Persistent malware: Floating ads in browser

[fixcomp1]

I am helping a friend fix his computer, but have not been able to get rid of all of the malware. 

 

When I first started working on his computer, the browsers were completely hijacked and constantly adding spammy links and redirecting pages. I ran SpyBot Search & Destroy, AdwCleaner, and Malwarebytes to try to get rid of it. All of these programs found and removed some malware (notably MySearchDial and Conduit). Now all of those programs report the computer is clean, but there is still one remaining problem.

 

Whenever I navigate to an online shopping site (amazon, ebay, etc), a floating ad is inserted over the right side of the screen. This isn't part of the page and occurs in both IE and FF. Additionally, on amazon, the browser redirects me via a referral link. I still see the page I requested, but the URL shows a referral link. I have installed Malwarebytes Premium version trial that actively protects the computer and whenever that is enabled, it blocks the floating ads and amazon redirects with the message (Successfully blocked access to a potentially malicious website: 162.210.192.22 Type: Outgoing Port: 49477 Process: firefox.exe).

 

I'm out of ideas on how to fix this. DDS log below. I captured the log while remotely connected to his computer using LogMeIn Rescue, so ignore entries related to that program. Please help!

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 11.0.9600.16428

Run by Christian at 0:43:34 on 2014-03-05

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.6051.4682 [GMT -6:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE

C:\Users\CHRIST~1\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue_srv.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Quiknowledge\Service\qksvc.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\WUDFHost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\CHRIST~1\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue_srv.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Users\CHRIST~1\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\taskhost.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

 

 

 

mWinlogon: Userinit = userinit.exe,

BHO: Quiknowledge: {323C6E6D-1621-470F-8A52-4FDEC4E75E40} - C:\Program Files (x86)\Quiknowledge\IE\QuiknowledgeClientIE.dll

mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun: [PDVD9LanguageShortcut] "C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"

mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{3FFA99C6-7105-4D04-BF94-1FE75C38517A} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{3FFA99C6-7105-4D04-BF94-1FE75C38517A}\2656C6B696E6E2034303E2765756374737 : DHCPNameServer = 192.168.169.1

TCP: Interfaces\{3FFA99C6-7105-4D04-BF94-1FE75C38517A}\75962756C6563737D2E413 : DHCPNameServer = 192.168.1.254

Notify: SDWinLogon - SDWinLogon.dll

SSODL: WebCheck - <orphaned>

 

x64-BHO: Quiknowledge: {323C6E6D-1621-470F-8A52-4FDEC4E75E40} - C:\Program Files\Quiknowledge\IE\QuiknowledgeClientIE.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [bLEServicesCtrl] C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe

x64-Run: [bTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

x64-Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\0pxsbufo.default-1393948825869\

FF - plugin: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll

.

============= SERVICES / DRIVERS ===============

.

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-3-2 55856]

R1 qknfd;qknfd;C:\Windows\System32\drivers\qknfd.sys [2014-2-5 58256]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2014-3-2 89600]

R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2013-2-13 770528]

R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2012-3-27 1014096]

R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2012-3-27 1104208]

R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2012-9-12 135984]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]

R2 LMIRescue_e8ad64f4-a638-4244-bcff-01bd816cc225;LogMeIn Rescue (e8ad64f4-a638-4244-bcff-01bd816cc225);C:\Users\CHRIST~1\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue_srv.exe [2014-3-4 2570592]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-3-4 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2014-3-4 701512]

R2 qksvc;Quiknowledge Client Service;C:\Program Files (x86)\Quiknowledge\Service\qksvc.exe [2014-2-5 273000]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-3-4 3921880]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-3-4 1042272]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-3-4 171416]

R2 ZeroConfigService;Intel® PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2013-2-8 3386608]

R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2013-2-13 163808]

R3 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2012-3-27 1304912]

R3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\System32\drivers\btmaux.sys [2012-2-13 95232]

R3 btmhsf;btmhsf;C:\Windows\System32\drivers\btmhsf.sys [2012-2-13 747008]

R3 ibtfltcoex;ibtfltcoex;C:\Windows\System32\drivers\iBtFltCoex.sys [2012-3-21 60928]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-3-2 342528]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-3-4 25928]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-15 80384]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-15 180736]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]

S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2013-2-13 163808]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-3-5 111616]

S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-2-8 273136]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-3-5 19456]

S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2014-3-4 31800]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-3-5 56832]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2014-3-5 30208]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-3-4 1255736]

.

=============== Created Last 30 ================

.

2014-03-05 06:42:27 -------- d-----w- C:\ProgramData\CanonIJ

2014-03-05 06:36:08 -------- d-----w- C:\Program Files\CCleaner

2014-03-05 06:05:44 -------- d-----w- C:\Windows\Migration

2014-03-05 06:01:06 44544 ----a-w- C:\Windows\System32\TsUsbGDCoInstaller.dll

2014-03-05 06:00:23 15360 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll

2014-03-05 06:00:18 30208 ----a-w- C:\Windows\System32\drivers\TsUsbGD.sys

2014-03-05 06:00:18 19456 ----a-w- C:\Windows\System32\drivers\rdpvideominiport.sys

2014-03-05 06:00:15 243200 ----a-w- C:\Windows\System32\rdpudd.dll

2014-03-05 06:00:15 228864 ----a-w- C:\Windows\System32\rdpendp_winip.dll

2014-03-05 06:00:15 192000 ----a-w- C:\Windows\SysWow64\rdpendp_winip.dll

2014-03-05 06:00:14 3174912 ----a-w- C:\Windows\System32\rdpcorets.dll

2014-03-05 05:59:36 -------- d-----w- C:\Windows\SysWow64\Wat

2014-03-05 05:59:36 -------- d-----w- C:\Windows\System32\Wat

2014-03-05 05:59:07 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll

2014-03-05 05:59:07 366592 ----a-w- C:\Windows\System32\qdvd.dll

2014-03-05 05:59:01 792576 ----a-w- C:\Windows\SysWow64\TSWorkspace.dll

2014-03-05 05:59:01 1030144 ----a-w- C:\Windows\System32\TSWorkspace.dll

2014-03-05 05:37:14 -------- d-----w- C:\Users\Christian\AppData\Local\ElevatedDiagnostics

2014-03-05 05:12:20 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-03-05 05:11:57 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-03-05 05:03:13 -------- d-----w- C:\Users\Christian\AppData\Local\VS Revo Group

2014-03-05 05:03:07 31800 ----a-w- C:\Windows\System32\drivers\revoflt.sys

2014-03-05 05:03:07 -------- d-----w- C:\ProgramData\VS Revo Group

2014-03-05 05:03:06 -------- d-----w- C:\Program Files\VS Revo Group

2014-03-05 04:39:53 -------- d-----w- C:\AdwCleaner

2014-03-05 04:33:13 -------- d-----w- C:\Users\Christian\AppData\Roaming\Malwarebytes

2014-03-05 04:33:07 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2014-03-05 04:33:07 -------- d-----w- C:\ProgramData\Malwarebytes

2014-03-05 04:33:07 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-03-05 04:16:26 -------- d-----w- C:\Users\Christian\AppData\Local\LogMeIn Rescue Applet

2014-03-05 01:09:51 -------- d--h--w- C:\ProgramData\CanonIJSolutionMenu

2014-03-05 01:04:12 -------- d--h--w- C:\ProgramData\CanonIJEPPEX

2014-03-05 01:04:12 -------- d-----w- C:\Users\Christian\AppData\Local\Canon Easy-PhotoPrint EX

2014-03-05 01:04:07 -------- d--h--w- C:\ProgramData\CanonIJMyPrinter

2014-03-05 01:03:57 -------- d-----w- C:\ProgramData\CanonIJPLM

2014-03-05 01:02:33 385024 ----a-w- C:\Windows\System32\SETEE0E.tmp

2014-03-05 01:02:23 346624 ----a-w- C:\Windows\System32\CNC340L.dll

2014-03-05 01:02:23 307200 ------w- C:\Windows\SysWow64\CNC340L.dll

2014-03-05 01:02:23 17920 ----a-w- C:\Windows\System32\CNHMCA6.dll

2014-03-05 01:02:23 15872 ------w- C:\Windows\SysWow64\CNHMCA.dll

2014-03-05 01:02:23 1324544 ----a-w- C:\Windows\System32\CNC340C.dll

2014-03-05 01:02:23 109568 ----a-w- C:\Windows\System32\CNC340I.dll

2014-03-05 01:02:23 102400 ------w- C:\Windows\SysWow64\CNC340U.dll

2014-03-05 01:01:21 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2014-03-05 01:01:04 10536864 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E14158BD-EA1A-4ED3-9E77-7D5611C6152F}\mpengine.dll

2014-03-05 00:55:59 38224 ------w- C:\Windows\SysWow64\IJRMF.exe

2014-03-05 00:51:12 -------- d-----w- C:\Program Files\Common Files\CANON

2014-03-05 00:49:27 -------- d-----w- C:\Program Files\Canon

2014-03-05 00:47:51 245760 ----a-w- C:\Windows\System32\CNMIUA5.DLL

2014-03-05 00:47:26 337920 ----a-w- C:\Windows\System32\CNMN6PPM.DLL

2014-03-05 00:47:26 144384 ----a-w- C:\Windows\System32\CNMN6UI.DLL

2014-03-05 00:47:26 -------- d-----w- C:\Windows\System32\STRING

2014-03-05 00:47:25 -------- d-----w- C:\Windows\System32\CHM

2014-03-05 00:46:59 -------- d-----w- C:\Program Files (x86)\Canon

2014-03-04 22:23:22 21040 ----a-w- C:\Windows\System32\sdnclean64.exe

2014-03-04 22:23:20 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2014-03-04 22:23:18 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2

2014-03-04 01:00:29 -------- d-----w- C:\Users\Christian\AppData\Local\Macromedia

2014-03-04 01:00:04 71048 ------w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-03-04 01:00:04 692616 ------w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-03-04 00:55:50 -------- d-----w- C:\ProgramData\Symantec

2014-03-04 00:55:45 -------- d-----w- C:\Windows\System32\drivers\NSSx64\0400030.01B

2014-03-04 00:55:45 -------- d-----w- C:\Windows\System32\drivers\NSSx64

2014-03-04 00:55:45 -------- d-----w- C:\ProgramData\Norton

2014-03-04 00:55:45 -------- d-----w- C:\Program Files (x86)\Norton Security Scan

2014-03-04 00:55:43 -------- d-----w- C:\ProgramData\NortonInstaller

2014-03-04 00:55:43 -------- d-----w- C:\Program Files (x86)\NortonInstaller

2014-03-04 00:53:25 -------- d-----w- C:\Users\Christian\AppData\Local\Adobe

2014-03-03 23:26:43 -------- d-----w- C:\Users\Christian\AppData\Local\Mozilla

2014-03-03 23:26:35 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service

2014-03-03 23:23:42 16896 ----a-w- C:\Windows\System32\sasnative64.exe

2014-03-03 23:22:35 -------- d-----w- C:\Users\Christian\AppData\Local\Programs

2014-03-03 23:22:30 -------- d-----w- C:\Program Files\Quiknowledge

2014-03-03 23:22:29 -------- d-----w- C:\Program Files (x86)\Quiknowledge

2014-03-03 05:27:16 53248 ------w- C:\Windows\SysWow64\CSVer.dll

2014-03-02 19:55:58 167424 ----a-w- C:\Program Files\Windows Media Player\wmplayer.exe

2014-03-02 19:55:58 164864 ----a-w- C:\Program Files (x86)\Windows Media Player\wmplayer.exe

2014-03-02 19:55:57 12625920 ----a-w- C:\Windows\System32\wmploc.DLL

2014-03-02 19:55:57 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL

2014-03-02 19:50:45 -------- d-----w- C:\Windows\System32\MRT

2014-03-02 18:16:49 10536864 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2014-03-02 18:12:09 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys

2014-03-02 18:12:09 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll

2014-03-02 18:12:09 744448 ----a-w- C:\Windows\System32\WUDFx.dll

2014-03-02 18:12:09 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll

2014-03-02 18:12:09 229888 ----a-w- C:\Windows\System32\WUDFHost.exe

2014-03-02 18:12:09 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys

2014-03-02 18:12:09 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll

2014-03-02 18:08:25 5120 ----a-w- C:\Windows\SysWow64\wmi.dll

2014-03-02 18:08:25 5120 ----a-w- C:\Windows\System32\wmi.dll

2014-03-02 18:08:25 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys

2014-03-02 18:05:11 327168 ----a-w- C:\Windows\System32\mswsock.dll

2014-03-02 18:05:11 231424 ----a-w- C:\Windows\SysWow64\mswsock.dll

2014-03-02 18:03:53 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll

2014-03-02 18:02:59 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll

2014-03-02 17:59:23 515584 ----a-w- C:\Windows\System32\timedate.cpl

2014-03-02 17:59:23 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl

2014-03-02 17:59:22 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys

2014-03-02 17:59:22 751104 ----a-w- C:\Windows\System32\win32spl.dll

2014-03-02 17:59:22 492544 ----a-w- C:\Windows\SysWow64\win32spl.dll

2014-03-02 17:59:21 956928 ----a-w- C:\Windows\System32\localspl.dll

2014-03-02 17:59:21 497152 ----a-w- C:\Windows\System32\drivers\afd.sys

2014-03-02 17:59:20 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe

2014-03-02 17:46:13 77312 ----a-w- C:\Windows\System32\packager.dll

2014-03-02 17:46:13 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2014-03-02 17:35:55 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2014-03-02 17:35:44 99840 ----a-w- C:\Windows\System32\wudriver.dll

2014-03-02 17:35:34 36864 ----a-w- C:\Windows\System32\wuapp.exe

2014-03-02 17:35:34 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2014-03-02 17:30:32 -------- d-----w- C:\Program Files (x86)\Common Files\CyberLink

2014-03-02 17:29:02 29480 ------w- C:\Windows\SysWow64\msxml3a.dll

2014-03-02 17:27:21 -------- d-----w- C:\Users\Christian\AppData\Roaming\Macrovision

2014-03-02 17:15:09 55856 ------w- C:\Windows\System32\drivers\PxHlpa64.sys

2014-03-02 17:15:09 10224 ------w- C:\Windows\System32\drivers\cdralw2k.sys

2014-03-02 17:15:09 10224 ------w- C:\Windows\System32\drivers\cdr4_xp.sys

2014-03-02 17:13:04 -------- d-----w- C:\Program Files (x86)\Roxio

2014-03-02 17:09:15 -------- d-----w- C:\Users\Christian\AppData\Roaming\Roxio Log Files

2014-03-02 16:34:19 90624 ----a-w- C:\Windows\System32\AESTCo64.dll

2014-03-02 16:34:19 874496 ----a-w- C:\Windows\System32\imapo64.dll

2014-03-02 16:34:19 734720 ----a-w- C:\Windows\System32\imapo32.dll

2014-03-02 16:34:19 68608 ----a-w- C:\Windows\System32\AESTAR64.dll

2014-03-02 16:34:19 455168 ----a-w- C:\Windows\System32\slapoi64.dll

2014-03-02 16:34:19 442368 ----a-w- C:\Windows\System32\AESTEC64.dll

2014-03-02 16:34:19 4113408 ----a-w- C:\Windows\System32\stlang64.dll

2014-03-02 16:34:19 390656 ----a-w- C:\Windows\System32\imthx64.dll

2014-03-02 16:34:19 1819136 ----a-w- C:\Windows\System32\IDTNC64.cpl

2014-03-02 16:34:19 162304 ----a-w- C:\Windows\System32\AESTAC64.dll

2014-03-02 16:34:18 -------- d-----w- C:\Windows\System32\SRSLabs

2014-03-02 16:33:59 535040 ----a-w- C:\Windows\System32\drivers\stwrt64.sys

2014-03-02 16:33:59 446464 ----a-w- C:\Windows\System32\stcplx64.dll

2014-03-02 16:33:59 1966080 ----a-w- C:\Windows\System32\stapo64.dll

2014-03-02 16:33:58 734720 ------w- C:\Windows\SysWow64\IMAPO32.dll

2014-03-02 16:33:58 655872 ------w- C:\Windows\System32\stapi64.dll

2014-03-02 16:33:58 334848 ----a-w- C:\Windows\System32\MaxxAudioAPO3064.dll

2014-03-02 16:33:58 251392 ----a-w- C:\Windows\System32\st646365.dll

2014-03-02 16:33:58 -------- d-----w- C:\Program Files\IDT

2014-03-02 16:26:38 20992 ----a-w- C:\Windows\System32\OpenCL.dll

2014-03-02 16:26:38 144896 ----a-w- C:\Windows\System32\IntelOpenCL64.dll

2014-03-02 16:26:36 17920 ------w- C:\Windows\SysWow64\OpenCL.dll

2014-03-02 16:26:36 104448 ------w- C:\Windows\SysWow64\IntelOpenCL32.dll

2014-03-02 16:26:32 -------- d-----w- C:\Program Files (x86)\Common Files\Intel

2014-03-02 16:21:49 9728 ----a-w- C:\Windows\System32\Wdfres.dll

2014-03-02 16:21:49 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys

2014-03-02 16:21:49 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui

2014-03-02 16:21:03 -------- d--h--w- C:\Windows\System32\WLANProfiles

2014-03-02 16:20:50 -------- d-----w- C:\Users\Christian\AppData\Roaming\Intel

2014-03-02 16:20:40 -------- d-----w- C:\Users\Christian\Roaming

2014-03-02 16:20:39 -------- d-----w- C:\ProgramData\Roaming

2014-03-02 16:20:22 -------- d-----w- C:\Program Files\Common Files\Intel

2014-03-02 16:20:22 -------- d-----w- C:\Program Files (x86)\Cisco

2014-03-02 16:19:34 -------- d-sh--w- C:\Windows\Installer

2014-03-02 16:19:30 -------- d-----w- C:\ProgramData\Package Cache

2014-03-02 16:18:07 -------- d-----w- C:\Dell

2014-03-02 16:07:55 -------- d-sh--w- C:\Recovery

2014-03-01 21:34:23 -------- d-----w- C:\Windows\Panther

2014-03-01 21:33:42 -------- d-----w- C:\Windows\System32\OEM

2014-03-01 21:33:42 -------- d-----w- C:\Hotfix

2014-03-01 21:33:42 -------- d-----w- C:\Drivers

2014-02-05 23:13:12 58256 ----a-w- C:\Windows\System32\drivers\qknfd.sys

.

==================== Find3M  ====================

.

2014-03-02 18:32:36 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2014-03-02 17:28:08 505128 ------w- C:\Windows\SysWow64\msvcp71.dll

2014-03-02 17:28:08 353576 ------w- C:\Windows\SysWow64\msvcr71.dll

2014-01-27 15:58:44 270496 ------w- C:\Windows\System32\MpSigStub.exe

2013-12-24 23:09:41 1987584 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2013-12-24 22:48:32 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll

2013-12-06 02:30:08 2048 ----a-w- C:\Windows\System32\msxml3r.dll

2013-12-06 02:30:08 1882112 ----a-w- C:\Windows\System32\msxml3.dll

2013-12-06 02:02:08 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll

2013-12-06 02:02:08 1237504 ----a-w- C:\Windows\SysWow64\msxml3.dll

.

============= FINISH:  0:45:06.24 ===============

 

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium 

Boot Device: \Device\HarddiskVolume1

Install Date: 3/2/2014 10:07:58 AM

System Uptime: 3/5/2014 12:39:56 AM (0 hours ago)

.

Motherboard: Dell Inc. |  | 034W60

Processor: Intel® Core i5-2410M CPU @ 2.30GHz | CPU 1 | 2301/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 233 GiB total, 199.424 GiB free.

D: is CDROM ()

E: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: 

Description: Intel® Centrino® Wireless-N + WiMAX 6150

Device ID: USB\VID_8087&PID_07D9\6&35E5F498&0&5

Manufacturer: 

Name: Intel® Centrino® Wireless-N + WiMAX 6150

PNP Device ID: USB\VID_8087&PID_07D9\6&35E5F498&0&5

Service: 

.

==== System Restore Points ===================

.

RP3: 3/2/2014 10:18:57 AM - Intel® PROSet/Wireless Software

RP4: 3/2/2014 10:21:24 AM - Windows Modules Installer

RP5: 3/2/2014 10:35:01 AM - Installed IDT Audio

RP6: 3/2/2014 11:10:21 AM - Installed DirectX

RP7: 3/2/2014 11:28:12 AM - Installed PowerDVD

RP8: 3/2/2014 11:35:23 AM - Windows Update

RP9: 3/2/2014 12:05:41 PM - Windows Update

RP10: 3/2/2014 2:52:30 PM - Installed Intel® PROSet/Wireless Software for Bluetooth® Technology

RP11: 3/3/2014 5:09:32 PM - Windows Update

RP12: 3/4/2014 8:16:50 AM - RegClean Pro Tue, Mar 04, 14  08:16

RP13: 3/4/2014 7:00:38 PM - Windows Update

RP15: 3/4/2014 11:04:01 PM - Revo Uninstaller Pro's restore point - Driver Support

RP16: 3/4/2014 11:59:13 PM - Windows Update

.

==== Installed Programs ======================

.

Adobe Flash Player 12 Plugin

Canon Inkjet Printer/Scanner/Fax Extended Survey Program

Canon MP Navigator EX 3.1

Canon MX340 series MP Drivers

Canon MX340 series User Registration

Canon Speed Dial Utility

Canon Utilities Easy-PhotoPrint EX

Canon Utilities My Printer

Canon Utilities Solution Menu

CCleaner

CyberLink PowerDVD 9.5

Dell Custom Help

IDT Audio

Intel® Processor Graphics

Intel® PROSet/Wireless for Bluetooth® + High Speed

Intel® PROSet/Wireless Software for Bluetooth® Technology

Intel® PROSet/Wireless WiFi Software Driver

Intel® SDK for OpenCL - CPU Only Runtime Package

Intel® PROSet/Wireless Software

Intel® PROSet/Wireless WiFi Software

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4.5.1

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox 27.0.1 (x86 en-US)

Mozilla Maintenance Service

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Norton Security Scan

Quiknowledge

Revo Uninstaller Pro 3.0.8

Spybot - Search & Destroy

.

==== Event Viewer Messages From Past Week ========

.

3/3/2014 5:11:32 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Microsoft XML Core Services 4.0 Service Pack 2 for x64-based Systems (KB973688).

3/3/2014 5:11:19 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft XML Core Services 4.0 Service Pack 2 for x64-based Systems (KB954430).

3/2/2014 2:11:58 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Internet Explorer 8 Compatibility View List for Windows 7 for x64-based Systems (KB2598845).

3/2/2014 2:10:02 PM, Error: Service Control Manager [7023]  - 

3/2/2014 11:36:25 AM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x8024d00e: Windows Update Core.

3/2/2014 11:15:26 AM, Error: Service Control Manager [7030]  - The Roxio Hard Drive Watcher 12 service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

3/2/2014 11:15:25 AM, Error: Service Control Manager [7030]  - The RoxMediaDB12OEM service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

3/2/2014 10:27:50 AM, Error: Service Control Manager [7023]  - The Intel® Content Protection HECI Service service terminated with the following error:  %%-2147024637

.

==== End Of File ===========================

 

 

[MrCharlie]

Welcome to the forum.

Please run a Quick Scan with Malwarebytes like this and post the log:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

---------------------

Then........

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General Forum P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running, please create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[fixcomp1]

RogueKiller V8.8.10 _x64_ [Feb 28 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Christian [Admin rights]
Mode : Scan -- Date : 03/05/2014 15:58:52
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST250LT007-9ZV14C ATA Device +++++
--- User ---
[MBR] 39c8370da1d6c56a66de830643565079
[bSP] 373398dcd9a8bf0cbfe410eecbf7cd11 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 238373 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_03052014_155852.txt >>



 

[MrCharlie]

Please uninstall this from your add/remove programs if possible:

Quiknowledge

Then..............

Lets clean out any adware/spyware now: (this will require a reboot so save all your work)

Please download AdwCleaner from HERE or HERE to your desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• When it's done you'll see: Pending: Please uncheck elements you don't want removed.
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• Look over the log especially under Files/Folders for any program you want to save.
• If there's a program you may want to save, just uncheck it from AdwCleaner.
• If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
• If you're ready to clean it all up.....click the Clean button.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
• To restore an item that has been deleted:
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[fixcomp1]

# AdwCleaner v3.020 - Report created 05/03/2014 at 20:16:55
# Updated 27/02/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Christian - CHRISTIAN-PC
# Running from : C:\Users\Christian\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\0pxsbufo.default-1393948825869\prefs.js ]


*************************

AdwCleaner[R0].txt - [5551 octets] - [04/03/2014 22:39:55]
AdwCleaner[R1].txt - [5611 octets] - [04/03/2014 22:40:11]
AdwCleaner[R2].txt - [983 octets] - [04/03/2014 22:45:36]
AdwCleaner[R3].txt - [1042 octets] - [04/03/2014 22:45:53]
AdwCleaner[R4].txt - [1163 octets] - [04/03/2014 23:53:53]
AdwCleaner[R5].txt - [1223 octets] - [04/03/2014 23:54:08]
AdwCleaner[R6].txt - [1286 octets] - [05/03/2014 20:15:38]
AdwCleaner[s0].txt - [4192 octets] - [04/03/2014 22:40:36]
AdwCleaner[s1].txt - [1104 octets] - [04/03/2014 22:46:23]
AdwCleaner[s2].txt - [1207 octets] - [05/03/2014 20:16:55]

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [1267 octets] ##########
 

[fixcomp1]

it seems to be working just fine now.

this is  report of the malware.

 

ofMalwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.03.05.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16428
Christian :: CHRISTIAN-PC [administrator]

Protection: Enabled

3/5/2014 8:22:39 PM
mbam-log-2014-03-05 (20-22-39).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: Heuristics/Extra
Objects scanned: 28498
Time elapsed: 2 minute(s), 8 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
 

[MrCharlie]

Good....that was the problem:

http://www.systemlookup.com/CLSID/81649-QuiknowledgeClientIE_dll.html

~~~~~~~~~~~~~~~~~~~~~

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[fixcomp1]

 Results of screen317's Security Check version 0.99.80  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Malwarebytes Anti-Malware version 1.75.0.1300  
  Adobe Flash Player 12.0.0.70 Flash Player out of Date!  
 Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Spybot Teatimer.exe is disabled!
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 5%
````````````````````End of Log``````````````````````
 

[MrCharlie]

Adobe Flash Player 12.0.0.70 Flash Player out of Date!<----this is OK

A little clean up to do....

Please download OTC to your desktop. (This will clean up most of the tools and logs)

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete. (right click.....Delete)

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:

If you used FRST and can't delete the quarantine folder:

Download the fixlist.txt to the same folder as FRST.exe.

Run FRST.exe and click Fix only once and wait

That will delete the quarantine folder created by FRST.

The rest you can manually delete.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (PM also found HERE)

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!