Virtumonde & Security Toolbar 7.1

[mpmtrash]

Hi,

Did the registry search for My Way but the result was no instances found.

Also went to add/remove programs but could not see google in the program list??!

Any toughts?
Thanks

 

[katana]

Any thoughts?

Yes --- Very curious

Try LocalPackage as the search term

 

[mpmtrash]

Found myway - I has a space in it before.... here is the log:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "myway" 10/11/2007 21:40:51

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32]
@="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F924-B9FE-4682-BF72-8AB8210D6D75}]
@="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F924-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32]
@="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F924-B9FE-4682-BF72-8AB8210D6D75}\ProgID]
@="MyWaySearchAssistantDE.Auxiliary.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F924-B9FE-4682-BF72-8AB8210D6D75}\VersionIndependentProgID]
@="MyWaySearchAssistantDE.Auxiliary"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D25F926-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32]
@="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\8829557EB322C354F96043E0B32EE193]
"ProductName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary\CurVer]
@="MyWaySearchAssistantDE.Auxiliary.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MyWaySearchAssistantDE.Auxiliary.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D25F920-B9FE-4682-BF72-8AB8210D6D75}\1.0\0\win32]
@="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D25F920-B9FE-4682-BF72-8AB8210D6D75}\1.0\HELPDIR]
@="C:\\Program Files\\MyWaySA\\SrchAsDe\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\MyWaySA\\SrchAsDe\\"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\MyWaySA\\"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97E4605D8365B904E94A77F1E1BC2AF8]
"8829557EB322C354F96043E0B32EE193"="C:\\Program Files\\MyWaySA\\SrchAsDe\\deSrcAs.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"Publisher"="MyWay"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"URLInfoAbout"="http://info.myway.com/index/id/terms.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"DisplayName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}]
"Publisher"="MyWay"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}]
"URLInfoAbout"="http://info.myway.com/index/id/terms.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E7559288-223B-453C-9F06-340E3BE21E39}]
"DisplayName"="MyWay Search Assistant"

[HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA]

[HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA\SearchAssistantDE]

[HKEY_LOCAL_MACHINE\SOFTWARE\MyWaySA\SearchAssistantDE]
"Dir"="C:\\Program Files\\MyWaySA\\SrchAsDe\\"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.dell.co.uk/myway"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"First Home Page"="http://www.dell.co.uk/myway"

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\Microsoft\Internet Connection Wizard]
"ShellNext"="http://www.dell.co.uk/myway"

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\Microsoft\Internet Explorer\Main]
"Search Bar"="http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DK"

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\MyWaySA]

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\MyWaySA\SearchAssistantDE]

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\MyWaySA\SearchAssistantDE]
"ABS"="http://mysearch.myway.com/jsp/cfg_redir2.jsp?id=DK&psa=U9HAtrNH4f_fOgGoV3DWpA&url=http://search.myway.com/search/barsearch.jhtml&st=kwd&ptnrS=DK&PG=SEASUSH&SEC=ABMANY&searchfor="

[HKEY_USERS\S-1-5-21-1713403217-1342212015-937822065-1006\Software\MyWaySA\SearchAssistantDE]
"DES"="http://mysearch.myway.com/jsp/cfg_redir2.jsp?id=DK&psa=U9HAtrNH4f_fOgGoV3DWpA&url=http://search.myway.com/search/barsearch.jhtml&st=dns&ptnrS=DK&PG=SEASUSH&SEC=DNS&searchfor="

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.dell.co.uk/myway"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"First Home Page"="http://www.dell.co.uk/myway"

 

[katana]

Ok, that's good

Now I need you to use the same search tool, but this time search for

LocalPackage

(Honest, we are getting somewhere :laugh: )

 

[mpmtrash]

Here we go.....

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "LocalPackage" 11/11/2007 06:29:46

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\00095BFF74BECB5448A2FEBFAD36C549]
"LocalPackage"="C:\\WINDOWS\\Installer\\b1a34.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\3574AFE896173CC42AB8A061348B3AB9]
"LocalPackage"="C:\\WINDOWS\\Installer\\27584a.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\37A494A313706A847B50935683F2686D]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c632.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\47D5B7190DD12874B9CCDFE6E20DF957]
"LocalPackage"="C:\\WINDOWS\\Installer\\11262d.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\48D7511FDD7382A428582E0515459A06]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8e89.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\4937F697BE364874B9446EFBCE5C79CD]
"LocalPackage"="C:\\WINDOWS\\Installer\\2da07b.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\49CFBB116E0E0174AAF67713079678CC]
"LocalPackage"="C:\\WINDOWS\\Installer\\50ade8.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\55C2C217CD64E794A96E71FDD44519BE]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8eb2.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\58CABFA223F8BDE4FA656D2893ADFFD7]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6ff.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\7291702F096CC894DBCBC0980AAFCBA5]
"LocalPackage"="C:\\WINDOWS\\Installer\\516ac6.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\75F24757AB1346E4A86884DCBDD6EFF4]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8e77.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\7FCDE114D557E4147AB4D3DC56385F98]
"LocalPackage"="C:\\WINDOWS\\Installer\\1599f.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\8A40193A0F141DB4F8D0AC0169B93BD3]
"LocalPackage"="C:\\WINDOWS\\Installer\\11261b.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\92B139F9099A8A74CAC13CAA075ABBF5]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c67a.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\97943EE65530BE447816123DB2C14EBA]
"LocalPackage"="C:\\WINDOWS\\Installer\\67aa77.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\9DBB284524015834682647FA646158C6]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6ed.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\A2CDF4113BCB74A41BD8D1A0CFD920C0]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8ea0.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\A9E0D1D8997C82D4E99200161D6EE634]
"LocalPackage"="C:\\WINDOWS\\Installer\\11260a.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\ABA8E19640D49834788396B25F4E625C]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c668.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\AF33030005256AB4497B4886F6884150]
"LocalPackage"="C:\\WINDOWS\\Installer\\50add6.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\B37B45BCCE35B2D4E8A1CAA8CA9FB6B3]
"LocalPackage"="C:\\WINDOWS\\Installer\\45958a.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\BB0A8EBF5879962498AB4E708E889FB6]
"LocalPackage"="C:\\WINDOWS\\Installer\\182239.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\BB38B80DA31C8A04B9CBC685A1CFBAC2]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6c9.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\BC6FC0DDCBDA26043BC05DB3128AA3BF]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c656.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D06EDE0F96DB153418AB07E61571F9E7]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6db.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D2CAF3C3C73891C49AB0068C621BA5A1]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8e65.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D326130434CA14B40AFD857479196848]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c644.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D5A1F02787E2BAF4D99C74CA42FBEBF4]
"LocalPackage"="C:\\WINDOWS\\Installer\\50adfa.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D78E1F6C1E3F478479CE8FD7BAD68687]
"LocalPackage"="C:\\WINDOWS\\Installer\\67aa64.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\D965EB20DBB715449A550CDCBF60591F]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6b5.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\E97FFC186E40CB144BAF2DFFD45EA851]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c6b6.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\F498D7EF7BACEF540865443F52234A30]
"LocalPackage"="C:\\WINDOWS\\Installer\\3e8129.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Patches\F81D2D10124B54D46986B33C209AA1DC]
"LocalPackage"="C:\\WINDOWS\\Installer\\62c68c.msp"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0B5EE0CABF8AA0D4FA30E2CD15F848B1\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bb2.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0B79C053C7D38EE4AB9A00CB3B5D2472\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\7506.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0CAE291463B632742B610D8EE67775CA\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bc2.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0E23E40C6140D434FA9B96967D309AFE\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\50adc5.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0F007175D9BDA3B40BD3531AB45B39F9\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\47c38a.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\116B3484BCF88244C832130D5AAE1E46\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b820.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\15CC353DD034F6C4B9E72500D31A0EA5\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b825.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\164AFE3E38BEB3C4C974C2D1850A5155\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b82a.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1FFEDB53016A65940AD05154C3113659\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6c69.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\29FE602138E29584CABC02843CBCD76A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bd1.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3D6B2B85FF5E61D478CA25CC75717C6C\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6c72.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\41858184422Aa74418AD17DB0285E0B1\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b81b.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4757561245DB2A844905BE302B7CCF92\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bab.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4EAC60FA431C1B446B9941BFBD36DB73\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bc6.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4F56621B39E44BA47BCF7350B3256492\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bdf.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4F57260AB42358E4596E782BDC274910\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\12a2e5.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\55716C7B84BD300449F8D343BDE8FA96\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b7e2.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\568774731F3A2774DA34AACFB6FC9FF9\InstallProperties]
"LocalPackage"="c:\\WINDOWS\\Installer\\1c0eb3.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5B397F38FBB8DF248A6A68C83B2EAAAE\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\68ef.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5B3B5BFE082A52E4EBC136E4FE3EC2B1\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b7f2.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5EAD28C50BE647342945EB3391ABE428\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\83ac46.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5F374570A648B844CB3B01A41A672050\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6be6.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\61DC2AA5F6073f14785CB2A530F1B2B3\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b7f7.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7447A0000000000\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\53befa.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\69A5CA7BCB8CC1346B16720A7918FD8A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6c6d.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6C356278CDD5B8847B2CFCE9D439535E\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\2abaff.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6C7CD9CB246FCDD489507B0CCC1303DE\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\eb1f9.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\74237FAFBA4533F48BE4AE3DC6F3C378\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\1e4ac6.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7A54B78467022644EBFF0513669D0E0E\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\8e930.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\87627777F71810443910DED1108AAD65\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b84c.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8829557EB322C354F96043E0B32EE193\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6c65.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\1dafc.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8D60D467ED8DE1141A8C9D9E83F0A848\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6b7e.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040211900063D11C8EF10054038389C\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\2cdaa9.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9399EE5EF9522ED40832C5941EA6F434\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b82f.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9B694C87B6A52964C8E2FAFF3CE49416\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bca.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9F2FDFE0D6387BE43AD230B83D1FBFA2\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\2e8e8f.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A266C3D16C6F76747A88A74AA3A93171\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bbe.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B9C807BA8C799CA498B9BD2F62CA3928\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bd8.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BAB3CC87A2ED4BF4F8BB4EADDD2C7674\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\1508a8d.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C2667F47BD1BE9848ACA700AB64279B8\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6b9d.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C6B56403F35B1A94E9AB3A1F78DA05E2\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\6bed.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\CBA921A9A35A90242AE15DEDFD7BCC8A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b7fc.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D24F5095F5F36194DA6A493A46A6EE67\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\68f6.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D9BD4ABD15EE44944A9189BAF121948C\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\855be.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DBC8D038866C2e949A962C2C0136230E\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b847.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\DDE7F2BCF1D91C3409CFF425AE1E271A\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\50c4.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\E7DD42A510B7CA14DA8A1F7716773AAB\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\26e019.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EE8A868315050BD4D86FF4B4A8890D38\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\2abb34.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F525BD4F689A94249BB8248A602615AC\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b834.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\FE2DACC32FFC736428AAAAFB7320283D\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\5b7e8.msi"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1713403217-1342212015-937822065-1006\Products\00F73955B96A9404D8A3C1779247B2F6\InstallProperties]
"LocalPackage"="C:\\WINDOWS\\Installer\\fd368.msi"

 

[katana]

Navigate to
C:\WINDOWS\Installer\6c65.msi
right-click the entry and select the uninstall option.

Let me know how you get on

 

[mpmtrash]

Hi - I cant see the Installer folder in the windows folder???!!!

 

[katana]

Show All Files And Folders
Now you need to show all files and folders

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Show hidden files and folders.
• Uncheck Hide file extensions for known file types
• Uncheck the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Now you should be able to see it

 

[mpmtrash]

Hi - Thanks - it has uninstalled successfully. However - if I put a wrong domain name in the web address now it goes to gooogle.com and comes up with search results there. Is this safe also? I do have a google search box in my toolbar of IE but I do not use it and am happy to uninstall Google completely.

 

[katana]

Glad to hear it has gone nicely
Google is safe enough :bigthumb:

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  • 

You can also delete any logs we have produced, and empty your Recycle bin.

Reset System Restore.
Now you should disable System restore to purge any infected files and then re-enable it,

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer

Turn ON System Restore

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Un-Check Turn off System Restore.
Click Apply, and then click OK.

Also PLEASE read this article

So How Did I Get Infected In The First Place

If you can see a program in the must have section that you have never seen or used then get it!

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

 

[mpmtrash]

Thanks. I have ow protected my computer - thanks for all your help much appreciated. You are an :angel::bigthumb:

Feel free to archive this thread. Thanks once again.resent: