Inactive AVG reports Trojan horse CRYPT.AQPI and Generic26.CLWW

Status
Not open for further replies.
Hi there. Any help gratefully received. Here are my logs for mbam, gmer ATTACH and dds. Thanks in anticipation;

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.07.01

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Simon :: SIMON-PC [administrator]

07/02/2012 11:57:25
mbam-log-2012-02-07 (11-57-25).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 195470
Time elapsed: 18 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 7
C:\Users\Simon\AppData\Local\Temp\3DCF.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Simon\AppData\Local\Temp\2530.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Simon\Downloads\SoftonicDownloader_for_movica.exe (PUP.BundleOffer.Downloader.S) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Simon\AppData\Local\Temp\ms0cfg32.exe (Exploit.Drop.CFG) -> Quarantined and deleted successfully.

(end)



GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-02-07 12:36:05
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST325031 rev.CC46
Running: 65nd2y4o.exe; Driver: C:\Users\Simon\AppData\Local\Temp\pgloypog.sys


---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- Processes - GMER 1.0.15 ----

Process PING.EXE (*** hidden *** ) 4028

---- EOF - GMER 1.0.15 ----

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 27/01/2011 19:32:35
System Uptime: 07/02/2012 12:19:28 (0 hours ago)
.
Motherboard: Dell Inc. | | 0200DY
Processor: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz | CPU | 2933/1066mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 222 GiB total, 119.394 GiB free.
D: is CDROM ()
G: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Community Help
Adobe Connect Add-in
Adobe Content Viewer
Adobe Dreamweaver CS5
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Illustrator CS5
Adobe InDesign CS5.5
Adobe Media Player
Adobe Photoshop CS5.1
Adobe Reader X
Any Video Converter 3.2.7
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Control Center
µTorrent
AVG 2011
Backup & Storage v2.3.1.37683
Bing Bar
Bing Rewards Client Installer
BioAPI Framework
Bonjour
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Citrix online plug-in (Web)
Compatibility Pack for the 2007 Office system
CompendiumDS
Conduit Engine
CopyTrans Suite Remove Only
D3DX10
Dell Backup and Recovery Manager
Dell Control Point
Dell ControlPoint Security Manager
Dell Edoc Viewer
Dell Embassy Trust Suite by Wave Systems
Dell Security Device Driver Pack
Document Manager Lite
Dropbox
EMBASSY Security Center
EMBASSY Security Setup
ESC Home Page Plugin
FileZilla Client 3.3.5.1
Free FLAC to MP3 Converter 1.0
Gemalto
Google Chrome
Google SketchUp 8
GoToMeeting 5.0.0.799
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
iCloud
Intel(R) Control Center
Intel(R) Network Connections 15.2.89.0
Intel(R) Rapid Storage Technology
Intel® Active Management Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 27
Junk Mail filter update
Malwarebytes Anti-Malware version 1.60.1.1000
Market Samurai
McAfee Security Scan Plus
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2008
Microsoft SQL Server 2008 Common Files
Microsoft SQL Server 2008 Management Studio
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 Policies
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft SQL Server Compact 3.5 SP1 Query Tools English
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual Studio Tools for Applications 2.0 - ENU
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Mozilla Firefox 9.0.1 (x86 en-GB)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NETGEAR WNA1100 wireless USB 2.0 adapter
NTRU TCG Software Stack
PDF Settings CS5
Picasa 3
PowerDVD DX
Preboot Manager
Private Information Manager
QuickTime
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
RealUpgrade 1.1
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE 10.3
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Safari
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Wizards
SEO SpyGlass
Skins
Trusted Drive Manager
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
UPEK TouchChip Fingerprint Reader
uTorrentBar Toolbar
Wave Infrastructure Installer
Wave Support Software
WebEx
Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinRAR 4.01 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
07/02/2012 12:21:04, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
07/02/2012 12:20:28, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
07/02/2012 12:20:26, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
07/02/2012 12:20:26, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
07/02/2012 12:20:20, Error: Service Control Manager [7001] - The NTRU TSS v1.2.1.29 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
07/02/2012 12:20:19, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\athExt.dll Error Code: 126
06/02/2012 18:35:20, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
05/02/2012 20:55:34, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSWNA1100 service.
01/02/2012 16:30:28, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user Simon-PC\Simon SID (S-1-5-21-2078146606-3485515792-3425677271-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
01/02/2012 16:30:28, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user Simon-PC\Simon SID (S-1-5-21-2078146606-3485515792-3425677271-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27
Run by Simon at 12:37:21 on 2012-02-07
Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3582.1802 [GMT 0:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\AVG\AVG10\avgemcx.exe
C:\Windows\system32\conhost.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Citrix\ICA Client\concentr.exe
C:\dell\DBRM\Reminder\DbrmTrayicon.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Citrix\ICA Client\wfcrun32.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Windows\PixArt\Pac207\Monitor.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Citrix\GoToMeeting\799\g2mstart.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
C:\Program Files\Citrix\GoToMeeting\799\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\799\g2mlauncher.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\conhost.exe
C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Simon\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\notepad.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Windows\system32\conhost.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.co.uk/
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: H - No File
uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
uRun: [Google Update] "c:\users\simon\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [GoToMeeting] "c:\program files\citrix\gotomeeting\799\g2mstart.exe" "/Trigger RunAtLogon"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [IAStorIcon] c:\program files\intel\intel(r) rapid storage technology\IAStorIcon.exe
mRun: [picon] "c:\program files\common files\intel\privacy icon\PIconStartup.exe" -startup
mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [jswtrayutil] "c:\program files\netgear\wna1100\jswtrayutil.exe"
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup
mRun: [DBRMTray] c:\dell\dbrm\reminder\DbrmTrayIcon.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [Monitor] c:\windows\pixart\pac207\Monitor.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Backup & Storage] "c:\program files\virginmedia\v stuff backup\Backup & Storage.exe"
mRunOnce: [DBRMTray] c:\dell\dbrm\reminder\TrayApp.exe
StartupFolder: c:\users\simon\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\simon\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wna1100\WNA1100.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\tdmnot~1.lnk - c:\program files\wave systems corp\trusted drive manager\TdmNotify.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL
LSP: mswsock.dll
Trusted Zone: brethertons.co.uk\remote
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FBAF77F5-3EA5-4340-A9C1-C9EE3179D7F6} : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3} : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\3596D6F6E6 : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\4777963747 : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\4777963747E65647 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\6796277696E6D65646961653632303838343 : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\6796277696E6D65646961693732393732363 : DhcpNameServer = 194.168.4.100 194.168.8.100
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\10.0.6\ViProtocol.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
LSA: Authentication Packages = msv1_0 wvauth
Hosts: 94.63.147.22 www.google.com
Hosts: 94.63.147.23 www.bing.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Be0c8a143-fbb5-48c5-8b06-513cea2eda74%7D&mid=6fc0fef31c6e47d69ce76d791d46772d-b5e63c70b7d9395af5bbd17c419f6219b2afe224&ds=AVG&v=9.0.0.18.1&lang=us&pr=fr&d=2011-12-12%2017%3A21%3A26&sap=ku&q=
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
FF - component: c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\simon\appdata\local\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\users\simon\appdata\roaming\mozilla\plugins\npatgpc.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\drivers\SCMNdisP.sys [2011-1-27 21728]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-4 297168]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2011-1-27 20384]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-1-20 172032]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2012-1-31 7391072]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\intel\intel(r) rapid storage technology\IAStorDataMgrSvc.exe [2011-1-20 13336]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\common files\intel\privacy icon\uns\UNS.exe [2011-1-20 2071064]
R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\10.0.6\ToolbarUpdater.exe [2012-1-18 909152]
R2 WSWNA1100;WSWNA1100;c:\program files\netgear\wna1100\WifiSvc.exe [2011-1-27 268768]
R3 athur;Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\drivers\athur.sys [2011-1-27 1501696]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-5-27 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 21968]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2011-1-20 224424]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-2-7 40776]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-13 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-12 167264]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S3 glancedrv;glancedrv;c:\windows\system32\drivers\glancedrv.sys [2011-8-25 34080]
S3 jswpsapi;JumpStart Wi-Fi Protected Setup;c:\program files\netgear\wna1100\jswpsapi.exe [2011-1-27 960992]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [2006-12-5 507136]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-30 1343400]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2012-02-07 12:22:05 -------- d-----w- c:\users\simon\appdata\local\{A8FF38D0-2EB3-4874-A9C8-FFF00E60D3BB}
2012-02-07 12:21:41 -------- d-----w- c:\users\simon\appdata\local\{4AD60A01-505C-4D26-85FC-A42F6B1960BF}
2012-02-07 12:21:33 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-02-07 12:04:39 -------- d-----w- c:\users\simon\appdata\local\{04CDE7E4-DB96-4622-A524-59C0BE10390A}
2012-02-07 12:04:14 -------- d-----w- c:\users\simon\appdata\local\{6F8236B6-8F65-4F9B-B025-88CADE57F3A9}
2012-02-07 11:56:34 -------- d-----w- c:\users\simon\appdata\roaming\Malwarebytes
2012-02-07 11:56:20 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-07 11:56:20 -------- d-----w- c:\programdata\Malwarebytes
2012-02-07 11:56:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-02-07 11:16:18 0 --sha-w- c:\windows\system32\dds_trash_log.cmd
2012-02-07 11:14:53 49640 --sh--w- c:\users\simon\appdata\local\dplayx.dll
2012-02-07 11:14:51 87528 --sh--w- c:\users\simon\appdata\local\dplaysvr.exe
2012-02-07 10:09:28 -------- d-----w- c:\users\simon\appdata\local\{CE82AACC-1E4D-432E-9620-3717CB9B760B}
2012-02-07 10:09:17 -------- d-----w- c:\users\simon\appdata\local\{130C0A7A-C1D3-4654-B55F-78671CE4CBB3}
2012-02-06 17:18:20 -------- d-----w- c:\users\simon\appdata\local\{21AA88D2-ADCD-499A-AE99-208FE1C9FE5F}
2012-02-06 17:17:59 -------- d-----w- c:\users\simon\appdata\local\{EDDF8FDD-CA46-4D2E-9DD5-B6FE10DA3DB1}
2012-02-06 09:18:17 -------- d-----w- c:\users\simon\appdata\local\{5B1EED27-47F3-48BB-8C82-056220998E8A}
2012-02-06 09:16:27 -------- d-----w- c:\users\simon\appdata\local\{F7A7F091-99A2-4D36-AD64-CBE0EFC7F111}
2012-02-05 18:49:19 -------- d-----w- c:\users\simon\appdata\local\{54D8B9A8-0D91-4DFE-9919-1D997D431507}
2012-02-05 03:06:37 -------- d-----w- c:\users\simon\appdata\local\{5FF24947-4C13-4A61-B053-0F700A9B4F19}
2012-02-04 11:44:59 -------- d-----w- c:\users\simon\appdata\local\{C5C812AE-840E-4AD8-A512-814CE6437EBC}
2012-02-04 11:44:10 -------- d-----w- c:\users\simon\appdata\local\{2E22E4F3-4B35-4721-88B7-5F720B9C9EB4}
2012-02-03 18:07:38 -------- d-----w- c:\users\simon\appdata\local\{C5232A99-99F7-47AE-AA46-942593F58072}
2012-02-03 18:07:16 -------- d-----w- c:\users\simon\appdata\local\{FBBCD115-637B-42F2-A217-7C52A311CCB6}
2012-02-01 22:41:45 -------- d-----w- c:\users\simon\appdata\local\{0B69EAB3-2665-4F1C-B274-23668C5B999B}
2012-02-01 22:41:34 -------- d-----w- c:\users\simon\appdata\local\{F8AAF3AE-1F31-45B3-B714-0E77A56249DC}
2012-02-01 10:41:49 -------- d-----w- c:\users\simon\appdata\local\{94A84BA9-C91A-4E36-AED9-439B0E8049C8}
2012-02-01 10:41:36 -------- d-----w- c:\users\simon\appdata\local\{228C371F-823C-4D3F-8EA5-7D3BDE99F17D}
2012-01-31 22:41:46 -------- d-----w- c:\users\simon\appdata\local\{E6A01B96-7DD0-4C57-A5E1-5C231D67F40F}
2012-01-31 22:41:35 -------- d-----w- c:\users\simon\appdata\local\{3A70D144-6F72-4CDE-866E-6DDBAC5AF875}
2012-01-31 10:42:00 -------- d-----w- c:\users\simon\appdata\local\{75A6B8B5-E47A-4F66-9FFA-3587AFFEA356}
2012-01-31 10:41:36 -------- d-----w- c:\users\simon\appdata\local\{B3EAF8D1-4E17-4684-8AE7-061C96AC1949}
2012-01-30 22:41:59 -------- d-----w- c:\users\simon\appdata\local\{3C3BED94-509B-44E8-9B07-57396AB54997}
2012-01-30 22:41:36 -------- d-----w- c:\users\simon\appdata\local\{74B68387-00B4-44A9-87A7-27956F222E3C}
2012-01-30 10:42:00 -------- d-----w- c:\users\simon\appdata\local\{EA7ADD70-5263-46EC-A15D-E5E9B8104841}
2012-01-30 10:41:37 -------- d-----w- c:\users\simon\appdata\local\{3F77E2E6-7A6C-4D45-A051-86C10566516F}
2012-01-29 22:41:51 -------- d-----w- c:\users\simon\appdata\local\{BB33463E-353A-4B05-97AD-AD22914E3180}
2012-01-29 22:41:37 -------- d-----w- c:\users\simon\appdata\local\{AD989A28-EBE6-477D-A58B-5166A7E66A1F}
2012-01-29 10:42:05 -------- d-----w- c:\users\simon\appdata\local\{F692A178-D800-4E07-99AC-6357C868C550}
2012-01-29 10:41:40 -------- d-----w- c:\users\simon\appdata\local\{237986EF-4C5C-4493-9E20-61EC9CCCA6B7}
2012-01-28 22:42:03 -------- d-----w- c:\users\simon\appdata\local\{1B57856F-810A-4925-9786-C3D03946DC87}
2012-01-28 22:41:51 -------- d-----w- c:\users\simon\appdata\local\{758E7938-C6BD-437D-ADFA-57F90CC375E3}
2012-01-28 10:42:03 -------- d-----w- c:\users\simon\appdata\local\{1C838561-9CBE-478E-8A83-3F2A4C4A1797}
2012-01-28 10:41:51 -------- d-----w- c:\users\simon\appdata\local\{12D2D7FF-1030-49B2-B7F2-A1804EDA3A7C}
2012-01-27 22:42:02 -------- d-----w- c:\users\simon\appdata\local\{96CD44A4-A4DF-42DB-A347-E8404E0240AF}
2012-01-27 22:41:50 -------- d-----w- c:\users\simon\appdata\local\{222C35F9-35B7-4ECD-A985-7EAC665C32E3}
2012-01-27 10:42:01 -------- d-----w- c:\users\simon\appdata\local\{60513276-AA12-4279-816F-5B5CAB32ECEE}
2012-01-27 10:41:50 -------- d-----w- c:\users\simon\appdata\local\{4B012CE1-D0E8-4C38-9FFA-95DA800CD7E4}
2012-01-20 09:33:56 -------- d-----w- c:\program files\Market Samurai
2012-01-20 08:19:30 -------- d-----w- c:\users\simon\appdata\local\{5B67AFD2-54F7-4B3F-81E0-78FB564FFB3D}
2012-01-20 08:19:08 -------- d-----w- c:\users\simon\appdata\local\{239118CD-2EC3-4F13-9558-7AA6E8C98EC0}
2012-01-19 21:09:36 -------- d-----w- c:\users\simon\appdata\local\{9E936F4E-E65C-407D-83D4-3B0CA3FC2EEE}
2012-01-19 21:09:14 -------- d-----w- c:\users\simon\appdata\local\{5B37B706-B8AC-45DF-862A-279C706A14CF}
2012-01-19 14:31:10 -------- d-----w- c:\users\simon\appdata\local\VirginMedia
2012-01-19 14:31:10 -------- d-----w- c:\programdata\VirginMedia
2012-01-19 14:31:07 4292096 ----a-w- c:\windows\system32\Redemption.dll
2012-01-19 14:31:05 -------- d-----w- c:\program files\VirginMedia
2012-01-19 09:16:13 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-01-19 09:16:13 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2012-01-19 09:15:41 -------- d-----w- c:\program files\iPod
2012-01-19 09:15:40 -------- d-----w- c:\program files\iTunes
2012-01-19 09:11:32 -------- d-----w- c:\program files\Bonjour
2012-01-19 09:09:35 -------- d-----w- c:\users\simon\appdata\local\{2E977B69-A7C5-4F4F-A803-F93569F17A42}
2012-01-19 09:09:15 -------- d-----w- c:\users\simon\appdata\local\{53E06AA7-9D1A-4EB6-AB0E-F10D37E414A9}
2012-01-18 20:09:11 -------- d-----w- c:\users\simon\appdata\local\{2EE4B6D7-9EAB-4715-A7C4-F3B40CCEAA3E}
2012-01-18 20:09:00 -------- d-----w- c:\users\simon\appdata\local\{8E7EC7B8-13B2-4289-88DC-7416E5EB39BF}
2012-01-18 08:09:12 -------- d-----w- c:\users\simon\appdata\local\{ACB524CB-C94F-4592-805B-5D6FC0DA1647}
2012-01-18 08:09:01 -------- d-----w- c:\users\simon\appdata\local\{CFBB8C94-AEFD-4A88-AA58-8F7AB236D315}
2012-01-18 08:08:50 -------- d-----w- c:\users\simon\appdata\local\{5BBD552D-BB71-40E7-9A12-244C96426F20}
2012-01-18 08:08:38 -------- d-----w- c:\users\simon\appdata\local\{571C559F-E47B-40A0-BC90-6EDE192CAE59}
2012-01-17 18:23:09 224768 ----a-w- c:\windows\system32\schannel.dll
2012-01-17 18:23:09 1037312 ----a-w- c:\windows\system32\lsasrv.dll
2012-01-17 18:23:08 99840 ----a-w- c:\windows\system32\sspicli.dll
2012-01-17 18:23:08 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-01-17 18:23:08 369352 ----a-w- c:\windows\system32\drivers\cng.sys
2012-01-17 18:23:08 314368 ----a-w- c:\windows\system32\webio.dll
2012-01-17 18:23:08 22528 ----a-w- c:\windows\system32\lsass.exe
2012-01-17 18:23:08 22016 ----a-w- c:\windows\system32\secur32.dll
2012-01-17 18:23:08 15360 ----a-w- c:\windows\system32\sspisrv.dll
2012-01-17 18:23:08 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-01-17 17:40:23 -------- d-----w- c:\users\simon\appdata\local\{CE3682A9-D4C9-479D-AFCF-D8D66D0B2ED0}
2012-01-17 17:40:11 -------- d-----w- c:\users\simon\appdata\local\{8C1B3118-3A30-4C36-A186-852566E35276}
2012-01-17 10:23:25 -------- d-----w- c:\users\simon\appdata\local\{83055E0A-B4C7-4772-BA04-07B0F165004F}
2012-01-17 10:23:14 -------- d-----w- c:\users\simon\appdata\local\{78EC6307-BCCD-435F-8419-358193230134}
2012-01-16 21:15:24 -------- d-----w- c:\users\simon\appdata\local\{6BF8264A-E96A-4F15-AE50-FBCC5D6066D4}
2012-01-16 21:15:12 -------- d-----w- c:\users\simon\appdata\local\{90512D07-6021-40E3-955B-45DD0257651A}
2012-01-16 09:15:34 -------- d-----w- c:\users\simon\appdata\local\{5DF3F5FB-8F0B-491F-8DD5-9B439406D8A7}
2012-01-16 09:15:11 -------- d-----w- c:\users\simon\appdata\local\{6A399368-D5EC-4004-BBCF-78E071147A8C}
2012-01-15 21:15:23 -------- d-----w- c:\users\simon\appdata\local\{B172EE74-1AD5-4524-9522-63D6D9F17272}
2012-01-15 21:15:11 -------- d-----w- c:\users\simon\appdata\local\{69F9F6FE-0DEE-43D4-BACA-09E2D0D8D8D8}
2012-01-15 09:15:33 -------- d-----w- c:\users\simon\appdata\local\{DB645B41-53EC-4E2F-BB63-0732B14F4400}
2012-01-15 09:15:11 -------- d-----w- c:\users\simon\appdata\local\{DD2B7515-1DF6-4172-8A69-A6DBFF157DC9}
2012-01-14 21:15:29 -------- d-----w- c:\users\simon\appdata\local\{DD7239EA-CC76-4AAF-B181-6F875C1144D9}
2012-01-14 21:15:17 -------- d-----w- c:\users\simon\appdata\local\{1AF22629-6DBC-44D4-A2DE-3615C2351BFC}
2012-01-14 09:15:37 -------- d-----w- c:\users\simon\appdata\local\{77D60410-94FC-496C-B199-4716EDCEE4E8}
2012-01-14 09:15:15 -------- d-----w- c:\users\simon\appdata\local\{D8203B67-68F1-44E7-AF8C-8BA54D63A3A1}
2012-01-13 21:15:39 -------- d-----w- c:\users\simon\appdata\local\{E512A4A9-E93D-49F6-B05A-EFAAC5387872}
2012-01-13 21:15:16 -------- d-----w- c:\users\simon\appdata\local\{1302B6B3-3C76-459F-B6C9-2D3A0E6FE7C8}
2012-01-13 09:15:37 -------- d-----w- c:\users\simon\appdata\local\{FC793043-CF28-47BE-84A0-DB156FB4A961}
2012-01-13 09:15:15 -------- d-----w- c:\users\simon\appdata\local\{8F13D1EC-E8F4-4066-BB72-9B164DA46CF2}
2012-01-12 21:15:26 -------- d-----w- c:\users\simon\appdata\local\{344E0379-6B07-4C0B-90C7-26F7903F8FF9}
2012-01-12 21:15:15 -------- d-----w- c:\users\simon\appdata\local\{48764AE0-8B9C-4A5B-8C69-C4FD4DD5693D}
2012-01-12 09:15:39 -------- d-----w- c:\users\simon\appdata\local\{DF7C0241-A497-45F5-B082-B0C7D39F701B}
2012-01-12 09:15:16 -------- d-----w- c:\users\simon\appdata\local\{AD9D0B46-A810-4786-8902-245460D90CC9}
2012-01-11 21:15:27 -------- d-----w- c:\users\simon\appdata\local\{0A802956-6B2F-4A5D-800A-B5F222BCCE79}
2012-01-11 21:15:16 -------- d-----w- c:\users\simon\appdata\local\{10E9D103-AE43-4A19-80A5-33634817BFF4}
2012-01-11 14:43:56 -------- d-----w- c:\users\simon\appdata\local\{2D01EE80-795A-4838-BC74-ED0DA506A00D}
2012-01-11 14:43:34 -------- d-----w- c:\users\simon\appdata\local\{D7AFE3C0-73C2-4C56-B29C-50C3CE85FBAE}
2012-01-11 09:15:28 -------- d-----w- c:\users\simon\appdata\local\{F7E07405-1FAE-44F9-BEC0-AEAAE648BDE5}
2012-01-11 09:15:17 -------- d-----w- c:\users\simon\appdata\local\{DB59901E-A1FA-43C5-8348-310C820F7FAC}
2012-01-11 09:15:07 -------- d-----w- c:\users\simon\appdata\local\{782E1289-B3F1-4ECB-832E-A5371610751B}
2012-01-11 09:14:56 -------- d-----w- c:\users\simon\appdata\local\{EDE3CA71-B9E1-4B1B-ACDF-22AC49F1320F}
2012-01-11 01:56:01 -------- d-----w- c:\users\simon\appdata\local\{3B80AAC8-A494-4035-AD73-79BDECA9232D}
2012-01-11 01:55:39 -------- d-----w- c:\users\simon\appdata\local\{627AE290-E1FD-4A15-9EA4-200C9884C6B9}
2012-01-10 23:56:58 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-01-10 23:56:56 67072 ----a-w- c:\windows\system32\packager.dll
2012-01-10 23:56:55 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-01-10 23:56:55 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-01-10 13:56:00 -------- d-----w- c:\users\simon\appdata\local\{443E21C6-FFEE-460F-A0CB-B2C8923FB94C}
2012-01-10 13:55:38 -------- d-----w- c:\users\simon\appdata\local\{30CB7F69-CCB1-4A18-A757-EDD7DBCFA77D}
2012-01-10 01:55:50 -------- d-----w- c:\users\simon\appdata\local\{3F466C53-C9E8-4B24-820C-86C7937A1632}
2012-01-10 01:55:39 -------- d-----w- c:\users\simon\appdata\local\{17646E2B-3B90-4E33-A03F-290E25AD52AB}
2012-01-09 13:55:49 -------- d-----w- c:\users\simon\appdata\local\{B3D553F9-6D96-4ACB-9F53-A1B868E89337}
2012-01-09 13:55:38 -------- d-----w- c:\users\simon\appdata\local\{852D491C-F5C3-4EEB-8BB1-897755D72FC7}
2012-01-09 11:25:36 548864 ----a-w- c:\program files\mozilla firefox\msvcp80.dll
2012-01-09 11:25:36 479232 ----a-w- c:\program files\mozilla firefox\msvcm80.dll
2012-01-09 11:25:36 43992 ----a-w- c:\program files\mozilla firefox\mozutils.dll
2012-01-09 11:25:35 626688 ----a-w- c:\program files\mozilla firefox\msvcr80.dll
2012-01-09 10:16:45 -------- d-----w- c:\users\simon\appdata\local\{0273E93B-8261-4705-8E16-201AFDEF4D13}
2012-01-09 10:16:34 -------- d-----w- c:\users\simon\appdata\local\{B2C60E87-DF70-4721-8980-23FCEAD57ECC}
.
==================== Find3M ====================
.
2012-01-16 09:34:09 60304 ----a-w- c:\users\simon\g2mdlhlpx.exe
2011-12-19 09:16:54 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-24 04:23:31 2340352 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 12:38:13.70 ===============
 
Welcome to TechSpot! Let's see what hijacked your Host files and is routing you through Romania!

Before you do the scans below, please do the following:
1. Uninstall the uTorrent Toolbar. Use Add/Remove Programs to uninstall, the use Windows explorer to access Computer> Local Drive> Programs> do a right click> Delete on the uTorrent folder.
2. Uninstall the Conduit Engine. Same path as above
3. Temporarily disable the Mcafee Security Scan Scheduler
Reboot when finished with above.
====================================
Then proceed with the following
To run the Eset Online Virus Scan:
If you use Internet Explorer:
  1. Open the ESETOnlineScan
  2. Skip to #4 to "Continue with the directions"

    If you are using a browser other than Internet Explorer
  3. Open Eset Smart Installer
    [o] Click on the esetsmartinstaller_enu.exelink and save to the desktop.
    [o] Double click on the desktop icon to run.
    [o] After successful installation of the ESET Smart Installer, the ESET Online Scanner will be launched in a new Window
  4. Continue with the directions.
  5. Check 'Yes I accept terms of use.'
  6. Click Start button
  7. Accept any security warnings from your browser.
    esetonlinescannersettings_thumb.jpg
  8. Uncheck 'Remove found threats'
  9. Check 'Scan archives/
  10. Leave remaining settings as is.
  11. Press the Start button.
  12. ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
  13. When the scan completes, press List of found threats
  14. Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
  15. Push the Back button, then Finish
NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
=========================================
I'd like you to run Combofix- but it won't run with AVG. You will need to temporarily uninstall AVG as follows:

Download AppRemover and save to the desktop
  1. Double click the setup on the desktop> click Next
  2. Select “Remove Security Application”
  3. Let scan finish to determine security apps
  4. A screen like below will appear:
    image_preview
  5. Click on Next after choice has been made
  6. Check the AVG program you want to uninstall
  7. After uninstall shows complete, follow online prompts to Exit the program.

Temporary AV: Use one:
Avira-AntiVir-Personal-Free-Antivirus
Avast Free Version
=============================
Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
  • Click START> then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
--------------------------------------
Expect these- they are normal:
1. If asked to install or or update the Recovery Console, allow. (you will need internet connection for this)
2. Before you run the Combofix scan, please disable any security software you have running.
3. Combofix may need to reboot your computer more than once to do its job this is normal.

Download Combofix from HERE or HEREhttp://www.forospyware.com/sUBs/ComboFix.exe and save to the desktop
  • Double click combofix.exe
    cf-icon.jpg
    & follow the prompts.
  • If prompted for Recovery Console, please allow.
  • Once installed, you should see a blue screen prompt that says:
    • The Recovery Console was successfully installed.[/b]
    • Note: If Combofix was downloaded to a flash drive, the Recovery Console will not install- just bypass and go on.[/b]
    • Note: No query will be made if the Recovery Console is already on the system.
  • .Close/disable all anti virus and anti malware programs
    (If you need help with this, please see HERE)
  • .Close any open browsers.
  • .Click on Yes, to continue scanning for malware
  • .If Combofix asks you to update the program, allow
  • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
Re-enable your Antivirus software.
Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Note 2:If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart the computer.
Note 3:CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
=====================================
Be sure to add one of the Temporary AV programs suggested. The McAfee isn't an AV- it's a scan that tells you if security programs are running,

Please leave log for the Eset scan and Combofix in your next reply.
====================================
My Guidelines: please read and follow:
  • Be patient. Malware cleaning takes time. I am also working with other members while I am helping you.
  • Read my instructions carefully. If you don't understand or have a problem, ask me. Follow the order of the tasks I give you. Order is crucial in cleaning process.
  • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
  • File sharing programs should be uninstalled or disabled during the cleaning process..
  • Observe these:
    [o] Don't follow directions given to someone else
    [o] Don't use any other cleaning programs or scans while I'm helping you.
    [o] Don't use a Registry cleaner or make any changes in the Registry.
    [o] Don't download and install new programs- except those I give you.

If I haven't replied back to you within 48 hours, you can send a PMwith your thread link in it as a reminder. Do not include technical problems from your thread. Support is given only in the forum.
Threads are closed after 5 days if there is no reply.
 
Status
Not open for further replies.
Back