icanseek popups

minamoo · July 12, 2009

I apologise if this is in the wrong thread but im desperate for help in getting rid of these pop ups.

Each time i open a new page i get pop ups from mainly icanseek.com but get others including porn or dating websites. I have completed scans using kaspersky, McAfee, spybot search & destroy, and bitdefender as well as malwarebytes and all have come up with nothing.

I havent downloaded anything on to my pc before getting these pop ups and when contacting service provider i was told just to add them to restriced sites which doesnt work as a) it wont add them or they still come up anyway.

My browser pop up blocker is on high and will block all the usual traffic but these pop ups seem to come from nowhere and open in the task bar at the bottom of the screen.

Any help with this will be greatly appreciated im slowly going mental here.

Here is my HJT report;

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:20:38, on 12/07/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Reg Tool\Reg Tool.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://*.mcafee.com

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O23 - Service: McAfee Application Installer Cleanup (0235771247308353) (0235771247308353mcinstcleanup) - - (no file)

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 7810 bytes

minamoo · July 13, 2009

Just updating - this morning i decided to empty all temp files from all desktop users and run more scans. Spyboy and Malwarebytes came up empty but McAfee came up with 32 Artemis trojans which it quarantined so I was hoping that would be the end of the problem but have since read that this could be a false report with Mcafee well know for this. But there is a difference of opinion and it could be a real threat. Even though these trojans are quarantined im still left with my original problem and the popups are still coming in thick and fast.

Sorry for another reply but I couldn't edit my original post.

Still need help - pleeeeeeeeeeeeaseeeeeeee

AdvancedSetup · July 14, 2009

Please disable your current Anti-Virus and run the following scanner. Try renaming it if you have to or running it in SAFE MODE if you have to, but if you can run other security software then that should not be necessary. Just make sure to disable your AV or it will block CF.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

minamoo · July 14, 2009

ComboFix 09-07-13.01 - hayley 14/07/2009 11:13.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1535.1097 [GMT 1:00]

Running from: c:\documents and settings\hayley\Desktop\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Internet Saving Optimizer

c:\program files\Internet Saving Optimizer\3.4.0.4340\adwpx.exe

c:\program files\Internet Saving Optimizer\3.4.0.4340\Data\config.md

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome.manifest

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.js

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\content\NPAddOn.xul

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\chrome\NPAddOn.jar

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.dll

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFAddOn.xpt

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\components\NPFFHelperComponent.js

c:\program files\Internet Saving Optimizer\3.4.0.4340\FF\install.rdf

c:\program files\Internet Saving Optimizer\3.4.0.4340\NPCommon.dll

c:\program files\Internet Saving Optimizer\3.4.0.4340\NPIEAddOn.dll

c:\program files\Internet Saving Optimizer\3.4.0.4340\unins000.dat

c:\program files\Internet Saving Optimizer\3.4.0.4340\unins000.exe

.

((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 )))))))))))))))))))))))))))))))

.

2009-07-14 08:32 . 2009-07-14 08:32 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2009-07-13 14:06 . 2009-07-13 14:06 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-07-13 14:06 . 2009-07-13 16:32 -------- d-----w- c:\documents and settings\hayley\Application Data\SUPERAntiSpyware.com

2009-07-13 06:42 . 2009-07-13 06:42 -------- d-sh--w- c:\documents and settings\Molly\IECompatCache

2009-07-13 06:41 . 2009-07-13 06:41 -------- d-sh--w- c:\documents and settings\Joshua\IECompatCache

2009-07-13 06:40 . 2009-07-13 06:40 -------- d-sh--w- c:\documents and settings\Jacob\IECompatCache

2009-07-12 09:20 . 2009-07-12 09:20 -------- d-----w- c:\program files\Trend Micro

2009-07-12 09:08 . 2009-07-12 09:37 -------- d-----w- c:\documents and settings\hayley\Application Data\Reg Tool

2009-07-11 14:55 . 2009-07-11 14:55 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-07-11 14:38 . 2009-05-12 15:08 266400 ----a-r- c:\documents and settings\hayley\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll

2009-07-11 13:48 . 2009-07-11 14:12 -------- d-----w- c:\windows\BDOSCAN8

2009-07-11 12:00 . 2009-07-11 12:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix

2009-07-11 12:00 . 2009-07-11 12:00 -------- d-----w- c:\documents and settings\hayley\Local Settings\Application Data\Citrix

2009-07-11 10:40 . 2009-07-11 10:40 -------- d-----w- c:\documents and settings\hayley\Application Data\McAfee

2009-07-11 10:40 . 2009-07-11 10:40 49152 ----a-r- c:\documents and settings\hayley\Application Data\Microsoft\Installer\{FCC07EEA-FA18-4A21-9105-9666603C6885}\IconFCC07EEA1.exe

2009-07-11 10:40 . 2009-07-11 10:40 49152 ----a-r- c:\documents and settings\hayley\Application Data\Microsoft\Installer\{FCC07EEA-FA18-4A21-9105-9666603C6885}\IconFCC07EEA.exe

2009-07-11 10:39 . 2009-07-11 10:40 -------- d-----w- c:\windows\FCC07EEAFA184A2191059666603C6885.TMP

2009-07-11 10:39 . 2009-07-11 10:39 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2009-07-11 10:37 . 2009-07-12 07:40 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore

2009-07-11 10:34 . 2009-07-11 10:34 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor

2009-07-11 10:32 . 2009-05-13 22:25 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys

2009-07-11 10:32 . 2009-05-13 22:25 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2009-07-11 10:32 . 2009-05-13 22:25 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys

2009-07-11 10:32 . 2009-04-09 13:23 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys

2009-07-11 10:32 . 2009-07-11 10:32 -------- d-----w- c:\program files\Common Files\McAfee

2009-07-11 10:32 . 2009-07-11 10:32 -------- d-----w- c:\program files\McAfee.com

2009-07-11 10:32 . 2009-07-13 06:37 -------- d-----w- c:\program files\McAfee

2009-07-11 10:29 . 2009-05-13 22:24 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys

2009-07-11 09:55 . 2009-07-11 10:40 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-07-11 08:01 . 2009-07-11 09:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-07-11 08:01 . 2009-07-11 08:02 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-07-10 17:20 . 2009-07-10 17:20 -------- d-----w- c:\documents and settings\Jacob\Local Settings\Application Data\Media Access Startup

2009-07-10 17:20 . 2009-07-10 17:20 -------- d-----w- c:\documents and settings\Jacob\Local Settings\Application Data\Internet Saving Optimizer

2009-07-10 13:24 . 2009-07-10 13:24 -------- d-----w- c:\windows\system32\wbem\Repository

2009-07-10 09:05 . 2009-07-10 09:05 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat

2009-07-10 08:59 . 2009-07-10 08:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2009-07-08 09:22 . 2009-07-08 09:22 -------- d-----w- c:\documents and settings\hayley\Local Settings\Application Data\Internet Saving Optimizer

2009-07-08 09:10 . 2009-07-08 09:10 -------- d-----w- c:\documents and settings\hayley\Local Settings\Application Data\DoubleD

2009-07-03 15:51 . 2009-07-03 15:51 44920 ----a-w- c:\documents and settings\Molly\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-27 10:09 . 2009-07-11 10:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2009-06-27 10:09 . 2009-07-11 07:39 -------- d-----w- c:\program files\Kaspersky Lab

2009-06-27 10:07 . 2008-04-14 00:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll

2009-06-27 10:07 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll

2009-06-27 10:06 . 2008-04-13 18:39 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys

2009-06-27 10:06 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

2009-06-27 10:06 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-06-27 10:06 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-06-19 16:39 . 2009-06-19 16:39 -------- d-----w- c:\windows\system32\%systemroo?%

2009-06-18 01:40 . 2009-06-18 01:40 -------- d-sh--w- c:\documents and settings\hayley\IECompatCache

2009-06-14 19:58 . 2009-06-14 19:58 -------- d-sh--w- c:\documents and settings\Default User\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-14 08:53 . 2009-05-10 15:42 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-07-12 09:38 . 2009-05-10 16:20 -------- d-----w- c:\program files\Windows Media Connect 2

2009-07-11 13:25 . 2009-05-10 17:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-11 13:24 . 2009-06-08 20:43 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-06-18 01:46 . 2009-05-27 12:13 -------- d-----w- c:\documents and settings\hayley\Application Data\Corel

2009-06-18 01:46 . 2009-05-10 17:07 2516 --sha-w- c:\windows\system32\KGyGaAvL.sys

2009-06-17 10:27 . 2009-05-10 17:15 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-17 10:27 . 2009-05-10 17:15 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-14 19:58 . 2009-05-10 16:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-06-09 09:21 . 2009-05-24 12:16 44920 ----a-w- c:\documents and settings\hayley\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-29 21:45 . 2009-05-29 21:45 612 ----a-w- c:\windows\eReg.dat

2009-05-29 21:38 . 2009-05-29 21:38 -------- d-----w- c:\program files\EA Games

2009-05-29 21:32 . 2009-05-10 15:35 -------- d-----w- c:\program files\Common Files\InstallShield

2009-05-28 12:29 . 2009-05-28 12:29 -------- d-----w- c:\documents and settings\Joshua\Application Data\Sony Corporation

2009-05-27 20:05 . 2009-05-27 20:05 -------- d-----w- c:\documents and settings\hayley\Application Data\Sony Corporation

2009-05-27 19:59 . 2009-05-27 19:59 -------- d-----w- c:\documents and settings\Simon\Application Data\Sony Corporation

2009-05-27 19:57 . 2009-05-10 15:35 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-05-27 19:57 . 2009-05-27 19:57 -------- d-----w- c:\program files\Sony

2009-05-26 08:58 . 2009-05-26 08:58 -------- d-----w- c:\documents and settings\hayley\Application Data\Malwarebytes

2009-05-24 12:25 . 2009-05-24 12:25 -------- d-----w- c:\program files\MSXML 4.0

2009-05-24 11:43 . 2009-05-24 11:43 -------- d-----w- c:\documents and settings\Molly\Application Data\Nero

2009-05-24 11:42 . 2009-05-24 11:42 -------- d-----w- c:\documents and settings\Joshua\Application Data\Nero

2009-05-24 11:40 . 2009-05-24 11:40 -------- d-----w- c:\documents and settings\Jacob\Application Data\Nero

2009-05-24 11:18 . 2009-05-24 11:18 -------- d-----w- c:\documents and settings\hayley\Application Data\Nero

2009-05-13 22:25 . 2009-05-13 22:25 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys

2009-05-13 05:15 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-10 17:12 . 2009-05-10 16:22 44528 ----a-w- c:\documents and settings\Simon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-05-10 17:12 . 2009-05-10 17:07 88 --sh--r- c:\windows\system32\A79EC8829B.sys

2009-05-10 16:15 . 2009-05-10 16:15 75376 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\sgc15.exe

2009-05-10 16:02 . 2009-05-10 15:25 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-05-10 15:50 . 2009-05-10 15:42 884 ----a-w- c:\windows\system32\d3d8caps.dat

2009-05-10 15:23 . 2009-05-10 15:23 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2009-05-07 15:32 . 2006-02-28 12:00 345600 ----a-w- c:\windows\system32\localspl.dll

2009-04-30 23:31 . 2009-04-30 23:31 1657376 ----a-w- c:\windows\system32\nwiz.exe

2009-04-30 23:31 . 2009-04-30 23:31 449056 ----a-w- c:\windows\system32\nvappbar.exe

2009-04-30 23:31 . 2009-04-30 23:31 436768 ----a-w- c:\windows\system32\keystone.exe

2009-04-30 23:31 . 2009-04-30 23:31 466944 ----a-w- c:\windows\system32\nvshell.dll

2009-04-30 23:31 . 2009-04-30 23:31 1724416 ----a-w- c:\windows\system32\nvwdmcpl.dll

2009-04-30 23:31 . 2009-04-30 23:31 1507328 ----a-w- c:\windows\system32\nview.dll

2009-04-30 23:31 . 2009-04-30 23:31 1101824 ----a-w- c:\windows\system32\nvwimg.dll

2009-04-30 21:02 . 2009-05-10 15:46 457248 ----a-w- c:\windows\system32\nvudisp.exe

2009-04-30 21:02 . 2009-04-30 21:02 663552 ----a-w- c:\windows\system32\nvcuvid.dll

2009-04-30 21:02 . 2009-04-30 21:02 1720320 ----a-w- c:\windows\system32\nvcuda.dll

2009-04-30 21:02 . 2009-04-30 21:02 1579630 ----a-w- c:\windows\system32\nvdata.bin

2009-04-30 21:02 . 2009-04-30 21:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-04-30 21:02 . 2007-08-17 08:13 9994240 ----a-w- c:\windows\system32\nvoglnt.dll

2009-04-30 21:02 . 2007-08-17 08:13 806912 ----a-w- c:\windows\system32\nvapi.dll

2009-04-30 21:02 . 2007-08-17 08:13 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-04-30 21:02 . 2007-08-17 08:13 5896320 ----a-w- c:\windows\system32\nv4_disp.dll

2009-04-30 21:02 . 2007-08-17 08:13 143360 ----a-w- c:\windows\system32\nvcodins.dll

2009-04-30 21:02 . 2007-08-17 08:13 143360 ----a-w- c:\windows\system32\nvcod.dll

2009-04-26 23:42 . 2009-05-10 15:31 457248 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-04-17 12:26 . 2006-02-28 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys

2009-04-15 14:51 . 2006-02-28 12:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-23 202024]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-30 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-30 13750272]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-05-01 645328]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-06-17 414992]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-10-30 16269312]

"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-30 1657376]

c:\documents and settings\Simon\Start Menu\Programs\Startup\

Cyber-shot Viewer Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2009-5-27 155648]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/05/2009 18:15 195856]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [11/07/2009 11:34 203280]

R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [25/02/2009 23:09 320512]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/05/2009 18:15 19096]

S2 0235771247308353mcinstcleanup;McAfee Application Installer Cleanup (0235771247308353); [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-07-13 c:\windows\Tasks\Malwarebytes' Scheduled Update for hayley.job

- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-05-10 10:27]

2009-07-11 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-07-11 07:57]

2009-07-11 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-07-11 07:57]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-Reg Tool - c:\program files\Reg Tool\Reg Tool.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.uk/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

Trusted Zone: internet

Trusted Zone: mcafee.com

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://*.mcafee.com

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab