Jump to content

mowman

Honorary Members
 View Profile  See their activity

  • Posts

    45

  • Joined

  • Last visited

 Content Type 

Posts posted by mowman

    I Think I've Been Infected

    in Resolved Malware Removal Logs

    Posted

    You appear clean of infections,please do the following.

    ComboFix - Cleanup

    Time for some housekeeping

    1. Click Start...select Run from the menu.
    2. Copy and paste the following into the text entry box:
      Combofix /Uninstall
    3. Click the OK button. (See image below as reference.)

    CF-Uninstall.png

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    Here are some recommendations to help you stay clean.

    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

    Visit Microsoft often to get the latest updates for your computer.

    http://www.update.microsoft.com/

    Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

    Please read this article 'Safe Computing Practices'.

    So how did I get infected in the first place.

    please take a moment to read quietman7's excellent prevention tips in post 3 here

    Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

    Preventing Infections in the Future

    Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

    • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

    Update Non-Microsoft Programs

    It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

    Thats it you are good to go.Safe surfing

    Yahoo emails - not sent by me!

    in Resolved Malware Removal Logs

    Posted

    You appear clean of infections,please do the following.

    ComboFix - Cleanup

    Time for some housekeeping

    1. Click Start...select Run from the menu.
    2. Copy and paste the following into the text entry box:
      Combofix /Uninstall
    3. Click the OK button. (See image below as reference.)

    CF-Uninstall.png

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    Here are some recommendations to help you stay clean.

    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

    Visit Microsoft often to get the latest updates for your computer.

    http://www.update.microsoft.com/

    Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

    Please read this article 'Safe Computing Practices'.

    So how did I get infected in the first place.

    please take a moment to read quietman7's excellent prevention tips in post 3 here

    Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

    Preventing Infections in the Future

    Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

    • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

    Update Non-Microsoft Programs

    It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

    Thats it you are good to go.Safe surfing

    I Think I've Been Infected

    in Resolved Malware Removal Logs

    Posted

    Just a few harmless registry entries we can remove then we should be done here.

    Run OTL.exe

    • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
      :Services

      :reg
      [-HKEY_CURRENT_USER\Software\AppDataLow\Software\SearchElf_1.1]
      [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchElf_1.1 Toolbar]
      [-HKEY_USERS\S-1-5-21-1221820996-1903880267-534926233-1000\Software\AppDataLow\Software\SearchElf_1.1]


      :Commands
      [emptytemp]
      [Reboot]


    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot when it is done
    • Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

    I Think I've Been Infected

    in Resolved Malware Removal Logs

    Posted

    Please download SystemLook from one of the links below and save it to your Desktop.

    Download Mirror #1

    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:

      :filefind
      *searchelf*

      :regfind
      searchelf



    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

    Note: The log can also be found on your Desktop entitled SystemLook.txt

    Yahoo emails - not sent by me!

    in Resolved Malware Removal Logs

    Posted

    Run RogueKiller again and click Scan

    When the scan completes > click on the Registry tab

    Put a check next to all of these and uncheck the rest: (if found)

    [TASK][sUSP PATH] 11fb2480 : C:\Users\Liz\AppData\Local\Temp\\setup886260736.exe [x] -> FOUND

    [TASK][sUSP PATH] 16ca0f00 : C:\Users\Liz\AppData\Local\Temp\\setup3642224640.exe [x] -> FOUND

    [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

    Logs look clean now, any more problems?

    I Think I've Been Infected

    in Resolved Malware Removal Logs

    Posted

    Run
    OTL.exe

    • Copy/paste the following text written
      inside of the code box
      into the
      Custom Scans/Fixes
      box located at the bottom of OTL

      :Services


      :Otl

      O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll File not found

      O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found

      O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found

      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

      O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

      O4 - HKCU..\Run: [sqoXnmCuXYw] "C:\ProgramData\sqoXnmCuXYw.exe" File not found




      :Commands

      [emptytemp]

      [Reboot]

    • Then click the 
      Run Fix
       button at the top

    • Let the program run unhindered, reboot when it is done

    • Then post a new OTL log ( 
      don't check
       the boxes beside LOP Check or Purity this time )

    Try this to remove searchelf toolbar.
    1. In the Firefox browser menu, select Add-ons > Extensions.
    2. Select the SearchElf 1.1 Community Toolbar.
    3. Click Remove.
    1. In the Google Chrome browser, go to chrome://extensions/.
    2. Find SearchElf 1.1 in the list.
    3. Click Uninstall.
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    11. 

	
	
  11. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			I Think I've Been Infected
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    • Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Under Custom Scan paste this in

      netsvcs
      %SYSTEMDRIVE%\*.exe
      /md5start
      explorer.exe
      winlogon.exe
      Userinit.exe
      svchost.exe
      /md5stop
      C:\Windows\assembly\tmp\U\*.* /s
      CREATERESTOREPOINT

    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
      • You may need two posts to fit them both in.
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    12. 

	
	
  12. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Yahoo emails - not sent by me!
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Please remove any usb or external drives from the computer before you run this scan!
    Please download and run  RogueKiller to your desktop.
    Quit all running programs.
    For Windows XP, double-click to start.
    For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.
    Click Scan to scan the system.
    When the scan completes > Close out the program > Don't Fix anything!
    Don't run any other options, they're not all bad!!!!!!!
    Post back the report which should be located on your desktop.
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    13. 

	
	
  13. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			I Think I've Been Infected
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Please download AdwCleaner from   here  and save it to your desktop.
    • Right click on AdwCleaner.exe and click "Run as Administrator" to run the tool.
    • Click on Delete.
    A logfile will automatically open after the scan has finished.
    Please post the content of that logfile in your reply.
    You can find the logfile at C:\AdwCleaner[Rn].txt as well - (n is the scan number.)
    Next
    ESET Online Scanner
    I'd like us to scan your machine with ESET Online Scan
    Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
    Please don't go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.
    1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan
    2. Click the esetOnline.png button.
    3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

      2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
      3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

      4. Check esetAcceptTerms.png
      5. Click the Start button.
      6. Accept any security warnings from your browser.
      7. Check esetScanArchives.png
      8. Make sure that the option "Remove found threats" is not checked
      9. Push the Start button.
      10. ESET will then download updates for itself, install itself, and begin
        scanning your computer. Please be patient as this can take some time.
      11. When the scan completes, push esetListThreats.png
      12. Push esetExport.png, and save the file to your desktop using a unique name, such as
        ESETScan. Include the contents of this report in your next reply.
      13. Push the Back button.
      14. Push Finish


        http://www.eset.com/onlinescan/
        Also tell me how the computer is running now. 
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    14. 

	
	
  14. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Yahoo emails - not sent by me!
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Download Combofix from either of the links below, and save it to your desktop.  
    Link 1
    Link 2
    **Note:  It is important that it is saved directly to your desktop**
    --------------------------------------------------------------------
    IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here 
    --------------------------------------------------------------------
    Double click on ComboFix.exe & follow the prompts. 
    • When finished, it will produce a report for you.  
    • Please post the C:\ComboFix.txt  for further review.
    NOTE:  If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    15. 

	
	
  15. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			I Think I've Been Infected
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Hello,
    Welcome . My name is mowman, and I will be helping you fix your problems.
    If you do not make a reply in 3 days, we will have to close your topic.
    Please take note of some guidelines for this fix:
    •Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
    •If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
    •Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
    •Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
     Only attach them if requested or if they do not fit into the post
    Download Combofix from either of the links below, and save it to your desktop. 
    Link 1
    Link 2
    **Note:  It is important that it is saved directly to your desktop**
    --------------------------------------------------------------------
    IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here 
    --------------------------------------------------------------------
    Double click on ComboFix.exe & follow the prompts. 
    • When finished, it will produce a report for you. 
    • Please post the C:\ComboFix.txt  for further review.
    NOTE:  If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    16. 

	
	
  16. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Yahoo emails - not sent by me!
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Hello,
    Welcome. My name is mowman, and I will be helping you fix your problems.
    If you do not make a reply in 3 days, we will have to close your topic.
    Please take note of some guidelines for this fix:
    •Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
    •If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
    •Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
    •Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
    Only attach them if requested or if they do not fit into the post
     
    • Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Under Custom Scan paste this in
      netsvcs
      %SYSTEMDRIVE%\*.exe
      /md5start
      explorer.exe
      winlogon.exe
      Userinit.exe
      svchost.exe
      /md5stop
      C:\Windows\assembly\tmp\U\*.* /s
      CREATERESTOREPOINT
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
      • You may need two posts to fit them both in.
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    17. 

	
	
  17. 
		
	
    18. 

	
	
  18. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Livesearchnow.com Redirect
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    You appear clean of infections,please do the following.
    ComboFix - Cleanup
    Time for some housekeeping
    1. Click Start...select Run from the menu.
    2. Copy and paste the following into the text entry box:
      Combofix /Uninstall
    3. Click the OK button.  (See image below as reference.) 
    CF-Uninstall.png
    Clean up with OTL:
    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.
    Here are some recommendations to help you stay clean.
    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
    Visit Microsoft often to get the latest updates for your computer.
    http://www.update.microsoft.com/
    Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
    Please read  this article  'Safe Computing Practices'.
    So how did I get infected in the first place.
    please take a moment to read quietman7's excellent prevention tips in post 3 here
    Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:
    Preventing Infections in the Future
    Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
    • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.
    Update Non-Microsoft Programs
    It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.  You can check these by visiting Secunia Software Inspector and Calendar of Updates.
    Thats it you are good to go.Safe surfing
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    19. 

	
	
  19. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Livesearchnow.com Redirect
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    COMBOFIX-Script
     
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
      File::
      C:\Users\Charles\AppData\Local\Google\Chrome\User Data\Default\Default\aadgdededhdidigfdadgdhdddedcdgde\background.html
      C:\Users\Charles\AppData\Local\{3F0E2CBF-7B84-11E1-826D-B8AC6F996F26}\chrome\content\browser.xul
      C:\Users\Charles\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\62d5adad-1699eee0





    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
      CFScriptB-4.gif
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • If you need help to disable your protection programs see here.
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Also tell me how the computer is running now. 
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    20. 

	
	
  20. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Livesearchnow.com Redirect
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Please download AdwCleaner from   here  and save it to your desktop.
    • Right click on AdwCleaner.exe and click "Run as Administrator" to run the tool.
    • Click on Delete.
    A logfile will automatically open after the scan has finished.
    Please post the content of that logfile in your reply.
    You can find the logfile at C:\AdwCleaner[Rn].txt as well - (n is the scan number.)
     
    • Please open your MalwareBytes AntiMalware Program
    • Click the Update Tab and search for updates
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish, so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected. <-- very important
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.
    Next
    ESET Online Scanner
    I'd like us to scan your machine with ESET Online Scan
    Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
    Please don't go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.
    1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan
    2. Click the esetOnline.png button.
    3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

      2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
      3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.
        4. 	
      4. Check esetAcceptTerms.png
      5. Click the Start button.
      6. Accept any security warnings from your browser.
      7. Check esetScanArchives.png
      8. Make sure that the option "Remove found threats" is not checked
      9. Push the Start button.
      10. ESET will then download updates for itself, install itself, and begin
        	scanning your computer. Please be patient as this can take some time.
      11. When the scan completes, push esetListThreats.png
      12. Push esetExport.png, and save the file to your desktop using a unique name, such as
        	ESETScan. Include the contents of this report in your next reply.
      13. Push the Back button.
      14. Push Finish


        http://www.eset.com/onlinescan/
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    21. 

	
	
  21. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Livesearchnow.com Redirect
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    You have 2 antivirus running, please uninstall one of them.
    Download Combofix from either of the links below, and save it to your desktop.
    Link 1
    Link 2
    **Note:  It is important that it is saved directly to your desktop**
    --------------------------------------------------------------------
    IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here 
    --------------------------------------------------------------------
    Double click on ComboFix.exe & follow the prompts.

    • When finished, it will produce a report for you.
    • Please post the C:\ComboFix.txt  for further review.
    NOTE:  If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    22. 

	
	
  22. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Livesearchnow.com Redirect
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    Please download TDSSKiller.zip
    • Extract it to your desktop
    • Double click TDSSKiller.exe
    • Press Start Scan
      • Only if Malicious objects are found then ensure Cure is selected
        If suspicious objects are found select skip
      • Then click Continue > Reboot now
      [*]Copy and paste the log in your next reply
      • A copy of the log will be saved automatically to the root of the drive (typically C:\)
    • Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Under Custom Scan paste this in

      netsvcs
      %SYSTEMDRIVE%\*.exe
      /md5start
      explorer.exe
      winlogon.exe
      Userinit.exe
      svchost.exe
      /md5stop
      C:\Windows\assembly\tmp\U\*.* /s
      CREATERESTOREPOINT

    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
      • You may need two posts to fit them both in.
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    23. 

	
	
  23. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Data Execution Prevention activated. Please advise?
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    You appear clean of infections,please do the following.
    ComboFix - Cleanup
    Time for some housekeeping
    1. Click Start...select Run from the menu.
    2. Copy and paste the following into the text entry box:
      Combofix /Uninstall
    3. Click the OK button.  (See image below as reference.)
    CF-Uninstall.png
    Here are some recommendations to help you stay clean.
    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
    Visit Microsoft often to get the latest updates for your computer.
    http://www.update.microsoft.com/
    Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
    Please read  this article  'Safe Computing Practices'.
    So how did I get infected in the first place.
    please take a moment to read quietman7's excellent prevention tips in post 3 here
    Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:
    Preventing Infections in the Future
    Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
    • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.
    Update Non-Microsoft Programs
    It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.  You can check these by visiting Secunia Software Inspector and Calendar of Updates.
    Thats it you are good to go.Safe surfing
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    24. 

	
	
  24. 
		
	
    25. 

	
	
  25. 
		
    

			

			
    	
				
    
					
    
						
						
      
							
							
						
    
					
    
					



    
	
    
		
			
		
			Data Execution Prevention activated. Please advise?
		
	
    
	
    in Resolved Malware Removal Logs
    

    
				
    
				
				
    
					
    
						
						
    
							Posted 
							
														
						
    
						

						
    
							
							
    • Please open your MalwareBytes AntiMalware Program
    • Click the Update Tab and search for updates
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select "Perform Quick Scan", then click Scan.
    • The scan may take some time to finish, so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected. <-- very important
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Copy&Paste the entire report in your next reply.
    Next
    ESET Online Scanner
    I'd like us to scan your machine with ESET Online Scan
    Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
    Please don't go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.
    1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESET OnlineScan
    2. Click the esetOnline.png button.
    3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

      2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
      3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.
        4. 	
      4. Check esetAcceptTerms.png
      5. Click the Start button.
      6. Accept any security warnings from your browser.
      7. Check esetScanArchives.png
      8. Make sure that the option "Remove found threats" is not checked
      9. Push the Start button.
      10. ESET will then download updates for itself, install itself, and begin
        	scanning your computer. Please be patient as this can take some time.
      11. When the scan completes, push esetListThreats.png
      12. Push esetExport.png, and save the file to your desktop using a unique name, such as
        	ESETScan. Include the contents of this report in your next reply.
      13. Push the Back button.
      14. Push Finish


        http://www.eset.com/onlinescan/
    
						
    
					
    
					
						
    
							

	
    	
		
    
			
				
				
    
					
				
    
			
			
			
		
    
	
    

						
    
					
				
    		
			
    
		
    
	
    26. 

			

		

	
	

		


	
	

	





			

		


	




						


					

					


					

				

			

			
		

		
         
 Back to top

      			
			


	

		×
		

			
				

					
				

			

			

			

			
		

	






	

		×
		

			
    
				
  • Create New...
    • 
				
			

		

	



			






















	

		

			
Important Information

			
This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.