Jump to content

Infected .tmp File - YTDownloader?

Recommended Posts

So, yesterday, I started getting system notifications (I run Windows 8, by the way) asking which program I wanted to use to open .tmp files. I figured it was a virus, and ran MalwareBytes, both a quick scan, and a total scan (which took five hours, and seemed to take care of the problem for a few minutes at least); however, the message kept popping up. I opened the .tmp file in Notepad, and from looking at it, it seems like it's a program called YTDownloader or something, and even after cleaning out my files with MB as well as CCleaner, the .txt file continues to open up at random. I attached a photo of part of the .txt file, as well as the FRST log. I also ran a HijackThis scan as well if I need to attach that log.




Thanks for the help, guys!



Link to post
Share on other sites

Hello and post-32477-1261866970.gif


P2P/Piracy Warning:



If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.



Upload a File to Virustotal
Go to http://www.virustotal.com/

  • Click the Choose file button
  • Navigate to the file C:\Windows\Runservice.exe
  • Click the Scan it tab
  • If you get a message saying File has already been analyzed: click Reanalyze file now
  • Copy and paste the results back here please.





Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.


Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.




Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.



Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.


When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.



In most cases, a restart will be required.



Wait for the prompt to restart the computer to appear, then click on Yes.



Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.




Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number




Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:


64 Bit version:



Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:


1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter

notepad c:\windows\debug\mrt.log


Let me see those logs in your next reply, also give an update on any remaining issues or concerns...








Link to post
Share on other sites

Hey Kevin, thanks for taking this on, I appreciate it. Sorry for the late reply though, I've been in class and at work all day (plus server issues haven't been helping that much).


I read the rules on piracy beforehand, and I did disable uTorrent before I posted. However, in order to prevent any sort of issues with your guys's rules--after all, I am coming to you guys for help--I uninstalled it entirely. Hopefully that takes care of that problem, but if I'm still in some sort of violation with the rules, feel free to let me know and I'll do whatever I can to fix that situation.


Attached are all of the log files that you requested. About half way through the process, the .txt file stopped opening, which is a nice sign. Of course, you know a bit more than I do, so I'm not going to jump to any conclusions. I've made sure to not input any sort of information that I would not want in the wrong hands on this computer, because, well, then I have an even bigger problem on my hands.


If I'm missing anything, or you need anything else, please let me know, I'm following your advice to a T.






Link to post
Share on other sites

Thanks for the update and logs, we still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:


Run Eset Online Scanner


**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.


(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART  Installer during the process)


Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.


Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is ticked
Click on Advanced Settings, ensure the following options are checked:
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Select "Change" next to Current scan targets A new window will open, select any extra drives, Flash drives etc as required.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish


When the scan is complete


If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found


If threats were found


click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish


close program


Copy and paste the report in next reply.




Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)
Double click SecurityCheck.exe (Vista or Windows 7/8 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
If Security Check will not run or you get an alert saying it is not supported, Re-boot your PC then try again...


Thank you,



Link to post
Share on other sites

Well, it looks like everything is good. The ESET scan reported that there were no issues, and the checkup seems to be alright.

 Results of screen317's Security Check version 0.99.87     x64 (UAC is enabled)   Internet Explorer 11  [b][u]``````````````Antivirus/Firewall Check:``````````````[/b][/u]  Windows Firewall Enabled!  Windows Defender   avast! Antivirus    Antivirus up to date!   [b][u]`````````Anti-malware/Other Utilities Check:`````````[/b][/u]  Java 7 Update 67   JavaScript Tooling     Visual Studio Extensions for Windows Library for JavaScript  Adobe Flash Player   Adobe Reader XI   Mozilla Firefox 27.0.1 [color=red][b]Firefox out of Date![/b][/color]   Google Chrome 37.0.2062.103   Google Chrome 37.0.2062.120  [b][u]````````Process Check: objlist.exe by Laurent````````[/b][/u]   AVAST Software Avast AvastSvc.exe   AVAST Software Avast AvastUI.exe  [b][u]`````````````````System Health check`````````````````[/b][/u]  Total Fragmentation on Drive C:  % [b][u]````````````````````End of Log``````````````````````[/b][/u] 

Thus far it seems like everything is back to normal. Really appreciate your help, Kevin.

Link to post
Share on other sites

You`re very welcome, run the following to clean up...


Download "Delfix by Xplode" and save it to your desktop.


Or use the following if first link is down:


"Delfix link mirror"


Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator


Make Sure the following items are checked:


    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings


Now click on "Run" and wait patiently until the tool has completed.


The tool will create a log when it has completed. We don't need you to post this.


Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:




When all is known to be well with your system you can delete that back up folder if you consider it as not needed...




Read the following link to fully understand PC security and best practices, you may find it useful....




Let me know if we can close out...



Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.