I cant clean my laptop

[Ridley87]

Hi I had the white smoke virus on my lap top, I have managed to clear it as much as I can but my web browser keeps redirecting me when I click on links in google, plus randomly opening new tabs for random sites.

I have run mbam, spybot, SAS and also my AVG but they have all found nothing.

Please help!

Thanks

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6811

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

08/06/2011 21:15:39

mbam-log-2011-06-08 (21-15-39).txt

Scan type: Full scan (C:\|D:\|F:\|)

Objects scanned: 344333

Time elapsed: 1 hour(s), 55 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-06-03.01) - NTFSx86

Internet Explorer: 8.0.6001.19019 BrowserJavaVersion: 1.6.0_13

Run by Matt at 23:59:42 on 2011-06-08

Microsoft

[screen317]

Hi and welcome to Malwarebytes.

I notice that you are using more than one antivirus program (AVG and Lavasoft). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[Ridley87]

Hi, thanks for your time!

I had quite a lot of trouble running the combofix with it crashing my computer but its all done now, I hope. here's the scripts that you needed:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6837

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

12/06/2011 01:06:10

mbam-log-2011-06-12 (01-06-10).txt

Scan type: Quick scan

Objects scanned: 167409

Time elapsed: 8 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13

Run by Matt at 2:19:10 on 2011-06-12

Microsoft

[screen317]

Hi,

Please see:

HijackThis Forum Policy

We will not be party to obvious use of key gens, cracks, warez or other illegal means of downloading software, music, videos ect. This means no P2P evidence will be supported. Logs that show these in them, will given the option to remove the P2P items. Keygens, cracks, warez and similar will have the thread closed period. It's theft and against the law.

This goes for uTorrent and anything else you may have installed.

[Ridley87]

Hi,

Sorry I thought I had deleted it but a system restore must have brought it back.

Iv deleted Utorrent now, is there anything else on here that I need to get rid of?

Thanks

[screen317]

Hi,

Thank you.

Update MBAM, run a Quick Scan, and post its log. Also post a fresh DDS log (DDS.txt) and we'll take it from there.

[Ridley87]

Hi, here are the logs you needed

In the DDS log it has a reading for a uterrent toolbar, but Iv deleated it and cant find it in the file location that it comes up with in the log but it still keeps coming up in the log, I hope this is alright, Or you may be able to instruct me on where to find it if its still there? thanks

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6896

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

19/06/2011 18:08:25

mbam-log-2011-06-19 (18-08-25).txt

Scan type: Quick scan

Objects scanned: 171749

Time elapsed: 7 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 3

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cK28258HbAmH28258 (Trojan.FakeAlert) -> Value: cK28258HbAmH28258 -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lvelejam (Trojan.Agent.U) -> Value: Lvelejam -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\programdata\ck28258hbamh28258\ck28258hbamh28258.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13

Run by Matt at 18:17:02 on 2011-06-19

Microsoft

[screen317]

Hi,

Is there anything in this folder?

c:\program files\utorrentbar

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[Ridley87]

Hi, sorry this is so late, I have been away.

With regards to the utorrent program file, I uninstalled the program but that left the file there and It didnt come up with the program in the uninstall prgrams list, so I went to the file and deleated it, but it still comes up on that report, I have searched in the start search for utorrent and there is nothing that comes up, so im pretty sure its not there, I just cant work out why it still comes up om that log! Either way, here is the combo fix log:

(btw, is it quite common for combofix to keep crashing, I had to run it about 8 times before it compleated properly?)

ComboFix 11-07-05.02 - Matt 05/07/2011 17:06:40.7.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2812.2018 [GMT 1:00]

Running from: c:\users\Matt\Downloads\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((( Files Created from 2011-06-05 to 2011-07-05 )))))))))))))))))))))))))))))))

.

.

2011-07-05 16:21 . 2011-07-05 16:25 -------- d-----w- c:\users\Matt\AppData\Local\temp

2011-07-05 16:21 . 2011-07-05 16:21 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-07-05 16:20 . 2011-07-05 16:21 -------- d-----w- c:\users\Matt\AppData\Roaming\Igylm

2011-07-05 16:20 . 2011-07-05 16:20 181248 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\nyoxy.exe

2011-07-05 16:20 . 2011-07-05 16:20 -------- d-----w- c:\users\Matt\AppData\Roaming\Viakqo

2011-07-05 16:20 . 2011-07-05 16:20 181248 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\laesde.exe

2011-07-05 16:20 . 2011-07-05 16:20 181248 ----a-w- c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\puhepo.exe

2011-06-18 18:24 . 2011-06-19 17:08 -------- d-----w- c:\programdata\cK28258HbAmH28258

2011-06-12 01:39 . 2011-06-12 01:39 16409960 ----a-w- c:\program files\spybotsd162.exe

2011-06-11 23:54 . 2011-06-11 23:56 9435312 ----a-w- c:\program files\mbam-setup-1.51.0.1200.exe

2011-06-11 23:33 . 2011-06-11 23:33 -------- d-----w- C:\AVGTemp

2011-06-11 21:41 . 2011-06-11 23:28 -------- d-----w- c:\programdata\MFAData

2011-06-11 16:25 . 2011-06-11 19:47 -------- d-----w- c:\users\Matt\AppData\Local\Temp(60)

2011-06-09 00:43 . 2011-06-10 10:44 -------- d-----w- c:\programdata\jN28321BeIaJ28321

2011-06-07 16:45 . 2011-06-07 16:45 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2011-06-07 10:56 . 2011-06-11 14:01 -------- d-----w- c:\programdata\Lavasoft

2011-06-06 19:52 . 2011-06-06 19:52 -------- d-----w- c:\users\Default\Tracing

2011-06-06 18:28 . 2011-06-08 16:57 -------- d-----w- c:\users\Matt\AppData\Roaming\Ziqu

2011-06-06 18:14 . 2011-06-06 19:05 -------- d-----w- c:\users\Matt\AppData\Roaming\Adnu

2011-06-06 18:14 . 2011-06-06 18:28 -------- d-----w- c:\users\Matt\AppData\Roaming\Imnoeb

2011-06-06 17:40 . 2011-06-06 17:40 0 ----a-w- c:\users\Matt\AppData\Local\Mqogijefedawevev.bin

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-11 21:25 . 2010-01-11 21:14 93234472 ----a-w- c:\program files\iTunesSetup.exe

2011-04-14 16:41 . 2011-06-19 16:40 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2010-11-29 15:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-11-29 3908192]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]

"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-08-13 405504]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]

"{A0796496-A58A-6452-3752-674B2690E319}"="c:\users\Matt\AppData\Roaming\Viakqo\ciang.exe" [2011-06-03 181248]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168]

"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984]

"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848]

"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1045800]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]

"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456]

"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2008-05-24 197904]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1314816]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-01 185896]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-28 570664]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-17 421160]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-18 2289664]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-11-02 8704]

.

c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

puhepo.exe [2011-7-5 181248]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-5-13 727592]

DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2008-6-26 197904]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

laesde.exe [2011-7-5 181248]

nyoxy.exe [2011-7-5 181248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"HideSCAHealth"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll c:\windows\System32\APSHook.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [x]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2008-01-21 179712]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

R3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [2008-05-21 64000]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 SafeBoot;SafeBoot; [x]

S0 SbAlg;SbAlg; [x]

S0 SbFsLock;SbFsLock; [x]

S1 RsvLock;RsvLock; [x]

S2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576]

S2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe [2008-01-21 21504]

S2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe [2008-01-21 21504]

S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944]

S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512]

S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2008-05-14 77824]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-04-07 24936]

S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2008-05-12 576024]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASBroker ASChannel

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

bthsvcs REG_MULTI_SZ BthServ

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-03-18 00:56 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-15 c:\windows\Tasks\HPCeeScheduleForMatt.job

- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-06-26 22:07]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=83&bd=all&pf=cmnb

uInternet Settings,ProxyOverride = *.local

IE: &AOL Toolbar Search - c:\programdata\AOL\ieToolbar\resources\en-GB\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 194.168.4.100 194.168.8.100

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -

FF - ProfilePath - c:\users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\0mcezlsr.default\

FF - prefs.js: network.proxy.type - 0

.

.

------- File Associations -------

.

exefile="c:\windows\system32\config\systemprofile\AppData\Local\aqh.exe" -a "%1" %*

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\tbuTor.dll

BHO-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\tbuTor.dll

Toolbar-{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\uTorrentBar\tbuTor.dll

WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - c:\program files\uTorrentBar\tbuTor.dll

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-07-05 17:24

Windows 6.0.6001 Service Pack 1 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\pdfcDispatcher]

"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(712)

c:\windows\System32\APSHook.dll

.

- - - - - - - > 'lsass.exe'(680)

c:\windows\System32\APSHook.dll

.

Completion time: 2011-07-05 17:32:58

ComboFix-quarantined-files.txt 2011-07-05 16:32

ComboFix2.txt 2011-06-12 01:05

.

Pre-Run: 88,560,369,664 bytes free

Post-Run: 88,670,556,160 bytes free

.

- - End Of File - - 492E83A128B268442000F2F39105EFF8

[screen317]

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[Ridley87]

Here is the log for the ESET scaner, I will run the other security check and get back to you with the results.

Thanks

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=f1250f1084a61d47b1a3f59076a455e8

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-07-09 11:29:49

# local_time=2011-07-10 12:29:49 (+0000, GMT Daylight Time)

# country="United Kingdom"

# lang=9

# osver=6.0.6001 NT Service Pack 1

# compatibility_mode=1026 16777214 0 2 2409276 2409276 0 0

# compatibility_mode=5892 16776574 66 100 33126696 147778744 0 0

# compatibility_mode=8192 67108863 100 0 152 152 0 0

# scanned=192844

# found=28

# cleaned=28

# scan_time=8173

C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM49.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM52.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\ProgramData\Spybot - Search & Destroy\Recovery\SweetIM72.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\ProgramData\Spybot - Search & Destroy\Recovery\WinPalevo1.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\ProgramData\Spybot - Search & Destroy\Recovery\WinPalevo3.zip Win32/Bagle.gen.zip worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\duydys.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\egaqi.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\foxa.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\laesde.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\nyoxy.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\vieqc.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\xetile.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ybleno.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Matt\AppData\Local\Temp(60)\Av-test.txt Eicar test file (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Matt\AppData\Roaming\Uqcyx\nobut.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Matt\AppData\Roaming\Viakqo\ciang.exe a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Matt\Documents\LimeWire\Saved\ulysses.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C

C:\Users\Matt\Downloads\Nero-7.11.10.0_all_update.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OGJPH9UE\imgsource[1].htm JS/Kryptik.AX trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\42da0c28-77cc1d8a Win32/Cycbot.AF trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\1da7a7ab-6902b3a9 a variant of Win32/Kryptik.PAC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\5029e6f5-2196cef4 a variant of Win32/Kryptik.PGE trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache3169363389145451901.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache3889622086770140951.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache4974769937107459320.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache6514596149409033919.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache7352957559942184625.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\temp\jar_cache9003765275009300922.tmp a variant of Win32/Kryptik.PYC trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

[screen317]

Did you get to run SecurityCheck??

[Ridley87]

here is the security check results.

Im still getting the same problems, redirects from google and ocasional pop ups for malware pregrams such as vista home security 2012.

Also, I uninstalled avg and MBAM so that I could run combofix but now I have redownloaded AVG 2011 and I can no longer get MBAM as it deleated it thinking it was malware and now wont let me download it again.

As this cleaning process is taking forever, and I have back ups of most of the important bits from my lap top, im thinking I may just do a full restart of my OS, would this be advisable?

Thanks

Results of screen317's Security Check version 0.99.17

Windows Vista Service Pack 1 (UAC is disabled!)

Out of date service pack!!

Internet Explorer 7 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

AVG 2011

ESET Online Scanner v3

Ranger Outpost Remote Client

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Spybot - Search & Destroy

Java 6 Update 13

Java 6 Update 6

Java 6 Update 7

HP JavaCard for HP ProtectTools

Out of date Java installed!

Flash Player Out of Date!

Adobe Flash Player 10.2.159.1

Mozilla Firefox (x86 en-GB..)

````````````````````````````````

Process Check:

objlist.exe by Laurent

AVG avgwdsvc.exe

AVG avgtray.exe

AVG avgrsx.exe

AVG avgnsx.exe

AVG avgemc.exe

``````````End of Log````````````

[screen317]

Hi,

At this point you may want to do a format and reinstallation. If so, ensure that you're protected next time.

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!