TechSpot

Random redirects from Google, seems like rootkit.

Solved
By BlindGuardian36
Apr 16, 2012
  1. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    It must.
    Did you download the file to your desktop?
     
  2. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    Yes, I have GETxPUD on the desktop has an icon of a box with books and trying to run as administrator. When I click on it nothing opens and no folder is produced. Mayb other computer is infected as well still?
     
  3. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box and paste it into the main textfield:
      Code:
      :folderfind
      GETxPUD
      
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
  4. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    SystemLook 30.07.11 by jpshortstuff
    Log created at 21:49 on 16/04/2012 by Brandon
    Administrator - Elevation successful

    ========== folderfind ==========

    Searching for "GETxPUD"
    C:\Program Files (x86)\Avant Browser\GETxPUD d------ [01:20 17/04/2012]
    C:\Users\Brandon\Desktop\GETxPUD d------ [01:19 17/04/2012]

    -= EOF =-
     
  5. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    New folder is right there on your desktop:
    C:\Users\Brandon\Desktop\GETxPUD
     
  6. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    That is just the file that I saved from the link. It's an application. I don't see any other folder.
     
  7. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    Just refreshed the desktop and I found it. Icon just didn't show up until then sorry about that.
     
  8. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    nvm found it
     
  9. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    bad computer is now just a black screen now. It has Fatal server error ddxsiggiveup:closing log giving up
    xinit: no such file or directory (errno 2): unable to connect to x server
    xinit: no such process (errno 3): server error
    xauth: (argv):1: bad display name "(none):0" in "remove" command
    sh: no job controll in this shell
    sh-4.0# (place for me to type here)
     
  10. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    I can't comment since I have no idea what you're doing.

    Did you create DVD?
     
  11. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    I just put the DVD-r in and used the cd burning program on default settings. I then placed it in other computer and booted from it. I get a screen that says xPUD a better desktop select a language I pick english then a black screen loads and that is the last bit of it.
     
     
  12. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    Did you burn DVD by double clicking on get&burn.bat?
     
  13. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    Yes, I used the one that auto opened when it finished
     
  14. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    See if you can boot good computer from that DVD.
    Do NOT perform any other actions though
     
  15. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    When I boot from that cd it just opens a page saying select a language if I don't do anything there are no other options. When I select a language it goes to a black screen and I get a long error message. I posted the end of the message above and then it allows me to type in commands like it's a cmd prompt.
     
  16. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    On bad computer?
    If so, proceed with other steps from my instructions (executing commands).
     
  17. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    do you mean
    • Type parted /dev/sda set 2 boot on
    • Press Enter
    • Type parted /dev/sda rm 4
    • Press Enter ?

    • because there is no menu or anything for me to click on bad computer. There is no toolbars or anything but the black screen which at the end allows me to type stuff in.
     
  18. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    Yes. You have to enter those commands by typing them.
    No misspelling, watch for "spaces". PLEASE.
     
  19. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    when i type the commands in it responds with "Information: you may need to update /etc/fstab"
     
  20. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    That's fine.
    Keep going.
     
  21. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
    Run date: 2012-04-17 00:33:14
    -----------------------------
    00:33:14.387 OS Version: Windows x64 6.1.7601 Service Pack 1
    00:33:14.403 Number of processors: 2 586 0x200
    00:33:14.403 ComputerName: CIERRASMELLS-PC UserName: Cierra smells
    00:33:17.101 Initialize success
    00:33:33.107 AVAST engine defs: 12041601
    00:33:41.032 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000073
    00:33:41.047 Disk 0 Vendor: TOSHIBA_ GT00 Size: 305245MB BusType: 11
    00:33:41.063 Disk 0 MBR read successfully
    00:33:41.063 Disk 0 MBR scan
    00:33:41.079 Disk 0 Windows VISTA default MBR code
    00:33:41.094 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
    00:33:41.125 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 291228 MB offset 3074048
    00:33:41.188 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 12516 MB offset 599508992
    00:33:41.281 Disk 0 scanning C:\Windows\system32\drivers
    00:33:59.891 Service scanning
    00:34:56.846 Modules scanning
    00:34:56.866 Disk 0 trace - called modules:
    00:34:56.893 ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys
    00:34:56.907 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002ff2730]
    00:34:56.923 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8002ec1310]
    00:34:56.936 5 amd_xata.sys[fffff880011228b4] -> nt!IofCallDriver -> \Device\00000073[0xfffffa80029c8650]
    00:34:59.233 AVAST engine scan C:\Windows
    00:35:04.800 AVAST engine scan C:\Windows\system32
    00:40:39.363 AVAST engine scan C:\Windows\system32\drivers
    00:40:59.751 AVAST engine scan C:\Users\Cierra smells
    00:42:30.630 Disk 0 MBR has been saved successfully to "C:\Users\Cierra smells\Desktop\MBR.dat"
    00:42:30.655 The log file has been saved successfully to "C:\Users\Cierra smells\Desktop\aswMBR.txt"


    You are a miracle worker!
     
  22. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    Good job :)

    See if TDSSKiller will run now.
     
  23. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    TDSSKiller ran and says it didn't find any threats I don't know where to find a log for it.
     
  24. Broni

    Broni Malware Annihilator Posts: 48,033   +271

    That's fine.

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  25. BlindGuardian36

    BlindGuardian36 TS Rookie Topic Starter Posts: 41

    Sorry it took so long to reply when the computer restarted it wouldn't let me use any of the internet explorers saying it was an illegal error on a registry value marked for deletion.

    ComboFix 12-04-15.01 - Cierra smells 04/17/2012 12:34:38.3.2 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2663.1348 [GMT -4:00]
    Running from: c:\users\Cierra smells\Desktop\ComboFix.exe
    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Cierra smells\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-03-17 to 2012-04-17 )))))))))))))))))))))))))))))))
    .
    .
    2012-04-17 16:50 . 2012-04-17 16:50 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-04-17 16:04 . 2012-03-14 03:27 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3D4F0E92-42D4-4D41-9F29-AD95415C118B}\mpengine.dll
    2012-04-16 00:22 . 2012-04-16 00:22 -------- d-----w- c:\users\Cierra smells\AppData\Local\CRE
    2012-04-16 00:21 . 2012-04-16 00:21 -------- d-----w- c:\program files (x86)\Conduit
    2012-04-16 00:21 . 2012-04-16 00:21 -------- d-----w- c:\users\Cierra smells\AppData\Local\Conduit
    2012-04-16 00:21 . 2012-04-16 00:21 -------- d-----w- c:\program files (x86)\BrotherSoft_Extreme
    2012-04-16 00:20 . 2012-04-16 00:21 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\GetRightToGo
    2012-04-12 07:00 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2012-04-12 07:00 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2012-04-12 07:00 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2012-04-12 07:00 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
    2012-04-12 07:00 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
    2012-04-12 07:00 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
    2012-04-12 07:00 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2012-04-09 01:49 . 2012-04-09 01:49 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Alawar
    2012-04-08 16:59 . 2012-04-08 16:59 -------- d-----w- c:\programdata\InterAction studios
    2012-04-07 19:58 . 2012-04-07 19:58 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\casualArts
    2012-04-07 19:58 . 2012-04-07 19:58 -------- d-----w- c:\programdata\casualArts
    2012-04-06 04:33 . 2012-04-06 09:50 -------- d-----w- c:\programdata\SpookyMall
    2012-04-06 02:37 . 2012-04-06 02:37 -------- d-----w- c:\programdata\The Poppit! Show
    2012-04-06 02:36 . 2012-04-09 00:43 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Pogo Games
    2012-04-06 02:33 . 2012-04-06 02:33 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Windows Live Writer
    2012-04-06 02:33 . 2012-04-06 03:59 -------- d-----w- c:\users\Cierra smells\AppData\Local\Windows Live Writer
    2012-04-05 19:34 . 2012-04-13 22:54 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\mIRC
    2012-04-05 19:34 . 2012-04-05 19:34 -------- d-----w- c:\program files (x86)\mIRC
    2012-04-01 21:47 . 2012-04-01 21:47 -------- d-----w- c:\programdata\HipSoft
    2012-04-01 21:39 . 2012-04-14 04:19 -------- d-----w- c:\program files (x86)\WildGames
    2012-04-01 03:59 . 2012-04-01 03:59 -------- d-----w- c:\programdata\Toshiba Book Place
    2012-04-01 03:48 . 2012-04-01 07:42 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Book Place
    2012-03-29 05:37 . 2012-03-29 05:37 592824 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
    2012-03-29 05:37 . 2012-03-29 05:37 44472 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
    2012-03-27 02:36 . 2012-03-27 02:36 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Screaming Bee
    2012-03-27 02:33 . 2012-03-27 02:33 -------- d-----w- c:\program files (x86)\Screaming Bee
    2012-03-27 02:02 . 2012-03-28 06:36 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\TS3Client
    2012-03-27 01:59 . 2012-03-27 01:59 -------- d-----w- c:\program files\TeamSpeak 3 Client
    2012-03-27 01:58 . 2012-03-27 01:58 -------- d-----w- c:\users\Cierra smells\AppData\Roaming\Malwarebytes
    2012-03-27 01:58 . 2012-03-27 01:58 -------- d-----w- c:\programdata\Malwarebytes
    2012-03-27 01:58 . 2012-04-15 11:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-03-23 19:58 . 2012-03-27 03:14 -------- d-----w- c:\windows\system32\drivers\NISx64\1306020.00A
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-03-26 21:28 . 2011-12-11 06:08 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
    2012-02-23 13:18 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
    2012-02-17 06:38 . 2012-03-14 14:21 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2012-02-17 05:34 . 2012-03-14 14:21 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2012-02-17 04:58 . 2012-03-14 14:21 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-02-17 04:57 . 2012-03-14 14:21 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2012-02-10 06:36 . 2012-03-14 14:24 1544192 ----a-w- c:\windows\system32\DWrite.dll
    2012-02-10 05:38 . 2012-03-14 14:24 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
    2012-02-03 04:34 . 2012-03-14 14:24 3145728 ----a-w- c:\windows\system32\win32k.sys
    2012-01-25 06:38 . 2012-03-14 14:21 77312 ----a-w- c:\windows\system32\rdpwsx.dll
    2012-01-25 06:38 . 2012-03-14 14:21 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2012-01-25 06:33 . 2012-03-14 14:21 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-04-15_21.32.05 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2012-04-17 16:56 . 2012-04-17 16:56 12167 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
    - 2012-04-15 11:17 . 2012-04-15 11:17 12167 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\SoftGrid Client\Icon Cache\icon_ex.dat
    + 2010-11-21 03:09 . 2012-04-17 04:26 40208 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-04-17 04:26 53960 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2012-01-08 02:40 . 2012-04-15 22:17 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2012-01-08 02:40 . 2012-04-15 20:20 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2012-01-08 02:40 . 2012-04-15 22:17 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2012-01-08 02:40 . 2012-04-15 20:20 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2012-04-15 22:17 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2009-07-14 04:54 . 2012-04-15 20:20 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2012-01-08 19:11 . 2012-04-17 04:26 8012 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-543161393-2309848711-2681049407-1000_UserData.bin
    - 2012-04-15 20:14 . 2012-04-15 20:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-04-17 16:57 . 2012-04-17 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-04-17 16:57 . 2012-04-17 16:57 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-04-15 20:14 . 2012-04-15 20:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2012-01-09 03:03 . 2012-04-17 15:51 236764 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
    - 2009-07-14 02:36 . 2012-04-15 20:19 624622 c:\windows\system32\perfh009.dat
    + 2009-07-14 02:36 . 2012-04-17 17:01 624622 c:\windows\system32\perfh009.dat
    + 2009-07-14 02:36 . 2012-04-17 17:01 106708 c:\windows\system32\perfc009.dat
    - 2009-07-14 02:36 . 2012-04-15 20:19 106708 c:\windows\system32\perfc009.dat
    - 2009-07-14 05:01 . 2012-04-15 11:15 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2012-04-17 16:56 228720 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2012-01-08 20:15 . 2012-01-17 03:33 229488 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-543161393-2309848711-2681049407-1000-12288.dat
    + 2012-01-08 20:15 . 2012-04-16 01:14 229488 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-543161393-2309848711-2681049407-1000-12288.dat
    + 2012-01-08 03:49 . 2012-04-17 16:56 12910132 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-543161393-2309848711-2681049407-1000-8192.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
    "{f78bf7a8-cf12-4de7-a6da-c463d1b539a7}"= "c:\program files (x86)\Dogpile Bundle Toolbar\Helper.dll" [2012-01-16 361984]
    "{51a86bb3-6602-4c85-92a5-130ee4864f13}"= "c:\program files (x86)\BrotherSoft_Extreme\prxtbBrot.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
    .
    [HKEY_CLASSES_ROOT\clsid\{f78bf7a8-cf12-4de7-a6da-c463d1b539a7}]
    [HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook.1]
    [HKEY_CLASSES_ROOT\TypeLib\{C766F9AD-E91E-43DE-91DC-D007680ED4AF}]
    [HKEY_CLASSES_ROOT\FreeCauseURLSearchHook.FCToolbarURLSearchHook]
    .
    [HKEY_CLASSES_ROOT\clsid\{51a86bb3-6602-4c85-92a5-130ee4864f13}]
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{51a86bb3-6602-4c85-92a5-130ee4864f13}]
    2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\BrotherSoft_Extreme\prxtbBrot.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{BFE4B5CB-63F7-4A51-9266-6167655D5B4F}]
    2012-01-16 23:57 1613312 ----a-w- c:\program files (x86)\Dogpile Bundle Toolbar\Toolbar.dll
    .
    [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
    2012-01-03 21:31 1514152 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
    "{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-01-03 1514152]
    "{C80BDEB2-8735-44C6-BD55-A1CCD555667A}"= "c:\program files (x86)\Dogpile Bundle Toolbar\Toolbar.dll" [2012-01-16 1613312]
    "{51a86bb3-6602-4c85-92a5-130ee4864f13}"= "c:\program files (x86)\BrotherSoft_Extreme\prxtbBrot.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
    [HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
    [HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
    .
    [HKEY_CLASSES_ROOT\clsid\{c80bdeb2-8735-44c6-bd55-a1ccd555667a}]
    [HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{CCBDEEA9-517A-4862-B0A1-862AE9532228}]
    [HKEY_CLASSES_ROOT\FCTB000060231.IEToolbar]
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.