Infection - need help please

[Vimar]

Georgi,

I too, have this uninstallconverter bundle in my program files.  I cannot get rid of websteroids.  I am running Dell desktop D9200 with Vista.  If you are willing to help should I start with the same download in your first post and attach the files?

Vimar

[B-boy/StyLe/]

Hello Vimar,

 

 

Please open your own topic and me or someone else will be happy to assist you.

 

 

Regards,

Georgi

[Vimar]

Here are the files.  I will check later to see if anyone was able to review.  Thanks in advance.

Addition.txt

FRST.txt

[Vimar]

I could not start my own so I added here.  Will try again.

[B-boy/StyLe/]

Hello,

 

 

I have asked a moderator to split your posts off to a new topic.

 

 

Regards,

Georgi

[Vimar]

Thank you.  As I can still not start new.

[B-boy/StyLe/]

Hello Vimar,

 

Ok...you have your own topic now.

 

Give me some time to check the logs files and come back with a fix for you.

 

 

Regards,

Georgi

[B-boy/StyLe/]

Hello,

 

 

Click on Start > type in appwiz.cpl in the search box and press Enter
Find and uninstall the following programs from the list
 

 

AutocompletePro
Websteroids

 

Please download the following file => fixlist.txt and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Regards,

Georgi

[Vimar]

I uninstalled autocomplete pro.  Websteroids is not listed in the programs list in the control panel even when I select "show hidden folders".  Websteroids is hidden inside the "InstallConverter bundle uninstaller" program.  When I uninstall this program it brings up a new window titled;

"InstallConverter bundle uninstaller Uninstaller"

and the following text;

"When you installed SearchProtect you also installed other applications, please choose which applications you wish to remove:"

There were more but now it only lists;

"Websteroids" - "Remove" (button)

"Remove All" (button)

I have clicked on both buttons but Websteroids continues to be listed.  It also states in the window (for what it's worth);

"During SearchProtect installation your home page and default search were changed to a different search.  If you would like to change the serach settings, follow the instuctions in the link below;"

I have not clicked on this link

[B-boy/StyLe/]

Hello,

 

 

Ok, we can unhide the entry this way:

 

Please download the following file => fixlist.txt and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Now try again to uninstall Websteroids.

If you are not able to uninstall it even after the fix above then try with the following tool:

 

http://support.microsoft.com/mats/program_install_and_uninstall/en

 

 

Then please proceed with step 2 from my previous post and post the results from the fix. (the attached fixlist.txt is different so you should download it as well).

 

Thanks!

 

 

Regards,

Georgi

[Vimar]

Ok.

I ran your fixlist and enclosed the fixlog.

I was now able to uninstall both websteroids and InstallConverter bundle uninstaller.

You then state to go back to step 2...to be clear you want me to save the larger fixlist file from your earlier post and execute that step?

Fixlog.txt

[Vimar]

I reread your post.  executed original fix.  Enclosed is the log.

Note - The completion of the fix propmted a restart.  Upon restart login, the FRST program window was open but not responding.  I left it for about 15mins to see if it would respond but then shut it down using the Task Manager.  Not sure if relevant but thought it was worth mentioning.

System appears to be running fine on restart.

Fixlog.txt

[B-boy/StyLe/]

Hello,

 

Good work. Can you please run a new scan with FRST and attach the new log please?

 

Thanks!

 

 

Regards,

Georgi

[Vimar]

See enclosed.

Thanks

FRST.txt

[B-boy/StyLe/]

Hello,

 

Good work. The log look a lot better now.

 

Also if you don't mind, I want to make sure there is nothing lurking on the system so just in case I want you to go through these steps:

 

The most of them should take no more than 5 minutes each (but the time they take to complete can vary depending on the size of your hard and the speed of your computer).

 

 

STEP 1

 

 

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

 

 

STEP 2

 

 

  Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

STEP 3

 

• Please download RKill by Grinler from the link below and save it to your desktop.
  
  Rkill
• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
• If nothing happens or if the tool does not run, please let me know in your next reply.
• A log pops up at the end of the run. This log file is located at C:\rkill.log.
• Please post the log in your next reply.

 

STEP 4

 

• Please download RogueKiller.exe and save to the desktop.
• Close all windows and browsers
• Right-click the program and select 'Run as Administrator'
• Press the scan button.
• A report opens on the desktop named - RKreport.txt
• Please copy and past the results at pastebin.com and post the link to the log in your next reply.

 

 

STEP 5
 

 

Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
   
• Put a checkmark beside loaded modules.
  
• A reboot will be needed to apply the changes. Do it.
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
• Then click on Change parameters in TDSSKiller.
• Check all boxes then click OK.
   
• Click the Start Scan button.
   
• The scan should take no longer than 2 minutes.
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and past the results at pastebin.com and post the link to the log in your next reply.

 

 

STEP 6

 

 

Please download Malwarebytes Anti-Malware to your desktop.
 

• Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish.
• On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
• Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
• A Threat Scan will begin.
• With some infections, you may see this message box.
  • 'Could not load DDA driver'
• Click 'Yes' to this message, to allow the driver to load after a restart.
• Allow the computer to restart. Continue with the rest of these instructions.
• When the scan is complete, click Apply Actions.
• Wait for the prompt to restart the computer to appear, then click on Yes.
• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.

 

 

STEP 7

 

 

1.Please download HitmanPro.

• For 32-bit Operating System - .
• This is the mirror -
• For 64-bit Operating System -
• This is the mirror -

2.Launch the program by double clicking on the icon. (Windows Vista/7 users right click on the HitmanPro icon and select run as administrator).

Note: If the program won't run please then open the program while holding down the left CTRL key until the program is loaded.

3.Click on the next button. You must agree with the terms of EULA. (if asked)

4.Check the box beside "No, I only want to perform a one-time scan to check this computer".

5.Click on the next button.

6.The program will start to scan the computer. The scan will typically take no more than 2-3 minutes.

7.When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore <= IMPORTANT!!!
 
8.Click on the next button.

9.Click on the "Save Log" button.

10.Save that file to your desktop and post the content of that file in your next reply.
 
Note: if there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro

Navigate to C:\ProgramData\HitmanPro\Logs open the report and copy and paste it to your next reply.

 

 

 

STEP 8

 

 

Download Security Check by screen317 from here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

and then if there aren't any issues left I'll give you my final recommendations.

 

 

Regards,

Georgi

[Vimar]

step 1

AdwCleanerS0.txt

[Vimar]

step 2

JRT.txt

[Vimar]

3 and 4

Rkill.txt

RKreport0_S_04032014_163844.txt

[B-boy/StyLe/]

Hello,

 

So far, so good!

 

 

Backup Your Registry
 

• Please download and install Tweaking.com-Registry Backup
• Open Tweaking.com-Registry Backup and click on Backup Now.
• Close the application.

 

Now download the following file and save it to your desktop:

agp440.reg

 

Now double click on it. An information box will pop up asking if you want to merge the information in the file into the registry, click YES.

 

Next continue with the rest of the steps from my previous post.

 

 

 

Regards,

Georgi

[Vimar]

My Malwarebytes did not have all the features that you listed?  Do I need to purchase an upgraded version?  I ran the scan and it found a lot so I posted the results.

MBAM-log-2014-04-04 (08-46-42).txt

[Vimar]

Hitman found a lot of crap!

HitmanPro_20140404_0914.log

[B-boy/StyLe/]

Hello,

 

You didn't remove the entries found my MBAM. Also no...please check my instructions about MBAM again. You need to download and install the version from the link from my previous post and then update the definitions and run a new scan & remove the entries found. Attach the log to your next reply and then re-run Hitmanpro again and attach its log as well.

 

 

Regards,

Georgi

[Vimar]

OK.  I downloaded the proper MBAM and executed as per your instructions.  Everything went well until I clicked "copy to clipboard" so I could copy the scan report.  When I do this MBAM shuts down..."Malwarebytes has stopped working, a problem has caused the program to stop working windows will notify you if a solution becomes available..."  I have also tried using the "export" button but the same problem. I tried pulling the log from C:\Program Files\Malwarebytes' Anti-Malware\Logs but the only file there in very old? 

There are several items quanantined.  Not sure what to do next?

[Vimar]

step 7

HitmanPro_20140404_1426.log

[B-boy/StyLe/]

That's weird..

 

• Please download MiniToolBox.exe by Farbar save it to your desktop and run it.
• Checkmark only list last 10 event viewer errors.
• Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

 

Also did you completely uninstall MBAM 1.75 before installing the new one?

Uninstall MBAM 2 this way => https://helpdesk.malwarebytes.org/entries/25291497-How-do-I-uninstall-Malwarebytes-Anti-Malware- and install it again and see if that resolve the issue.

 

 

Regards,

Georgi