Click.GiftLoad removal help, DDS Log Posted

**dwill60513** · 2011-04-02, 22:26

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6247

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

4/2/2011 3:02:41 PM
mbam-log-2011-04-02 (15-02-41).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|)
Objects scanned: 341564
Time elapsed: 1 hour(s), 27 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

________________________________________

SPYBOT SCAN RESULTS:

Click.Giftload

(SBI $89783858)User settings
HKEY_USERS\DEFAULT\Software\Microsoft\InternetExplorer\Main\featuredcontrol\FEATURE_BROWSER_EMULATION\svchost.exe

SPYBOTS WARNING AFTER TRYING TO REMOVE:

Some problems couldn't be fixed; the reason could be
that the associated files are still in use (in memory).
This could be fixed after a restart.
May Spybot - S&&D run on your next system startup?

I've tried to run spybot after the next startup many time but still does the same thing..

Dave

**Blade81** · 2011-04-03, 15:22

Please download the Registry Search tool by clicking on the
hard drive icon halfway down this page:
http://www.billsway.com/vbspage/
Save it to the desktop and run it. If you get an alert from your antivirus about scripting, choose to allow the script to run. Search for FEATURE_BROWSER_EMULATION and click OK. Post the logfile from the tool here for me.

**dwill60513** · 2011-04-03, 18:50

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "FEATURE_BROWSER_EMULATION" 4/3/2011 12:41:09 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]

**Blade81** · 2011-04-03, 18:54

Hi,

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Please run Spybot again.

**dwill60513** · 2011-04-03, 18:57

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "FEATURE_BROWSER_EMULATION" 4/3/2011 12:41:09 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]

Originally Posted by Blade81

Hi,

Open notepad and copy/paste the text in the quotebox below into it:

Code:

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Please run Spybot again.

**Blade81** · 2011-04-03, 19:27

Kindly follow those steps in my previous post.

**dwill60513** · 2011-04-03, 19:34

Sorry, I don't understand what "quote box" you want me to post the registry search results in...

**Blade81** · 2011-04-03, 19:38

Hi,

Just create CFScript.txt file with contents of this code box:

Code:

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\main\featurecontrol\FEATURE_BROWSER_EMULATION]
"svchost.exe"=-

Then drag'n'drop it to ComboFix. You did it earlier so shouldn't be difficult to do now either

**dwill60513** · 2011-04-03, 20:05

ComboFix 11-04-03.01 - Dave 04/03/2011 13:46:50.3.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.1263 [GMT -4:00]
Running from: c:\users\Dave\Desktop\ComboFix.exe
Command switches used :: c:\users\Dave\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WMPNetworkSvc
.
.
((((((((((((((((((((((((( Files Created from 2011-03-03 to 2011-04-03 )))))))))))))))))))))))))))))))
.
.
2011-04-03 17:54 . 2011-04-03 17:58 -------- d-----w- c:\users\Dave\AppData\Local\temp
2011-04-03 17:54 . 2011-04-03 17:54 -------- d-----w- c:\users\Nellie O. Stone\AppData\Local\temp
2011-04-03 17:54 . 2011-04-03 17:54 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-04-03 17:54 . 2011-04-03 17:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-03 16:45 . 2011-03-15 01:05 6792528 ----a-w- c:\progra~2\Microsoft\Microsoft Antimalware\Definition Updates\{4A3A1EDF-0971-45C3-8A74-7A3597E9ECCE}\mpengine.dll
2011-03-30 14:21 . 2011-03-30 14:21 -------- d-----w- c:\program files\ERUNT
2011-03-29 19:34 . 2011-03-29 19:34 -------- d-----w- c:\users\Dave\AppData\Roaming\SourceTec
2011-03-29 19:34 . 2011-03-29 19:34 -------- d-----w- c:\program files\Common Files\SourceTec
2011-03-29 19:33 . 2011-03-29 19:33 -------- d-----w- c:\program files\Sothink Web Video Downloader Stand-alone
2011-03-29 14:26 . 2011-03-29 14:24 439632 ------w- c:\progra~2\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-03-29 14:26 . 2011-03-29 14:24 439632 ------w- c:\progra~2\Microsoft\Microsoft Antimalware\Definition Updates\{63FB66BD-CB5E-47FC-833F-5734E9EF69A6}\gapaengine.dll
2011-03-29 14:25 . 2011-03-15 01:05 6792528 ----a-w- c:\progra~2\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-03-29 14:15 . 2011-03-29 14:16 -------- d-----w- c:\program files\Microsoft Security Client
2011-03-28 15:20 . 2011-03-28 15:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-03-28 13:10 . 2011-03-28 13:10 -------- d-----w- c:\program files\VS Revo Group
2011-03-23 12:34 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-03-23 12:34 . 2011-02-22 13:33 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-03-23 12:34 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-03-12 16:28 . 2011-03-12 16:28 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-03-12 16:28 . 2011-03-12 16:28 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
2011-03-10 01:34 . 2010-12-29 18:28 429056 ----a-w- c:\windows\system32\EncDec.dll
2011-03-10 01:34 . 2010-12-29 18:28 322560 ----a-w- c:\windows\system32\sbe.dll
2011-03-10 01:34 . 2010-12-29 18:28 153088 ----a-w- c:\windows\system32\sbeio.dll
2011-03-10 01:34 . 2010-12-29 18:26 177664 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-10 01:34 . 2010-12-17 15:45 2067968 ----a-w- c:\windows\system32\mstscax.dll
2011-03-10 01:34 . 2010-12-17 13:54 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-03-04 20:03 . 2011-03-04 20:06 -------- d-----w- c:\users\Dave\AppData\Roaming\VTExtra
2011-03-04 20:00 . 2011-03-04 20:03 -------- d-----w- c:\users\Dave\AppData\Local\VTShared
2011-03-04 20:00 . 2011-04-02 01:18 -------- d-----w- c:\users\Dave\AppData\Local\EnglishHarbourCasino
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-14 19:57 . 2009-04-16 21:05 307200 ----a-w- c:\windows\system32\TubeFinder.exe
2011-01-20 16:37 . 2011-02-09 08:48 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 08:48 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 08:48 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 08:48 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 08:48 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:08 . 2011-02-09 08:48 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:07 . 2011-02-09 08:48 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 08:48 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 08:48 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 08:48 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 08:48 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 08:48 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 08:48 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 08:48 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 08:48 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 08:48 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 08:48 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 08:48 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 08:48 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 08:48 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 08:48 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:14 . 2011-02-09 08:48 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:12 . 2011-02-09 08:48 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 08:48 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 08:48 683008 ----a-w- c:\windows\system32\d2d1.dll
2011-01-08 08:47 . 2011-02-09 08:47 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-01-08 06:28 . 2011-02-09 08:47 292352 ----a-w- c:\windows\system32\atmfd.dll
2011-03-18 17:53 . 2011-03-28 15:09 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"Web Video Downloader"="c:\program files\Sothink Web Video Downloader Stand-alone\VideoDownloader.exe" [2010-11-11 5387608]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"VolPanel"="c:\program files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2006-11-27 180224]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-16 13793824]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]
.
c:\users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MBCameraMonitor.lnk]
backup=c:\windows\pss\MBCameraMonitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdloader]
2010-01-19 23:55 50520 ----a-w- c:\users\Dave\AppData\Roaming\mjusbsp\cdloader2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DELL Webcam Manager]
2007-07-27 21:43 118784 ------w- c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVD or CD Sharing]
2008-02-21 01:10 619832 ----a-w- c:\program files\DVD or CD Sharing\ODSAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-08-29 21:14 133104 ----atw- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2006-10-03 16:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 16:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-12-20 22:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2009-06-16 15:27 92704 ----a-w- c:\windows\System32\nvhotkey.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
2007-08-29 05:54 36864 ----a-w- c:\windows\OEM02Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
2010-10-22 21:47 524288 ----a-w- c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-01-26 22:05 15026056 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSDMonitor]
2010-12-12 04:35 112600 ----a-w- c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe
.
R1 MpKsl01e2028a;MpKsl01e2028a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F64B1C59-3566-460D-BEA0-55A2EAB36AA2}\MpKsl01e2028a.sys [x]
R1 MpKsl85925626;MpKsl85925626;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BF66AE33-8869-4152-98DD-67014400B098}\MpKsl85925626.sys [x]
R1 MpKsla1223c18;MpKsla1223c18;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A3A1EDF-0971-45C3-8A74-7A3597E9ECCE}\MpKsla1223c18.sys [x]
R1 MpKslffd59198;MpKslffd59198;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D3FC9DB2-2937-48AE-90A1-E76570BAE064}\MpKslffd59198.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 Aldebaran;Aldebaran - Storage Filter Drivers;c:\windows\system32\Drivers\Aldebaran.sys [x]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 54144]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-08-12 64288]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2008-12-09 20392]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-10-22 386560]
S2 DbgSvc;Debug Diagnostic Service;c:\program files\DebugDiag\DbgSvc.exe [2007-01-16 316256]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2010-12-12 632792]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3087515188-20942962-1641699201-1000Core1cb6fb1c6c3d42d.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-29 21:14]
.
2011-04-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3087515188-20942962-1641699201-1000UA.job
- c:\users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2009-08-29 21:14]
.
2009-11-12 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]
.
2011-03-10 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-10-12 05:01]
.
2009-11-12 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
.
2011-03-10 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-10-12 05:01]
.
2010-10-16 c:\windows\Tasks\RMSchedule.job
- c:\program files\Registry Mechanic\RegMech.exe [2010-10-16 04:35]
.
2011-04-03 c:\windows\Tasks\User_Feed_Synchronization-{444E6A6C-6AAC-4FFC-9F9B-ED6104AA48E1}.job
- c:\windows\system32\msfeedssync.exe [2011-03-28 20:01]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://broadband.zoomtown.com
uInternet Settings,ProxyOverride = *.local
LSP: c:\windows\system32\wpclsp.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
FF - ProfilePath - c:\users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\shx0bqp7.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=867034&p=
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files:
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\windows\system32\nvvsvc.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\STacSV.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\dllhost.exe
c:\windows\System32\msdtc.exe
c:\windows\ehome\ehmsas.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2011-04-03 14:02:56 - machine was rebooted
ComboFix-quarantined-files.txt 2011-04-03 18:02
ComboFix2.txt 2011-04-02 15:55
.
Pre-Run: 72,674,938,880 bytes free
Post-Run: 72,189,358,080 bytes free
.
- - End Of File - - 3E027FFF6748632E91F504B49DE4F4ED

**Blade81** · 2011-04-04, 14:32

Hi,

Does Spybot still detect anything?

Thread: Click.GiftLoad removal help, DDS Log Posted

Thread Tools

Display

Ok, here the results

results for registry search

I quess this is where your talking about ...

do not understand...

ok, heres the combofix results...

Posting Permissions