We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 <b>Have you signed up to the Forum's <a href="https://forums.moneysavingexpert.com/discussion/6612556/new-feature-get-sent-trending-forum-threads-by-email?utm_source=banner">new Email Digest</a> yet? </b>Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Might have a avirus

2»

Comments

  • aliEnRIK
    aliEnRIK Posts: 17,741
    Part of the Furniture Combo Breaker
    Forumite
    Smallest log ive seen!

    Can you now please post the malwarebytes log

    Whats the operating system?
    :idea:
  • 23n1th
    23n1th Posts: 1,523 Forumite
    Its windows 7. The computers fairly new and not much stuff installed on it. A mate set up the security on it. Heres the log:

    Malwarebytes' Anti-Malware 1.44
    Database version: 3766
    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    20/02/2010 14:57:18
    mbam-log-2010-02-20 (14-57-18).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 251841
    Time elapsed: 1 hour(s), 28 minute(s), 40 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  • aliEnRIK
    aliEnRIK Posts: 17,741
    Part of the Furniture Combo Breaker
    Forumite
    Please run COMBOFIX
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Shut down your anti virus
    Follow the simple instructions it gives
    Post the COMPLETE log it creates here (Split into sections if need be)
    If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download


    (Assuming its NOT 64 bit)
    :idea:
  • 23n1th
    23n1th Posts: 1,523 Forumite
    Here it is:

    ComboFix 10-02-21.01 - Home 25/02/2010 20:00:57.2.2 - x86
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3067.2272 [GMT 0:00]
    Running from: c:\downloads\qwerty.exe
    SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
    .

    ((((((((((((((((((((((((( Files Created from 2010-01-21 to 2010-02-21 )))))))))))))))))))))))))))))))
    .

    2010-02-21 20:06 . 2010-02-21 20:06
    d
    w- c:\users\Default\AppData\Local\temp
    2010-02-21 15:26 . 2010-02-21 15:26
    d
    w- c:\program files\Secunia
    2010-02-21 00:47 . 2010-02-11 18:38 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-02-21 00:47 . 2010-02-11 18:42 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-02-21 00:47 . 2010-02-11 18:42 162512 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-02-21 00:47 . 2010-02-11 18:39 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-02-21 00:47 . 2010-02-11 18:38 51792 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2010-02-21 00:46 . 2010-02-11 18:53 38848 ----a-w- c:\windows\system32\avastSS.scr
    2010-02-21 00:46 . 2010-02-11 18:53 153184 ----a-w- c:\windows\system32\aswBoot.exe
    2010-02-21 00:46 . 2010-02-21 00:46
    d
    w- c:\programdata\Alwil Software
    2010-02-21 00:13 . 2010-02-21 00:13
    d
    w- c:\program files\Alwil Software
    2010-02-20 12:04 . 2010-02-20 12:04
    d
    w- c:\windows\McAfee.com
    2010-02-20 11:52 . 2010-02-20 11:52
    d
    w- c:\program files\Common Files\Symantec Shared
    2010-02-20 11:50 . 2010-02-20 13:25
    d
    w- c:\programdata\Norton
    2010-02-20 11:50 . 2010-02-20 13:25
    d
    w- c:\programdata\Symantec
    2010-02-20 11:50 . 2010-02-20 11:50
    d
    w- c:\programdata\NortonInstaller
    2010-02-19 22:51 . 2010-02-20 13:22
    d
    w- c:\program files\Panda Security
    2010-02-15 22:20 . 2010-02-15 22:20
    d
    w- c:\users\Home\AppData\Roaming\dvdcss
    2010-02-15 22:20 . 2010-02-15 22:20
    d
    w- c:\users\Home\AppData\Roaming\vlc
    2010-02-14 17:32 . 2009-06-18 12:55 18816
    w- c:\windows\system32\SAVRKBootTasks.sys
    2010-02-13 19:04 . 2010-02-13 19:04
    d
    w- c:\programdata\IObit
    2010-02-13 19:04 . 2010-02-13 19:04
    d
    w- c:\program files\IObit
    2010-02-11 16:28 . 2010-02-11 16:37
    d
    w- c:\users\Home\AppData\Roaming\ImgBurn
    2010-02-01 21:09 . 2010-02-01 21:09
    d
    w- c:\windows\CheckSur
    2010-01-30 16:41 . 2010-01-30 16:41
    d
    w- c:\users\Home\AppData\Local\Apps
    2010-01-30 16:05 . 2010-01-30 16:05
    d
    w- c:\users\Home\AppData\Roaming\skypePM
    2010-01-30 15:48 . 2010-01-30 16:06
    d
    w- c:\users\Home\AppData\Roaming\Skype
    2010-01-30 15:48 . 2010-01-30 15:48
    d
    w- c:\program files\Common Files\Skype
    2010-01-30 15:47 . 2010-01-30 15:48
    d
    r- c:\program files\Skype
    2010-01-30 15:47 . 2010-01-30 15:47
    d
    w- c:\programdata\Skype
    2010-01-26 19:34 . 2010-01-26 19:34
    d
    w- c:\program files\Common Files\Java
    2010-01-26 18:45 . 2009-10-31 05:45 2614272 ----a-w- c:\windows\explorer.exe
    2010-01-26 18:45 . 2009-10-28 06:17 285696 ----a-w- c:\windows\system32\winlogon.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-02-21 19:43 . 2009-11-23 20:47 251392032 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2010-02-21 19:40 . 2009-12-03 12:53
    d
    w- c:\users\Home\AppData\Roaming\Free Download Manager
    2010-02-21 00:52 . 2009-11-23 20:47 2819708 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2010-02-20 14:59 . 2009-12-03 16:37 117760 ----a-w- c:\users\Home\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-02-20 14:58 . 2009-12-03 16:34
    d
    w- c:\program files\SUPERAntiSpyware
    2010-02-14 18:08 . 2010-02-14 18:08 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
    2010-02-11 21:52 . 2009-12-21 14:48
    d
    w- c:\program files\QtWeb
    2010-01-30 22:54 . 2009-12-06 19:09
    d
    w- c:\users\Home\AppData\Roaming\TeraCopy
    2010-01-30 16:05 . 2010-01-30 16:05 56 ---ha-w- c:\programdata\ezsidmv.dat
    2010-01-26 19:33 . 2009-12-03 23:21
    d
    w- c:\program files\Java
    2010-01-24 15:10 . 2009-11-15 17:29
    d
    w- c:\program files\Microsoft Silverlight
    2010-01-18 21:38 . 2009-11-15 15:59
    d
    w- c:\program files\Microsoft Security Essentials
    2010-01-18 17:42 . 2009-12-03 16:29
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-01-18 17:42 . 2010-01-18 17:42 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2010-01-18 17:37 . 2010-01-18 17:37 52224 ----a-w- c:\users\Home\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
    2010-01-14 11:12 . 2009-11-15 15:39 181120
    w- c:\windows\system32\MpSigStub.exe
    2010-01-08 03:18 . 2010-02-10 08:16 221184 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2010-01-08 03:17 . 2010-02-10 08:16 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
    2010-01-07 16:07 . 2009-12-03 16:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-01-07 16:07 . 2009-12-03 16:29 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-19 09:02 . 2010-01-22 12:40 977920 ----a-w- c:\windows\system32\wininet.dll
    2009-12-19 09:02 . 2010-02-10 08:16 12288 ----a-w- c:\windows\system32\tsbyuv.dll
    2009-12-19 09:02 . 2010-02-10 08:16 1328640 ----a-w- c:\windows\system32\quartz.dll
    2009-12-19 09:02 . 2010-02-10 08:16 22016 ----a-w- c:\windows\system32\msyuv.dll
    2009-12-19 09:02 . 2010-02-10 08:16 31744 ----a-w- c:\windows\system32\msvidc32.dll
    2009-12-19 09:02 . 2010-02-10 08:16 13312 ----a-w- c:\windows\system32\msrle32.dll
    2009-12-19 09:02 . 2010-02-10 08:16 84480 ----a-w- c:\windows\system32\mciavi32.dll
    2009-12-19 09:02 . 2010-02-10 08:16 50176 ----a-w- c:\windows\system32\iyuv_32.dll
    2009-12-19 09:02 . 2010-02-10 08:16 91648 ----a-w- c:\windows\system32\avifil32.dll
    2009-12-17 17:14 . 2009-12-03 23:15 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-12-08 11:40 . 2010-02-10 08:16 3955288 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2009-12-08 11:40 . 2010-02-10 08:16 3899464 ----a-w- c:\windows\system32\ntoskrnl.exe
    2009-12-08 11:32 . 2010-02-10 08:16 292864 ----a-w- c:\windows\system32\apphelp.dll
    2009-12-08 08:05 . 2010-02-10 08:16 310784 ----a-w- c:\windows\system32\drivers\srv.sys
    2009-12-08 08:05 . 2010-02-10 08:16 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
    2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
    "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-02-11 2756488]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
    @="Service"

    R1 aswSP;aswSP;c:\windows\System32\drivers\aswSP.sys [21/02/2010 00:47 162512]
    R1 is-1U5DLdrv;is-1U5DLdrv;c:\windows\System32\drivers\03395299.sys [23/11/2009 20:47 148496]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [11/11/2009 10:44 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 66632]
    R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\System32\SAVRKBootTasks.sys [14/02/2010 17:32 18816]
    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\System32\drivers\vwififlt.sys [13/07/2009 23:52 48128]
    R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [21/02/2010 00:47 19024]
    R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [21/02/2010 00:47 51792]
    R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\k57nd60x.sys [13/07/2009 22:02 229888]
    R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\System32\drivers\NETw5s32.sys [15/09/2009 19:40 6114816]
    R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [21/08/2009 20:24 66592]
    S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\System32\drivers\MpNWMon.sys [18/06/2009 18:48 42480]
    S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\netw5v32.sys [10/06/2009 21:18 4231168]
    S3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [17/06/2009 12:20 12648]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 12872]
    .
    .
    Supplementary Scan
    .
    uStart Page = https://www.google.com
    uInternet Settings,ProxyOverride = local
    IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
    IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
    IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
    IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
    .
    .
    File Associations
    .
    txtfile\shell\ab_notepad\command=
    .
    .
    LOCKED REGISTRY KEYS

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'Explorer.exe'(2484)
    c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
    .
    Completion time: 2010-02-21 20:08:38
    ComboFix-quarantined-files.txt 2010-02-21 20:08

    Pre-Run: 272,636,346,368 bytes free
    Post-Run: 272,324,046,848 bytes free

    - - End Of File - - 36951C3E1DCDC6759A71785FBBBC3A72
  • aliEnRIK
    aliEnRIK Posts: 17,741
    Part of the Furniture Combo Breaker
    Forumite
    Log looks fine ~ id say your good to go
    :idea:
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 355.8K Banking & Borrowing
  • 254.9K Reduce Debt & Boost Income
  • 456.2K Spending & Discounts
  • 248.3K Work, Benefits & Business
  • 605.9K Mortgages, Homes & Bills
  • 179K Life & Family
  • 263.7K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.2K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture