Jump to content

svchost.exe trojan.agent Removal

Power1tobee

By Power1tobee
in Resolved Malware Removal Logs

 Share

Recommended Posts

Power1tobee

Power1tobee

Posted
Posted

A few days ago malwarebytes stared blocking this file, trojan.agent svchost.exe. After mutiple tries I have been unable to remove the file, can you please help. Thanks in advance. Here are the dds. and attach files:

dds.

DDS (Ver_2012-11-07.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16450 BrowserJavaVersion: 1.6.0_37

Run by John Schultz at 8:50:41 on 2012-11-12

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6134.3647 [GMT -5:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

C:\Program Files\Bigfoot Networks\Killer Driver\PortManager.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Alienware\AlienFX\AlienwareAlienFXController.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Dell\XPS Thermal Monitor\ThermalApp.exe

C:\Windows\ehome\ehtray.exe

C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

C:\Program Files\Bigfoot Networks\Killer Driver\KillerTray.exe

C:\Program Files (x86)\Belkin\Nostromo\nost_LM.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

C:\Program Files\Dell\DellDock\DellDock.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe

C:\Windows\SysWOW64\Ctxfihlp.exe

C:\Program Files (x86)\Logitech\G35\G35.exe

C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

C:\Users\John Schultz\AppData\Local\Apps\2.0\W2319RD7.RYN\903L7J7N.KPM\curs..tion_9e9e83ddf3ed3ead_0005.0001_161f1f0e4761792c\CurseClient.exe

C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe

C:\Program Files (x86)\AVG Secure Search\vprot.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Belkin\Nostromo\LoadoutManagerHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\SysWOW64\CTXFISPI.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Alienware\AlienFX\AlienFXHook32Mngr.exe

C:\Program Files\Alienware\AlienFX\AlienFXHook64Mngr.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_110.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp

uWindow Title = Internet Explorer provided by Dell

uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220

mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} -

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: CBrowserHelperObject Object: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>

TB: MSN Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll

TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [XPS Thermal Monitor] C:\Program Files\Dell\XPS Thermal Monitor\ThermalApp.exe

uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe

uRun: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

uRun: [Google Update] "C:\Users\John Schultz\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

uRun: [wmrar] "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText

uRun: [iSUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

mRun: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r

mRun: [updReg] C:\Windows\UpdReg.EXE

mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

mRun: [CTxfiHlp] CTXFIHLP.EXE

mRun: [Logitech G35] C:\Program Files (x86)\Logitech\G35\G35.exe

mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"

mRun: [Anti-phishing Domain Advisor] "C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

mRun: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini

StartupFolder: C:\Users\John Schultz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip

StartupFolder: C:\Users\JOHNSC~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KILLER~1.LNK - C:\Program Files\Bigfoot Networks\Killer Driver\KillerTray.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOADOU~1.LNK - C:\Program Files (x86)\Belkin\Nostromo\nost_LM.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

LSP: %SYSTEMROOT%\system32\BfLLR.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{2258201E-49A6-4265-884D-269F0CFF4D31} : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{4DE68E87-BC1B-467D-8480-4CD5249721D9} : DHCPNameServer = 192.168.1.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

x64-mDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4090220

x64-BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} -

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [Windows Defender] C:\Program Files (x86)\Windows Defender\MSASCui.exe -hide

x64-Run: [iAAnotif] "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe"

x64-Run: [AlienFX Controller] "C:\Program Files\Alienware\AlienFX\AlienwareAlienFXController.exe"

x64-mPolicies-Explorer: NoActiveDesktop = dword:1

x64-mPolicies-Explorer: NoActiveDesktopChanges = dword:1

x64-mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

x64-mPolicies-System: EnableUIADesktopToggle = dword:0

x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

Hosts: 172.31.254.2 mykillernic

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=

FF - prefs.js: browser.search.selectedEngine - AVG Secure Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=USERGUID&q=

FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\npsitesafety.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Google Updater\2.4.1691.8062\npCIDetect13.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Users\John Schultz\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Users\John Schultz\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll

FF - plugin: C:\Users\John Schultz\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2012-09-12 19:40; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

FF - ExtSQL: 2012-10-21 11:56; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

FF - ExtSQL: !HIDDEN! 2009-09-05 16:36; {20a82645-c095-46ed-80e3-08825760534b}; c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-2-20 53488]

R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-7-29 30568]

R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-9-23 155648]

R2 DragonSvc;Dragon Service;C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe [2010-7-23 296808]

R2 FontCache;Windows Font Cache Service;C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 27648]

R2 Killer Port Manager;Killer Port Manager;C:\Program Files\Bigfoot Networks\Killer Driver\PortManager.exe [2009-2-20 316928]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-8 399432]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-8 676936]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-29 382272]

R2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-8 711112]

R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\System32\drivers\CT20XUT.sys [2009-2-20 230424]

R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\System32\drivers\CTEXFIFX.sys [2009-2-20 1445912]

R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\System32\drivers\CTHWIUT.sys [2009-2-20 95256]

R3 ha20x22k;Creative 20X2 HAL Driver;C:\Windows\System32\drivers\ha20x22k.sys [2009-2-20 1610776]

R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2009-2-20 252928]

R3 LADF_DHP2;G35 DHP2 Filter Driver;C:\Windows\System32\drivers\ladfDHP2amd64.sys [2010-9-29 62168]

R3 LADF_SBVM;G35 SBVM Filter Driver;C:\Windows\System32\drivers\ladfSBVMamd64.sys [2010-9-29 377176]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-11-8 25928]

R3 Nv834x64;Killer NIC Gaming Adapter Service;C:\Windows\System32\drivers\Nv834x64.sys [2009-2-20 121888]

R3 NvEdge64;Killer NIC NDIS-Edge Service;C:\Windows\System32\drivers\NvEdge64.sys [2009-2-20 26656]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate1ca250736aa44f5;Google Update Service (gupdate1ca250736aa44f5);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-8-24 133104]

S3 bcgame;Nostromo HID Device Minidriver;C:\Windows\System32\drivers\bcgame.sys [2009-3-1 35328]

S3 Creative ALchemy AL1 Licensing Service;Creative ALchemy AL1 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe [2009-2-20 79360]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-2-20 79360]

S3 CT20XUT;CT20XUT;C:\Windows\System32\drivers\CT20XUT.sys [2009-2-20 230424]

S3 CTEXFIFX;CTEXFIFX;C:\Windows\System32\drivers\CTEXFIFX.sys [2009-2-20 1445912]

S3 CTHWIUT;CTHWIUT;C:\Windows\System32\drivers\CTHWIUT.sys [2009-2-20 95256]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe [2011-6-17 237008]

S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]

S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-9-18 89920]

.

=============== File Associations ===============

.

FileExt: .js: JSFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

FileExt: .jse: JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

.

=============== Created Last 30 ================

.

.

==================== Find3M ====================

.

2012-11-10 14:50:29 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-10 14:50:29 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-11-08 23:56:34 30568 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys

2012-10-10 18:54:59 65309168 ----a-w- C:\Windows\System32\mrt.exe

2012-10-10 02:34:03 10220472 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

2012-10-02 23:59:52 462848 ----a-w- C:\Users\John Schultz\AppData\Roaming\wmrar.dll

2012-09-30 00:54:26 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-09-24 19:32:24 477168 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll

2012-09-24 19:32:20 473072 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-09-24 19:23:41 157680 ----a-w- C:\Windows\SysWow64\javaws.exe

2012-09-24 19:23:37 149488 ----a-w- C:\Windows\SysWow64\javaw.exe

2012-09-24 19:23:26 149488 ----a-w- C:\Windows\SysWow64\java.exe

2012-09-13 13:45:46 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-09-13 13:28:08 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-08-29 11:40:01 4699520 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-08-24 16:07:02 218624 ----a-w- C:\Windows\System32\wintrust.dll

2012-08-24 15:53:29 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

2012-08-24 11:15:45 17810944 ----a-w- C:\Windows\System32\mshtml.dll

2012-08-24 10:39:42 10925568 ----a-w- C:\Windows\System32\ieframe.dll

2012-08-24 10:31:32 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2012-08-24 10:22:46 1346048 ----a-w- C:\Windows\System32\urlmon.dll

2012-08-24 10:21:18 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-08-24 10:20:11 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-08-24 10:18:46 237056 ----a-w- C:\Windows\System32\url.dll

2012-08-24 10:17:03 85504 ----a-w- C:\Windows\System32\jsproxy.dll

2012-08-24 10:14:45 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-08-24 10:14:34 816640 ----a-w- C:\Windows\System32\jscript.dll

2012-08-24 10:13:29 599040 ----a-w- C:\Windows\System32\vbscript.dll

2012-08-24 10:12:04 2144768 ----a-w- C:\Windows\System32\iertutil.dll

2012-08-24 10:11:57 729088 ----a-w- C:\Windows\System32\msfeeds.dll

2012-08-24 10:10:14 96768 ----a-w- C:\Windows\System32\mshtmled.dll

2012-08-24 10:09:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-08-24 10:04:06 248320 ----a-w- C:\Windows\System32\ieui.dll

2012-08-24 07:27:00 12319744 ----a-w- C:\Windows\SysWow64\mshtml.dll

2012-08-24 07:03:49 9738240 ----a-w- C:\Windows\SysWow64\ieframe.dll

2012-08-24 06:59:17 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-08-24 06:51:50 1103872 ----a-w- C:\Windows\SysWow64\urlmon.dll

2012-08-24 06:51:27 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-08-24 06:51:02 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-08-24 06:49:57 231936 ----a-w- C:\Windows\SysWow64\url.dll

2012-08-24 06:48:38 65024 ----a-w- C:\Windows\SysWow64\jsproxy.dll

2012-08-24 06:47:36 717824 ----a-w- C:\Windows\SysWow64\jscript.dll

2012-08-24 06:47:26 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-08-24 06:47:12 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2012-08-24 06:45:46 607744 ----a-w- C:\Windows\SysWow64\msfeeds.dll

2012-08-24 06:44:35 1793024 ----a-w- C:\Windows\SysWow64\iertutil.dll

2012-08-24 06:44:10 73216 ----a-w- C:\Windows\SysWow64\mshtmled.dll

2012-08-24 06:43:58 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-08-24 06:40:11 176640 ----a-w- C:\Windows\SysWow64\ieui.dll

.

============= FINISH: 8:51:47.43 ===============

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

attach:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume3

Install Date: 2/20/2009 5:18:57 AM

System Uptime: 11/12/2012 8:40:40 AM (0 hours ago)

.

Motherboard: DELL Inc. | | 0P270J

Processor: Intel® Core i7 CPU 940 @ 2.93GHz | CPU 1 | 2800/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 697 GiB total, 452.891 GiB free.

D: is FIXED (NTFS) - 2 GiB total, 1.008 GiB free.

E: is CDROM ()

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Microsoft ISATAP Adapter

Device ID: ROOT\*ISATAP\0003

Manufacturer: Microsoft

Name: isatap.home

PNP Device ID: ROOT\*ISATAP\0003

Service: tunnel

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

AAC Decoder

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9

AlienFX for XPS

Anti-phishing Domain Advisor

Apple Application Support

Apple Software Update

AutoUpdate

AVG Security Toolbar

Blekko search bar

Broadcom Management Programs

Browser Address Error Redirector

ClearView

Creative MediaSource 5

Curse Client

Dell DataSafe Online

Dell Dock

Dell Getting Started Guide

Dell Video Chat (remove only)

DivX Codec

DivX Converter

DivX Player

DivX Plus DirectShow Filters

DivX Version Checker

DivX Web Player

Dolby Digital Live Pack

Dragon NaturallySpeaking 11

EPSON Artisan 720 Series Printer Uninstall

Epson Event Manager

EPSON Scan

EpsonNet Print

EpsonNet Setup 3.3

Google Chrome

Google Earth

Google Talk Plugin

Google Toolbar for Internet Explorer

Google Update Helper

Google Updater

H.264 Decoder

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

InstallMgr

Intel® Matrix Storage Manager

Java Auto Updater

Java 6 Update 37

Killer Driver

Logitech G35

Malwarebytes Anti-Malware version 1.65.1.1000

McAfee Security Scan Plus

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Default Manager

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Professional Plus 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

MINITAB Release 14

MKV Splitter

Mozilla Firefox 16.0.2 (x86 en-US)

Mozilla Maintenance Service

MSN Toolbar

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Mumble 1.2.3

Nostromo

Nostromo Array Programming Software

NVIDIA 3D Vision Controller Driver 296.10

NVIDIA 3D Vision Driver 296.10

NVIDIA Control Panel 296.10

NVIDIA Graphics Driver 296.10

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX System Software 9.12.0213

NVIDIA Stereoscopic 3D Driver

NVIDIA Update Components

OpenAL

Pavtube Video DVD Converter Ultimate Ver 4.0.9.3687

PowerDVD

QualXServ Service Agreement

QuickTime

RegiStax 6

RegiStax 6.1.0.8 update

Roxio Creator Audio

Roxio Creator Copy

Roxio Creator Data

Roxio Creator DE

Roxio Creator Tools

Roxio Express Labeler 3

Roxio Update Manager

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition

Sound Blaster X-Fi

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687407) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

VC80CRTRedist - 8.0.50727.762

Ventrilo Client for Windows x64

Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64)

Windows Movie Maker 2.6

WinZip 16.5

World of Warcraft

XPS Thermal Monitor

Xvid 1.1.3 final uninstall

.

==== Event Viewer Messages From Past Week ========

.

11/8/2012 9:28:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the vToolbarUpdater13.2.0 service to connect.

11/8/2012 9:28:06 PM, Error: Service Control Manager [7000] - The vToolbarUpdater13.2.0 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/8/2012 9:15:51 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The system cannot find the path specified.

11/8/2012 9:10:13 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.

11/8/2012 9:10:13 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/8/2012 9:07:09 PM, Error: Service Control Manager [7034] - The McAfee Security Scan Component Host Service service terminated unexpectedly. It has done this 1 time(s).

11/11/2012 9:46:59 AM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.1.4 for the Network Card with network address 0019030217E5 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).

11/10/2012 9:47:35 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel® Matrix Storage Event Monitor service to connect.

11/10/2012 9:47:35 AM, Error: Service Control Manager [7000] - The Intel® Matrix Storage Event Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

.

==== End Of File ===========================

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows Vista (6.0.6002 Service Pack 2) 64 bits version

Started in : Normal mode

User : John Schultz [Admin rights]

Mode : Scan -- Date : 11/12/2012 09:16:13

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2005839633-3723987899-1263698059-1000[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Wow6432Node\Run : Anti-phishing Domain Advisor ("C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe") -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Extern Hives: ¤¤¤

-> D:\windows\system32\config\SOFTWARE

-> D:\Users\Default\NTUSER.DAT

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

172.31.254.2 mykillernic

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3750630AS +++++

--- User ---

[MBR] cdfc5d12e6f2d4e1921044ebfbc03da9

[bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo

User != LL1 ... KO!

--- LL1 ---

[MBR] b66828344da21450bf50857281b4b6f7

[bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code

Partition table:

1 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo

3 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo

User != LL2 ... KO!

--- LL2 ---

[MBR] b66828344da21450bf50857281b4b6f7

[bSP] 69a577cfd462274758ec500c84e5c42e : Windows Vista MBR Code

Partition table:

1 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 78 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 161792 | Size: 2048 Mo

3 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 4356096 | Size: 713276 Mo

Finished : << RKreport[1]_S_11122012_02d0916.txt >>

RKreport[1]_S_11122012_02d0916.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

I suggest you uninstall this app: Anti-phishing Domain Advisor

~~~~~~~~~~~~~~~~~`

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-2005839633-3723987899-1263698059-1000[...]\Run : wmrar ( "C:\Users\John Schultz\AppData\Roaming\wmrar.dll",ProgramText) -> FOUND

Now click Delete on the right hand column under Options

Delete this file if found:

C:\Users\John Schultz\AppData\Roaming\wmrar.dll

You may have to enable hidden files to see it:

http://www.howtogeek...-windows-vista/

~~~~~~~~~~~~~~~~~~~~~~

Next................

Please create a new system restore point before running Malwarebytes Anti-Malware.

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

MrC

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

Ok all done as requested, it appears that there was more than I had expected, the svchost is now gone on startup, anything else you want to do?

First Log from MBAR:

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.12.04

Windows Vista Service Pack 2 x64 NTFS

Internet Explorer 9.0.8112.16421

John Schultz :: JOHN-PC [administrator]

11/12/2012 10:43:41 AM

mbar-log-2012-11-12 (10-43-41).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: PUP | PUM | P2P

Objects scanned: 27107

Time elapsed: 21 minute(s), 41 second(s)

Memory Processes Detected: 1

C:\Windows\svchost.exe (Trojan.Agent) -> 7036 -> Delete on reboot. [cbd024914f0e71c515956c1005fd9f61]

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 9

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Bootstrap_0_0_29_infected.mbam (Rootkit.Pihar.c.MBR) -> Delete on reboot. [5ba961d04ba8753d2e3203c50ebafdfc]

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\MBR_0_infected.mbam (Rootkit.Pihar.c.MBR) -> Delete on reboot. [cdfc5d12e6f2d4e1921044ebfbc03da9]

C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_1465148923_user.mbam (Forged physical sector) -> Delete on reboot. [8240dd042845ebed5e91aabb51877474]

C:\Users\John Schultz\AppData\Local\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [18837d38ef6e93a3f6314c664db66898]

C:\Users\John Schultz\Local Settings\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [0f8c189d352810261017684a9b6837c9]

C:\Users\John Schultz\Local Settings\Application Data\Temp\1\LibRock-1.0.zip (Trojan.BHO) -> Delete on reboot. [5546625346175ed866c1a60ccf34be42]

C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot. [cbd024914f0e71c515956c1005fd9f61]

C:\Users\John Schultz\Local Settings\Application Data\chromeupdate.crx (Trojan.Agent) -> Delete on reboot. [ddbe32831647c670135601a19a6948b8]

C:\Users\John Schultz\AppData\Local\chromeupdate.crx (Trojan.Agent) -> Delete on reboot. [b4e7694c3627e15529410a98c93a3dc3]

(end)

**** SECOND MBAR Log ****

Malwarebytes Anti-Rootkit 1.1.0.1009

www.malwarebytes.org

Database version: v2012.11.12.04

Windows Vista Service Pack 2 x64 NTFS

Internet Explorer 9.0.8112.16421

John Schultz :: JOHN-PC [administrator]

11/12/2012 11:20:57 AM

mbar-log-2012-11-12 (11-20-57).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken

Scan options disabled: PUP | PUM | P2P

Objects scanned: 26719

Time elapsed: 27 minute(s), 38 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please run the 'fixdamage' tool in the Malwarebytes Anti-Rootkit folder and reboot.

Then..............

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

Here is the AdwCleaner log file:

# AdwCleaner v2.007 - Logfile created 11/12/2012 at 14:16:44

# Updated 06/11/2012 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (64 bits)

# User : John Schultz - JOHNSCHULTZ-PC

# Boot Mode : Normal

# Running from : C:\Users\John Schultz\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

Folder Found : C:\Program Files (x86)\AVG Secure Search

Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Found : C:\ProgramData\AVG Secure Search

Folder Found : C:\ProgramData\blekko toolbars

Folder Found : C:\Users\John Schultz\AppData\Local\AVG Secure Search

Folder Found : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0

Folder Found : C:\Users\John Schultz\AppData\LocalLow\AVG Secure Search

Folder Found : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\extensions\crossriderapp2258@crossrider.com

Folder Found : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\FCTB

Folder Found : C:\Users\JOHNSC~1\AppData\Local\Temp\avg@toolbar

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Crossrider

Key Found : HKCU\Software\AppDataLow\Software\I Want This

Key Found : HKCU\Software\AVG Secure Search

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Cr_Installer

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\I Want This

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\Software\AVG Secure Search

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

Key Found : HKLM\SOFTWARE\Classes\S

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : HKU\S-1-5-21-2005839633-3723987899-1263698059-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Found : HKU\S-1-5-21-2005839633-3723987899-1263698059-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Value Found : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default

File : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\prefs.js

Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");

Found : user_pref("browser.search.order.1", "Blekko");

Found : user_pref("browser.search.selectedEngine", "AVG Secure Search");

Found : user_pref("extensions.crossriderapp2258.2258.InstallationThankYouPage", true);

Found : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1336955183);

Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.searchUserConifrmation", false[...]

Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setHomepage", false);

Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setNewTab", false);

Found : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setSearch", false);

Found : user_pref("extensions.crossriderapp2258.2258.active", true);

Found : user_pref("extensions.crossriderapp2258.2258.addressbar", "");

Found : user_pref("extensions.crossriderapp2258.2258.affid", "0");

Found : user_pref("extensions.crossriderapp2258.2258.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]

Found : user_pref("extensions.crossriderapp2258.2258.backgroundver", 16);

Found : user_pref("extensions.crossriderapp2258.2258.can_run_bg_code", true);

Found : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", "");

Found : user_pref("extensions.crossriderapp2258.2258.changeprevious", false);

Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1336955183");

Found : user_pref("extensions.crossriderapp2258.2258.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.value", "1336955183");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.expiration", "Mon Nov 12 2012 14:[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.expiration", "Tue Nov 13 2012 [...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.value", "%22US%22");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.value", "1352747723");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.value", "%221%22");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.value", "%2214019%22");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.value", "1346204276819");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.value", "%2221%22");

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.value", "%2236240%22");

Found : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]

Found : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.value", "1346007302432");

Found : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!");

Found : user_pref("extensions.crossriderapp2258.2258.domain", "");

Found : user_pref("extensions.crossriderapp2258.2258.emailsig", "");

Found : user_pref("extensions.crossriderapp2258.2258.enablesearch", false);

Found : user_pref("extensions.crossriderapp2258.2258.exposesites", "");

Found : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", "");

Found : user_pref("extensions.crossriderapp2258.2258.group", 0);

Found : user_pref("extensions.crossriderapp2258.2258.homepage", "");

Found : user_pref("extensions.crossriderapp2258.2258.iframe", false);

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.value", "91");

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.value", "0");

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.value", "%7B%7D");

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.expiration", "Mon Nov 12[...]

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.value", "true");

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]

Found : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.value", "%7B%7D");

Found : user_pref("extensions.crossriderapp2258.2258.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]

Found : user_pref("extensions.crossriderapp2258.2258.manifesturl", "");

Found : user_pref("extensions.crossriderapp2258.2258.name", "I Want This");

Found : user_pref("extensions.crossriderapp2258.2258.newtab", "");

Found : user_pref("extensions.crossriderapp2258.2258.opensearch", "");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.name", "GPL Plugin (Loader)");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.ver", 7);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.name", "GPL Background (BG)");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.ver", 4);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.name", "CrossriderAppUtils");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.ver", 2);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.name", "CrossriderUtils");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.ver", 2);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.code", "(function(e){function u(c,b){[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.name", "FacebookFFIE");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.ver", 1);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.code", "(function(b,a){function h(){v[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.name", "FFAppAPIWrapper");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.ver", 3);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.name", "jQuery");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.ver", 3);

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.name", "resources_background");

Found : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.ver", 1);

Found : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_0", "17,14,16,47,1000015");

Found : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_1", "17,14,13,16,15,1000014");

Found : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]

Found : user_pref("extensions.crossriderapp2258.2258.pluginsversion", 16);

Found : user_pref("extensions.crossriderapp2258.2258.premium", true);

Found : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps");

Found : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0);

Found : user_pref("extensions.crossriderapp2258.2258.setnewtab", false);

Found : user_pref("extensions.crossriderapp2258.2258.settingsurl", "");

Found : user_pref("extensions.crossriderapp2258.2258.thankyou", "hxxp://iw.antthis.com/thankyou.html");

Found : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360);

Found : user_pref("extensions.crossriderapp2258.2258.ver", 91);

Found : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1336955216);

Found : user_pref("extensions.crossriderapp2258.73407340.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_N[...]

Found : user_pref("extensions.crossriderapp2258.73407340.backgroundver", 15);

Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[...]

Found : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1336955216");

Found : user_pref("extensions.crossriderapp2258.73407340.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.code", "Array.prototype.inde[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.name", "GPL Plugin (Loader)"[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.ver", 7);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.code", "var _GPL_BG={vars:{}[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.name", "GPL Background (BG)"[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.ver", 3);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.code", "(function(a){a.selectedTe[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.name", "CrossriderAppUtils");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.ver", 2);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.code", "if(typeof(appAPI)===\"und[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.name", "CrossriderUtils");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.ver", 2);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.code", "(function(f){var u={};var[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.name", "FacebookFFIE");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.ver", 1);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.code", "(function(f,b){if(typeof([...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.name", "FFAppAPIWrapper");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.ver", 3);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.code", "if(typeof window!==\"unde[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.name", "jQuery");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.ver", 3);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.code", "(function(){appAPI.ready=[...]

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.name", "resources_background");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.ver", 1);

Found : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_0", "17,14,16,47,1000015");

Found : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_1", "17,14,13,16,15,1000014")[...]

Found : user_pref("extensions.crossriderapp2258.73407340.pluginsversion", 15);

Found : user_pref("extensions.crossriderapp2258.73407340.ver", 90);

Found : user_pref("extensions.crossriderapp2258.adsOldValue", -1);

Found : user_pref("extensions.crossriderapp2258.apps", "2258");

Found : user_pref("extensions.crossriderapp2258.bic", "13748bda268ac6b1a8020dccef660219");

Found : user_pref("extensions.crossriderapp2258.cid", 2258);

Found : user_pref("extensions.crossriderapp2258.firstrun", false);

Found : user_pref("extensions.crossriderapp2258.hadappinstalled", true);

Found : user_pref("extensions.crossriderapp2258.installationdate", 1336955216);

Found : user_pref("extensions.crossriderapp2258.lastcheck", 22545463);

Found : user_pref("extensions.crossriderapp2258.lastcheckitem", 22545796);

Found : user_pref("extensions.crossriderapp2258.misc.lastBgWorkerTimer", "1340768854793");

Found : user_pref("extensions.crossriderapp2258.misc.lastDomWorkerTimer", "1340768854784");

Found : user_pref("extensions.crossriderapp2258.modetype", "production");

Found : user_pref("extensions.enabledAddons", "{003e1c8f-ebd6-f074-7551-4b31c0f547ec}:1.300.430,{92044B07-01[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.AutoSearchEventData", "auto%20search");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ClearCacheDate", 12);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DNSCatch", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DisplayEULA", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DnsCatchEventData", "dns%20catch");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.EBOMode", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.FirstLaunchShown", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallDomain", "freecause.com");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallType", "standard");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.LoadLayoutDate.100770", 12);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.NewTabSearchEventData", "tab%20search");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ShowRecommendedOptions", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.StateReportDate", "1352684628633");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.TopRightSearchEventData", "top%20right%20search[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeInstallSaved", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.homepage", "hxxp%3A//www.yahoo.co[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.search", "Blekko");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.customNewTab", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.helpUsImprove", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.hideOthers", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.partnerauth", false);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.processAddrBar", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.restoreSearch", false);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.runcmd.", "bb_acct_status_1352747172");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.searchHistory", true);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.session", "DF7926955FE486B24D144F72842373B5D331[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.showFirstLaunchOptions", false);

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tb_lang", "en");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tool_id", "100770");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_id", "111598052");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_key", "53c5828dc535eb14c1acb246d3f21dbcb46[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_layouts", "100770");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_lnames", "fcreward.100770.b");

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]

Found : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.yahooSearch", true);

Found : user_pref("keyword.URL", "hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=U[...]

-\\ Google Chrome v [unable to get version]

File : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.9] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp",

Found [l.13] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ]

Found [l.566] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp",

Found [l.829] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ]

*************************

AdwCleaner[R1].txt - [25798 octets] - [12/11/2012 14:09:40]

AdwCleaner[R2].txt - [25742 octets] - [12/11/2012 14:16:44]

########## EOF - C:\AdwCleaner[R2].txt - [25803 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lots of adware found....lets clear it out.....

  1. Please re-run AdwCleaner
  2. Click on Delete button.
  3. Confirm each time with OK if asked.
  4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

MrC

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

New Report:

# AdwCleaner v2.007 - Logfile created 11/12/2012 at 14:22:12

# Updated 06/11/2012 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (64 bits)

# User : John Schultz - JOHNSCHULTZ-PC

# Boot Mode : Normal

# Running from : C:\Users\John Schultz\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\AVG Secure Search

Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search

Deleted on reboot : C:\ProgramData\AVG Secure Search

Deleted on reboot : C:\ProgramData\blekko toolbars

Deleted on reboot : C:\Users\John Schultz\AppData\Local\AVG Secure Search

Deleted on reboot : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_mpfapcdfbbledbojijcbcclmlieaoogk_0

Deleted on reboot : C:\Users\John Schultz\AppData\LocalLow\AVG Secure Search

Deleted on reboot : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\extensions\crossriderapp2258@crossrider.com

Deleted on reboot : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\FCTB

Deleted on reboot : C:\Users\JOHNSC~1\AppData\Local\Temp\avg@toolbar

File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

Key Deleted : HKCU\Software\AppDataLow\Software\I Want This

Key Deleted : HKCU\Software\AVG Secure Search

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Cr_Installer

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AVG Secure Search

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\I Want This

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKLM\Software\AVG Secure Search

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI

Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1

Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj

Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1

Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol

Key Deleted : HKLM\SOFTWARE\Classes\S

Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi

Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE

Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (en-US)

Profile name : default

File : C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\prefs.js

C:\Users\John Schultz\AppData\Roaming\Mozilla\Firefox\Profiles\9vdxx2kv.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");

Deleted : user_pref("browser.search.order.1", "Blekko");

Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationThankYouPage", true);

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationTime", 1336955183);

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.searchUserConifrmation", false[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setHomepage", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setNewTab", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.InstallationUserSettings.setSearch", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.active", true);

Deleted : user_pref("extensions.crossriderapp2258.2258.addressbar", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.affid", "0");

Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_NEW&&[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.backgroundver", 16);

Deleted : user_pref("extensions.crossriderapp2258.2258.can_run_bg_code", true);

Deleted : user_pref("extensions.crossriderapp2258.2258.certdomaininstaller", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.changeprevious", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.expiration", "Fri Feb 01 2030 0[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallationTime.value", "1336955183");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 [...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_aoi.value", "1336955183");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.expiration", "Mon Nov 12 2012 14:[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_blocklist.value", "%22nonexistantdomain.com[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.expiration", "Tue Nov 13 2012 [...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_country_code.value", "%22US%22");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 [...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_crr.value", "1352747723");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 [...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_hotfix20111102645.value", "%221%22");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.expiration", "Fri Feb 01 2[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_installer_params.value", "%7B%22source_id%2[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_parent_zoneid.value", "%2214019%22");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 0[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_pc_20120828.value", "1346204276819");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_product_id.value", "%2221%22");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie._GPL_zoneid.value", "%2236240%22");

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GM[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.cookie.dbtest.value", "1346007302432");

Deleted : user_pref("extensions.crossriderapp2258.2258.description", "I Want This!");

Deleted : user_pref("extensions.crossriderapp2258.2258.domain", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.emailsig", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.enablesearch", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.exposesites", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.fbremoteurl", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.group", 0);

Deleted : user_pref("extensions.crossriderapp2258.2258.homepage", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.iframe", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.expiration", "Fri Feb 01 20[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_appVer.value", "91");

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.expiration", "Fri Feb [...]

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_lastVersion.value", "0");

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.expiration", "Fri Feb 01 2030[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_meta.value", "%7B%7D");

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.expiration", "Mon Nov 12[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_nextCheck.value", "true");

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.expiration", "Fri Feb 01 203[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.internaldb.Resources_queue.value", "%7B%7D");

Deleted : user_pref("extensions.crossriderapp2258.2258.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GP[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.manifesturl", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.name", "I Want This");

Deleted : user_pref("extensions.crossriderapp2258.2258.newtab", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.opensearch", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.code", "Array.prototype.indexOf|[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.name", "GPL Plugin (Loader)");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000014.ver", 7);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.code", "var _GPL_BG={vars:{},rul[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.name", "GPL Background (BG)");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_1000015.ver", 4);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.code", "(function(a){a.selectedText=f[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.name", "CrossriderAppUtils");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_13.ver", 2);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefin[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.name", "CrossriderUtils");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_14.ver", 2);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.code", "(function(e){function u(c,b){[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.name", "FacebookFFIE");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_15.ver", 1);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.code", "(function(b,a){function h(){v[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.name", "FFAppAPIWrapper");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_16.ver", 3);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.code", "if(typeof window!==\"undefine[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.name", "jQuery");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_17.ver", 3);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.code", "(function(){appAPI.ready=func[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.name", "resources_background");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins.plugin_47.ver", 1);

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_0", "17,14,16,47,1000015");

Deleted : user_pref("extensions.crossriderapp2258.2258.plugins_lists.plugins_1", "17,14,13,16,15,1000014");

Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsurl", "hxxp://app-static.crossrider.com/plugin/a[...]

Deleted : user_pref("extensions.crossriderapp2258.2258.pluginsversion", 16);

Deleted : user_pref("extensions.crossriderapp2258.2258.premium", true);

Deleted : user_pref("extensions.crossriderapp2258.2258.publisher", "215 Apps");

Deleted : user_pref("extensions.crossriderapp2258.2258.searchstatus", 0);

Deleted : user_pref("extensions.crossriderapp2258.2258.setnewtab", false);

Deleted : user_pref("extensions.crossriderapp2258.2258.settingsurl", "");

Deleted : user_pref("extensions.crossriderapp2258.2258.thankyou", "hxxp://iw.antthis.com/thankyou.html");

Deleted : user_pref("extensions.crossriderapp2258.2258.updateinterval", 360);

Deleted : user_pref("extensions.crossriderapp2258.2258.ver", 91);

Deleted : user_pref("extensions.crossriderapp2258.73407340.InstallationTime", 1336955216);

Deleted : user_pref("extensions.crossriderapp2258.73407340.backgroundjs", "\n\n\"undefined\"!=typeof _GPL_BG_N[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.backgroundver", 15);

Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.expiration", "Fri Feb 01 20[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.cookie.InstallationTime.value", "1336955216");

Deleted : user_pref("extensions.crossriderapp2258.73407340.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.code", "Array.prototype.inde[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.name", "GPL Plugin (Loader)"[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000014.ver", 7);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.code", "var _GPL_BG={vars:{}[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.name", "GPL Background (BG)"[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_1000015.ver", 3);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.code", "(function(a){a.selectedTe[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.name", "CrossriderAppUtils");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_13.ver", 2);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.code", "if(typeof(appAPI)===\"und[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.name", "CrossriderUtils");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_14.ver", 2);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.code", "(function(f){var u={};var[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.name", "FacebookFFIE");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_15.ver", 1);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.code", "(function(f,b){if(typeof([...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.name", "FFAppAPIWrapper");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_16.ver", 3);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.code", "if(typeof window!==\"unde[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.name", "jQuery");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_17.ver", 3);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.code", "(function(){appAPI.ready=[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.name", "resources_background");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins.plugin_47.ver", 1);

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_0", "17,14,16,47,1000015");

Deleted : user_pref("extensions.crossriderapp2258.73407340.plugins_lists.plugins_1", "17,14,13,16,15,1000014")[...]

Deleted : user_pref("extensions.crossriderapp2258.73407340.pluginsversion", 15);

Deleted : user_pref("extensions.crossriderapp2258.73407340.ver", 90);

Deleted : user_pref("extensions.crossriderapp2258.adsOldValue", -1);

Deleted : user_pref("extensions.crossriderapp2258.apps", "2258");

Deleted : user_pref("extensions.crossriderapp2258.bic", "13748bda268ac6b1a8020dccef660219");

Deleted : user_pref("extensions.crossriderapp2258.cid", 2258);

Deleted : user_pref("extensions.crossriderapp2258.firstrun", false);

Deleted : user_pref("extensions.crossriderapp2258.hadappinstalled", true);

Deleted : user_pref("extensions.crossriderapp2258.installationdate", 1336955216);

Deleted : user_pref("extensions.crossriderapp2258.lastcheck", 22545463);

Deleted : user_pref("extensions.crossriderapp2258.lastcheckitem", 22545796);

Deleted : user_pref("extensions.crossriderapp2258.misc.lastBgWorkerTimer", "1340768854793");

Deleted : user_pref("extensions.crossriderapp2258.misc.lastDomWorkerTimer", "1340768854784");

Deleted : user_pref("extensions.crossriderapp2258.modetype", "production");

Deleted : user_pref("extensions.enabledAddons", "{003e1c8f-ebd6-f074-7551-4b31c0f547ec}:1.300.430,{92044B07-01[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.AutoSearchEventData", "auto%20search");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ClearCacheDate", 12);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DNSCatch", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DisplayEULA", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.DnsCatchEventData", "dns%20catch");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.EBOMode", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.FirstLaunchShown", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallDomain", "freecause.com");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.InstallType", "standard");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.LoadLayoutDate.100770", 12);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.NewTabSearchEventData", "tab%20search");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.ShowRecommendedOptions", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.StateReportDate", "1352684628633");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.TopRightSearchEventData", "top%20right%20search[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeInstallSaved", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.homepage", "hxxp%3A//www.yahoo.co[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.beforeinstall.search", "Blekko");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.customNewTab", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.helpUsImprove", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.hideOthers", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.partnerauth", false);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.processAddrBar", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.restoreSearch", false);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.runcmd.", "bb_acct_status_1352747172");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.searchHistory", true);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.session", "DF7926955FE486B24D144F72842373B5D331[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.showFirstLaunchOptions", false);

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tb_lang", "en");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.tool_id", "100770");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_id", "111598052");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_key", "53c5828dc535eb14c1acb246d3f21dbcb46[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_layouts", "100770");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.user_lnames", "fcreward.100770.b");

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.xml_service_url", "6bb94bbf55fe2f255901a560824a[...]

Deleted : user_pref("freecause003e1c8febd6f07475514b31c0f547ec.yahooSearch", true);

Deleted : user_pref("keyword.URL", "hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_soc&u=U[...]

-\\ Google Chrome v [unable to get version]

File : C:\Users\John Schultz\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.9] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp",

Deleted [l.13] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ]

Deleted [l.566] : homepage = "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp",

Deleted [l.829] : urls_to_restore_on_startup = [ "hxxps://isearch.avg.com/?cid={A2C6BF1A-EA02-4D41-A198-4B926F88585B}&mid=cbb57769766e416890bc23c7fea7ca6f-459f19ff00d8727367d7de2ea512bd5c953ae3e0〈=en&ds=hk014&pr=sa&d=2012-07-29 16:22:40&v=12.1.0.21&sap=hp" ]

*************************

AdwCleaner[R1].txt - [25798 octets] - [12/11/2012 14:09:40]

AdwCleaner[R2].txt - [25859 octets] - [12/11/2012 14:16:44]

AdwCleaner[R3].txt - [25920 octets] - [12/11/2012 14:21:53]

AdwCleaner[s1].txt - [25852 octets] - [12/11/2012 14:22:12]

########## EOF - C:\AdwCleaner[s1].txt - [25913 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!

MrC

Link to post
Share on other sites
Power1tobee

Power1tobee

Posted
  • Author
Posted

Here is the log:

Results of screen317's Security Check version 0.99.54

Windows Vista Service Pack 2 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Java 6 Update 37

Java version out of Date!

Adobe Flash Player 11.5.502.110

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox (16.0.2)

````````Process Check: objlist.exe by Laurent````````

Windows Defender MSASCui.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

Windows Defender MSASCui.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0 %

````````````````````End of Log``````````````````````

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted
Java™ 6 Update 37 <----this is actually the latest version of Java 6 and OK

Java version out of Date!

Adobe Flash Player 11.5.502.110

Adobe Reader 9 Adobe Reader out of Date! <---please check for an update

You have out dated programs on the system which are vulnerable to malware.

Please update or uninstall them

Info on doing that can be found in my Preventive Maintenance

~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.