strange message on gmail

waddler_8

Post the contents of C:\Qoobox\Add-Remove Programs.txt

harrys_nan

waddler_8 wrote: »

Post the contents of C:\Qoobox\Add-Remove Programs.txt

Havent got that either sorry

waddler_8

Press your windows key + R on your keyboard and when the Run box opens, copy/paste this into the box and click ok:

C:\Qoobox\Add-Remove Programs.txt

harrys_nan

Adobe AIR
Adobe Reader X (10.1.2)
Adobe Shockwave Player 11.6
Advanced Audio FX Engine
Apple Application Support
Apple Software Update
ArcSoft Panorama Maker 5
Click to Call with Skype
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
Dell Webcam Central
Google Toolbar for Internet Explorer
Google Update Helper
GoToAssist Corporate
HiJackThis
ieSpell
Intel(R) Rapid Storage Technology
J2SE Runtime Environment 5.0 Update 7
Live! Cam Avatar Creator
Malwarebytes Anti-Malware version 1.60.0.1800
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Word Viewer 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Works
Mozilla Firefox 9.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nectar Search Toolbar
Nikon Message Center 2
Nikon Movie Editor
Picture Control Utility
PowerDVD DX
QuickTime
Rapport
Safari
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Skype™ 5.3
swMSM
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
ViewNX 2
Visual Studio 2008 x64 Redistributables

Ok so tell what this is please

waddler_8

That's your installed programs. That file rik has tried to get you to upload looks to be associated with Registry cleaning software.

[MD5.1623ACB6E11B70DED4FEC0E9F64E3026] - 23/11/2011 - 21:35:52 RSHAD . (.Systweak Inc., (www.systweak.com) - Regclean Pro.) -- C:\Windows\system32\roboot64.exe B]18816[/B

[MD5.7D9C5494D5DCE60E5FD1BC20E34A9DC5] - 28/07/2011 - 12:06:44 RSHAD . (.Systweak Inc., (www.systweak.com) - Regclean Pro.) -- C:\Windows\system32\roboot64.exe [18816]

Have you had a program like that installed but then removed it?

harrys_nan

not actuall sure, bit (lot) of a bimbo with computers, did run a defrag recently and i think that was what took all my stored passwords away. Usually get my son in law do this sort of thing for me but i now live a 200 miles away

harrys_nan

I am very grateful to both of you but I have taken up a lot of ur time now, I really dont mind if you both give up now

aliEnRIK

Well im still concerned how long malwarebytes took

I would personally recommend two more scans (At your leisure)

They would be kasperskys TDSS KILLER
http://support.kaspersky.com/faq/?qid=208283363

and Dr Web (Be aware this one will take a LONG time to scan - leave overnight perhaps)
Download and run the FREE version of DR WEB
http://www.freedrweb.com/download+cureit/gr/
Turn your anti virus OFF
Follow the simple questions it asks (Entirely up to you if your happy for Dr Web to 'lock' the computer as it runs)
It will auto QUICK scan
Press the STOP button on the right (Unless your happy to quick scan first)
After that set to COMPLETE SCAN the computer and press the 'play' icon
This will more than likely take hours (12 is average!), so leave running overnight or whatever

***DO NOT UPGRADE TO FULL VERSION***

reset the HOSTS file if it asks you

waddler_8

To be honest things look ok. I would dequarantine a file combofix removed and then If rik's in agreement uninstall it.


This should only take a very short time. It wont do a full run through of combofix. After it's finished, post me the contents of DeQuarantine.txt

Run this combofix script. When you run combofix make sure you antivirus isn't enabled, you should temporarily disable it whilst combofix runs.

• Open Notepad
• Copy and paste the text present inside the code box below (Don't include Code:)

DeQuarantine:: 
C:\qoobox\quarantine\c\users\Dell\GoToAssistDownloadHelper.exe.vir
Quit::  
 
 
 

• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
• Temporarily disable your anti-virus, before following the steps below.
• To disable your Antivirus, see here.
  
  
• Drag CFScript.txt into ComboFix.exe as the screenshot above shows.
• Copy and paste the contents of DeQuarantine.txt here.

aliEnRIK

No issue with that waddler