Regclean Pro

[hulagirl]

Hello,

I tried to download the CCleaner on Cnet but inadvertently downloaded the (advertisement) file instead.  Attached are the frst.txt and addition.txt.  Will you kindly help me in deleting this virus?  I would greatly appreciate your help!

FRST.txt

Addition.txt

[MrCharlie]

Welcome to the forum.

Please run a Quick Scan with Malwarebytes

For Malwarebytes ver: 1.75

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

For Malwarebytes 2.0, please run a Threat Scan

Click on Settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine all that's found

General P2P/Piracy Warning:

 

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

Then.......

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

If I don't respond within 24 hours, please send me a PM

[hulagirl]

RogueKiller V9.0.2.0 [Jun  3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Admin [Admin rights]
Mode : Scan -- Date : 06/15/2014  09:15:53

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 34 ¤¤¤
[PUM.SysRestore] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore | DisableSR : 1  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyComputer : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyComputer : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyComputer : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1708537768-1364589140-1177238915-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1708537768-1364589140-1177238915-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyComputer : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1708537768-1364589140-1177238915-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1708537768-1364589140-1177238915-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1708537768-1364589140-1177238915-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowControlPanel : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyComputer : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyDocs : 2  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 2  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HM080HI +++++
--- User ---
[MBR] d40a7177e56c3cca84d6b47f9c468472
[bSP] 11d467b9f31927f29d49c85858b51038 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 112455 | Size: 71139 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1:  +++++
--- User ---
[MBR] 2dd27a2bd9b0b305e974b4defc45b985
[bSP] df4f83c1f72e36823a12b0dfc7617313 : Unknown MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 8192 | Size: 15189 MB
Error reading LL1 MBR! ([1] Incorrect function. )
Error reading LL2 MBR! ([1] Incorrect function. )


============================================
RKreport_SCN_06142014_222759.log

[MrCharlie]

Make sure you have created a restore point and.....
Download Delfix from Here and save it to your desktop.

• Place a check mark in front of .......
• Create registry backup <---only!
• Uncheck the rest!
• Click the Run button.
  
  Close the tool out when it's done....we'll use it later.
  
  -----------------------
  
  I don't see the program in the logs.
  
  It's listed in your add/remove programs:
  RegClean-Pro
  Have you tried to uninstall it???
  
  ---------------------------------------
  
  Download the attached fixlist.txt to the same folder as FRST.exe.
  Run FRST.exe and click Fix only once and wait
  The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.
  
  Then.............
  
  Please download AdwCleaner from HERE or HERE to your desktop.
  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  Last:
  
  Please run a Threat Scan
  Click on settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware
  Same for PUM (Potentially Unwanted Modifications)
  Quarantine All that's found
  
  Let me know.....MrC

[hulagirl]

Thank you for the prompt help, Mr. Charlie.  Sorry for the ignorance, but is a restore point a backup?

[hulagirl]

Ok, I found the System Restore, and it says "Sytem Restore is off.  Do you want to turn System Restore now?"

[MrCharlie]

Yes, turn it on and create a restore point, MrC

[hulagirl]

No, I haven't tried uninstalling it in the add/remove programs.  Shall I do it now?
-------------------------------------------
I don't see the program in the logs.

It's listed in your add/remove programs:
RegClean-Pro
Have you tried to uninstall it???

---------------------------------------

[MrCharlie]

Yes, give it a try....then move on with the rest of my instructions.

 

 MrC

[hulagirl]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:15-06-2014
Ran by Admin at 2014-06-15 12:35:57 Run:1
Running from C:\Documents and Settings\Admin\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CHR HKLM\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Documents and Settings\Admin\Local Settings\Application Data\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-03-12]
CHR HKCU\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Documents and Settings\Admin\Local Settings\Application Data\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-03-12]
 C:\Documents and Settings\All Users\Desktop\RegClean Pro.lnk
C:\Documents and Settings\Admin\jagex_runescape_preferences.dat
C:\Documents and Settings\Admin\jagex_runescape_preferences2.dat

*****************

'HKLM\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle' => Key deleted successfully.
C:\Documents and Settings\Admin\Local Settings\Application Data\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx => Moved successfully.
'HKCU\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle' => Key deleted successfully.
"C:\Documents and Settings\Admin\Local Settings\Application Data\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx" => File/Directory not found.
C:\Documents and Settings\All Users\Desktop\RegClean Pro.lnk => Moved successfully.
C:\Documents and Settings\Admin\jagex_runescape_preferences.dat => Moved successfully.
C:\Documents and Settings\Admin\jagex_runescape_preferences2.dat => Moved successfully.

==== End of Fixlog ====

[hulagirl]

Am I to delete the following:

c:\documentsandsettings\admin\applicationdata\systweak

c:\documentsandsettings\admin\mydocuments\updater

 

Thanks for your patience!

[MrCharlie]

Yes, if that's what AdwCleaner found, MrC

[hulagirl]

My computer has stalled both times that I've tried to click on "Clean" while running AdwCleaner.  The blue bar (deleting folders) is at 1/10 capacity.  

[MrCharlie]

Delete your copy of AdwCleaner and download a fresh one.

 

Reboot into safe mode and try it.

 

If you can't do that, then just run a scan with AdwCleaner and post the log.

 

MrC

[hulagirl]

Good morning,

I hope that you had a lovely day yesterday, MrCharlie!  Unfortunately, it kept crashing, so here is the log:

 

# AdwCleaner v3.212 - Report created 16/06/2014 at 05:55:48
# Updated 05/06/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Admin - ADMIN-B6C5AD421
# Running from : C:\Documents and Settings\Admin\My Documents\Downloads\AdwCleaner(1).exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Found : C:\Documents and Settings\Admin\Application Data\Systweak
Folder Found : C:\Documents and Settings\Admin\My Documents\Updater

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\systweak
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\Software\systweak

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v29.0.1 (en-US)

[ File : C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\pk1l53t7.default\prefs.js ]

Line Found : user_pref("extensions.crossrider.bic", "13af3cde4a70a82880839ed9d78b10ab");
Line Found : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Line Found : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

-\\ Google Chrome v

[ File : C:\Documents and Settings\Admin\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

Found [search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Found [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [1808 octets] - [15/06/2014 12:37:56]
AdwCleaner[R1].txt - [1927 octets] - [15/06/2014 15:50:21]
AdwCleaner[R2].txt - [1788 octets] - [16/06/2014 05:55:48]
AdwCleaner[s0].txt - [375 octets] - [15/06/2014 13:27:55]
AdwCleaner[s1].txt - [375 octets] - [15/06/2014 15:51:35]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1966 octets] ##########

[MrCharlie]

See if this one will work:

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

MrC

[hulagirl]

Thank you, here it is:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Microsoft Windows XP x86

Ran by Admin on Mon 06/16/2014 at 17:02:51.57

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

~~~ Services

 

 

~~~ Registry Values

 

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441193}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4864315E-A06A-4C63-BAD8-67310F7B99AA}

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Admin\Application Data\systweak"

Successfully deleted: [Folder] "C:\Documents and Settings\Admin\Local Settings\Application Data\cre"

 

 

~~~ FireFox

 

Successfully deleted the following from C:\Documents and Settings\Admin\Application Data\mozilla\firefox\profiles\pk1l53t7.default\prefs.js

 

user_pref("extensions.crossrider.bic", "13af3cde4a70a82880839ed9d78b10ab");

Emptied folder: C:\Documents and Settings\Admin\Application Data\mozilla\firefox\profiles\pk1l53t7.default\minidumps [13 files]

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 06/16/2014 at 17:13:31.73

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[MrCharlie]

Looks Good, now run a Threat Scan with MB and let me know how the computer is, MrC

[hulagirl]

Ok, will do, thanks.  Is there a possibility that my external hardrive got infected also?  I had it plugged into the computer at the time I downloaded the Regclean Pro. 

[MrCharlie]

If you want CCleaner, download it from here:

https://www.piriform.com/ccleaner

I don't think your external hard drive got infected but it wouldn't hurt to scan it with MB.

MrC

[hulagirl]

qsMalwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.06.15.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Admin :: ADMIN-B6C5AD421 [administrator]

6/16/2014 5:42:49 PM
mbam-log-2014-06-16 (17-42-49).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 339361
Time elapsed: 1 hour(s), 47 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[MrCharlie]

How is it????

If there's no other problems......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• If you get Unsupported operating system. Aborting now, just reboot and try again.
• A Notepad document should open automatically called checkup.txt.
• Please Post the contents of that document.
• Do Not Attach It!!!

MrC

[hulagirl]

 Results of screen317's Security Check version 0.99.85  
 Windows XP Service Pack 3 x86   
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 MVPS Hosts File  
 Malwarebytes Anti-Malware version 1.70.0.1100  
 Out of date Malwarebytes Anti-Malware installed!
 CCleaner     
 Java 7 Update 60  
  Adobe Flash Player     11.8.800.94 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox 29.0.1 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast afwServ.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:: 15% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

[MrCharlie]

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

------------------------------------------------

Out of date Malwarebytes Anti-Malware installed!

From your last log, looks like you're using this version:
Malwarebytes Anti-Malware 1.75.0.1300

This is the newest version: Malwarebytes Anti-Malware 2.0.2.1012

If you would like to install it, instructions in the link below:
https://forums.malwarebytes.org/index.php?/topic/146017-mbam-clean-removal-process-2x/

-------------------------------------------------

Adobe Flash Player 11.8.800.94 Flash Player out of Date!

Flash Player:
Check for an update if available
Downloads are at the top of the page. (don't install the McAfee toolbar)

-------------------------------------------

Mozilla Firefox 29.0.1 Firefox out of Date!
Please update to the latest version:
https://support.mozilla.org/en-US/kb/update-firefox-latest-version

-------------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /



Then hit enter. (it may look like CF is re-installing but it's not)
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

Download Delfix from here and save it to your desktop. (you may already have this)

• Ensure Remove disinfection tools is checked.
• Click the Run button.
• Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

Note:
If you used FRST and can't delete the quarantine folder:
Download the fixlist.txt to the same folder as FRST.exe.
Run FRST.exe and click Fix only once and wait
That will delete the quarantine folder created by FRST.
The rest you can manually delete.

-------------------------------

Any questions...please post back.
If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (My Preventive Maintenance also found HERE)

Good Luck and Thanks for using the forum, MrC

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!