Kobrakai

April 12, 2014

Hello,

I removed the necessary programs, and i would like to thank you for helping me out! Your explanation was amazingly clear for a IT-noob like me, and i am very happy my computer is clean again.

I hope not to contact you in the futur, but that is nothing personal ;-).

Regards,

Dimi

April 10, 2014

Hello,

My bad, i missed the Security step. Here you go:

Results of screen317's Security Check version 0.99.81

Windows Vista Service Pack 1 x64 (UAC is enabled)

Out of date service pack!!

Internet Explorer 7 Out of date!

``````````````Antivirus/Firewall Check:``````````````

ESET NOD32 Antivirus 3.0

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Java 6 Update 14

Java 6 Update 6

Java version out of Date!

Adobe Flash Player 12.0.0.77

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox 27.0.1 Firefox out of Date!

Google Chrome 33.0.1750.146

Google Chrome 33.0.1750.154

````````Process Check: objlist.exe by Laurent````````

ESET NOD32 Antivirus egui.exe

ESET NOD32 Antivirus ekrn.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: %

````````````````````End of Log``````````````````````

March 29, 2014

Hello,

I will be without internet/pc access for the next week, starting this afternoon. If i do not reply to the next steps, please do not shut down this thread, i will read/execute it asap (next weekend).

A huge thanks for the help!

gr.

Dimi

March 28, 2014

Hey Marius,

Thank you very much for spending your time on me. I will leave it to you to determine if my pc is clean again, but i am very happy to notice that the symptons (crazy downloading) are no longer present. I checked it with Netlimiter, and it was very strange to see that my antivirus (ESET) was downloading 24/24, 7/7 at high speeds, but this is completely over!

Regards,

Dimi

March 28, 2014

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.3 (03.23.2014:1)

OS: Windows Vista Business x64

Ran by CZC8507XQB on vr 28/03/2014 at 19:01:11,65

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ FireFox

Successfully deleted: [File] C:\user.js

Emptied folder: C:\Users\CZC8507XQB\AppData\Roaming\mozilla\firefox\profiles\v05rurev.default\minidumps [34 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on vr 28/03/2014 at 19:07:18,70

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

March 28, 2014

Part 1:

# AdwCleaner v3.022 - Report created 28/03/2014 at 18:13:03

# Updated 13/03/2014 by Xplode

# Operating System : Windows Vista Business Service Pack 1 (64 bits)

# Username : CZC8507XQB - P-CZC8507XQB

# Running from : C:\Users\CZC8507XQB\Downloads\adwcleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

[!] Folder Deleted : C:\Program Files (x86)\DAEMON Tools Toolbar

[!] Folder Deleted : C:\Windows\SysWOW64\AI_RecycleBin

File Deleted : C:\Users\CZC8507XQB\AppData\Roaming\Mozilla\Firefox\Profiles\v05rurev.default\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKLM\Software\dt soft\daemon tools toolbar

Key Deleted : HKLM\Software\Funmoods

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Funmoods

***** [ Browsers ] *****

-\\ Internet Explorer v7.0.6001.18639

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [searchAssistant]

-\\ Mozilla Firefox v27.0.1 (nl)

[ File : C:\Users\CZC8507XQB\AppData\Roaming\Mozilla\Firefox\Profiles\v05rurev.default\prefs.js ]

Line Deleted : user_pref("extensions.funmoods_i.aflt", "ddrnw");

Line Deleted : user_pref("extensions.funmoods_i.dfltLng", "");

Line Deleted : user_pref("extensions.funmoods_i.dfltSrch", true);

Line Deleted : user_pref("extensions.funmoods_i.dnsErr", true);

Line Deleted : user_pref("extensions.funmoods_i.excTlbr", false);

Line Deleted : user_pref("extensions.funmoods_i.hmpg", true);

Line Deleted : user_pref("extensions.funmoods_i.id", "86dda43100000000000000216b2c7322");

Line Deleted : user_pref("extensions.funmoods_i.instlDay", "15374");

Line Deleted : user_pref("extensions.funmoods_i.instlRef", "");

Line Deleted : user_pref("extensions.funmoods_i.newTab", true);

Line Deleted : user_pref("extensions.funmoods_i.prdct", "funmoods");

Line Deleted : user_pref("extensions.funmoods_i.prtnrId", "funmoods");

Line Deleted : user_pref("extensions.funmoods_i.smplGrp", "none");

Line Deleted : user_pref("extensions.funmoods_i.srchPrvdr", "Search");

Line Deleted : user_pref("extensions.funmoods_i.tlbrId", "base");

Line Deleted : user_pref("extensions.funmoods_i.vrsn", "1.5.11.16");

Line Deleted : user_pref("extensions.funmoods_i.vrsnTs", "1.5.11.1615:57:40");

Line Deleted : user_pref("extensions.funmoods_i.vrsni", "1.5.11.16");

-\\ Google Chrome v33.0.1750.154

[ File : C:\Users\CZC8507XQB\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [7320 octets] - [28/03/2014 18:11:08]

AdwCleaner[s0].txt - [5913 octets] - [28/03/2014 18:13:03]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5973 octets] ##########

March 27, 2014

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014

Ran by CZC8507XQB at 2014-03-27 17:59:16 Run:1

Running from C:\Users\CZC8507XQB\Downloads\FRST

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|42033

C:\PROGRA~3\LOCALS~1\Temp\mseqwbi.sc

C:\Users\CZC8507XQB\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000

C:\Program Files (x86)\The Walking Dead Episode 5\steam_api.dll

C:\Users\CZC8507XQB\Downloads\Shockwave_Installer_Slim.exe

C:\Windows\System32\Adobe\Shockwave 12\gt.exe

C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe

*****************

"C:\PROGRA~3\LOCALS~1\Temp\mseqwbi.sc" => File/Directory not found.

"C:\Users\CZC8507XQB\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000" => File/Directory not found.

C:\Program Files (x86)\The Walking Dead Episode 5\steam_api.dll => Moved successfully.

C:\Users\CZC8507XQB\Downloads\Shockwave_Installer_Slim.exe => Moved successfully.

"C:\Windows\System32\Adobe\Shockwave 12\gt.exe" => File/Directory not found.

C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe => Moved successfully.

==== End of Fixlog ====

March 27, 2014

Never mind, i found it in one of your others posts. On it!

March 27, 2014

Hello,

What is FRST? I just google FRST.exe?

March 25, 2014

C:\Program Files (x86)\The Walking Dead Episode 5\steam_api.dll a variant of Win32/HackTool.Crack.BQ potentially unsafe application

C:\Users\CZC8507XQB\Downloads\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Windows\System32\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

March 25, 2014

I just finnished the scan with Malwarebytes. I will start the ESET scan now. Here is the Malwarebytes Log.

Small note: I had the same result before, but a second scan shows the same (2) found items.

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Databaseversie: v2014.03.23.06

Windows Vista Service Pack 1 x64 NTFS

Internet Explorer 7.0.6001.18000

CZC8507XQB :: P-CZC8507XQB [administrator]

25/03/2014 17:23:48

mbam-log-2014-03-25 (17-23-48).txt

Scan type: Volledige scan (C:\|Z:\|)

Uitgeschakelde scan opties: P2P

Objecten gescand: 614635

Verstreken tijd: 1 uur/uren, 43 minuut/minuten, 17 seconde(n)

Geheugenprocessen gedetecteerd: 0