its something that starts up with my computer, it has no publisher information, its located in C:\ProgramData\TyIaJGyFfA.exe and i have no idea what it is. ive googled it and some odd looking sites claim its a trojan, but im as suspicious of those websites as i am of the above .exe file.
any ideas anyone?
Yep it is a bad boy - no exe file should run from that location
Follow the steps in this thread http://forum.avast.com/index.php?topic=53253.0
And post the logs here
thanks essex,
only 4 minor things, nothing major. thanks for your rapid response also. much obliged.
heres for you to mull over:
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.14.08
Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Maris Pipericus :: MARISPIPERICUS [administrator]
Protection: Enabled
14/07/2012 21:09:45
mbam-log-2012-07-14 (21-09-45).txt
Scan type: Full scan (C:|D:|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 149100
Time elapsed: 55 minute(s), 56 second(s) [aborted]
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{B58926D6-CFB0-45D2-9C28-4B5A0F0368AE} (Adware.ClickPotato) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
*********************Registry Values Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Yfaruveka (Trojan.Agent.U) → Data: rundll32.exe “C:\Users\Maris Pipericus\AppData\Local\ponsml.dll”,Startup → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Mbuvegepazopesi (Trojan.Agent.U) → Data: rundll32.exe “C:\Users\Maris Pipericus\AppData\Local\ijetumoyes.dll”,Startup → Quarantined and deleted successfully.
Files Detected: 2
C:\Users\Maris Pipericus\AppData\Roaming\Adobe\shed\thr1.chm (Malware.Trace) → Quarantined and deleted successfully.
C:\Users\Maris Pipericus\AppData\Roaming\Adobe\plugs\mmc165.exe (Trojan.Agent.Gen) → Quarantined and deleted successfully.*************************************************
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
********the were added too after (i done a full scan, aborted, then followed with a quick scan, quick scan foud the starred ones which ive added into the (aborted) full scan reults).
Could be worth attaching the OTL log to ensure that it is all gone