also @ TechSpot: Updated Microsoft EULA prohibits class action lawsuits

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Inactive] AVG reports Trojan horse CRYPT.AQPI and Generic26.CLWW

Discussion in 'Virus and Malware Removal' started by simonh, Feb 7, 2012.

Thread Status:
Not open for further replies.

  1. simonh Newcomer, in training

    Hi there. Any help gratefully received. Here are my logs for mbam, gmer ATTACH and dds. Thanks in anticipation;

    Malwarebytes Anti-Malware 1.60.1.1000
    www.malwarebytes.org

    Database version: v2012.02.07.01

    Windows 7 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Simon :: SIMON-PC [administrator]

    07/02/2012 11:57:25
    mbam-log-2012-02-07 (11-57-25).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 195470
    Time elapsed: 18 minute(s), 12 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 1
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 7
    C:\Users\Simon\AppData\Local\Temp\3DCF.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\Simon\AppData\Local\Temp\2530.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\Simon\Downloads\SoftonicDownloader_for_movica.exe (PUP.BundleOffer.Downloader.S) -> Quarantined and deleted successfully.
    C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Users\Simon\AppData\Local\Temp\ms0cfg32.exe (Exploit.Drop.CFG) -> Quarantined and deleted successfully.

    (end)



    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2012-02-07 12:36:05
    Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST325031 rev.CC46
    Running: 65nd2y4o.exe; Driver: C:\Users\Simon\AppData\Local\Temp\pgloypog.sys


    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    ---- Processes - GMER 1.0.15 ----

    Process PING.EXE (*** hidden *** ) 4028

    ---- EOF - GMER 1.0.15 ----

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 27/01/2011 19:32:35
    System Uptime: 07/02/2012 12:19:28 (0 hours ago)
    .
    Motherboard: Dell Inc. | | 0200DY
    Processor: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz | CPU | 2933/1066mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 222 GiB total, 119.394 GiB free.
    D: is CDROM ()
    G: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    No restore point in system.
    .
    ==== Installed Programs ======================
    .
    Adobe AIR
    Adobe Community Help
    Adobe Connect Add-in
    Adobe Content Viewer
    Adobe Dreamweaver CS5
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Illustrator CS5
    Adobe InDesign CS5.5
    Adobe Media Player
    Adobe Photoshop CS5.1
    Adobe Reader X
    Any Video Converter 3.2.7
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ATI Catalyst Control Center
    µTorrent
    AVG 2011
    Backup & Storage v2.3.1.37683
    Bing Bar
    Bing Rewards Client Installer
    BioAPI Framework
    Bonjour
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    ccc-utility
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Citrix online plug-in (Web)
    Compatibility Pack for the 2007 Office system
    CompendiumDS
    Conduit Engine
    CopyTrans Suite Remove Only
    D3DX10
    Dell Backup and Recovery Manager
    Dell Control Point
    Dell ControlPoint Security Manager
    Dell Edoc Viewer
    Dell Embassy Trust Suite by Wave Systems
    Dell Security Device Driver Pack
    Document Manager Lite
    Dropbox
    EMBASSY Security Center
    EMBASSY Security Setup
    ESC Home Page Plugin
    FileZilla Client 3.3.5.1
    Free FLAC to MP3 Converter 1.0
    Gemalto
    Google Chrome
    Google SketchUp 8
    GoToMeeting 5.0.0.799
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946040)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946308)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB946344)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947540)
    Hotfix for Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789)
    iCloud
    Intel(R) Control Center
    Intel(R) Network Connections 15.2.89.0
    Intel(R) Rapid Storage Technology
    Intel® Active Management Technology
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 27
    Junk Mail filter update
    Malwarebytes Anti-Malware version 1.60.1.1000
    Market Samurai
    McAfee Security Scan Plus
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Office 2010
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
    Microsoft SQL Server 2008
    Microsoft SQL Server 2008 Common Files
    Microsoft SQL Server 2008 Management Studio
    Microsoft SQL Server 2008 Native Client
    Microsoft SQL Server 2008 Policies
    Microsoft SQL Server 2008 Setup Support Files
    Microsoft SQL Server Compact 3.5 SP1 English
    Microsoft SQL Server Compact 3.5 SP1 Query Tools English
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual Studio Tools for Applications 2.0 - ENU
    Microsoft_VC80_ATL_x86
    Microsoft_VC80_CRT_x86
    Microsoft_VC80_MFC_x86
    Microsoft_VC80_MFCLOC_x86
    Microsoft_VC90_ATL_x86
    Microsoft_VC90_CRT_x86
    Microsoft_VC90_MFC_x86
    Microsoft_VC90_MFCLOC_x86
    Mozilla Firefox 9.0.1 (x86 en-GB)
    MSVCRT
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    NETGEAR WNA1100 wireless USB 2.0 adapter
    NTRU TCG Software Stack
    PDF Settings CS5
    Picasa 3
    PowerDVD DX
    Preboot Manager
    Private Information Manager
    QuickTime
    RealNetworks - Microsoft Visual C++ 2008 Runtime
    RealPlayer
    RealUpgrade 1.1
    Roxio Creator Audio
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE 10.3
    Roxio Creator Tools
    Roxio Express Labeler 3
    Roxio Update Manager
    Safari
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Wizards
    SEO SpyGlass
    Skins
    Trusted Drive Manager
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    UPEK TouchChip Fingerprint Reader
    uTorrentBar Toolbar
    Wave Infrastructure Installer
    Wave Support Software
    WebEx
    Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Media Player Firefox Plugin
    WinRAR 4.01 (32-bit)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    07/02/2012 12:21:04, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.
    07/02/2012 12:20:28, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    07/02/2012 12:20:26, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    07/02/2012 12:20:26, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    07/02/2012 12:20:20, Error: Service Control Manager [7001] - The NTRU TSS v1.2.1.29 TCS service depends on the TPM Base Services service which failed to start because of the following error: The operation completed successfully.
    07/02/2012 12:20:19, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\athExt.dll Error Code: 126
    06/02/2012 18:35:20, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
    05/02/2012 20:55:34, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WSWNA1100 service.
    01/02/2012 16:30:28, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D3DCB472-7261-43CE-924B-0704BD730D5F} and APPID {D3DCB472-7261-43CE-924B-0704BD730D5F} to the user Simon-PC\Simon SID (S-1-5-21-2078146606-3485515792-3425677271-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    01/02/2012 16:30:28, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {145B4335-FE2A-4927-A040-7C35AD3180EF} and APPID {145B4335-FE2A-4927-A040-7C35AD3180EF} to the user Simon-PC\Simon SID (S-1-5-21-2078146606-3485515792-3425677271-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    .
    ==== End Of File ===========================


    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27
    Run by Simon at 12:37:21 on 2012-02-07
    Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3582.1802 [GMT 0:00]
    .
    AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG10\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Microsoft\BingBar\SeaPort.EXE
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.0.6\ToolbarUpdater.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\AVG\AVG10\avgnsx.exe
    C:\Program Files\AVG\AVG10\avgemcx.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
    C:\Windows\system32\WUDFHost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
    C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
    c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\AVG\AVG10\avgtray.exe
    C:\Program Files\Citrix\ICA Client\concentr.exe
    C:\dell\DBRM\Reminder\DbrmTrayicon.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files\Real\RealPlayer\Update\realsched.exe
    C:\Windows\PixArt\Pac207\Monitor.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\AVG Secure Search\vprot.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\VirginMedia\V Stuff Backup\Backup & Storage.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Citrix\GoToMeeting\799\g2mstart.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
    C:\Program Files\NETGEAR\WNA1100\WNA1100.exe
    C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe
    C:\Program Files\Citrix\GoToMeeting\799\g2mcomm.exe
    C:\Program Files\Citrix\GoToMeeting\799\g2mlauncher.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
    C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Users\Simon\AppData\Roaming\Dropbox\bin\Dropbox.exe
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files\Intel\AMT\LMS.exe
    C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\notepad.exe
    C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    C:\Program Files\AVG\AVG10\avgcsrvx.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\conhost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uSearch Page = hxxp://www.google.com
    uStart Page = hxxp://www.google.co.uk/
    uSearch Bar = hxxp://www.google.com/ie
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: H - No File
    uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    mURLSearchHooks: H - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
    BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
    BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
    BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
    TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
    TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll
    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
    TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\10.0.0.7\AVG Secure Search_toolbar.dll
    TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
    {e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
    uRun: [Google Update] "c:\users\simon\appdata\local\google\update\GoogleUpdate.exe" /c
    uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
    uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
    uRun: [GoToMeeting] "c:\program files\citrix\gotomeeting\799\g2mstart.exe" "/Trigger RunAtLogon"
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
    mRun: [IAStorIcon] c:\program files\intel\intel(r) rapid storage technology\IAStorIcon.exe
    mRun: [picon] "c:\program files\common files\intel\privacy icon\PIconStartup.exe" -startup
    mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe
    mRun: [USCService] c:\program files\dell\dell controlpoint\security manager\BcmDeviceAndTaskStatusService.exe
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [jswtrayutil] "c:\program files\netgear\wna1100\jswtrayutil.exe"
    mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
    mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup
    mRun: [DBRMTray] c:\dell\dbrm\reminder\DbrmTrayIcon.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
    mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
    mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
    mRun: [Monitor] c:\windows\pixart\pac207\Monitor.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin
    mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
    mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [Backup & Storage] "c:\program files\virginmedia\v stuff backup\Backup & Storage.exe"
    mRunOnce: [DBRMTray] c:\dell\dbrm\reminder\TrayApp.exe
    StartupFolder: c:\users\simon\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\simon\appdata\roaming\dropbox\bin\Dropbox.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wna1100\WNA1100.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\tdmnot~1.lnk - c:\program files\wave systems corp\trusted drive manager\TdmNotify.exe
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL
    LSP: mswsock.dll
    Trusted Zone: brethertons.co.uk\remote
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FBAF77F5-3EA5-4340-A9C1-C9EE3179D7F6} : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3} : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\3596D6F6E6 : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\4777963747 : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\4777963747E65647 : DhcpNameServer = 192.168.0.1
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\6796277696E6D65646961653632303838343 : DhcpNameServer = 194.168.4.100 194.168.8.100
    TCP: Interfaces\{FE52A8E8-2B22-489E-B314-9A25EC9AECF3}\6796277696E6D65646961693732393732363 : DhcpNameServer = 194.168.4.100 194.168.8.100
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
    Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\10.0.6\ViProtocol.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    LSA: Authentication Packages = msv1_0 wvauth
    Hosts: 94.63.147.22 www.google.com
    Hosts: 94.63.147.23 www.bing.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
    FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Be0c8a143-fbb5-48c5-8b06-513cea2eda74%7D&mid=6fc0fef31c6e47d69ce76d791d46772d-b5e63c70b7d9395af5bbd17c419f6219b2afe224&ds=AVG&v=9.0.0.18.1&lang=us&pr=fr&d=2011-12-12%2017%3A21%3A26&sap=ku&q=
    FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
    FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
    FF - component: c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll
    FF - component: c:\users\simon\appdata\roaming\mozilla\firefox\profiles\c6ka7und.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
    FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
    FF - plugin: c:\users\simon\appdata\local\google\update\1.3.21.99\npGoogleUpdate3.dll
    FF - plugin: c:\users\simon\appdata\roaming\mozilla\plugins\npatgpc.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
    R0 SCMNdisP;General NDIS Protocol Driver;c:\windows\system32\drivers\SCMNdisP.sys [2011-1-27 21728]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-4 297168]
    R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2011-1-27 20384]
    R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
    R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-1-20 172032]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2012-1-31 7391072]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\intel\intel(r) rapid storage technology\IAStorDataMgrSvc.exe [2011-1-20 13336]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\common files\intel\privacy icon\uns\UNS.exe [2011-1-20 2071064]
    R2 vToolbarUpdater;vToolbarUpdater;c:\program files\common files\avg secure search\vtoolbarupdater\10.0.6\ToolbarUpdater.exe [2012-1-18 909152]
    R2 WSWNA1100;WSWNA1100;c:\program files\netgear\wna1100\WifiSvc.exe [2011-1-27 268768]
    R3 athur;Atheros AR9271 Wireless Network Adapter Service;c:\windows\system32\drivers\athur.sys [2011-1-27 1501696]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-5-27 134480]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 21968]
    R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2011-1-20 224424]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2012-2-7 40776]
    R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-13 14336]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-12 167264]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
    S3 glancedrv;glancedrv;c:\windows\system32\drivers\glancedrv.sys [2011-8-25 34080]
    S3 jswpsapi;JumpStart Wi-Fi Protected Setup;c:\program files\netgear\wna1100\jswpsapi.exe [2011-1-27 960992]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [2006-12-5 507136]
    S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-1-30 1343400]
    S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
    .
    =============== Created Last 30 ================
    .
    2012-02-07 12:22:05 -------- d-----w- c:\users\simon\appdata\local\{A8FF38D0-2EB3-4874-A9C8-FFF00E60D3BB}
    2012-02-07 12:21:41 -------- d-----w- c:\users\simon\appdata\local\{4AD60A01-505C-4D26-85FC-A42F6B1960BF}
    2012-02-07 12:21:33 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2012-02-07 12:04:39 -------- d-----w- c:\users\simon\appdata\local\{04CDE7E4-DB96-4622-A524-59C0BE10390A}
    2012-02-07 12:04:14 -------- d-----w- c:\users\simon\appdata\local\{6F8236B6-8F65-4F9B-B025-88CADE57F3A9}
    2012-02-07 11:56:34 -------- d-----w- c:\users\simon\appdata\roaming\Malwarebytes
    2012-02-07 11:56:20 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-02-07 11:56:20 -------- d-----w- c:\programdata\Malwarebytes
    2012-02-07 11:56:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2012-02-07 11:16:18 0 --sha-w- c:\windows\system32\dds_trash_log.cmd
    2012-02-07 11:14:53 49640 --sh--w- c:\users\simon\appdata\local\dplayx.dll
    2012-02-07 11:14:51 87528 --sh--w- c:\users\simon\appdata\local\dplaysvr.exe
    2012-02-07 10:09:28 -------- d-----w- c:\users\simon\appdata\local\{CE82AACC-1E4D-432E-9620-3717CB9B760B}
    2012-02-07 10:09:17 -------- d-----w- c:\users\simon\appdata\local\{130C0A7A-C1D3-4654-B55F-78671CE4CBB3}
    2012-02-06 17:18:20 -------- d-----w- c:\users\simon\appdata\local\{21AA88D2-ADCD-499A-AE99-208FE1C9FE5F}
    2012-02-06 17:17:59 -------- d-----w- c:\users\simon\appdata\local\{EDDF8FDD-CA46-4D2E-9DD5-B6FE10DA3DB1}
    2012-02-06 09:18:17 -------- d-----w- c:\users\simon\appdata\local\{5B1EED27-47F3-48BB-8C82-056220998E8A}
    2012-02-06 09:16:27 -------- d-----w- c:\users\simon\appdata\local\{F7A7F091-99A2-4D36-AD64-CBE0EFC7F111}
    2012-02-05 18:49:19 -------- d-----w- c:\users\simon\appdata\local\{54D8B9A8-0D91-4DFE-9919-1D997D431507}
    2012-02-05 03:06:37 -------- d-----w- c:\users\simon\appdata\local\{5FF24947-4C13-4A61-B053-0F700A9B4F19}
    2012-02-04 11:44:59 -------- d-----w- c:\users\simon\appdata\local\{C5C812AE-840E-4AD8-A512-814CE6437EBC}
    2012-02-04 11:44:10 -------- d-----w- c:\users\simon\appdata\local\{2E22E4F3-4B35-4721-88B7-5F720B9C9EB4}
    2012-02-03 18:07:38 -------- d-----w- c:\users\simon\appdata\local\{C5232A99-99F7-47AE-AA46-942593F58072}
    2012-02-03 18:07:16 -------- d-----w- c:\users\simon\appdata\local\{FBBCD115-637B-42F2-A217-7C52A311CCB6}
    2012-02-01 22:41:45 -------- d-----w- c:\users\simon\appdata\local\{0B69EAB3-2665-4F1C-B274-23668C5B999B}
    2012-02-01 22:41:34 -------- d-----w- c:\users\simon\appdata\local\{F8AAF3AE-1F31-45B3-B714-0E77A56249DC}
    2012-02-01 10:41:49 -------- d-----w- c:\users\simon\appdata\local\{94A84BA9-C91A-4E36-AED9-439B0E8049C8}
    2012-02-01 10:41:36 -------- d-----w- c:\users\simon\appdata\local\{228C371F-823C-4D3F-8EA5-7D3BDE99F17D}
    2012-01-31 22:41:46 -------- d-----w- c:\users\simon\appdata\local\{E6A01B96-7DD0-4C57-A5E1-5C231D67F40F}
    2012-01-31 22:41:35 -------- d-----w- c:\users\simon\appdata\local\{3A70D144-6F72-4CDE-866E-6DDBAC5AF875}
    2012-01-31 10:42:00 -------- d-----w- c:\users\simon\appdata\local\{75A6B8B5-E47A-4F66-9FFA-3587AFFEA356}
    2012-01-31 10:41:36 -------- d-----w- c:\users\simon\appdata\local\{B3EAF8D1-4E17-4684-8AE7-061C96AC1949}
    2012-01-30 22:41:59 -------- d-----w- c:\users\simon\appdata\local\{3C3BED94-509B-44E8-9B07-57396AB54997}
    2012-01-30 22:41:36 -------- d-----w- c:\users\simon\appdata\local\{74B68387-00B4-44A9-87A7-27956F222E3C}
    2012-01-30 10:42:00 -------- d-----w- c:\users\simon\appdata\local\{EA7ADD70-5263-46EC-A15D-E5E9B8104841}
    2012-01-30 10:41:37 -------- d-----w- c:\users\simon\appdata\local\{3F77E2E6-7A6C-4D45-A051-86C10566516F}
    2012-01-29 22:41:51 -------- d-----w- c:\users\simon\appdata\local\{BB33463E-353A-4B05-97AD-AD22914E3180}
    2012-01-29 22:41:37 -------- d-----w- c:\users\simon\appdata\local\{AD989A28-EBE6-477D-A58B-5166A7E66A1F}
    2012-01-29 10:42:05 -------- d-----w- c:\users\simon\appdata\local\{F692A178-D800-4E07-99AC-6357C868C550}
    2012-01-29 10:41:40 -------- d-----w- c:\users\simon\appdata\local\{237986EF-4C5C-4493-9E20-61EC9CCCA6B7}
    2012-01-28 22:42:03 -------- d-----w- c:\users\simon\appdata\local\{1B57856F-810A-4925-9786-C3D03946DC87}
    2012-01-28 22:41:51 -------- d-----w- c:\users\simon\appdata\local\{758E7938-C6BD-437D-ADFA-57F90CC375E3}
    2012-01-28 10:42:03 -------- d-----w- c:\users\simon\appdata\local\{1C838561-9CBE-478E-8A83-3F2A4C4A1797}
    2012-01-28 10:41:51 -------- d-----w- c:\users\simon\appdata\local\{12D2D7FF-1030-49B2-B7F2-A1804EDA3A7C}
    2012-01-27 22:42:02 -------- d-----w- c:\users\simon\appdata\local\{96CD44A4-A4DF-42DB-A347-E8404E0240AF}
    2012-01-27 22:41:50 -------- d-----w- c:\users\simon\appdata\local\{222C35F9-35B7-4ECD-A985-7EAC665C32E3}
    2012-01-27 10:42:01 -------- d-----w- c:\users\simon\appdata\local\{60513276-AA12-4279-816F-5B5CAB32ECEE}
    2012-01-27 10:41:50 -------- d-----w- c:\users\simon\appdata\local\{4B012CE1-D0E8-4C38-9FFA-95DA800CD7E4}
    2012-01-20 09:33:56 -------- d-----w- c:\program files\Market Samurai
    2012-01-20 08:19:30 -------- d-----w- c:\users\simon\appdata\local\{5B67AFD2-54F7-4B3F-81E0-78FB564FFB3D}
    2012-01-20 08:19:08 -------- d-----w- c:\users\simon\appdata\local\{239118CD-2EC3-4F13-9558-7AA6E8C98EC0}
    2012-01-19 21:09:36 -------- d-----w- c:\users\simon\appdata\local\{9E936F4E-E65C-407D-83D4-3B0CA3FC2EEE}
    2012-01-19 21:09:14 -------- d-----w- c:\users\simon\appdata\local\{5B37B706-B8AC-45DF-862A-279C706A14CF}
    2012-01-19 14:31:10 -------- d-----w- c:\users\simon\appdata\local\VirginMedia
    2012-01-19 14:31:10 -------- d-----w- c:\programdata\VirginMedia
    2012-01-19 14:31:07 4292096 ----a-w- c:\windows\system32\Redemption.dll
    2012-01-19 14:31:05 -------- d-----w- c:\program files\VirginMedia
    2012-01-19 09:16:13 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2012-01-19 09:16:13 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2012-01-19 09:15:41 -------- d-----w- c:\program files\iPod
    2012-01-19 09:15:40 -------- d-----w- c:\program files\iTunes
    2012-01-19 09:11:32 -------- d-----w- c:\program files\Bonjour
    2012-01-19 09:09:35 -------- d-----w- c:\users\simon\appdata\local\{2E977B69-A7C5-4F4F-A803-F93569F17A42}
    2012-01-19 09:09:15 -------- d-----w- c:\users\simon\appdata\local\{53E06AA7-9D1A-4EB6-AB0E-F10D37E414A9}
    2012-01-18 20:09:11 -------- d-----w- c:\users\simon\appdata\local\{2EE4B6D7-9EAB-4715-A7C4-F3B40CCEAA3E}
    2012-01-18 20:09:00 -------- d-----w- c:\users\simon\appdata\local\{8E7EC7B8-13B2-4289-88DC-7416E5EB39BF}
    2012-01-18 08:09:12 -------- d-----w- c:\users\simon\appdata\local\{ACB524CB-C94F-4592-805B-5D6FC0DA1647}
    2012-01-18 08:09:01 -------- d-----w- c:\users\simon\appdata\local\{CFBB8C94-AEFD-4A88-AA58-8F7AB236D315}
    2012-01-18 08:08:50 -------- d-----w- c:\users\simon\appdata\local\{5BBD552D-BB71-40E7-9A12-244C96426F20}
    2012-01-18 08:08:38 -------- d-----w- c:\users\simon\appdata\local\{571C559F-E47B-40A0-BC90-6EDE192CAE59}
    2012-01-17 18:23:09 224768 ----a-w- c:\windows\system32\schannel.dll
    2012-01-17 18:23:09 1037312 ----a-w- c:\windows\system32\lsasrv.dll
    2012-01-17 18:23:08 99840 ----a-w- c:\windows\system32\sspicli.dll
    2012-01-17 18:23:08 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2012-01-17 18:23:08 369352 ----a-w- c:\windows\system32\drivers\cng.sys
    2012-01-17 18:23:08 314368 ----a-w- c:\windows\system32\webio.dll
    2012-01-17 18:23:08 22528 ----a-w- c:\windows\system32\lsass.exe
    2012-01-17 18:23:08 22016 ----a-w- c:\windows\system32\secur32.dll
    2012-01-17 18:23:08 15360 ----a-w- c:\windows\system32\sspisrv.dll
    2012-01-17 18:23:08 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
    2012-01-17 17:40:23 -------- d-----w- c:\users\simon\appdata\local\{CE3682A9-D4C9-479D-AFCF-D8D66D0B2ED0}
    2012-01-17 17:40:11 -------- d-----w- c:\users\simon\appdata\local\{8C1B3118-3A30-4C36-A186-852566E35276}
    2012-01-17 10:23:25 -------- d-----w- c:\users\simon\appdata\local\{83055E0A-B4C7-4772-BA04-07B0F165004F}
    2012-01-17 10:23:14 -------- d-----w- c:\users\simon\appdata\local\{78EC6307-BCCD-435F-8419-358193230134}
    2012-01-16 21:15:24 -------- d-----w- c:\users\simon\appdata\local\{6BF8264A-E96A-4F15-AE50-FBCC5D6066D4}
    2012-01-16 21:15:12 -------- d-----w- c:\users\simon\appdata\local\{90512D07-6021-40E3-955B-45DD0257651A}
    2012-01-16 09:15:34 -------- d-----w- c:\users\simon\appdata\local\{5DF3F5FB-8F0B-491F-8DD5-9B439406D8A7}
    2012-01-16 09:15:11 -------- d-----w- c:\users\simon\appdata\local\{6A399368-D5EC-4004-BBCF-78E071147A8C}
    2012-01-15 21:15:23 -------- d-----w- c:\users\simon\appdata\local\{B172EE74-1AD5-4524-9522-63D6D9F17272}
    2012-01-15 21:15:11 -------- d-----w- c:\users\simon\appdata\local\{69F9F6FE-0DEE-43D4-BACA-09E2D0D8D8D8}
    2012-01-15 09:15:33 -------- d-----w- c:\users\simon\appdata\local\{DB645B41-53EC-4E2F-BB63-0732B14F4400}
    2012-01-15 09:15:11 -------- d-----w- c:\users\simon\appdata\local\{DD2B7515-1DF6-4172-8A69-A6DBFF157DC9}
    2012-01-14 21:15:29 -------- d-----w- c:\users\simon\appdata\local\{DD7239EA-CC76-4AAF-B181-6F875C1144D9}
    2012-01-14 21:15:17 -------- d-----w- c:\users\simon\appdata\local\{1AF22629-6DBC-44D4-A2DE-3615C2351BFC}
    2012-01-14 09:15:37 -------- d-----w- c:\users\simon\appdata\local\{77D60410-94FC-496C-B199-4716EDCEE4E8}
    2012-01-14 09:15:15 -------- d-----w- c:\users\simon\appdata\local\{D8203B67-68F1-44E7-AF8C-8BA54D63A3A1}
    2012-01-13 21:15:39 -------- d-----w- c:\users\simon\appdata\local\{E512A4A9-E93D-49F6-B05A-EFAAC5387872}
    2012-01-13 21:15:16 -------- d-----w- c:\users\simon\appdata\local\{1302B6B3-3C76-459F-B6C9-2D3A0E6FE7C8}
    2012-01-13 09:15:37 -------- d-----w- c:\users\simon\appdata\local\{FC793043-CF28-47BE-84A0-DB156FB4A961}
    2012-01-13 09:15:15 -------- d-----w- c:\users\simon\appdata\local\{8F13D1EC-E8F4-4066-BB72-9B164DA46CF2}
    2012-01-12 21:15:26 -------- d-----w- c:\users\simon\appdata\local\{344E0379-6B07-4C0B-90C7-26F7903F8FF9}
    2012-01-12 21:15:15 -------- d-----w- c:\users\simon\appdata\local\{48764AE0-8B9C-4A5B-8C69-C4FD4DD5693D}
    2012-01-12 09:15:39 -------- d-----w- c:\users\simon\appdata\local\{DF7C0241-A497-45F5-B082-B0C7D39F701B}
    2012-01-12 09:15:16 -------- d-----w- c:\users\simon\appdata\local\{AD9D0B46-A810-4786-8902-245460D90CC9}
    2012-01-11 21:15:27 -------- d-----w- c:\users\simon\appdata\local\{0A802956-6B2F-4A5D-800A-B5F222BCCE79}
    2012-01-11 21:15:16 -------- d-----w- c:\users\simon\appdata\local\{10E9D103-AE43-4A19-80A5-33634817BFF4}
    2012-01-11 14:43:56 -------- d-----w- c:\users\simon\appdata\local\{2D01EE80-795A-4838-BC74-ED0DA506A00D}
    2012-01-11 14:43:34 -------- d-----w- c:\users\simon\appdata\local\{D7AFE3C0-73C2-4C56-B29C-50C3CE85FBAE}
    2012-01-11 09:15:28 -------- d-----w- c:\users\simon\appdata\local\{F7E07405-1FAE-44F9-BEC0-AEAAE648BDE5}
    2012-01-11 09:15:17 -------- d-----w- c:\users\simon\appdata\local\{DB59901E-A1FA-43C5-8348-310C820F7FAC}
    2012-01-11 09:15:07 -------- d-----w- c:\users\simon\appdata\local\{782E1289-B3F1-4ECB-832E-A5371610751B}
    2012-01-11 09:14:56 -------- d-----w- c:\users\simon\appdata\local\{EDE3CA71-B9E1-4B1B-ACDF-22AC49F1320F}
    2012-01-11 01:56:01 -------- d-----w- c:\users\simon\appdata\local\{3B80AAC8-A494-4035-AD73-79BDECA9232D}
    2012-01-11 01:55:39 -------- d-----w- c:\users\simon\appdata\local\{627AE290-E1FD-4A15-9EA4-200C9884C6B9}
    2012-01-10 23:56:58 1288984 ----a-w- c:\windows\system32\ntdll.dll
    2012-01-10 23:56:56 67072 ----a-w- c:\windows\system32\packager.dll
    2012-01-10 23:56:55 514560 ----a-w- c:\windows\system32\qdvd.dll
    2012-01-10 23:56:55 1328640 ----a-w- c:\windows\system32\quartz.dll
    2012-01-10 13:56:00 -------- d-----w- c:\users\simon\appdata\local\{443E21C6-FFEE-460F-A0CB-B2C8923FB94C}
    2012-01-10 13:55:38 -------- d-----w- c:\users\simon\appdata\local\{30CB7F69-CCB1-4A18-A757-EDD7DBCFA77D}
    2012-01-10 01:55:50 -------- d-----w- c:\users\simon\appdata\local\{3F466C53-C9E8-4B24-820C-86C7937A1632}
    2012-01-10 01:55:39 -------- d-----w- c:\users\simon\appdata\local\{17646E2B-3B90-4E33-A03F-290E25AD52AB}
    2012-01-09 13:55:49 -------- d-----w- c:\users\simon\appdata\local\{B3D553F9-6D96-4ACB-9F53-A1B868E89337}
    2012-01-09 13:55:38 -------- d-----w- c:\users\simon\appdata\local\{852D491C-F5C3-4EEB-8BB1-897755D72FC7}
    2012-01-09 11:25:36 548864 ----a-w- c:\program files\mozilla firefox\msvcp80.dll
    2012-01-09 11:25:36 479232 ----a-w- c:\program files\mozilla firefox\msvcm80.dll
    2012-01-09 11:25:36 43992 ----a-w- c:\program files\mozilla firefox\mozutils.dll
    2012-01-09 11:25:35 626688 ----a-w- c:\program files\mozilla firefox\msvcr80.dll
    2012-01-09 10:16:45 -------- d-----w- c:\users\simon\appdata\local\{0273E93B-8261-4705-8E16-201AFDEF4D13}
    2012-01-09 10:16:34 -------- d-----w- c:\users\simon\appdata\local\{B2C60E87-DF70-4721-8980-23FCEAD57ECC}
    .
    ==================== Find3M ====================
    .
    2012-01-16 09:34:09 60304 ----a-w- c:\users\simon\g2mdlhlpx.exe
    2011-12-19 09:16:54 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-11-24 04:23:31 2340352 ----a-w- c:\windows\system32\win32k.sys
    .
    ============= FINISH: 12:38:13.70 ===============
    simonh, Feb 7, 2012
    #1

  2. Bobbye Helper on the Fringe

    Welcome to TechSpot! Let's see what hijacked your Host files and is routing you through Romania!

    Before you do the scans below, please do the following:
    1. Uninstall the uTorrent Toolbar. Use Add/Remove Programs to uninstall, the use Windows explorer to access Computer> Local Drive> Programs> do a right click> Delete on the uTorrent folder.
    2. Uninstall the Conduit Engine. Same path as above
    3. Temporarily disable the Mcafee Security Scan Scheduler
    Reboot when finished with above.
    ====================================
    Then proceed with the following
    To run the Eset Online Virus Scan:
    If you use Internet Explorer:
    1. Open the ESETOnlineScan
    2. Skip to #4 to "Continue with the directions"

      If you are using a browser other than Internet Explorer
    3. Open Eset Smart Installer
      [o] Click on the esetsmartinstaller_enu.exelink and save to the desktop.
      [o] Double click on the desktop icon to run.
      [o] After successful installation of the ESET Smart Installer, the ESET Online Scanner will be launched in a new Window
    4. Continue with the directions.
    5. Check 'Yes I accept terms of use.'
    6. Click Start button
    7. Accept any security warnings from your browser.
      [IMG]
    8. Uncheck 'Remove found threats'
    9. Check 'Scan archives/
    10. Leave remaining settings as is.
    11. Press the Start button.
    12. ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    13. When the scan completes, press List of found threats
    14. Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    15. Push the Back button, then Finish
    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
    =========================================
    I'd like you to run Combofix- but it won't run with AVG. You will need to temporarily uninstall AVG as follows:

    Download AppRemover and save to the desktop
    1. Double click the setup on the desktop> click Next
    2. Select “Remove Security Application”
    3. Let scan finish to determine security apps
    4. A screen like below will appear:
      [IMG]
    5. Click on Next after choice has been made
    6. Check the AVG program you want to uninstall
    7. After uninstall shows complete, follow online prompts to Exit the program.

    Temporary AV: Use one:
    Avira-AntiVir-Personal-Free-Antivirus
    Avast Free Version
    =============================
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Expect these- they are normal:
    1. If asked to install or or update the Recovery Console, allow. (you will need internet connection for this)
    2. Before you run the Combofix scan, please disable any security software you have running.
    3. Combofix may need to reboot your computer more than once to do its job this is normal.

    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe [IMG]& follow the prompts.
    • If prompted for Recovery Console, please allow.
    • Once installed, you should see a blue screen prompt that says:
      • The Recovery Console was successfully installed.[/b]
      • Note: If Combofix was downloaded to a flash drive, the Recovery Console will not install- just bypass and go on.[/b]
      • Note: No query will be made if the Recovery Console is already on the system.
    • .Close/disable all anti virus and anti malware programs
      (If you need help with this, please see HERE)
    • .Close any open browsers.
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2:If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart the computer.
    Note 3:CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    =====================================
    Be sure to add one of the Temporary AV programs suggested. The McAfee isn't an AV- it's a scan that tells you if security programs are running,

    Please leave log for the Eset scan and Combofix in your next reply.
    ====================================
    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time. I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me. Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't follow directions given to someone else
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.

    If I haven't replied back to you within 48 hours, you can send a PMwith your thread link in it as a reminder. Do not include technical problems from your thread. Support is given only in the forum.
    Threads are closed after 5 days if there is no reply.
    Bobbye, Feb 7, 2012
    #2
Thread Status:
Not open for further replies.