| Live Chat & Podcast at 1:00PM Eastern on Sunday! |
Advertisement
Advertisement
 Search | |
| |
11-Jul-2012, 03:13 AM
#2 | |||||||
| Hello FizzyJay and welcome to TSG, I'm kevinf80 and I will be helping with any malware issues you may have with your system.
Please proceed as follows :- Close all windows, Select > start icon > all programs > accessories > Right click on "command prompt" > select > Run as administrator > ok any alerts > at the command prompt type or copy and paste sfc /scannow > then enter. Type exit when its finished and re-boot your PC. Next, Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :- Link 1 Link 2
****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze **** Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read Here why disabling autoruns is recommended. *EXTRA NOTES*
Post the log in next reply please... Kevin |
12-Jul-2012, 03:20 AM
#5 | |||||||
| OK, continue as follows please: Step 1 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the Codebox below into it: Code: KillAll::
ClearJavaCache::
Folder::
c:\windows\SysWow64\%APPDATA%
c:\program files (x86)\Conduit
c:\users\Thomas\AppData\Local\Conduit
c:\program files (x86)\uTorrentControl2
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"=-
[-HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]
[-HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{687578b9-7132-4a7a-80e4-30ee31099e03}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{687578b9-7132-4a7a-80e4-30ee31099e03}"=-
[-HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}]   Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Step 2  Please download Malwarebytes Anti-Malware and save it to your desktop.Alernative D/L mirror Alternative D/L mirror Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Step 3 Go here http://www.sophos.com/products/free-...i-rootkit.html to Download Sophos tool. Select the Download now tab as below:  In the new window select for Home User then fill out all necessary information: The download should start automatically, if not select the link as below:  Save the download file to your Desktop, when complete double click the file  to install the tool. Windows 7 or Vista user accept UAC alert.The tool will self extract as below:  In the new window select next, as below:  Agree the licence and select next, as below:  Leave the installation folder as default, select next, as below:  In the new window select "Install" as below:  The install will progress from:  To:  At the above image ensure "Launch Sophos Virus Removal tool" is checked, then select Finish: In the new window select "Start scanning" as below:  When the tool completes the log can be found by Navigating Start > Computer > C:\Program data \Sophos. open the Sophos folder and expand to Logs. Post the 3 produced logs, also give update on current issues/concerns.. Kevin |
12-Jul-2012, 02:04 PM
#6 | ||||||
| Here is the ComboFix log: ComboFix 12-07-11.03 - Thomas 12/07/2012 1:31.2.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.7860.5772 [GMT -6:00] Running from: c:\users\Thomas\Desktop\ComboFix.exe Command switches used :: c:\users\Thomas\Desktop\CFScript.txt AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\fxsst.dll . . . . Failed to delete c:\windows\system32\slwga.dll . . . . Failed to delete c:\windows\system32\srrstr.dll . . . . Failed to delete c:\windows\system32\systemcpl.dll . . . . Failed to delete c:\windows\system32\termsrv.dll . . . . Failed to delete . ----- File Replicators ----- . c:\programdata\Adobe\Reader\9.2\ARM\11748\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\11861\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\1201\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\13636\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\14180\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\15238\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\17357\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\20515\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\23347\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\24111\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\25936\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\26820\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\27295\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\30466\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\31237\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\3140\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\9382\AdobeARM.exe c:\programdata\Adobe\Reader\9.2\ARM\9947\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\11748\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\11861\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\1201\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\13636\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\14180\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\15238\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\17357\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\20515\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\23347\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\24111\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\25936\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\26820\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\27295\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\30466\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\31237\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\3140\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\9382\AdobeARM.exe c:\users\All Users\Adobe\Reader\9.2\ARM\9947\AdobeARM.exe . . ((((((((((((((((((((((((( Files Created from 2012-06-12 to 2012-07-12 ))))))))))))))))))))))))))))))) . . 2012-07-12 08:14 . 2012-07-12 08:14 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-07-07 03:57 . 2012-07-07 03:57 -------- d-----w- c:\users\Thomas\AppData\Roaming\Packard Bell 2012-07-07 03:57 . 2012-07-07 03:57 -------- d-----w- c:\users\Thomas\AppData\Local\Gateway 2012-07-06 04:38 . 2012-07-06 04:39 -------- d-----w- c:\users\Thomas\AppData\Roaming\AVG 2012-07-05 16:24 . 2012-07-05 16:24 -------- d-----w- c:\program files (x86)\ASIO4ALL v2 2012-07-04 02:00 . 2012-07-11 06:47 -------- d-----w- c:\windows\usb-audio.deBehringer2902 2012-07-04 01:50 . 2009-10-30 19:39 49728 ----a-w- c:\windows\system32\drivers\busbwdm.sys 2012-07-04 01:50 . 2009-10-30 19:39 460864 ----a-w- c:\windows\system32\drivers\BUSB2902.sys 2012-07-03 15:06 . 2012-07-03 15:06 -------- d-sh--w- c:\windows\SysWow64\%APPDATA% 2012-07-03 15:01 . 2012-07-03 15:01 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-07-03 15:01 . 2012-07-03 15:01 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-07-03 15:01 . 2012-07-03 15:01 -------- d-----w- c:\windows\system32\Macromed 2012-07-03 14:55 . 2012-07-03 20:18 -------- d-----w- c:\program files (x86)\OApps 2012-07-03 14:55 . 2012-07-03 14:55 -------- d-----w- c:\program files (x86)\TorrentSearch 2012-07-03 14:55 . 2012-07-12 01:50 -------- d-----w- c:\program files (x86)\intellidownload 2012-07-03 14:46 . 2012-07-03 20:39 -------- d-----w- c:\users\Thomas\AppData\Roaming\Line 6 2012-07-03 14:45 . 2012-07-03 14:45 -------- d-----w- c:\programdata\Line 6 2012-07-03 14:45 . 2012-07-03 14:45 -------- d-----w- c:\program files (x86)\Common Files\Digidesign 2012-07-03 14:45 . 2012-07-03 14:45 -------- d-----w- c:\program files (x86)\Line6 2012-07-03 14:38 . 2012-07-03 14:38 -------- d-----w- c:\users\Thomas\AppData\Local\CRE 2012-07-03 14:38 . 2012-07-03 14:38 -------- d-----w- c:\program files (x86)\Conduit 2012-07-03 14:38 . 2012-07-03 14:38 -------- d-----w- c:\users\Thomas\AppData\Local\Conduit 2012-07-03 14:38 . 2012-07-11 06:48 -------- d-----w- c:\program files (x86)\uTorrent 2012-07-03 14:37 . 2012-07-11 06:48 -------- d-----w- c:\users\Thomas\AppData\Roaming\uTorrent 2012-06-24 19:48 . 2012-05-18 02:06 2311680 ----a-w- c:\windows\system32\jscript9.dll 2012-06-22 13:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-06-22 13:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-06-22 13:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-06-22 13:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-06-22 13:13 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-06-22 13:13 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-06-22 13:13 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-06-22 13:13 . 2012-06-02 21:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-06-22 13:13 . 2012-06-02 21:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-06-14 04:53 . 2012-04-26 05:41 77312 ----a-w- c:\windows\system32\rdpwsx.dll 2012-06-14 04:53 . 2012-04-26 05:41 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-06-14 04:53 . 2012-04-26 05:34 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-06-14 04:53 . 2012-05-01 05:40 209920 ----a-w- c:\windows\system32\profsvc.dll 2012-06-14 04:53 . 2012-05-04 11:06 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-06-14 04:53 . 2012-05-04 10:03 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-06-14 04:53 . 2012-05-04 10:03 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-06-14 04:53 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys 2012-06-14 04:52 . 2012-04-28 03:55 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-06-14 04:52 . 2012-04-07 12:31 3216384 ----a-w- c:\windows\system32\msi.dll 2012-06-14 04:52 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\SysWow64\msi.dll 2012-06-14 04:52 . 2012-04-24 05:37 1462272 ----a-w- c:\windows\system32\crypt32.dll 2012-06-14 04:52 . 2012-04-24 04:36 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll 2012-06-14 04:52 . 2012-04-24 05:37 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2012-06-14 04:52 . 2012-04-24 05:37 140288 ----a-w- c:\windows\system32\cryptnet.dll 2012-06-14 04:52 . 2012-04-24 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2012-06-14 04:52 . 2012-04-24 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2012-06-13 04:01 . 2012-06-13 04:01 -------- d-----w- c:\users\Thomas\AppData\Local\AVG Secure Search . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-06-05 22:50 . 2012-06-05 22:50 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2012-06-05 22:50 . 2012-06-05 22:50 161792 ----a-w- c:\windows\SysWow64\msls31.dll 2012-06-05 22:50 . 2012-06-05 22:50 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll 2012-06-05 22:50 . 2012-06-05 22:50 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2012-06-05 22:50 . 2012-06-05 22:50 63488 ----a-w- c:\windows\SysWow64\tdc.ocx 2012-06-05 22:50 . 2012-06-05 22:50 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2012-06-05 22:50 . 2012-06-05 22:50 367104 ----a-w- c:\windows\SysWow64\html.iec 2012-06-05 22:50 . 2012-06-05 22:50 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2012-06-05 22:50 . 2012-06-05 22:50 74752 ----a-w- c:\windows\SysWow64\iesetup.dll 2012-06-05 22:50 . 2012-06-05 22:50 420864 ----a-w- c:\windows\SysWow64\vbscript.dll 2012-06-05 22:50 . 2012-06-05 22:50 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll 2012-06-05 22:50 . 2012-06-05 22:50 152064 ----a-w- c:\windows\SysWow64\wextract.exe 2012-06-05 22:50 . 2012-06-05 22:50 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2012-06-05 22:50 . 2012-06-05 22:50 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2012-06-05 22:50 . 2012-06-05 22:50 35840 ----a-w- c:\windows\SysWow64\imgutil.dll 2012-06-05 22:50 . 2012-06-05 22:50 11776 ----a-w- c:\windows\SysWow64\mshta.exe 2012-06-05 22:50 . 2012-06-05 22:50 101888 ----a-w- c:\windows\SysWow64\admparse.dll 2012-06-05 22:50 . 2012-06-05 22:50 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2012-06-05 22:50 . 2012-06-05 22:50 49664 ----a-w- c:\windows\system32\imgutil.dll 2012-06-05 22:50 . 2012-06-05 22:50 48640 ----a-w- c:\windows\system32\mshtmler.dll 2012-06-05 22:50 . 2012-06-05 22:50 222208 ----a-w- c:\windows\system32\msls31.dll 2012-06-05 22:50 . 2012-06-05 22:50 135168 ----a-w- c:\windows\system32\IEAdvpack.dll 2012-06-05 22:50 . 2012-06-05 22:50 12288 ----a-w- c:\windows\system32\mshta.exe 2012-06-05 22:50 . 2012-06-05 22:50 114176 ----a-w- c:\windows\system32\admparse.dll 2012-06-05 22:50 . 2012-06-05 22:50 111616 ----a-w- c:\windows\system32\iesysprep.dll 2012-06-05 22:50 . 2012-06-05 22:50 85504 ----a-w- c:\windows\system32\iesetup.dll 2012-06-05 22:50 . 2012-06-05 22:50 76800 ----a-w- c:\windows\system32\tdc.ocx 2012-06-05 22:50 . 2012-06-05 22:50 448512 ----a-w- c:\windows\system32\html.iec 2012-06-05 22:50 . 2012-06-05 22:50 30720 ----a-w- c:\windows\system32\licmgr10.dll 2012-06-05 22:50 . 2012-06-05 22:50 165888 ----a-w- c:\windows\system32\iexpress.exe 2012-06-05 22:50 . 2012-06-05 22:50 160256 ----a-w- c:\windows\system32\wextract.exe 2012-06-05 22:50 . 2012-06-05 22:50 603648 ----a-w- c:\windows\system32\vbscript.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-07-12_01.56.50 ))))))))))))))))))))))))))))))))))))))))) . + 2009-11-06 05:06 . 2012-07-12 02:31 45130 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-07-12 08:19 38160 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2010-08-21 01:29 . 2012-07-12 08:19 11160 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-640407645-4038575709-3359598853-1001_UserData.bin - 2012-07-12 01:54 . 2012-07-12 01:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-07-12 08:16 . 2012-07-12 08:16 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-07-12 01:54 . 2012-07-12 01:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-07-12 08:16 . 2012-07-12 08:16 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 04:54 . 2012-07-12 08:16 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Cookies\index.dat - 2009-07-14 04:54 . 2012-07-12 01:54 114688 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\ Cookies\index.dat + 2010-08-21 04:08 . 2012-07-12 07:16 317510 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 05:01 . 2012-07-12 08:15 327648 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-07-12 01:53 327648 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 04:54 . 2012-07-12 08:16 1228800 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Te mporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-07-12 01:54 1228800 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Te mporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-07-12 08:16 1474560 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Hi story\History.IE5\index.dat - 2009-07-14 04:54 . 2012-07-12 01:54 1474560 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Hi story\History.IE5\index.dat + 2012-02-21 15:21 . 2012-07-12 08:15 2431220 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-640407645-4038575709-3359598853-1001-8192.dat + 2012-07-04 02:01 . 2012-07-12 02:26 1745472 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-640407645-4038575709-3359598853-1001-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2012-06-12 14:56 2068536 ----a-w- c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll" [2012-06-12 2068536] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-06-15 15141768] "Steam"="c:\program files (x86)\Steam\steam.exe" [2011-10-14 1242448] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ru n] "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648] "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" [2009-09-24 244480] "Camera Assistant Software"="c:\program files (x86)\Video Web Camera\traybar.exe" [2009-12-03 600688] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736] "CLMLServer"="c:\program files (x86)\Cyberlink\Power2Go\CLMLSvc.exe" [2009-06-04 103720] "RemoteControl8"="c:\program files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-16 91432] "PDVD8LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-16 50472] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2012-01-18 2339168] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-06 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-06-12 1104440] "ROC_roc_dec12"="c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096] . c:\users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.271\SSScheduler.exe [2012-3-13 274328] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2009-10-03 11:08 35696 ----a-w- c:\program files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-07-22 40448] R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264] R3 BEHRINGER_2902;usb-audio.de driver for BEHRINGER USB AUDIO;c:\windows\system32\Drivers\BUSB2902.sys [2009-10-30 460864] R3 BUSB_AUDIO_WDM;BEHRINGER USB WDM AUDIO;c:\windows\system32\drivers\busbwdm.sys [2009-10-30 49728] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.271\McCHSvc.exe [2012-03-13 237272] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-21 1255736] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2008-07-10 47128] R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2008-07-10 369688] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 26704] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2011-03-16 37456] S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys [2011-09-26 64272] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2011-01-07 304720] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-03-01 41552] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2011-04-05 377936] S1 RapportCerberus_32029;RapportCerberus_32029;c:\programdata\Trusteer\Rapport \store\exts\RapportCerberus\32029\RapportCerberus64_32029.sys [2011-10-18 396816] S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [2011-09-26 55056] S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [2011-09-26 61712] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904] S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-01-31 7391072] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520] S2 ePowerSvc;Acer ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [2009-09-30 844320] S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [2009-08-28 1150496] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136] S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [2009-09-24 62720] S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-09-26 919352] S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-03-02 11576] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784] S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2320920] S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2009-07-04 240160] S2 vToolbarUpdater11.1.0;vToolbarUpdater11.1.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe [2012-06-12 935480] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-05-28 118864] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 29264] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2009-02-13 292864] S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344] S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 244736] S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456] . . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-29 8312352] "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU] "AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-07-22 323072] "PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704] "Acer ePower Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2009-09-30 823840] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.ca/ uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=1009&m=nv59&r=27360810k6b6l0370z1h5a49k1y320 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: cantireu.com Trusted Zone: icanelearn.com Trusted Zone: line6.net Trusted Zone: plateau.com TCP: DhcpNameServer = 192.168.0.1 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file) . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-640407645-4038575709-3359598853-1001\Software\SecuROM\License information*] "datasecu"=hex:18,0e,52,d6,9b,9c,31,91,e1,a2,67,2d,63,8a,c8,f0,45,1f,97,32, 56, e0,0c,11,c5,4c,00,51,1a,50,ef,d9,31,ef,d2,cb,e4,82,7a,4c,12,8d,58,1a,b0,c3, \ "rkeysecu"=hex:d4,b9,60,18,d4,27,0a,7d,bd,68,93,3b,ba,0a,24,65 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_ 3_300_257_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX .exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\program files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe . ************************************************************************** . Completion time: 2012-07-12 02:26:11 - machine was rebooted ComboFix-quarantined-files.txt 2012-07-12 08:26 ComboFix2.txt 2012-07-12 02:04 . Pre-Run: 484,467,417,088 bytes free Post-Run: 484,227,055,616 bytes free . - - End Of File - - 820756381DC0C83CED20E1293727D697 Here is the MBAM log: Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.12.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Thomas :: THOMAS-PC [administrator] 12/07/2012 9:59:42 AM mbam-log-2012-07-12 (09-59-42).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 213758 Time elapsed: 1 minute(s), 34 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Finally, here is the sophos log: 2012-07-12 10:04:02 Sophos Virus Removal Tool version 2.1 2012-07-12 10:04:02 Copyright (c) 2009-2012 Sophos Limited. All rights reserved. 2012-07-12 10:04:02 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them. 2012-07-12 10:04:02 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x300 PT=0x1 WOW64 2012-07-12 10:04:02 Component SVRTcli.exe version 2.1 2012-07-12 10:04:02 Component control.dll version 2.1 2012-07-12 10:04:02 Component SVRTservice.exe version 2.1 2012-07-12 10:04:02 Component osdp.dll version 1.44.0.1982 2012-07-12 10:04:03 Component veex.dll version 3.33.2.1982 2012-07-12 10:04:03 Component savi.dll version 7.5.9.1982 2012-07-12 10:04:03 Component rkdisk.dll version 1.5.30.0 2012-07-12 10:04:12 Option all = no 2012-07-12 10:04:12 Option recurse = yes 2012-07-12 10:04:12 Option archive = no 2012-07-12 10:04:12 Option service = yes 2012-07-12 10:04:12 Option confirm = yes 2012-07-12 10:04:12 Option sxl = yes 2012-07-12 10:04:12 Option max-data-age = 35 2012-07-12 10:04:12 Version info: Product version 2.1 2012-07-12 10:04:12 Version info: Detection engine 3.33.2 2012-07-12 10:04:12 Version info: Detection data 4.79 2012-07-12 10:04:12 Version info: Virus data date 02/07/2012 2012-07-12 10:04:12 Version info: Data files added 261 2012-07-12 10:44:00 Could not open C:\hiberfil.sys 2012-07-12 10:45:13 Could not open C:\pagefile.sys 2012-07-12 10:52:34 >>> Virus 'Mal/FakeAV-DO' found in file C:\Program Files (x86)\Gateway Games\Virtual Villagers - The Secret City\Virtual Villagers - The Secret City-WT.exe\FILE:0001 2012-07-12 11:03:07 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} 2012-07-12 11:03:07 Could not open C:\System Volume Information\{58ea33b6-cc38-11e1-8520-00262d714433}{3808876b-c176-4e48-b7ae-04046e6cc752} 2012-07-12 11:03:07 Could not open C:\System Volume Information\{973640a7-cb15-11e1-a9fa-00262d714433}{3808876b-c176-4e48-b7ae-04046e6cc752} 2012-07-12 11:18:00 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb 2012-07-12 11:18:00 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb 2012-07-12 11:49:25 The following items will be cleaned up: 2012-07-12 11:49:25 Mal/FakeAV-DO 2012-07-12 12:01:49 >>> Virus 'Mal/FakeAV-DO' found in file C:\Program Files (x86)\Gateway Games\Virtual Villagers - The Secret City\Virtual Villagers - The Secret City-WT.exe\FILE:0001 2012-07-12 12:01:49 Disinfection failed 2012-07-12 12:02:09 Scan completed. 2012-07-12 12:02:09 ------------------------------------------------------------ With respect to my current issues/concerns, my computer appears to be running better since the runnings of combofix, mbam and sophos although sophos failed to remove the malware it discovered. ComboFix did take not quite an hour to run this morning (~1:30am -> 2:30am my time), could this be due to a more serious infection? MBAM detected one threat and removed it successfully, which is a good thing  . Prior to starting this fix process, my computer sometimes would freeze while gaming or even while browsing with chrome/ie. While I have yet to use my computer for online games, browsing has not lead to a freeze as of yet. The speed of my computer at startup still feels slower than it did before my pc became infected. Could this be from some damage done by the infection(s) or due to a lingering infection that the software run up to this point has not detected? Regardless, great work thus far with removing these threats from my computer. Awaiting further instructions.. |
13-Jul-2012, 04:04 AM
#9 | |||||||
| Apologies for dragging this out, I want to be 100% sure we`ve missed nothing, run the following :- Step 1 Download  TFC to your desktop, from either of the following linksLink 1 Link 2
Keep TFC it is an excellent utility to keep your system optimized, it empties all user temp folders, Java cache etc etc. Always remember to re-boot after a run, even if not prompted Step 2 Run ESET Online Scan
Frequently asked questions available Here Please read them before running the scan. Also be aware this scan can take several hours to complete depending on the size of your system. ESET log can be found here "C:\Program Files\ESET\EsetOnlineScanner\log.txt". Kevin.. |
Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.
If you're not already familiar with forums, watch our Welcome Guide to get started.
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
button.
to download the ESET Smart Installer. Save it to your desktop.
icon on your desktop.
button.
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
button.