata\ntuser.dat
    2010-01-29 13:58 . 2009-03-06 18:57
    d
    w- c:\program files\Google
    2010-01-21 10:26 . 2008-12-02 00:53
    d
    w- c:\program files\Microsoft Silverlight
    2010-01-20 20:50 . 2009-11-25 00:32
    d
    w- c:\programdata\HP Product Assistant
    2010-01-16 16:22 . 2008-08-06 00:09
    d
    w- c:\programdata\McAfee
    2010-01-16 08:41 . 2008-08-08 20:16 0 ----a-w- c:\users\Ian\AppData\Local\prvlcl.dat
    2010-01-16 01:37 . 2009-06-22 12:04
    d
    w- c:\users\Ian\AppData\Roaming\Skype
    2010-01-16 00:01 . 2008-05-23 22:35
    d
    w- c:\users\Ian\AppData\Roaming\skypePM
    2010-01-15 09:14 . 2006-11-02 11:18
    d
    w- c:\program files\Windows Mail
    2010-01-14 17:51 . 2008-08-24 20:06
    d
    w- c:\programdata\NOS
    2010-01-14 11:12 . 2009-11-05 12:29 181120
    w- c:\windows\system32\MpSigStub.exe
    2010-01-07 16:07 . 2009-02-26 11:56 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-01-07 16:07 . 2009-02-26 11:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-01-02 06:38 . 2010-01-21 22:30 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-01-02 06:32 . 2010-01-21 22:30 109056 ----a-w- c:\windows\system32\iesysprep.dll
    2010-01-02 06:32 . 2010-01-21 22:30 71680 ----a-w- c:\windows\system32\iesetup.dll
    2010-01-02 04:57 . 2010-01-21 22:30 133632 ----a-w- c:\windows\system32\ieUnatt.exe
    2009-11-05 12:00 . 2009-02-15 21:08 2380538 ----a-w- c:\programdata\ArcSoft\Global Deploy\CheckUpdate\ArcConnect.exe
    2007-10-23 18:22 . 2007-10-23 18:22 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
    2008-09-29 17:24 325000 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000]
    [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
    [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "BitTorrent DNA"="c:\users\Ian\Program Files\DNA\btdna.exe" [2009-11-13 323392]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-06 39408]
    "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]
    "Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" [2008-10-02 147456]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-06-20 4493312]
    "Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-05-31 326440]
    "PCMMediaSharing"="c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2007-06-22 204908]
    "SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2007-06-05 548864]
    "Skytel"="Skytel.exe" [2007-06-15 1826816]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-01-16 2043160]
    "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
    "LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
    "Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-07-03 122368]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
    "Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-05 149280]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-06 185896]
    "WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-06 57344]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2007-1-31 245760]
    Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-9-14 535336]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624]
    McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
    TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\Win2k\TWCU.exe [2008-4-7 622592]
    Wireless Configuration Utility.lnk - c:\program files\TRENDnet\TEW-424UB\WlanCU.exe [2007-4-29 434176]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoResolveTrack"= 1 (0x1)
    "NoFileAssociate"= 0 (0x0)
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
    @="Service"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "VistaSp2"=hex(b):41,75,95,63,e7,3d,ca,01
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [08/11/2008 10:09 335240]
    R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [15/02/2009 18:05 108552]
    R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [14/09/2007 03:58 269448]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [15/01/2010 13:19 908056]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [15/01/2010 13:19 297752]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [24/07/2008 18:46 12856]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [21/02/2009 16:30 47640]
    R3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\System32\drivers\RTL8187B.sys [19/07/2007 00:40 281088]
    R3 SiS6350;SiS6350;c:\windows\System32\drivers\SISGRKMD.sys [14/09/2007 02:53 454520]
    R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\System32\drivers\SiSGB6.sys [14/09/2007 02:53 46592]
    S2 gupdate1c9b142ce89b221;Google Update Service (gupdate1c9b142ce89b221);c:\program files\Google\Update\GoogleUpdate.exe [30/03/2009 14:21 133104]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [28/05/2008 14:38 21504]
    S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [11/11/2009 00:49 54632]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
    S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\System32\drivers\netr73.sys [26/02/2008 09:17 493568]
    S3 WSVD;WSVD;c:\windows\System32\drivers\WSVD.sys [26/05/2008 07:53 80744]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder
    2010-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 14:21]
    2010-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-30 14:21]
    2010-02-03 c:\windows\Tasks\User_Feed_Synchronization-{0A025761-1C77-4FBE-9169-6C96DF54EBD5}.job
    - c:\windows\system32\msfeedssync.exe [2010-01-21 04:56]
    .
    .
    Supplementary Scan
    .
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    uStart Page = hxxp://www.google.co.uk/
    mStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
    Trusted Zone: internet
    Trusted Zone: mcafee.com
    DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} - hxxp://docs.cyberlink.com/acer/arcade/prog/UpdateAdvisorV2.cab
    FF - ProfilePath - c:\users\Ian\AppData\Roaming\Mozilla\Firefox\Profiles\reu28967.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
    FF - prefs.js: browser.search.selectedEngine - Yahoo
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npcsau7.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
    FF - plugin: c:\users\Ian\Program Files\DNA\plugins\npbtdna.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -
    HKCU-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
    HKCU-Run-Acer Tour Reminder - (no file)
    HKLM-Run-eRecoveryService - (no file)
    HKLM-Run-Lexmark X1100 Series - c:\program files\Lexmark X1100 Series\lxbkbmgr.exe
    HKLM-Run-Acer Tour - (no file)
    HKLM-Run-Apanel - c:\acersw\config\NewSetApanel.cmd
    HKLM-Run-NWEReboot - (no file)
    Notify-GoToAssist - c:\program files\Citrix\GoToAssist\482\G2AWinLogon.dll
    AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe
    AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe

    **************************************************************************
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files:
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'Explorer.exe'(3140)
    c:\windows\system32\MsnChatHook.dll
    c:\windows\system32\ShowErrMsg.dll
    c:\windows\system32\sysenv.dll
    c:\windows\system32\BatchCrypto.dll
    c:\windows\system32\CryptoAPI.dll
    c:\windows\system32\keyManager.dll
    .
    Other Running Processes
    .
    c:\windows\System32\LEXBCES.EXE
    c:\windows\System32\LEXPPS.EXE
    c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    c:\acer\Empowering Technology\ePerformance\MemCheck.exe
    c:\windows\system32\CISVC.EXE
    c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
    c:\programdata\EPSON\EPW!3 SSRP\E_S40RP7.EXE
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\CyberLink\Shared Files\RichVideo.exe
    c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    c:\program files\Sophos\AutoUpdate\ALsvc.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\windows\system32\WUDFHost.exe
    c:\progra~1\AVG\AVG8\avgrsx.exe
    c:\progra~1\AVG\AVG8\avgnsx.exe
    c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
    c:\program files\AVG\AVG8\avgcsrvx.exe
    c:\windows\RtHDVCpl.exe
    c:\program files\ACD Systems\DevDetect\DevDetect.exe
    c:\program files\AVG\AVG8\avgtray.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\windows\ehome\ehmsas.exe
    c:\acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
    c:\acer\Empowering Technology\eRecovery\ERAGENT.EXE
    c:\program files\LogMeIn\x86\LMIGuardian.exe
    c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
    c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
    c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
    c:\windows\system32\RacAgent.exe
    .
    **************************************************************************
    .
    Completion time: 2010-02-03 01:59:02 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-02-03 01:58
    Pre-Run: 17,903,296,512 bytes free
    Post-Run: 18,551,578,624 bytes free
    - - End Of File - - 37BF6875B5813197B4151D2CAAFF968D
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Taffy

    Ill be honest (And it might be because im feeling a bit ill today) but all these logs are really confusing

    Please stick to just the ONE computer for now

    OR

    If you must do both (Not aproblem) please LABEL which one is which at the top of the post so i know which one im reading from

    Clearly theyre both infected so they both need sorting out

    I have both combofix logs now but im going to ask for some HIJACK THIS ones before going on

    For both computers, do as below and make sure you LABEL which log is which ~

    Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
    http://www.filehippo.com/download_hijackthis/
    REBOOT
    Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
    (do NOT do anything else with Hijack but scan and post the FULL log)
    :idea:
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    Thanks Rik,

    You say they are clearly both infected it is as clear as mud to me and I have absolutely no idea what I am doing. Ok I will run the hijack now on the laptop ok and will post the results here. It was only because the other older pc was taking so long I decided to do the same to this laptop. It was going really slow the last little while and I also tried going into help and clearing up files etc to get the performance up. I had no idea it was infected too. Sorry to be such a dummy and thanks again.
    Taffy
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    Sony Laptop Hijack this log file

    Logfile of Trend Micro HijackThis v2.0.3 (BETA)
    Scan saved at 11:18:08, on 03/02/2010
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v8.00 (8.00.6001.18882)
    Boot mode: Normal
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Sony\ISB Utility\ISBMgr.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
    C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Sony\Network Utility\LANUtil.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.bin
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
    C:\Program Files\Windows Live\Toolbar\wltuser.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O1 - Hosts: ::1 localhost
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Advertising Cookie Opt-out - {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} - C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\PROGRA~1\GOOGLE~1\BAE.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [MarketingTools] C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
    O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [NSUFloatingUI] "C:\Program Files\Sony\Network Utility\LANUtil.exe"
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: McAfee Security Scan.lnk = ?
    O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
    O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
    O8 - Extra context menu item: Lookup on Merriam Webster - [URL]file://C:\Program[/URL] Files\ieSpell\Merriam Webster.HTM
    O8 - Extra context menu item: Lookup on Wikipedia - [URL]file://C:\Program[/URL] Files\ieSpell\wikipedia.HTM
    O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
    O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
    O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
    O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O9 - Extra button: (no name) - {056523E6-6100-425d-A5C0-D1812B5772DD} - (no file) (HKCU)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll C:\Windows\System32\avgrsstx.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\482\g2aservice.exe
    O23 - Service: Google Update Service (gupdate1c9b8991840ba4) (gupdate1c9b8991840ba4) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: IviRegMgr - InterVideo - c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: NSUService - Sony Corporation - C:\Program Files\Sony\Network Utility\NSUService.exe
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
    O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - C:\Windows\RtkAudioService.exe
    O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
    O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe
    O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
    O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
    O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
    O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
    O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
    O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
    O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
    O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    --
    End of file - 14342 bytes
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    laptop ~
    TICk and FIX these ~
    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Advertising Cookie Opt-out - {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} - C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll
    O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O9 - Extra button: (no name) - {056523E6-6100-425d-A5C0-D1812B5772DD} - (no file) (HKCU)
    :idea:
  • Taffyscot
    Taffyscot Posts: 896 Forumite
    Hi Rik

    It also said this after it had scanned it. I tried to copy and paste it but could not do that. I will copy it verbatim ok. I have vista and I did try to right click on the icon for hijack and pick administrator but that was not an option when I right clicked on it. I have not done the other thing with the run etc. Should I do the start run and type thing? I am sorry to be such a bother and so clueless should I just get a computer bloke in and pay him to do both pcs? Thanks Taffy


    For some reason your system denied write access to the HOst files. If any hijacked domains are in this file Hijack this might NOT be able to fix this .
    If that happens you will need to edit the file yourself. To do this click start run and type :
    notepad C:\Windows\System32\drivers\etc\hosts

    and press Enter Find the line(s) HijackThis reports and delete them

    Save the file as "hosts" (with quotes) and reboot

    For Vista simply exit Hijack this, right click on the Highjack this icon, choose Run as Administrator
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Seems to be a recurring problem this
    Try holding the SHIFT key as you right click
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 354.2K Banking & Borrowing
  • 254.4K Reduce Debt & Boost Income
  • 455.3K Spending & Discounts
  • 247.2K Work, Benefits & Business
  • 603.9K Mortgages, Homes & Bills
  • 178.4K Life & Family
  • 261.4K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.1K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture