Malware Destructor + Google Redirect

annoooyed · September 23, 2010

Its pretty much all in the title. The redirector started a couple of months ago, and it was very infrequent so I decided just to ignore it an carry on. Big mistake! Only yesterday did Malware Destructor rear its ugly head. I have MBAM and HJT logs, but ill wait until I'm told to post them.

MrCharlie · September 23, 2010

Please post them, MrC

annoooyed · September 23, 2010

Please post them, MrC

MBAM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4672

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

23/09/2010 17:25:20
mbam-log-2010-09-23 (17-25-20).txt

Scan type: Quick scan
Objects scanned: 141608
Time elapsed: 8 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 9
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 29

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Malware Destructor (Rogue.MalwareDestructor2011) -> No action taken.
HKEY_CURRENT_USER\Software\WinServers (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Malware Destructor Inc (Rogue.MalwareDestructor) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{3c210281-8bea-2f0d-e57b-23a6cad0b259} (Heuristics.Shuriken) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{33c3809e-0609-6688-8c84-bfeeffa401fa} (Malware.Packer.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{71429a9f-b541-7968-8e89-364fd54bd744} (Spyware.Passwords.XGen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mainapp708dl.exe (Malware.Packer.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{4ea77498-ac8f-35a5-1384-3e44427c3231} (Trojan.ZbotR.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{a8ab3e83-616f-5dd2-a3be-83708dc063e9} (Trojan.ZbotR.Gen) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{a3b9615a-1a91-d79a-edcf-4b057fa27482} (Trojan.ZbotR.Gen) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\adver_id (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor (Rogue.MalwareDestructor2011) -> No action taken.

Files Infected:
C:\Users\The General\AppData\Roaming\Adviy\usky.exe (Heuristics.Shuriken) -> No action taken.
C:\Users\The General\AppData\Roaming\Azir\oshai.exe (Malware.Packer.Gen) -> No action taken.
C:\Users\The General\AppData\Roaming\Arennu\ugedo.exe (Spyware.Passwords.XGen) -> No action taken.
C:\Users\The General\AppData\Roaming\6ABCEFE7043299D0386DC981FAF42F06\mainapp708dl.exe (Malware.Packer.Gen) -> No action taken.
C:\Program Files\Mozilla Firefox\firefox.exe (Trojan.Patched) -> No action taken.
C:\Users\The General\AppData\Local\temp\41B5.tmp (Backdoor.Agent) -> No action taken.
C:\Users\The General\AppData\Local\temp\update1.exe (Trojan.Dropper) -> No action taken.
C:\Users\The General\AppData\Local\temp\update2.exe (Trojan.Dropper) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmp29a81f8e\setup446.exe (Spyware.Passwords) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmp530a9044\time.exe (Trojan.Zbot) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmp6f28dce7\setup.exe (Trojan.Hiloti) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmp74494077\setup.exe (Trojan.Hiloti) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmpace41f6c\Java.Net.5.71.12.8.exe (Backdoor.Agent) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmpca12b78f\Java.Net.1.78.9.26.exe (Trojan.Meredrop) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmpee63ac7c\time.exe (Trojan.Agent) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmpfebd4f5c\setup.exe (Trojan.Hiloti) -> No action taken.
C:\Users\The General\AppData\Local\temp\tmpb1ea5f4a\setup446.exe (Heuristics.Shuriken) -> No action taken.
C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.
C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor\Uninstall.lnk (Rogue.MalwareDestructor2011) -> No action taken.
C:\Users\The General\pizda_ntload.dll (Trojan.Agent) -> No action taken.
C:\Users\The General\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.
C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.
C:\Users\The General\AppData\Roaming\download2\svcnost.exe (Trojan.Agent) -> No action taken.
C:\Users\The General\AppData\Local\temp\nxfsss.bak (Malware.Trace) -> No action taken.
C:\Users\The General\Local Settings\Application Data\Windows Server\admin.txt (Malware.Trace) -> No action taken.
C:\Users\The General\AppData\Roaming\Ovpo\qayzg.exe (Trojan.ZbotR.Gen) -> No action taken.
C:\Users\The General\AppData\Roaming\Katake\inynu.exe (Trojan.ZbotR.Gen) -> No action taken.
C:\Users\The General\AppData\Roaming\Pubiv\yrvao.exe (Trojan.ZbotR.Gen) -> No action taken.
C:\Users\The General\AppData\Local\Windows\Malware Destructor.lnk (Rogue.Malware.Destructor) -> No action taken.

HJT

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:03:15, on 23/09/2010

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18385)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\Salling Software AB\Salling Media Sync\Salling Media Sync.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\YouTube Downloader Toolbar\SearchSettings.exe

C:\Program Files\Freecorder\FLVSrvc.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Opera\Opera.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\TortoiseSVN\bin\TSVNCache.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\explorer.exe

C:\Users\The General\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll

O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\YouTube Downloader Toolbar\SearchSettings.dll

O2 - BHO: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll

O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll

O3 - Toolbar: YouTube Downloader Toolbar - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\1.0\youtubedownloaderToolbarIE.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

O4 - HKLM\..\Run: [salling Media Sync] "C:\Program Files\Salling Software AB\Salling Media Sync\Salling Media Sync.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [searchSettings] "C:\Program Files\YouTube Downloader Toolbar\SearchSettings.exe"

O4 - HKLM\..\Run: [Freecorder FLV Service] "C:\Program Files\Freecorder\FLVSrvc.exe" /run

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [steam] "K:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [{4EA77498-AC8F-35A5-1384-3E44427C3231}] "C:\Users\The General\AppData\Roaming\Ovpo\qayzg.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [{A8AB3E83-616F-5DD2-A3BE-83708DC063E9}] "C:\Users\The General\AppData\Roaming\Katake\inynu.exe"

O4 - HKCU\..\Run: [{3C210281-8BEA-2F0D-E57B-23A6CAD0B259}] "C:\Users\The General\AppData\Roaming\Adviy\usky.exe"

O4 - HKCU\..\Run: [{33C3809E-0609-6688-8C84-BFEEFFA401FA}] "C:\Users\The General\AppData\Roaming\Azir\oshai.exe"

O4 - HKCU\..\Run: [{71429A9F-B541-7968-8E89-364FD54BD744}] "C:\Users\The General\AppData\Roaming\Arennu\ugedo.exe"

O4 - HKCU\..\Run: [{A3B9615A-1A91-D79A-EDCF-4B057FA27482}] "C:\Users\The General\AppData\Roaming\Pubiv\yrvao.exe"

O4 - HKCU\..\Run: [mainapp708dl.exe] C:\Users\The General\AppData\Roaming\6ABCEFE7043299D0386DC981FAF42F06\mainapp708dl.exe

O4 - HKUS\S-1-5-18\..\Run: [jdhrwbmy] C:\Windows\system32\config\systemprofile\AppData\Local\rnpttflex\nprmpxxtssd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [jdhrwbmy] C:\Windows\system32\config\systemprofile\AppData\Local\rnpttflex\nprmpxxtssd.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = K:\Local Disk2\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - User Startup: Malware Destructor.lnk = C:\Users\The General\AppData\Roaming\6ABCEFE7043299D0386DC981FAF42F06\mainapp708dl.exe

O4 - Global Startup: WeGame.lnk = C:\Program Files\WeGame\wegame.exe

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm

O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm

O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX

MrCharlie · September 23, 2010

OK, you don't have to quote my post, just use the add/reply button on the bottom.

Please don't put the logs in code, they're too hard to read, just post them

Please repost post logs for me please.

Thanks....MrC

annoooyed · September 23, 2010

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4672

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

23/09/2010 17:25:20

mbam-log-2010-09-23 (17-25-20).txt

Scan type: Quick scan

Objects scanned: 141608

Time elapsed: 8 minute(s), 36 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 3

Registry Values Infected: 9

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 29

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Malware Destructor (Rogue.MalwareDestructor2011) -> No action taken.

HKEY_CURRENT_USER\Software\WinServers (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Malware Destructor Inc (Rogue.MalwareDestructor) -> No action taken.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{3c210281-8bea-2f0d-e57b-23a6cad0b259} (Heuristics.Shuriken) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{33c3809e-0609-6688-8c84-bfeeffa401fa} (Malware.Packer.Gen) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{71429a9f-b541-7968-8e89-364fd54bd744} (Spyware.Passwords.XGen) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mainapp708dl.exe (Malware.Packer.Gen) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{4ea77498-ac8f-35a5-1384-3e44427c3231} (Trojan.ZbotR.Gen) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{a8ab3e83-616f-5dd2-a3be-83708dc063e9} (Trojan.ZbotR.Gen) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{a3b9615a-1a91-d79a-edcf-4b057fa27482} (Trojan.ZbotR.Gen) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\adver_id (Malware.Trace) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor (Rogue.MalwareDestructor2011) -> No action taken.

Files Infected:

C:\Users\The General\AppData\Roaming\Adviy\usky.exe (Heuristics.Shuriken) -> No action taken.

C:\Users\The General\AppData\Roaming\Azir\oshai.exe (Malware.Packer.Gen) -> No action taken.

C:\Users\The General\AppData\Roaming\Arennu\ugedo.exe (Spyware.Passwords.XGen) -> No action taken.

C:\Users\The General\AppData\Roaming\6ABCEFE7043299D0386DC981FAF42F06\mainapp708dl.exe (Malware.Packer.Gen) -> No action taken.

C:\Program Files\Mozilla Firefox\firefox.exe (Trojan.Patched) -> No action taken.

C:\Users\The General\AppData\Local\temp\41B5.tmp (Backdoor.Agent) -> No action taken.

C:\Users\The General\AppData\Local\temp\update1.exe (Trojan.Dropper) -> No action taken.

C:\Users\The General\AppData\Local\temp\update2.exe (Trojan.Dropper) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmp29a81f8e\setup446.exe (Spyware.Passwords) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmp530a9044\time.exe (Trojan.Zbot) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmp6f28dce7\setup.exe (Trojan.Hiloti) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmp74494077\setup.exe (Trojan.Hiloti) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmpace41f6c\Java.Net.5.71.12.8.exe (Backdoor.Agent) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmpca12b78f\Java.Net.1.78.9.26.exe (Trojan.Meredrop) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmpee63ac7c\time.exe (Trojan.Agent) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmpfebd4f5c\setup.exe (Trojan.Hiloti) -> No action taken.

C:\Users\The General\AppData\Local\temp\tmpb1ea5f4a\setup446.exe (Heuristics.Shuriken) -> No action taken.

C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.

C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Destructor\Uninstall.lnk (Rogue.MalwareDestructor2011) -> No action taken.

C:\Users\The General\pizda_ntload.dll (Trojan.Agent) -> No action taken.

C:\Users\The General\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.

C:\Users\The General\AppData\Roaming\Microsoft\Windows\Start Menu\Malware Destructor.lnk (Rogue.MalwareDestructor2011) -> No action taken.

C:\Users\The General\AppData\Roaming\download2\svcnost.exe (Trojan.Agent) -> No action taken.

C:\Users\The General\AppData\Local\temp\nxfsss.bak (Malware.Trace) -> No action taken.

C:\Users\The General\Local Settings\Application Data\Windows Server\admin.txt (Malware.Trace) -> No action taken.

C:\Users\The General\AppData\Roaming\Ovpo\qayzg.exe (Trojan.ZbotR.Gen) -> No action taken.

C:\Users\The General\AppData\Roaming\Katake\inynu.exe (Trojan.ZbotR.Gen) -> No action taken.

C:\Users\The General\AppData\Roaming\Pubiv\yrvao.exe (Trojan.ZbotR.Gen) -> No action taken.

C:\Users\The General\AppData\Local\Windows\Malware Destructor.lnk (Rogue.Malware.Destructor) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.4