PC wireless connectivity post malware

plumtast · October 29, 2012

Using PC running XP SP3 with Thomson router wirless and had malware infection (related to live security platinum - forget exact name) while using Firefox. MS security essentials was already installed but not sure whether working properly. Previously had AVG and have since reinstalled it post-malware but showing driver problem. Malwarebytes and anvi smart defender have since been used to try to remove malware and seemed to have worked to some extent because PC no longer locked with ransom screen asking you to pay for the rogue security software. However, the most recent problem is inability to connect to our home wireless network. When trying 'repair', it tries to renew IP address but gets stuck and when ask for details, get error message about IP address, subnet mask, and default gateway (and in fact today, it's not even showing the wireless connections in range - i.e. no list - and just says cannot configure connection). I did an ipconfg command prompt and got the following info:

Windows IP Configuration Host Name . . . . . . . . . . . . : mesh Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : NoEthernet adapter Local Area Connection: Media State . . . . . . . . . . . : Media disconnected Description . . . . . . . . . . . : NVIDIA nForce Networking Controller Physical Address. . . . . . . . . : 00-17-31-2F-AB-F7Ethernet adapter Local Area Connection 3: Media State . . . . . . . . . . . : Media disconnected Description . . . . . . . . . . . : Bluetooth PAN Network Adapter Physical Address. . . . . . . . . : 00-03-0D-00-00-01Ethernet adapter Wireless Network Connection 12: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : ADD-GWP110v4 PCI Wireless LAN Card Physical Address. . . . . . . . . : 00-A1-B0-25-29-C4 Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 0.0.0.0 Subnet Mask . . . . . . . . . . . : 0.0.0.0 Default Gateway . . . . . . . . . : DHCP Server . . . . . . . . . . . : 255.255.255.255

Any help much appreciated:confused:

KenB · October 29, 2012

Hi and welcome to ExTS

Did you have help to get rid of the malware or did you just rely on MBAM and your AV ?

=============

Please try an ethernet cable direct to the router and let me know if you can access the net this way

=============

Please click on the orange Network Test in my signature ( bottom of this post )

You will need to save it to a memory stick (or run it from the wired connection) and run the software from there.

Copy and post the result here please.

plumtast · October 29, 2012

Hi and welcome to ExTS

Did you have help to get rid of the malware or did you just rely on MBAM and your AV ?
=============
No help, just those. Not sure it's gone - how can I test?

Please try an ethernet cable direct to the router and let me know if you can access the net this way

=============
Yes that works

Please click on the orange Network Test in my signature ( bottom of this post )
You will need to save it to a memory stick (or run it from the wired connection) and run the software from there.
Copy and post the result here please.

===============
I've run this - I'll PM results to you.

KenB · October 29, 2012

Post them here - there is nothing personal

I will ask one of our security guys to advise you further if necessary regarding the malware issue.

plumtast · October 29, 2012

Ok - my name was on one of the files but I've asterisked that.

Windows IP Configuration

Host Name . . . . . . . . . . . . : mesh

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : lan

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : lan

Description . . . . . . . . . . . : NVIDIA nForce Networking Controller

Physical Address. . . . . . . . . : 00-17-31-2F-AB-F7

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.1.64

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.1.254

DHCP Server . . . . . . . . . . . : 192.168.1.254

DNS Servers . . . . . . . . . . . : 192.168.1.254

Lease Obtained. . . . . . . . . . : 29 October 2012 17:09:01

Lease Expires . . . . . . . . . . : 30 October 2012 17:09:01

Ethernet adapter Wireless Network Connection 13:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : ADD-GWP110v4 PCI Wireless LAN Card

Physical Address. . . . . . . . . : 00-A1-B0-25-29-C4

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Autoconfiguration IP Address. . . : 169.254.118.97

Subnet Mask . . . . . . . . . . . : 255.255.0.0

Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 3:

Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : Bluetooth PAN Network Adapter

Physical Address. . . . . . . . . : 00-03-0D-00-00-01

Pinging 194.119.131.66 with 32 bytes of data:

Reply from 194.119.131.66: bytes=32 time=18ms TTL=55

Reply from 194.119.131.66: bytes=32 time=17ms TTL=55

Reply from 194.119.131.66: bytes=32 time=18ms TTL=55

Ping statistics for 194.119.131.66:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 17ms, Maximum = 18ms, Average = 17ms

Pinging plus.net [212.159.8.2] with 32 bytes of data:

Reply from 212.159.8.2: bytes=32 time=28ms TTL=248

Reply from 212.159.8.2: bytes=32 time=27ms TTL=248

Ping statistics for 212.159.8.2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 27ms, Maximum = 28ms, Average = 27ms

Tracing route to cns1.uk.vianw.net [194.119.131.66]

over a maximum of 30 hops:

1 6 ms 99 ms 99 ms dsldevice.lan [192.168.1.254]

2 18 ms 23 ms 19 ms lo0-central10.ptw-ag03.plus.net [195.166.128.197]

3 20 ms 33 ms 19 ms link9-central10.ptw-gw01.plus.net [84.93.248.80]

4 64 ms 19 ms 19 ms xe-7-2-0.ptw-cr01.plus.net [212.159.1.20]

5 19 ms 18 ms 19 ms g1-1-1-t40-br3.router.uk.clara.net [195.66.224.66]

6 19 ms 19 ms 20 ms ten1-0-0-t40-cr1.router.uk.clara.net [195.8.68.85]

7 111 ms 55 ms 55 ms ten2-0-0-t6-cr2.router.uk.clara.net [195.8.68.118]

8 20 ms 19 ms 19 ms g6-1-t6-ar12.router.uk.clara.net [195.157.0.245]

9 18 ms 18 ms 18 ms cns1.uk.vianw.net [194.119.131.66]

Trace complete.

These Windows services are started:

Akamai NetSession Interface

Apple Mobile Device

Ati HotKey Poller

AVG WatchDog

BlueSoleil Hid Service

Bonjour Service

COM+ Event System

Cryptographic Services

CyberLink Background Capture Service (CBCS)

CyberLink Media Library Service

CyberLink Task Scheduler (CTS)

DCOM Server Process Launcher

DHCP Client

Distributed Link Tracking Client

DNS Client

Error Reporting Service

Event Log

Fast User Switching Compatibility

Frontier Compute Engine

Frontier Update Service

Help and Support

HTTP SSL

Indexing Service

IPSEC Services

Java Quick Starter

Network Connections

Network Location Awareness (NLA)

Plug and Play

Pml Driver HPZ12

PnkBstrA

Print Spooler

Protected Storage

Ralink Registry Writer

Remote Access Connection Manager

Remote Procedure Call (RPC)

Secondary Logon

Security Accounts Manager

Server

Shell Hardware Detection

SSDP Discovery Service

System Event Notification

System Restore Service

Task Scheduler

TCP/IP NetBIOS Helper

Telephony

Terminal Services

Themes

Ulead Burning Helper

Universal Plug and Play Device Host

Viewpoint Manager Service

vToolbarUpdater13.2.0

WebClient

Windows Audio

Windows Image Acquisition (WIA)

Windows Installer

Windows Management Instrumentation

Windows Media Player Network Sharing Service

Windows Time

Workstation

The command completed successfully.

Microsoft Windows XP [Version 5.1.2600]

The following command was not found: interface ipv4 show subinterfaces.

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 17 31 2f ab f7 ...... NVIDIA nForce Networking Controller - Packet Scheduler Miniport

0x3 ...00 a1 b0 25 29 c4 ...... ADD-GWP110v4 PCI Wireless LAN Card - Packet Scheduler Miniport

0x4 ...00 03 0d 00 00 01 ...... Bluetooth PAN Network Adapter - Packet Scheduler Miniport

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.64 20

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

169.254.0.0 255.255.0.0 169.254.118.97 169.254.118.97 20

169.254.118.97 255.255.255.255 127.0.0.1 127.0.0.1 25

169.254.255.255 255.255.255.255 169.254.118.97 169.254.118.97 25

192.168.1.0 255.255.255.0 192.168.1.64 192.168.1.64 20

192.168.1.64 255.255.255.255 127.0.0.1 127.0.0.1 20

192.168.1.255 255.255.255.255 192.168.1.64 192.168.1.64 20

224.0.0.0 240.0.0.0 169.254.118.97 169.254.118.97 25

224.0.0.0 240.0.0.0 192.168.1.64 192.168.1.64 20

255.255.255.255 255.255.255.255 169.254.118.97 169.254.118.97 1

255.255.255.255 255.255.255.255 192.168.1.64 192.168.1.64 1

255.255.255.255 255.255.255.255 192.168.1.64 4 1

Default Gateway: 192.168.1.254

===========================================================================

Persistent Routes:

None

Local Area Connection:

Node IpAddress: [192.168.1.64] Scope Id: []

No Connections

Wireless Network Connection 13:

Node IpAddress: [169.254.118.97] Scope Id: []

No Connections

Local Area Connection 3:

Node IpAddress: [0.0.0.0] Scope Id: []

No Connections

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

PCMService REG_SZ "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"

RemoteControl REG_SZ "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

{1290A33C-85F5-4164-A1BE-7DD299D4986A} REG_SZ "C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe"

Ptipbmf REG_SZ rundll32.exe ptipbmf.dll,SetWriteCacheMode

SoundMan REG_SZ SOUNDMAN.EXE

ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

HP Software Update REG_SZ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

boincmgr REG_SZ "C:\Program Files\BOINC\boincmgr.exe" /a /s

boinctray REG_SZ "C:\Program Files\BOINC\boinctray.exe"

QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime

KeePass 2 PreLoad REG_SZ "C:\Program Files\KeePass Password Safe 2\KeePass.exe" --preload

My Web Search Bar Search Scope Monitor REG_SZ "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0

DivXUpdate REG_SZ "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

<NO NAME> REG_SZ

ApnUpdater REG_SZ "C:\Program Files\Ask.com\Updater\Updater.exe"

MSC REG_SZ "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

Regedit32 REG_SZ C:\WINDOWS\system32\regedit.exe

Anvi Smart Defender REG_SZ C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe

AVG_UI REG_SZ "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY

vProt REG_SZ "C:\Program Files\AVG Secure Search\vprot.exe"

ROC_roc_ssl_v12 REG_SZ "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12

Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

SunJavaUpdateSched REG_SZ "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

Power2GoExpress REG_SZ

BullGuard REG_SZ "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"

WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe

MyWebSearch Email Plugin REG_SZ C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

Akamai NetSession Interface REG_SZ "C:\Documents and Settings\**********\Local Settings\Application Data\Akamai\netsession_win.exe"

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Microsoft Windows XP [Version 5.1.2600]

KenB · October 29, 2012

Hi

This was done with the wired connection by the looks of it.

What does this look like if you do it wireless ( no wired connection ) Clicl on Wireless Test below.

KenB · October 29, 2012

Hi

I have deleted the latest log that you posted as it was exactly the same as the first.

I should have asked you to download the Wireless Test whilst connected with the cable then disconnect the cable and run the test software.

I want to compare the two.

===============

Also .....start > type in .....devmgmt.msc .....Enter

Click the + next to Network Adapters.

Please post what is listed.

Are there any yellow exclamation marks or red Xs ?

===============

If this is a laptop - is the wireless switch in the ON position ?

plumtast · October 29, 2012

Hi
I have deleted the latest log that you posted as it was exactly the same as the first.
I should have asked you to download the Wireless Test whilst connected with the cable then disconnect the cable and run the test software.

I want to compare the two.

===============

Also .....start > type in .....devmgmt.msc .....Enter
Click the + next to Network Adapters.

Please post what is listed.

Are there any yellow exclamation marks or red Xs ?

===============

If this is a laptop - is the wireless switch in the ON position ?

=======================

Not a laptop - PC

===========

Yellow exclamation mark next to: virtualbox bridged networking driver miniport #10

There are others in list if needed but no marks against them.

=================

Report as follows (though seemed to stall at one point - didn't automatically produce results though when exiting prompt it produced them!):

Windows IP Configuration

Host Name . . . . . . . . . . . . : mesh

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : NVIDIA nForce Networking Controller

Physical Address. . . . . . . . . : 00-17-31-2F-AB-F7

Ethernet adapter Wireless Network Connection 13:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : ADD-GWP110v4 PCI Wireless LAN Card

Physical Address. . . . . . . . . : 00-A1-B0-25-29-C4

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Autoconfiguration IP Address. . . : 169.254.118.97

Subnet Mask . . . . . . . . . . . : 255.255.0.0

Default Gateway . . . . . . . . . : 169.254.118.97

Ethernet adapter Local Area Connection 3:

Media State . . . . . . . . . . . : Media disconnected

Description . . . . . . . . . . . : Bluetooth PAN Network Adapter

Physical Address. . . . . . . . . : 00-03-0D-00-00-01

The following command was not found: wlan show networks mode=bssid.

The following command was not found: wlan show profile.

Pinging 194.119.131.66 with 32 bytes of data:

Request timed out.

Ping statistics for 194.119.131.66:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

Ping request could not find host plus.net. Please check the name and try again.

Tracing route to 194.119.131.66 over a maximum of 30 hops

1 * * * Request timed out.

2 * * * Request timed out.

3 * * * Request timed out.

4 * * * Request timed out.

5 * * * Request timed out.

6 * * * Request timed out.

7 * * * Request timed out.

8 * * * Request timed out.

9 * * * Request timed out.

10 * * * Request timed out.

11 * * * Request timed out.

12 * * * Request timed out.

13 These Windows services are started:

Akamai NetSession Interface

Apple Mobile Device

Ati HotKey Poller

AVG WatchDog

BlueSoleil Hid Service

Bonjour Service

COM+ Event System

Cryptographic Services

CyberLink Background Capture Service (CBCS)

CyberLink Media Library Service

CyberLink Task Scheduler (CTS)

DCOM Server Process Launcher

DHCP Client

Distributed Link Tracking Client

DNS Client

Error Reporting Service

Event Log

Fast User Switching Compatibility

Frontier Compute Engine

Frontier Update Service

Help and Support

HTTP SSL

Indexing Service

IPSEC Services

Java Quick Starter

Network Connections

Network Location Awareness (NLA)

Plug and Play

Pml Driver HPZ12

PnkBstrA

Print Spooler

Protected Storage

Ralink Registry Writer

Remote Access Connection Manager

Remote Procedure Call (RPC)

Secondary Logon

Security Accounts Manager

Server

Shell Hardware Detection

SSDP Discovery Service

System Event Notification

System Restore Service

Task Scheduler

TCP/IP NetBIOS Helper

Telephony

Terminal Services

Themes

Ulead Burning Helper

Universal Plug and Play Device Host

Viewpoint Manager Service

vToolbarUpdater13.2.0

WebClient

Windows Audio

Windows Image Acquisition (WIA)

Windows Management Instrumentation

Windows Media Player Network Sharing Service

Windows Time

Workstation

The command completed successfully.

Microsoft Windows XP [Version 5.1.2600]

The following command was not found: interface ipv4 show subinterfaces.

The following command was not found: int tcp show globa.

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x2 ...00 17 31 2f ab f7 ...... NVIDIA nForce Networking Controller - Packet Scheduler Miniport

0x3 ...00 a1 b0 25 29 c4 ...... ADD-GWP110v4 PCI Wireless LAN Card - Packet Scheduler Miniport

0x4 ...00 03 0d 00 00 01 ...... Bluetooth PAN Network Adapter - Packet Scheduler Miniport

===========================================================================

Active Routes:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 169.254.118.97 169.254.118.97 399

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1

169.254.0.0 255.255.0.0 169.254.118.97 169.254.118.97 20

169.254.118.97 255.255.255.255 127.0.0.1 127.0.0.1 25

169.254.255.255 255.255.255.255 169.254.118.97 169.254.118.97 25

224.0.0.0 240.0.0.0 169.254.118.97 169.254.118.97 25

255.255.255.255 255.255.255.255 169.254.118.97 4 1

255.255.255.255 255.255.255.255 169.254.118.97 2 1

255.255.255.255 255.255.255.255 169.254.118.97 169.254.118.97 1

Default Gateway: 169.254.118.97

===========================================================================

Persistent Routes:

None

Local Area Connection:

Node IpAddress: [0.0.0.0] Scope Id: []

No Connections

Wireless Network Connection 13:

Node IpAddress: [169.254.118.97] Scope Id: []

No Connections

Local Area Connection 3:

Node IpAddress: [0.0.0.0] Scope Id: []

No Connections

Server: UnKnown

Address: 127.0.0.1

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

PCMService REG_SZ "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"

RemoteControl REG_SZ "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

{1290A33C-85F5-4164-A1BE-7DD299D4986A} REG_SZ "C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe"

Ptipbmf REG_SZ rundll32.exe ptipbmf.dll,SetWriteCacheMode

SoundMan REG_SZ SOUNDMAN.EXE

ATICCC REG_SZ "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

TkBellExe REG_SZ "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

HP Software Update REG_SZ C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

boincmgr REG_SZ "C:\Program Files\BOINC\boincmgr.exe" /a /s

boinctray REG_SZ "C:\Program Files\BOINC\boinctray.exe"

QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime

KeePass 2 PreLoad REG_SZ "C:\Program Files\KeePass Password Safe 2\KeePass.exe" --preload

My Web Search Bar Search Scope Monitor REG_SZ "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0

DivXUpdate REG_SZ "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

<NO NAME> REG_SZ

ApnUpdater REG_SZ "C:\Program Files\Ask.com\Updater\Updater.exe"

MSC REG_SZ "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

Regedit32 REG_SZ C:\WINDOWS\system32\regedit.exe

Anvi Smart Defender REG_SZ C:\Program Files\Anvisoft\Anvi Smart Defender\ASDTray.exe

AVG_UI REG_SZ "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY

vProt REG_SZ "C:\Program Files\AVG Secure Search\vprot.exe"

ROC_roc_ssl_v12 REG_SZ "C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12

Adobe Reader Speed Launcher REG_SZ "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

SunJavaUpdateSched REG_SZ "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe

Power2GoExpress REG_SZ

BullGuard REG_SZ "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"

WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe

MyWebSearch Email Plugin REG_SZ C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

Akamai NetSession Interface REG_SZ "C:\Documents and Settings\***********\Local Settings\Application Data\Akamai\netsession_win.exe"

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Starbuck · October 29, 2012

Hi plumtast

Let's make sure that the malware has been removed.

Please follow these 3 steps for now.

Step 1

Download RogueKiller and save it to your desktop.

Close all the running processes
Double click RogueKiller icon to run the program
Vista/Win7 users should right click the icon and select Run as Administrator.
When prompted, type 1 (SCAN) and then press Enter
A report will open, please copy and paste this report in your next reply.

A copy of the RKreport.txt can be found on your desktop.

Note:

If RogueKiller is blocked, do not hesitate to try running it again.

If it still fails to run, right click on the downloaded icon and select 'Rename'.....rename it to winlogon and try again.

Step 2

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Search.
A logfile will automatically open after the scan has finished.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[R1].txt as well.

Step 3

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

Please post the 3 reports in your next reply.

Thanks

Edited October 29, 2012 by Starbuck

plumtast · October 29, 2012

Hi plumtast

Let's make sure that the malware has been removed.
Please follow these 3 steps for now.

Step 1
Download RogueKiller and save it to your desktop.

Close all the running processes

Double click RogueKiller icon to run the program
Vista/Win7 users should right click the icon and select Run as Administrator.

When prompted, type 1 (SCAN) and then press Enter

A report will open, please copy and paste this report in your next reply.

A copy of the RKreport.txt can be found on your desktop.

Note:
If RogueKiller is blocked, do not hesitate to try running it again.
If it still fails to run, right click on the downloaded icon and select 'Rename'.....rename it to winlogon and try again.

Step 2
Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.

Double click on adwcleaner.exe to run the tool.

Click on Search.

A logfile will automatically open after the scan has finished.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[R1].txt as well.

Step 3
Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center/Action Center

Windows Update

Windows Defender

[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

Please post the 3 reports in your next reply.

Thanks

Rogue Killer

RogueKiller V8.2.1 [10/29/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User :[Admin rights]

Mode : Scan -- Date : 10/29/2012 21:44:59

¤¤¤ Bad processes : 4 ¤¤¤

[sUSP PATH] wcg_faah_autodock_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_faah_autodock_6.40_windows_intelx86 -> KILLED [TermProc]

[sUSP PATH] wcg_hpf2_rosetta_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86 -> KILLED [TermProc]

[RESIDUE] wcg_faah_autodock_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_faah_autodock_6.40_windows_intelx86 -> KILLED [TermProc]

[RESIDUE] wcg_hpf2_rosetta_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86 -> KILLED [TermProc]

¤¤¤ Registry Entries : 7 ¤¤¤

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet003\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[TASK][sUSP PATH] {35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job : C:\WINDOWS\Ssudea.exe -> FOUND

[TASK][sUSP PATH] {22116563-108C-42c0-A7CE-60161B75E508}.job : C:\DOCUME~1\visitor\LOCALS~1\Temp\Sbx.exe -> FOUND

[HJ] HKCU\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : C:\WINDOWS\Installer\{129bf727-f6b4-db0a-d8e5-74bd0aa0d5b7}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\WINDOWS\Installer\{129bf727-f6b4-db0a-d8e5-74bd0aa0d5b7}\L --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Maxtor 6V250F0 +++++

--- User ---

[MBR] 4d9f567356a1513974290e6595d0a1a0

[bSP] d119ba93793e2a02163436fbf2281b49 : Windows Vista/7 MBR Code

Partition table:

0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 63 | Size: 4502 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 9221310 | Size: 234864 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1].txt >>

RKreport[1].txt

=======================================================

Adwcleaner:

# AdwCleaner v2.005 - Logfile created 10/29/2012 at 21:47:08

# Updated 14/10/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : - MESH

# Boot Mode : Normal

# Running from : C:\Documents and Settings\\My Documents\Downloads\AdwCleaner.exe

# Option [search]

***** [services] *****

Found : MyWebSearchService

Found : Viewpoint Manager Service

***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

File Found : C:\WINDOWS\system32\conduitEngine.tmp

File Found : C:\WINDOWS\system32\f3PSSavr.scr

File Found : C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

Folder Found : C:\Documents and Settings\All Users\Application Data\Ask

Folder Found : C:\Documents and Settings\All Users\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\All Users\Application Data\Trymedia

Folder Found : C:\Documents and Settings\All Users\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\Application Data\PriceGong

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\APN

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AskToolbar

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Conduit

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Softonic-Eng7

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\\Application Data\PriceGong

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AskToolbar

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Conduit

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\ConduitEngine

Folder Found : C:\Documents and Settingsz\\Local Settings\Application Data\Softonic-Eng7

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AskToolbar

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\Local Settings\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\\My Documents\I Want This

Folder Found : C:\Documents and Settings\dfgs\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\dfgs\Local Settings\Application Data\AskToolbar

Folder Found : C:\Documents and Settings\dfgs\Local Settings\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\dfgs\Local Settings\Application Data\Viewpoint

Folder Found : C:\Documents and Settings\visitor\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\visitor\Application Data\Mozilla\Firefox\Profiles\psfyj4ez.default\Conduit

Folder Found : C:\Documents and Settings\visitor\Application Data\Mozilla\Firefox\Profiles\psfyj4ez.default\ConduitEngine

Folder Found : C:\Documents and Settings\visitor\Application Data\PriceGong

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\AskToolbar

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\AVG Secure Search

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\Conduit

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\ConduitEngine

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\Softonic-Eng7

Folder Found : C:\Documents and Settings\visitor\Local Settings\Application Data\Viewpoint

Folder Found : C:\Program Files\Ask.com

Folder Found : C:\Program Files\AVG Secure Search

Folder Found : C:\Program Files\Common Files\AVG Secure Search

Folder Found : C:\Program Files\Common Files\Viewpoint

Folder Found : C:\Program Files\Conduit

Folder Found : C:\Program Files\FunWebProducts

Folder Found : C:\Program Files\MyWebSearch

Folder Found : C:\Program Files\Softonic-Eng7

Folder Found : C:\Program Files\Viewpoint

Folder Found : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Found : HKCU\Software\APN

Key Found : HKCU\Software\AskToolbar

Key Found : HKCU\Software\AVG Secure Search

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\conduitEngine

Key Found : HKCU\Software\Fun Web Products

Key Found : HKCU\Software\FunWebProducts

Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Search

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\VWPT

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7327C09-B521-4EDB-8509-7D2660C9EC98}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F8AD5AA5-D966-4667-9DAF-2561D68B2012}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7327C09-B521-4EDB-8509-7D2660C9EC98}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F8AD5AA5-D966-4667-9DAF-2561D68B2012}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Found : HKCU\Software\MyWebSearch

Key Found : HKCU\Software\PriceGong

Key Found : HKCU\Software\Softonic-Eng7

Key Found : HKCU\Software\Viewpoint

Key Found : HKCU\Toolbar

Key Found : HKLM\Software\APN

Key Found : HKLM\Software\AskToolbar

Key Found : HKLM\Software\AVG Secure Search

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL

Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1

Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{0E2C3126-DDED-4A58-800E-9AEDE84EA31E}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4730EBE-43A6-443E-9776-36915D323AD3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A7327C09-B521-4EDB-8509-7D2660C9EC98}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A9571378-68A1-443D-B082-284F960C6D17}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AD701DC7-7CEB-462E-B66E-935C7F50E57D}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{F8AD5AA5-D966-4667-9DAF-2561D68B2012}

Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.DataControl

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.DataControl.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.2

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton.1

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl

Key Found : HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl.1

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd

Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1

Key Found : HKLM\SOFTWARE\Classes\IMsiDe1egate.Application.1

Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}

Key Found : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}

Key Found : HKLM\SOFTWARE\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}

Key Found : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}

Key Found : HKLM\SOFTWARE\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}

Key Found : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}

Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}

Key Found : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}

Key Found : HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}

Key Found : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}

Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}

Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}

Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}

Key Found : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}

Key Found : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}

Key Found : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}

Key Found : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}

Key Found : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin.1

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel.1

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin.1

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin

Key Found : HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin.1

Key Found : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin

Key Found : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin.1

Key Found : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin

Key Found : HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin.1

Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

Key Found : HKLM\SOFTWARE\Classes\S

Key Found : HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller

Key Found : HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller.1

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2405280

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9DBB28C1-1925-11D3-A498-00104B6EB52E}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E060D9D9-E979-4C2F-A840-BE5150F84AC5}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}

Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\FocusInteractive

Key Found : HKLM\Software\Freeze.com

Key Found : HKLM\Software\Fun Web Products

Key Found : HKLM\Software\FunWebProducts

Key Found : HKLM\Software\MetaStream

Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{180F80D4-6370-467D-8C82-E03E8746E177}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{27E8D778-A556-472E-92E8-43689D58DC15}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Key Found : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss

Key Found : HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin

Key Found : HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Softonic-Eng7 Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Viewpoint Manager

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Viewpoint Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44CF-8957-5838F569A31D}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7327C09-B521-4EDB-8509-7D2660C9EC98}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AD701DC7-7CEB-462E-B66E-935C7F50E57D}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mywebsearch bar uninstall

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Softonic-Eng7 Toolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Manager

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Viewpoint Toolbar

Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Found : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP

Key Found : HKLM\Software\MyWebSearch

Key Found : HKLM\Software\Softonic-Eng7

Key Found : HKLM\Software\Viewpoint

Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Key Found : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Key Found : HKU\S-1-5-21-1646635644-807565481-2889989635-1006\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Found : HKU\S-1-5-21-1646635644-807565481-2889989635-1006\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}

Key Found : HKU\S-1-5-21-1646635644-807565481-2889989635-1006\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{07B18EA9-A523-4961-B6BB-170DE4475CCA}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00A6FAF6-072E-44CF-8957-5838F569A31D}]

Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [MyWebSearch Email Plugin]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{07B18EA9-A523-4961-B6BB-170DE4475CCA}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F8AD5AA5-D966-4667-9DAF-2561D68B2012}]

Value Found : HKLM\SOFTWARE\Microsoft\Windows Media\Wmsdk\Sources [F3PopularScreenSavers]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform [FunWebProducts]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [My Web Search Bar Search Scope Monitor]

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Mozilla Firefox v16.0.1 (en-US)

Profile name : default

File : C:\Documents and Settings\Application Data\Mozilla\Firefox\Profiles\lr2j7lup.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");

Found : user_pref("keyword.URL", "https://isearch.avg.com/search?cid={BF834818-53B8-4657-A041-7D8DCFD5FF69}&[...]

Profile name : default

File : C:\Documents and Settings\visitor\Application Data\Mozilla\Firefox\Profiles\psfyj4ez.default\prefs.js

Found : user_pref("extensions.skipscreen.hostMatchStr", "http://www.shared.com/(get|audio|file|document|dir[...]

Profile name : default

File : C:\Documents and Settings\dfgs\Application Data\Mozilla\Firefox\Profiles\nr1xmfqf.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");

Found : user_pref("browser.search.selectedEngine", "AVG Secure Search");

Found : user_pref("keyword.URL", "https://isearch.avg.com/search?cid={BF834818-53B8-4657-A041-7D8DCFD5FF69}&[...]

-\\ Google Chrome v [unable to get version]

File : C:\Documents and Settings\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

File : C:\Documents and Settings\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

Found [l.73] : icon_url = "https://isearch.avg.com/favicon.ico",

Found [l.76] : keyword = "isearch.avg.com",

Found [l.79] : search_url = "https://isearch.avg.com/search?cid={BF834818-53B8-4657-A041-7D8DCFD5FF69}&mid=f08d936c0f5547d0a362d15e77cb4204-77589c755422fbd30a9c627f198d6086968e183c&lang=en&ds=AVG&pr=fr&d=2012-10-18 19:15:41&v=13.2.0.1&sap=dsp&q={searchTerms}",

File : C:\Documents and Settings\DLocal Settings\Application Data\Google\Chrome\User Data\Default\Preferences

/!\ Cannot open file /!\

===================================================

Farbar

Farbar Service Scanner Version: 27-10-2012

Ran by (administrator) on 29-10-2012 at 22:08:12

Running from "C:\Documents and Settings\\My Documents\Downloads"

Microsoft Windows XP Home Edition Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

sharedaccess Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to retrieve start type of sharedaccess. The value does not exist.

Checking ImagePath: ATTENTION!=====> Unable to retrieve ImagePath of sharedaccess. The value does not exist.

Unable to retrieve ServiceDll of sharedaccess. The value does not exist.

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

wscsvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Windows Update:

============

wuauserv Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

BITS Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit

C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit

C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit

C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit

C:\WINDOWS\system32\netman.dll => MD5 is legit

C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit

C:\WINDOWS\system32\srsvc.dll => MD5 is legit

C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit

C:\WINDOWS\system32\wscsvc.dll => MD5 is legit

C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit

C:\WINDOWS\system32\wuauserv.dll => MD5 is legit

C:\WINDOWS\system32\qmgr.dll => MD5 is legit

C:\WINDOWS\system32\es.dll => MD5 is legit

C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit

C:\WINDOWS\system32\svchost.exe => MD5 is legit

C:\WINDOWS\system32\rpcss.dll => MD5 is legit

C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:

=======

Avgtdix(9) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3) VBoxNetFlt(8)

0x0A000000040000000100000002000000030000005A0000000900000005000000060000000700000008000000

IpSec Tag value is correct.

**** End of log ****

Starbuck · October 29, 2012

Hi plumtast

You actually had a very serious infection there.

Let's make a start with cleaning this system:

Step 1

Close all the running processes
Double click RogueKiller icon to run the program
Vista/Win7 users should right click the icon and select Run as Administrator.
When prompted, type 2 (DELETE) and then press Enter
A report will open, please copy and paste this report in your next reply.

A copy of the RKreport.txt can be found on your desktop.

Step 2

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
You will be prompted to restart your computer. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

Please post the reports and then we'll take it from there.

I'll move this to the Malware Removal forum until we have finished the cleaning process.

Edited October 29, 2012 by Starbuck

plumtast · October 30, 2012

(step 1) Ran program- no prompt appeared, tried to delete using delete button on right hand side - something happened (green activity bar flashed), but files still there ...

KenB · October 30, 2012

I am adding this - more as a note to myself .....

The Wireless Zero Service is not running ( wireless connection will not be available without this )

Stay with starbuck and get the all clear before we continue.

Starbuck · October 30, 2012

Ran program- no prompt appeared, tried to delete using delete button on right hand side - something happened (green activity bar flashed), but files still there ...

Sorry i hadn't noticed that Tigzy had updated the interface.

There is no prompt now.... just the buttons on the right.

Did you allow a little time for everything to load?

This will show in the main window.

Once this has finished, you can click the delete button.

Did you try step 2?

It doesn't matter which order you perform the 2 steps.

plumtast · October 30, 2012

Sorry i hadn't noticed that Tigzy had updated the interface.
There is no prompt now.... just the buttons on the right.
Did you allow a little time for everything to load?
This will show in the main window.
Once this has finished, you can click the delete button.

Did you try step 2?
It doesn't matter which order you perform the 2 steps.

========================================

There are several roguekiller logs which are all quite similar but with slight differences. This one is one of the 7:

RogueKiller V8.2.1 [10/29/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : [Admin rights]

Mode : Scan -- Date : 10/30/2012 08:58:41

¤¤¤ Bad processes : 4 ¤¤¤

[sUSP PATH] wcg_faah_autodock_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_faah_autodock_6.40_windows_intelx86 -> KILLED [TermProc]

[sUSP PATH] wcg_hpf2_rosetta_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86 -> KILLED [TermProc]

[RESIDUE] wcg_faah_autodock_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_faah_autodock_6.40_windows_intelx86 -> KILLED [TermProc]

[RESIDUE] wcg_hpf2_rosetta_6.40_windows_intelx86 -- C:\Documents and Settings\All Users\Application Data\BOINC\projects\http://www.worldcommunitygrid.org\wcg_hpf2_rosetta_6.40_windows_intelx86 -> KILLED [TermProc]

¤¤¤ Registry Entries : 7 ¤¤¤

[services][ROGUE ST] HKLM\[...]\ControlSet001\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet002\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[services][ROGUE ST] HKLM\[...]\ControlSet003\Services\61883 (system32\DRIVERS\61883.sys) -> FOUND

[TASK][sUSP PATH] {35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job : C:\WINDOWS\Ssudea.exe -> FOUND

[TASK][sUSP PATH] {22116563-108C-42c0-A7CE-60161B75E508}.job : C:\DOCUME~1\visitor\LOCALS~1\Temp\Sbx.exe -> FOUND

[HJ] HKCU\[...]\Internet Settings : WarnOnHTTPSToHTTPRedirect (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : C:\WINDOWS\Installer\{129bf727-f6b4-db0a-d8e5-74bd0aa0d5b7}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\WINDOWS\Installer\{129bf727-f6b4-db0a-d8e5-74bd0aa0d5b7}\L --> FOUND

==========================================

Here is the adware log: