Please help!

[feebeebuzz]

Hi,

My computer has contracted 'Security Tool' - a fake spyware remover
and Trojan.

However, I am not sure which files I should get rid of - please could
you analyse my free fixer log and tell me!! Would greatly appreciate
it....

Thank you!

I have put my saved file log below but have also copied and pasted the
file log from the webpage below that as I think my virus comes under
'Applications' and it looks like this was missed from the saved file
log.


FreeFixer v0.58 log
http://www.freefixer.com/
Operating system: Windows Vista Service Pack 1
Log dated 2010-08-30 18:13


Browser Helper Objects (7 whitelisted)
{201f27d4-3704-41d6-89c1-aa35e39143ed}, AskBar BHO, C:\Program Files
\AskBarDis\bar\bin\askBar.dll
{22BF413B-C6D2-4d91-82A9-A0F997BA588C}, Skype add-on (mastermind), C:
\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB}, , (no file specified)
{AA58ED58-01DD-4d91-8333-CF10577473F7}, Google Toolbar Helper, C:
\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}, Google Toolbar Notifier BHO, C:
\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
{ba14329e-9550-4989-b3f2-9732e92d17cc}, Vuze Remote Toolbar, C:
\Program Files\Vuze_Remote\tbVuz1.dll

Internet Explorer toolbars (1 whitelisted)
HKLM\..\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Ask Toolbar -
C:\Program Files\AskBarDis\bar\bin\askBar.dll
HKLM\..\Toolbar\{ba14329e-9550-4989-b3f2-9732e92d17cc} - Vuze Remote
Toolbar - C:\Program Files\Vuze_Remote\tbVuz1.dll
HKLM\..\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google
Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

Basic Internet Explorer settings
HKCU\..\Main, Start Page = http://www.t-zones.co.uk/apps/ebdc/en/purchase-redirect?jsenabled=true
HKCU\..\Desktop\General, Wallpaper = C:\Users\Public\Pictures\Sample
Pictures\Dock.jpg

Registry Startups (14 whitelisted)
HKLM\..\Run, StartCCC = "C:\Program Files\ATI Technologies\ATI.ACE
\Core-Static\CLIStart.exe"
HKLM\..\Run, Broadcom Wireless Manager UI = C:\Windows
\system32\WLTRAY.exe
HKLM\..\Run, Dell Webcam Central = "C:\Program Files\Dell Webcam\Dell
Webcam Central\WebcamDell.exe" /mode2
HKLM\..\Run, 4oD = "C:\Program Files\Kontiki\KHost.exe" -all
HKLM\..\Run, DataCardMonitor = C:\Program Files\T-Mobile\T-Mobile
Internet Manager\DataCardMonitor.exe
HKLM\..\Run, QuickTime Task = "C:\Program Files\QuickTime\QTTask.exe" -
atboottime
HKCU\..\Run, swg = "C:\Program Files\Google\GoogleToolbarNotifier
\GoogleToolbarNotifier.exe"
HKCU\..\Run, kdx = C:\Program Files\Kontiki\KHost.exe -all
HKCU\..\Run, HW_OPENEYE_OUC_T-Mobile Internet Manager = "C:\Program
Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe"
HKCU\..\Run, Raptr = C:\PROGRA~1\Raptr\raptrstub.exe --startup
HKCU\..\Run, Google Update = "C:\Users\Admin\AppData\Local\Google
\Update\GoogleUpdate.exe" /c

Autostart shortcuts
QuickSet.lnk, , C:\Program Files\Dell\QuickSet\quickset.exe
Dropbox.lnk, Dropbox - Sync your files online and across computers, C:
\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
winhelp.exe, , C:\Users\Admin\AppData\Local\Windows\winhelp.exe

Processes (23 whitelisted)
C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\FreeFixer\freefixer.exe

Services (80 whitelisted)
ASKUpgrade, ASKUpgrade, c:\program files\askbardis\bar\bin
\askupgrade.exe
ATService, AuthenTec Fingerprint Service, c:\program files\fingerprint
sensor\atservice.exe
gupdate, Google Update Service (gupdate), c:\program files\google
\update\googleupdate.exe
KService, KService, c:\program files\kontiki\kservice.exe
RapportMgmtService, Rapport Management Service, c:\program files
\trusteer\rapport\bin\rapportmgmtservice.exe
wltrysvc, Dell Wireless WLAN Tray Service, c:\windows
\system32\wltrysvc.exe

Explorer.exe Modules (128 whitelisted)
C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
C:\Users\Admin\AppData\Roaming\Dropbox\bin\MSVCP71.dll
C:\Users\Admin\AppData\Roaming\Dropbox\bin\MSVCR71.dll
C:\Windows\WinSxS
\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1\ATL80.DLL

Drivers (48 whitelisted)
BMLoad, Bytemobile Boot Time Load Driver, C:\Windows\system32\drivers
\bmload.sys
RapportKELL, RapportKELL, c:\program files\trusteer\rapport\bin
\rapportkell.sys
RapportPG, RapportPG, c:\program files\trusteer\rapport\bin
\rapportpg.sys

Recently created/modified files (18 whitelisted)
-806 minutes, c:\Users\Admin\AppData\Local\Google\Chrome\Application
\5.0.375.127\1.exe
21 minutes, c:\Program Files\FreeFixer\Uninstall.exe
21 minutes, c:\Users\Admin\AppData\Local\Google\Chrome\User Data
\Default\Cache\f_000e16
21 minutes, c:\Users\Admin\Downloads\freefixersetup.exe
30 minutes, c:\Users\Admin\AppData\Local\Google\Chrome\User Data
\Default\Cache\f_000e07
1 hour, c:\Users\Admin\AppData\Local\Windows\winhelp.exe
1 hour, c:\Users\Admin\AppData\Local\Temp\is-7SDOM.tmp\_isetup
\_shfoldr.dll
1 hour, c:\Users\Admin\AppData\Local\Temp\is-7SDOM.tmp\_isetup
\_RegDLL.tmp
1 hour, c:\Users\Admin\AppData\Local\Temp\is-CHGHI.tmp\_isetup
\_RegDLL.tmp
1 hour, c:\Users\Admin\AppData\Local\Temp\is-CHGHI.tmp\_isetup
\_shfoldr.dll
1 hour, c:\Users\Admin\AppData\Local\Temp\is-HVO2P.tmp\_isetup
\_shfoldr.dll
1 hour, c:\Users\Admin\AppData\Local\Temp\is-HVO2P.tmp\_isetup
\_RegDLL.tmp

The following errors occurred during the scan:
Problems opening folder 'c:\Windows\System32\LogFiles\WMI\RtBackup' to
enumerate files. FindFirstFile failed. System error message: Access is
denied. Error code: 5.

End of FreeFixer log






Copied from webpage


Namespace Service Providers
The following namespace service providers were found on your system.
If you want to remove a provider, check the box to the left of that
item. 6 namespace service providers are whitelisted by FreeFixer and
do not appear in the scan result.

Delete? Online info Class id Path
more info {B600E6E9-553B-4A19-8696-335E5C896153} C:\Program Files
\Bonjour\mdnsNSP.dll

Browser Helper Objects
The following Browser Helper Objects were found on your system. If you
want to delete the BHO class id and the BHO file, check the box to the
left of that item.

Delete? Online info Class ID Path
more info {201f27d4-3704-41d6-89c1-aa35e39143ed} C:\Program Files
\AskBarDis\bar\bin\askBar.dll
more info {22BF413B-C6D2-4d91-82A9-A0F997BA588C} C:\Program Files
\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
more info {5C255C8A-E604-49b4-9D64-90988571CECB} No file specified
more info {AA58ED58-01DD-4d91-8333-CF10577473F7} C:\Program Files
\Google\Google Toolbar\GoogleToolbar_32.dll
more info {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files
\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
more info {ba14329e-9550-4989-b3f2-9732e92d17cc} C:\Program Files
\Vuze_Remote\tbVuz1.dll
more info {18DF081C-E8AD-4283-A596-FA578C2EBDC3} C:\Program Files
\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
more info {27B4851A-3207-45A2-B947-BE8AFE6163AB} c:\progra~1\mcafee
\msk\mskapbho.dll
more info {72853161-30C5-4D22-B7F9-0BBC1D38A37E} C:\Program Files
\Microsoft Office\Office12\GrooveShellExtensions.dll
more info {7DB2D5A0-7241-4E79-B68D-6309F01C5231} C:\Program Files
\Common Files\McAfee\SystemCore\ScriptSn.20100830131620.dll
more info {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files
\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
more info {B164E929-A1B6-4A06-B104-2CD0E90A88FF} c:\progra~1\mcafee
\sitead~1\mcieplg.dll
more info {DBC80044-A445-435b-BC74-9C25C1C588A9} C:\Program Files
\Java\jre6\bin\jp2ssv.dll

Internet Explorer toolbars
The following Internet Explorer toolbars were found on your system. If
you want to delete the toolbar class id and the toolbar file, check
the box to the left of that item.

Delete? Online info Class ID Path
more info {3041d03e-fd4b-44e0-b742-2d9b88305f98} C:\Program Files
\AskBarDis\bar\bin\askBar.dll
more info {ba14329e-9550-4989-b3f2-9732e92d17cc} C:\Program Files
\Vuze_Remote\tbVuz1.dll
more info {2318C2B1-4965-11d4-9B18-009027A5CD4F} C:\Program Files
\Google\Google Toolbar\GoogleToolbar_32.dll
more info {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} c:\progra~1\mcafee
\sitead~1\mcieplg.dll

Basic Internet Explorer settings
The following are your basic Internet Explorer settings. If you want
to restore a setting to the default value, check the box to the left
of that item.

Repair? Online info Registry value Setting
more info HKCU\..\Main, Start Page http://www.t-zones.co.uk/apps/ebdc/en/purchase-redirect?jsenabled=true
more info HKCU\..\Desktop\General, Wallpaper C:\Users\Public\Pictures
\Sample Pictures\Dock.jpg

Registry Startups
The following are your Registry Startups. 3 startups are whitelisted
by FreeFixer and do not appear in the scan result. If you want to
delete a registry value and the associated file, check the box to the
left of that item.

Delete? Online info Registry value Command line
more info HKLM\..\Run, StartCCC "C:\Program Files\ATI Technologies
\ATI.ACE\Core-Static\CLIStart.exe"
more info HKLM\..\Run, Broadcom Wireless Manager UI C:\Windows
\system32\WLTRAY.exe
more info HKLM\..\Run, Dell Webcam Central "C:\Program Files\Dell
Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
more info HKLM\..\Run, 4oD "C:\Program Files\Kontiki\KHost.exe" -
all
more info HKLM\..\Run, DataCardMonitor C:\Program Files\T-Mobile\T-
Mobile Internet Manager\DataCardMonitor.exe
more info HKLM\..\Run, QuickTime Task "C:\Program Files\QuickTime
\QTTask.exe" -atboottime
more info HKCU\..\Run, swg "C:\Program Files\Google
\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
more info HKCU\..\Run, kdx C:\Program Files\Kontiki\KHost.exe -all
more info HKCU\..\Run, HW_OPENEYE_OUC_T-Mobile Internet Manager "C:
\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe"
more info HKCU\..\Run, Raptr C:\PROGRA~1\Raptr\raptrstub.exe --
startup
more info HKCU\..\Run, Google Update "C:\Users\Admin\AppData\Local
\Google\Update\GoogleUpdate.exe" /c
more info HKLM\..\Run, SysTrayApp C:\Program Files\IDT\WDM
\sttray.exe
more info HKLM\..\Run, PCMService "C:\Program Files\Dell\MediaDirect
\PCMService.exe"
more info HKLM\..\Run, Adobe Reader Speed Launcher "C:\Program Files
\Adobe\Reader 9.0\Reader\Reader_sl.exe"
more info HKLM\..\Run, GrooveMonitor "C:\Program Files\Microsoft
Office\Office12\GrooveMonitor.exe"
more info HKLM\..\Run, AppleSyncNotifier C:\Program Files\Common
Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
more info HKLM\..\Run, SunJavaUpdateSched "C:\Program Files\Common
Files\Java\Java Update\jusched.exe"
more info HKLM\..\Run, AdobeCS4ServiceManager "C:\Program Files
\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -
launchedbylogin
more info HKLM\..\Run, iTunesHelper "C:\Program Files\iTunes
\iTunesHelper.exe"
more info HKLM\..\Run, mcui_exe "C:\Program Files\McAfee.com\Agent
\mcagent.exe" /runkey
more info HKCU\..\Run, Skype "C:\Program Files\Skype\Phone
\Skype.exe" /nosplash /minimized
more info HKCU\..\Run, msnmsgr "C:\Program Files\Windows Live
\Messenger\msnmsgr.exe" /background

Autostart shortcuts
The following are the autostart shortcuts on your computer. If you
want to delete a shortcut and the file that the shortcut points to,
check the box to left of that item.

Delete? Online info Filename Path
more info QuickSet.lnk C:\Program Files\Dell\QuickSet\quickset.exe
more info Dropbox.lnk C:\Users\Admin\AppData\Roaming\Dropbox\bin
\Dropbox.exe
more info winhelp.exe C:\Users\Admin\AppData\Local\Windows
\winhelp.exe

Processes
The following are the processes running on your computer. 19 processes
are whitelisted by FreeFixer and do not appear in the scan result. If
you want to terminate a process and delete the associated file, check
the box to the left of that item.

Delete? Online info Path
more info C:\Users\Admin\AppData\Local\Google\Chrome\Application
\chrome.exe
more info C:\Users\Admin\AppData\Local\Google\Chrome\Application
\chrome.exe
more info C:\Users\Admin\AppData\Local\Google\Chrome\Application
\chrome.exe
more info C:\Program Files\FreeFixer\freefixer.exe
more info C:\Program Files\Common Files\Mcafee\SystemCore
\mfevtps.exe
more info C:\Program Files\Common Files\Mcafee\SystemCore
\mfefire.exe
more info C:\Program Files\Common Files\Mcafee\McSvcHost
\McSvHost.exe
more info C:\Program Files\McAfee.com\Agent\mcagent.exe

Services
The following are the services installed on your system. 64 services
are whitelisted by FreeFixer and do not appear in the scan result. If
you want to delete a service, check the box to the left of that item.

Delete? Online info Registry key Display name Path
more info ASKUpgrade ASKUpgrade c:\program files\askbardis\bar\bin
\askupgrade.exe
more info ATService AuthenTec Fingerprint Service c:\program files
\fingerprint sensor\atservice.exe
more info gupdate Google Update Service (gupdate) c:\program files
\google\update\googleupdate.exe
more info KService KService c:\program files\kontiki\kservice.exe
more info RapportMgmtService Rapport Management Service c:\program
files\trusteer\rapport\bin\rapportmgmtservice.exe
more info wltrysvc Dell Wireless WLAN Tray Service c:\windows
\system32\wltrysvc.exe
more info AESTFilters Andrea ST Filters Service c:\windows
\system32\driverstore\filerepository\stwrt.inf_2ba5baa4\aestsrv.exe
more info Apple Mobile Device Apple Mobile Device c:\program files
\common files\apple\mobile device support
\applemobiledeviceservice.exe
more info Ati External Event Utility c:\windows
\system32\ati2evxx.exe
more info Bonjour Service Bonjour Service c:\program files\bonjour
\mdnsresponder.exe
more info clr_optimization_v4.0.30319_32 Microsoft .NET Framework
NGEN v4.0.30319_X86 c:\windows\microsoft.net\framework
\v4.0.30319\mscorsvw.exe
more info McAfee SiteAdvisor Service McAfee SiteAdvisor Service c:
\program files\common files\mcafee\mcsvchost\mcsvhost.exe
more info McMPFSvc McAfee Personal Firewall Service c:\program files
\common files\mcafee\mcsvchost\mcsvhost.exe
more info mcmscsvc McAfee Services c:\program files\common files
\mcafee\mcsvchost\mcsvhost.exe
more info McNaiAnn McAfee VirusScan Announcer c:\program files
\common files\mcafee\mcsvchost\mcsvhost.exe
more info McNASvc McAfee Network Agent c:\program files\common files
\mcafee\mcsvchost\mcsvhost.exe
more info McProxy McAfee Proxy Service c:\program files\common files
\mcafee\mcsvchost\mcsvhost.exe
more info McShield McShield c:\program files\common files\mcafee
\systemcore\mcshield.exe
more info mfefire McAfee Firewall Core Service c:\program files
\common files\mcafee\systemcore\mfefire.exe
more info mfevtp McAfee Validation Trust Protection Service c:
\program files\common files\mcafee\systemcore\mfevtps.exe
more info MSK80Service McAfee Anti-Spam Service c:\program files
\common files\mcafee\mcsvchost\mcsvhost.exe
more info STacSV Audio Service c:\windows\system32\driverstore
\filerepository\stwrt.inf_2ba5baa4\stacsv.exe

Svchost.exe Modules
The following are the modules loaded into Svchost.exe. 174 modules are
whitelisted by FreeFixer and do not appear in the scan result. If you
want to delete a module, check the box to the left of that item.

Delete? Online info Path
more info C:\Program Files\Bonjour\mdnsNSP.dll
more info C:\Windows\WinSxS
\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54c9c04bca
\gdiplus.dll
more info C:\Windows\WinSxS\x86_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc
\comctl32.dll

Explorer.exe Modules
The following are the modules loaded into Explorer.exe. 121 modules
are whitelisted by FreeFixer and do not appear in the scan result. If
you want to delete a module, check the box to the left of that item.

Delete? Online info Path
more info C:\Users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.
13.dll
more info C:\Users\Admin\AppData\Roaming\Dropbox\bin\MSVCP71.dll
more info C:\Users\Admin\AppData\Roaming\Dropbox\bin\MSVCR71.dll
more info C:\Windows\WinSxS
\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1\ATL80.DLL
more info C:\Windows\WinSxS
\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54c9c04bca
\gdiplus.dll
more info C:\Windows\WinSxS\x86_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc
\comctl32.dll
more info C:\Program Files\Microsoft Office
\Office12\GrooveShellExtensions.dll
more info C:\Program Files\Microsoft Office
\Office12\GrooveUtil.DLL
more info C:\Windows\WinSxS
\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d08d7da0442a985d
\MSVCR80.dll
more info C:\Program Files\Microsoft Office\Office12\GrooveNew.DLL
more info C:\Program Files\Common Files\Adobe\Adobe Drive
CS4\AdobeDriveCS4_NP.dll

Application modules
The following are the application modules loaded into FreeFixer. 77
modules are whitelisted by FreeFixer and do not appear in the scan
result. If you want to delete a module, check the box to the left of
that item.

Delete? Online info Path
more info C:\Windows\WinSxS\x86_microsoft.windows.common-
controls_6595b64144ccf1df_5.82.6001.18000_none_886786f450a74a05\COMCTL32.dll
more info C:\Windows\WinSxS\x86_microsoft.windows.common-
controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc
\comctl32.dll
more info C:\Program Files\Bonjour\mdnsNSP.dll

Drivers
The following are the drivers installed on your system. 37 drivers are
whitelisted by FreeFixer and do not appear in the scan result. If you
want to delete a driver, check the box to the left of that item.

Delete? Online info Registry key Display name Path
more info BMLoad Bytemobile Boot Time Load Driver C:\Windows
\system32\drivers\bmload.sys
more info RapportKELL RapportKELL c:\program files\trusteer\rapport
\bin\rapportkell.sys
more info RapportPG RapportPG c:\program files\trusteer\rapport\bin
\rapportpg.sys
more info Compbatt Microsoft Composite Battery Driver C:\Windows
\system32\drivers\compbatt.sys
more info crcdisk Crcdisk Filter Driver C:\Windows\system32\drivers
\crcdisk.sys
more info mfehidk McAfee Inc. mfehidk C:\Windows\system32\drivers
\mfehidk.sys
more info mfenlfk McAfee NDIS Light Filter C:\Windows
\system32\drivers\mfenlfk.sys
more info mfewfpk McAfee Inc. mfewfpk C:\Windows\system32\drivers
\mfewfpk.sys
more info msahci C:\Windows\system32\drivers\msahci.sys
more info Parvdm C:\Windows\system32\drivers\parvdm.sys
more info PCTCore PCTools KDS C:\Windows\system32\drivers
\pctcore.sys
more info rimmptsk C:\Windows\system32\drivers\rimmptsk.sys
more info rimsptsk C:\Windows\system32\drivers\rimsptsk.sys
more info rismxdp Ricoh xD-Picture Card Driver C:\Windows
\system32\drivers\rixdptsk.sys

Recently created or modified files
The following are the Recently created or modified files. If you want
to delete the file, check the box to the left of that item.

Delete? Online info Created/modified Path
more info -819 minutes c:\Users\Admin\AppData\Local\Google\Chrome
\Application\5.0.375.127\1.exe
more info 8 minutes c:\Program Files\FreeFixer\Uninstall.exe
more info 8 minutes c:\Users\Admin\AppData\Local\Google\Chrome\User
Data\Default\Cache\f_000e16
more info 8 minutes c:\Users\Admin\Downloads\freefixersetup.exe
more info 17 minutes c:\Users\Admin\AppData\Local\Google\Chrome\User
Data\Default\Cache\f_000e07
more info 1 hour c:\Users\Admin\AppData\Local\Windows\winhelp.exe
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-7SDOM.tmp
\_isetup\_shfoldr.dll
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-7SDOM.tmp
\_isetup\_RegDLL.tmp
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-CHGHI.tmp
\_isetup\_RegDLL.tmp
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-CHGHI.tmp
\_isetup\_shfoldr.dll
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-HVO2P.tmp
\_isetup\_shfoldr.dll
more info 1 hour c:\Users\Admin\AppData\Local\Temp\is-HVO2P.tmp
\_isetup\_RegDLL.tmp
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\Components
\McFFPlg.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor
\McSACorePS.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\sares.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\McPlgUI.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\mcbrwctl.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\saplugin.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\sahook.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor
\uninstall.exe
more info 4 hours c:\Program Files\McAfee\MQS\mqsuc.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\saupkeep.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\SaSSHMod.dll
more info 4 hours c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
more info 4 hours c:\Program Files\McAfee\MQS\ShrCL.exe
more info 4 hours c:\Program Files\McAfee\MQS\ShredShm.dll
more info 4 hours c:\Program Files\McAfee\MQS\ShrCore.dll
more info 4 hours c:\Program Files\McAfee\MQS\MqsRes.dll
more info 4 hours c:\Program Files\McAfee\MQS\QCJsRes.dll

Errors
The following errors occurred when scanning. Please consult
FreeFixer's manual for troubleshooting.

Error message
Problems opening folder 'c:\Windows\System32\LogFiles\WMI\RtBackup' to
enumerate files. FindFirstFile failed. System error message: Access is
denied. Error code: 5.

[Roger Karlsson]

Hello,

I think this file looks suspicious:

C:\Users\Admin\AppData\Local\Windows\winhelp.exe

Please upload winhelp.exe to http://www.virustotal.com/ If virustotal
report it as malware, please select winhelp.exe for removal in
FreeFixer. Then restart your computer and run another FreeFixer scan to
verify that winhelp.exe no longer appear in FreeFixer's scan result.

Did this remove the "Security Tool" malware? If not, please post a new
FreeFixer log.

/Roger

Hi,

Thank you!

End of FreeFixer log

Copied from webpage

--
You received this message because you are subscribed to the Google
Groups "FreeFixer User Forum" group. To post to this group, send email
to freefix...@googlegroups.com. To unsubscribe from this group,
send email to freefixer-for...@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/freefixer-forum?hl=en.

[A&L]

http://www.bleepingcomputer.com/virus-removal/remove-security-tool

On 8/30/2010 1:25 PM, feebeebuzz wrote:

Security Tool

[jkeser]

There were 91 new viruses identified just today. Who knows how many
were left unidentified? Run Malwarebytes and then run Superantispyware.
Update them first before you run them. They are free and there are pay
for versions. The free should work. Google their names to find them but
be careful that you are not led to a fake site containing further
viruses. Try running the programs in "safe mode". This is a special form
of WINDOWS start that keeps memory usage down. It stops the little icons
next to your time at the lower right from starting. Hit the F8 key
repeatedly when your halfway through your first white bar when starting.
Keep hitting it until a DOS screen pops up and use your "up" arrow key
to move the pointer to the first choice which says "safe mode" with no
net connection. Press enter on it. It will become filled with much
printing and your name of you or your computer will show after some
time. Put your pointer on the icon and left click on it. It will show a
window that says you will be in safe mode. Click on yes. Then run
Malewarebytes and later Superantispyware that you have downloaded
previously and updated. You can not get online to the Internet in safe
mode. Do a complete check of your computer. It should take about a hour
for each scan to run. When finished with the results click fix it and
when it finishes restart the computer normally. I hope this works. It
has been ten years since I worked on computers and I am out of date. Be
very careful when you delete files. If you delete the wrong ones,
WINDOWS may not start. Good luck!
Jerry K.

On 8/30/2010 1:25 PM, feebeebuzz wrote:

[feebeebuzz]

Hi Roger

That worked!!

Thank you so much.
Will be letting a lot of people know about this site in future and
donating asap.

Cheers

Fiona

On Sep 1, 6:20 am, "Roger Karlsson" <m...@rogerkarlsson.com> wrote:
> Hello,
>
> I think this file looks suspicious:
>
> C:\Users\Admin\AppData\Local\Windows\winhelp.exe
>

> Please upload winhelp.exe tohttp://www.virustotal.com/If virustotal

> report it as malware, please select winhelp.exe for removal in
> FreeFixer. Then restart your computer and run another FreeFixer scan to
> verify that winhelp.exe no longer appear in FreeFixer's scan result.
>
> Did this remove the "Security Tool" malware? If not, please post a new
> FreeFixer log.
>
> /Roger
>
>
>
> -----Original Message-----
> From: freefix...@googlegroups.com
>
> [mailto:freefix...@googlegroups.com] On Behalf Of feebeebuzz
> Sent: den 30 augusti 2010 19:26
> To: FreeFixer User Forum
> Subject: Please help!
>
> Hi,
>
> My computer has contracted 'Security Tool' - a fake spyware remover and
> Trojan.
>
> However, I am not sure which files I should get rid of - please could
> you analyse my free fixer log and tell me!! Would greatly appreciate
> it....
>
> Thank you!
>
> I have put my saved file log below but have also copied and pasted the
> file log from the webpage below that as I think my virus comes under
> 'Applications' and it looks like this was missed from the saved file
> log.
>

> FreeFixer v0.58 loghttp://www.freefixer.com/

> Operating system: Windows Vista Service Pack 1
> Log dated 2010-08-30 18:13
>
> Browser Helper Objects (7 whitelisted)
> {201f27d4-3704-41d6-89c1-aa35e39143ed}, AskBar BHO, C:\Program Files
> \AskBarDis\bar\bin\askBar.dll {22BF413B-C6D2-4d91-82A9-A0F997BA588C},
> Skype add-on (mastermind), C: \Program Files\Skype\Toolbars\Internet
> Explorer\SkypeIEPlugin.dll {5C255C8A-E604-49b4-9D64-90988571CECB}, , (no
> file specified) {AA58ED58-01DD-4d91-8333-CF10577473F7}, Google Toolbar
> Helper, C: \Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}, Google Toolbar Notifier BHO, C:
> \Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
> {ba14329e-9550-4989-b3f2-9732e92d17cc}, Vuze Remote Toolbar, C: \Program
> Files\Vuze_Remote\tbVuz1.dll
>
> Internet Explorer toolbars (1 whitelisted)
> HKLM\..\Toolbar\{3041d03e-fd4b-44e0-b742-2d9b88305f98} - Ask Toolbar -
> C:\Program Files\AskBarDis\bar\bin\askBar.dll
> HKLM\..\Toolbar\{ba14329e-9550-4989-b3f2-9732e92d17cc} - Vuze Remote
> Toolbar - C:\Program Files\Vuze_Remote\tbVuz1.dll
> HKLM\..\Toolbar\{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar
> - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
>
> Basic Internet Explorer settings

> HKCU\..\Main, Start Page =http://www.t-zones.co.uk/apps/ebdc/en/purchase-redirect?jsenabled=true

>  more info HKCU\..\Main, Start Pagehttp://www.t-zones.co.uk/apps/ebdc/en/purchase-redirect?jsenabled=true

>  more info HKCU\..\Desktop\General, Wallpaper C:\Users\Public\Pictures
> \Sample Pictures\Dock.jpg
>
> Registry Startups
> The following are your Registry Startups. 3 startups are whitelisted by
> FreeFixer and do not appear in the scan result. If you want to delete a
> registry value and the associated file, check the box to the left of
> that item.
>
> Delete? Online info Registry value Command line
>  more info HKLM\..\Run, StartCCC  "C:\Program Files\ATI Technologies
> \ATI.ACE\Core-Static\CLIStart.exe"

>  more info HKLM\..\Run, Broadcom Wireless Manager UI  C:\Windows...
>
> read more »

[Per Suneby]

Roger et al,

HELP!

My laptop has been taken over by some security malware which takes over Explorer, prevents Internet access can pops up all sorts of Alert Windows like "XP Anti-Virus 2011 Alert".

 

I loaded FreeFixer via download to another computer and handported it over to run a scan.  The log is attached.

Appreciate your guidance on what to remove.

thanks!

Per

 

[Per Suneby]

Roger et al.

I ran another scan this morning which appears to have more items and also a different error message at the bottom.

Please advise!

thanks,

Per

[Roger Karlsson]

Hello Per,

 

This file looks suspicious:

 

C:\Documents and Settings\Per Suneby\Local Settings\Application Data\nmh.exe

 

Please upload it to www.virustotal.com to check if it is malware. If so, check it for removal in FreeFixer.

 

Did this solve remove the "XP Anti-Virus 2011 Alert" pop-ups?

 

/Roger

--

[psu...@gmail.com]

Roger,
Thanks for responding.

How do I upload it if the virus keeps interfering with my ability to access the Internet? Ie, it interferes with IE and maybe other apps/functions....
Tx,
Per

Sent from my Verizon Wireless BlackBerry

---

From: "Roger Karlsson" <ma...@rogerkarlsson.com>

Sender: freefix...@googlegroups.com

Date: Sun, 1 May 2011 22:32:21 +0200

To: <freefix...@googlegroups.com>

ReplyTo: freefix...@googlegroups.com

Subject: RE: Please help!

[Roger Karlsson]

Hello Per,

 

Ok, uploading won't work then...

 

I searched the file database at freefixer.com and found the nmh.exe file here:

 

http://www.freefixer.com/library/file/69442/

 

and it is indeed malware. You should check it for removal in FreeFixer.

 

Did this solve the pop-up problem?

[psu...@gmail.com]

Roger,
The popups stopped. But now my IE is not working properly. When I click on it, it opens a window asking which program I want to open it with. If I choose IE, I just get into a do loop. Any idea what that is about?

Tx,
Per

Sent from my Verizon Wireless BlackBerry

---

From: "Roger Karlsson" <ma...@rogerkarlsson.com>

Sender: freefix...@googlegroups.com

Date: Sun, 1 May 2011 22:50:29 +0200

[Roger Karlsson]

Hello Per,

 

Uninstalling and reinstalling Internet Explorer might fix the problem where it asks about a file.

 

If you like I can have another look on a FreeFixer log to see if there remains any malware on the machine.

[psu...@gmail.com]

Thanks, Roger.

I got it fixed with the help of an IT guy at one of my clients.

BTW, I'm a Swedish emigrant -- my family moved to Canada when I was 7.

Do you spend fulltime on Freefixer?

Thanks again for your help.

Per

Sent from my Verizon Wireless BlackBerry

---

From: "Roger Karlsson" <ma...@rogerkarlsson.com>

Sender: freefix...@googlegroups.com

Date: Wed, 4 May 2011 23:43:29 +0200

[Roger Karlsson]

Hello Per,

 

Good to hear you solved the problem. Unfortunately I've not had much time to work on FreeFixer for the last 6 months. I've been busy with my day job and another little web service where you can make to-do lists: www.adolist.com Made the first release of the site public today.

 

But I'll start to make another push with FreeFixer now. I've some new ideas how to improve both the web site and the program.

 

Take care!