1st time using Hijack Scan and submission

Trifool · January 19, 2011

Hello to all,

I have just downloaded this software as recommended by a friend. Seems to be user friendly and seems to work well. As the title indicates, this is the first time I have used the Hijack Scan and submitting the information for review. So please excuse me if I have not submitted all of the information necessary for assistance. Reviewing the directions, it states that I should supply as much information as I can to better assist in the review of my report. I am not sure as to what information I should be supplying besides this log. I run Comodo Firewall Pro along with Avast Anitvirus 5.0.677 virus definitions 110111-1. I have used most of the tools IObit Security 360 ver 1.50.

Below is the log that I have generated on my system and seeking help on the review of any malware or other items that may infect my system. I did not attach the file as the instructions indicate that you are to copy and paste the report in your post.

Thank you,

Logfile of IObit HijackScan v1.0.2.0

Scan saved at 23:48:2, on 2011-1-18

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\COMODO\Firewall\cmdagent.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

F:\Program Files\IObit\IObit Security 360\IS360srv.exe

C:\Program Files\COMODO\Firewall\cfp.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe

C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe

C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe

C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Alwil Software\Avast5\avastUI.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe

F:\Program Files\IObit\IObit Security 360\IS360tray.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe

F:\Program Files\Advanced SystemCare 3\AWC.exe

C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe

C:\Program Files\Southwest Airlines\Ding\Ding.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe

C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

F:\Program Files\IObit\IObit Security 360\is360.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE

C:\WINDOWS\msagent\AgentSvr.exe

F:\Program Files\IObit\IObit Security 360\a_hijackscan.exe

O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: FGCatchUrl - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - F:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Unknown - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll

O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [intelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [DXDllRegExe] dxdllreg.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [nwiz] nwiz.exe /install

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [blackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iObit Security 360] "F:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE}SPRT.ScriptRunner.1 - http://www.comcastsupport.com/OneClickFix/tgctlsr.cab

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B}SysProWmi.1 - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000}SWCtl.SWCtl.10.1.1 - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}YInstHelper.YInstStarter.1 - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77}Scanner.SysScanner - http://i.dell.com/images/global/js/scanner/SysProExe.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}MsnPhotoUpload.PhotoUploadCtl.1 - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab

O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}Aurigma.ImageUploaderEx.5.1 - http://fb.familylink.com/we_are_related/stream/core/lib/AurigmaImageUploader/ImageUploader5.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}SoftwareDistribution.MicrosoftUpdateWebControl.1 - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1278204636750

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}Java Plug-in 1.6.0_23 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697}Ctp.Ctp.1 - http://www.imgag.com/cp/install/AxCtp2.cab

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}Java Plug-in 1.6.0_23 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Java Plug-in 1.6.0_23 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\COMMON~1\AOL\ACS\AOLacsd.exe

O23 - Service: Application Updater (Application Updater) - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

O23 - Service: avast! Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Mail Scanner (avast! Mail Scanner) - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Web Scanner (avast! Web Scanner) - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown - C:\Program Files\COMODO\Firewall\cmdagent.exe

O23 - Service: Creative Service for CDROM Access (Creative Service for CDROM Access) - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe

O23 - Service: iPod Service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IS360service (IS360service) - IObit - F:\Program Files\IObit\IObit Security 360\IS360srv.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe

O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe

O23 - Service: RoxMediaDB (RoxMediaDB) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe

O23 - Service: RoxUPnPRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe

O23 - Service: RoxUpnpServer (RoxUpnpServer) - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe

O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

Superdave · January 22, 2011

Hello and welcome to IOBit Forums. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.

2. The fixes are specific to your problem and should only be used for this issue on this machine.

3. If you don't know or understand something, please don't hesitate to ask.

4. Please DO NOT run any other tools or scans while I am helping you.

5. It is important that you reply to this thread. Do not start a new topic.

6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

What problems are you experiencing?

*********************************************************

I strongly recommend that you remove Ask from your computer because it;

•Promotes its toolbars on sites targeted to kids.

•Promotes its toolbars through ads that appear to be part of other companies' sites.

•Promotes its toolbars through other companies' spyware.

•Installs without any disclosure whatsoever and without any consent whatsoever.

•Solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.

•Makes confusing changes to users' browsers -- increasing Ask's revenues while taking users to pages they didn't intend to visit.

See Here for more info.

If you choose to follow my recommendation then please go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

•AskBarDis or anything related to Ask

Then please find and delete this folder in bold (if present):

C:\Program Files\AskBarDis. or anything related to Ask.

**************************************************

Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

**********************************************

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)

* Double-click the icon on your desktop to run the installer.

* When asked to Update the program definitions, click Yes

* If you encounter any problems while downloading the updates, manually download and unzip them from here

* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts

* Click the Scanning Control tab.

* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning

•Scan for tracking cookies

•Terminate memory threats before quarantining

•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer

* On the left check the box for the drive you are scanning.

* On the right choose Perform Complete Scan

* Click Next to start the scan. Please be patient while it scans your computer.

* After the scan is complete a summary box will appear. Click OK

* Make sure everything in the white box has a check next to it, then click Next

* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:

•After reboot, double-click the SUPERAntiSpyware icon on your desktop.

•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).

•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)

* Click close and close again to exit the program.

*Copy and Paste the log in your post.

******************************************

Please download Malwarebytes Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

****************************************************

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1

Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.

* Open the Security Check folder and double-click Security Check.bat

* Follow the on-screen instructions inside of the black box.

* A Notepad document should open automatically called checkup.txt

* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

Trifool · January 23, 2011

Reply to questions.....

You asked what type of problems am I having with my system. The only problem I was having was at times, my system would seem to run slow. I would reboot my system and it would be fine. Really no other real type of issues with my system.

I have run the programs you have outlined in your reply and here are the logs you have requested:

Malwarebytes' Anti-Malware 1.50.1.1100

http://www.malwarebytes.org

Database version: 5575

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

1/23/2011 2:04:30 AM

mbam-log-2011-01-23 (02-04-30).txt

Scan type: Full scan (C:\|F:\|)

Objects scanned: 298131

Time elapsed: 3 hour(s), 17 minute(s), 34 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 2

Registry Keys Infected: 12

Registry Values Infected: 15

Registry Data Items Infected: 0

Folders Infected: 26

Files Infected: 110

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\program files\dealio toolbar\searchsettings.dll (PUP.Dealio) -> Delete on reboot.

c:\program files\dealio toolbar\searchsettingsres409.dll (PUP.Dealio) -> Delete on reboot.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Application Updater (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Dealio (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\SEARCH SETTINGS (PUP.Dealio) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gasfkyhriikgmj (Rootkit.TDSS) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\SEARCHSETTINGS.DLL (PUP.Dealio) -> Value: SEARCHSETTINGS.DLL -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\APPLICATION UPDATER\APPLICATIONUPDATER.EXE (PUP.Dealio) -> Value: APPLICATIONUPDATER.EXE -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} (PUP.Dealio) -> Value: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} (PUP.Dealio) -> Value: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\SEARCHSETTINGS.EXE (PUP.Dealio) -> Value: SEARCHSETTINGS.EXE -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\SEARCHSETTINGS@SPIGOT.COM (PUP.Dealio) -> Value: SEARCHSETTINGS@SPIGOT.COM -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Search Settings\installDir (PUP.Dealio) -> Value: installDir -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\FF\CHROME.MANIFEST (PUP.Dealio) -> Value: CHROME.MANIFEST -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\FF\INSTALL.RDF (PUP.Dealio) -> Value: INSTALL.RDF -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\FF\CHROME\LOCALE\EN-US\WIDGITOOLBARPLUGIN.PROPERTIES (PUP.Dealio) -> Value: WIDGITOOLBARPLUGIN.PROPERTIES -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\SSFF\CHROME.MANIFEST (PUP.Dealio) -> Value: CHROME.MANIFEST -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\SSFF\INSTALL.RDF (PUP.Dealio) -> Value: INSTALL.RDF -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO TOOLBAR\SSFF\CHROME\LOCALE\EN-US\SEARCHSETTINGSPLUGIN.DTD (PUP.Dealio) -> Value: SEARCHSETTINGSPLUGIN.DTD -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

c:\program files\ddnsfilter (Trojan.DNSChanger) -> Quarantined and deleted successfully.

c:\program files\windows police pro (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale\EN-US (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\components (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\IE (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\IE\4.0.2 (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\content (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\locale (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\locale\en-US (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\skin (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\components (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed administrator\application data\Dealio (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed administrator\application data\Dealio\res (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed administrator\application data\Dealio\temp (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed piedad\application data\Dealio (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed piedad\application data\Dealio\res (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed piedad\application data\Dealio\temp (PUP.Dealio) -> Quarantined and deleted successfully.

Files Infected:

c:\program files\dealio toolbar\searchsettings.dll (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\searchsettingsres409.dll (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\application updater\applicationupdater.exe (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\IE\4.0.2\dealiotoolbarie.dll (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\searchsettings.exe (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\widgihelper.exe (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\mozilla firefox\extensions\searchsettings@spigot.com (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\Shared\lib.sig (Adware.Deepdive) -> Quarantined and deleted successfully.

c:\WINDOWS\SYSTEM32\gasfkyatswkiod.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\SYSTEM32\gasfkypalmlygh.dat (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\SYSTEM32\SYSDLL.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\010112010146101105.xe (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\010112010146120114.xe (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\0101120101464950.xe (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\0101120101465753.xe (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\ectbbyn.dat (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\ex23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\freddy45.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

c:\WINDOWS\ld08.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

c:\WINDOWS\pp10.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\sscfg.ini (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome.manifest (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\install.rdf (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\chevron.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\chevron.xul (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\login.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\login.xul (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\parser.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\rsstickerwidget.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\searchbox.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\searchbox.xul (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgichevron.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgicomm.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgihandling.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgilisteners.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgitoolbarplugin.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgitoolbarplugin.xul (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\content\widgiui.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale\EN-US\searchbox.dtd (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\locale\EN-US\yahoo-search.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\searchbox.css (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\separator.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\target.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\chrome\skin\widgitoolbarplugin.css (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\components\config.ini (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\components\ifbhohelperwidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\FF\components\ifbhowidgitoolbar.xpt (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\IE\4.0.2\config.ini (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\apple.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\barnes.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\bestbuy.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\dealio_logo.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\dealio_logo_hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\icon_settings.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\macys.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\newegg.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\overstock.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search-button-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search-button.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search-chevron-hover.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search-chevron.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search_amazon.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search_dealio.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search_ebay.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\search_yahoo.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\target.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\walmart.gif (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\Res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome.manifest (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\install.rdf (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\content\plugin.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\content\plugin.xul (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\content\protection.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\content\utils.js (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\locale\en-US\searchsettingsplugin.dtd (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\locale\en-US\searchsettingsplugin.properties (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\chrome\skin\yahoo.xml (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\components\ifbhosearch.xpt (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\components\ifbhosearchhelperengine.xpt (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\components\ifhelperpreferences.xpt (PUP.Dealio) -> Quarantined and deleted successfully.

c:\program files\dealio toolbar\SSFF\components\sscfg.ini (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed administrator\application data\Dealio\res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed administrator\application data\Dealio\temp\http___www_dealio_com_rss_coupons-deals_dotd_.xml (PUP.Dealio) -> Quarantined and deleted successfully.

c:\documents and settings\ed piedad\application data\Dealio\res\widgets.xml (PUP.Dealio) -> Quarantined and deleted successfully.

Results of screen317's Security Check version 0.99.8

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

avast! Free Antivirus

COMODO Firewall Pro

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

HijackThis 2.0.2

CCleaner

Java 6 Update 23

Java 2 Runtime Environment, SE v1.4.2_03

Adobe Flash Player 10.1.102.64

Adobe Reader 9.4.1

Out of date Adobe Reader installed!

Mozilla Firefox (3.6.12) Firefox Out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Comodo Firewall cmdagent.exe

Comodo Firewall cfp.exe

Alwil Software Avast5 AvastSvc.exe

Alwil Software Avast5 avastUI.exe

``````````End of Log````````````

Superdave · January 24, 2011

Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.

Go to the Control Panel and enter Add or Remove Programs.

Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

***************************************************

Please download ComboFix http://img7.imageshack.us/img7/4930/combofix.gif from BleepingComputer.com

Alternate link: GeeksToGo.com

and save it to your Desktop.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here

Double click ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

http://img.photobucket.com/albums/v666/sUBs/Query_RC.gif

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

http://img.photobucket.com/albums/v666/sUBs/RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

Sign In

1st time using Hijack Scan and submission

Recommended Posts

Trifool

Link to comment

Share on other sites

Superdave

Link to comment

Share on other sites

Trifool

Link to comment

Share on other sites

Superdave

Link to comment

Share on other sites

Archived

Browse

Activity