<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/#comment-323789>
<http://schema.org/text>
"Please do this: [*]Close all programs leaving only HijackThis running.  Place a check against each of the following, making sure you get them all and not any others by mistake: O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\\Program Files\\Google\\GoogleToolbarNotifier\\5.6.5612.1312\\swg.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\\PROGRA~1\\Yahoo!\\Companion\\Installs\\cpn6\\yt.dll O3 - Toolbar: 100% Free Gin Toolbar - {BDE1999F-C91A-4f5d-8E3F-B7BB7624DCE8} - C:\\Program Files\\100% Free Gin Toolbar\\v2.0.0.2\\100%_Free_Gin_Toolbar.dll If you set these restrictions then leave them, if not please have HJT fix them. O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Restrictions present O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Toolbars\\Restrictions present O9 - Extra button: (no name) - Software - (no file) (HKCU) O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O13 - DefaultPrefix: O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/download/bin/actxcab.cab Click on Fix Checked when finished and exit HijackThis. -------------------------------------- You also have these in your Internet Explorers Trusted Zone, if you put them there OK, if not please have HJT fix them. O15 - Trusted Zone: *.bing.com O15 - Trusted Zone: *.doccentral.com O15 - Trusted Zone: *.fnismls.com O15 - Trusted Zone: *.getmedianow.com O15 - Trusted Zone: *.live.com O15 - Trusted Zone: *.rdesk.com O15 - Trusted Zone: *.rexplorer.net O15 - Trusted Zone: *.safemls.net O15 - Trusted Zone: *.showingtime.com O15 - Trusted Zone: *.sitexdata.com O15 - Trusted Zone: *.spellchecker.net O15 - Trusted Zone: *.transactionpoint.com O15 - Trusted Zone: *.trpoint.com O15 - Trusted Zone: *.xmlsweb.com --------------------------------------------------------- Next....... Please download and run ComboFix: A few notes first:  ComboFix is compatible exclusively with W2K, XP, Vista, and Windows 7 (32-bit only).   ComboFix must be run from an Administrative account.  Vista and W7 users - Right click, choose \"Run as Administrator\"  It must be downloaded to and run from your desktop.  Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can and will interfere with ComboFix or remove some of its embedded files which may cause \"unpredictable results\". ComboFix Guide &lt;---please read!   --------------------------- Download ComboFix from one of these locations: Link 1 Link 2  * IMPORTANT !!! Save ComboFix.exe to your Desktop  Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable/exit.   More info HERE&lt;------- They may interfere with the running of ComboFix.  Double click on ComboFix.exe &amp; follow the prompts. Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.   Note: If you have SP3, use the SP2 package. If Vista or Windows 7, skip the Recovery Console part  ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.  Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.   **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you.  Please include the C:\\ComboFix.txt using Copy / Paste in your next reply. Notes: 1.Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix permanently prevents autorun of ALL CD, floppy and USB devices to assist with malware removal &amp; increase security. Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. Read USB-Based Malware Attacks and Please disable Autorun ASAP!. If this is an issue or makes it difficult for you -- please let me know.     4.CF disconnects your machine from the internet.  The connection is automatically restored before CF completes its run.  If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine. If a reboot doesn't restore your connection, please try this:  For XP systems download and run  WinSockFix Vista users: Check HERE  Windows 7 systems: Download and run this Winsockfix.bat  5.Give it atleast 20-30 minutes to finish if needed. MrC "
<https://forums.malwarebytes.com/topic/64228-rootkit-or-am-i-paranoid/>