dllhost.exe COM surrogate infection

BrassRat87 · October 29, 2014

I've picked this up. Running MBAM, but I ran FRST before I read the procedure. Results attached. Do I need to wait for MBAM to complete before proceeding? It has caught some bad keys and files.

Addition.txt

FRST.txt

kevinf80 · October 29, 2014

If Malwarebytes is running let it complete then post its log, I`ll check the FRST logs.....

Kevin..

BrassRat87 · October 29, 2014

Thanks, Kevin.

MBAM log below (I don't see a way to attach). I have not yet quarantined anything. Please advise. Thanks. --Mike

************************

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 10/29/2014

Scan Time: 3:08:37 PM

Logfile: MBAM log.txt

Administrator: Yes

Version: 2.00.3.1025

Malware Database: v2014.10.29.07

Rootkit Database: v2014.10.22.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7

CPU: x64

File System: NTFS

User: Michael Roberts

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 342854

Time Elapsed: 1 hr, 1 min, 3 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 20

PUP.Optional.SearchQu, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}, , [4239a872e19b191deedd931c8e74e020],

PUP.Optional.SearchQu, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, , [4239a872e19b191deedd931c8e74e020],

PUP.Optional.SearchQu, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}, , [4239a872e19b191deedd931c8e74e020],

PUP.Optional.WeCare.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}, , [65160911de9ef83e6850459ca35ffc04],

PUP.Optional.TidyNetwork.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D7CD9955-4049-36A2-EB4E-A1ABEA9E68BB}, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.TidyNetwork.A, HKLM\SOFTWARE\CLASSES\CLSID\{D7CD9955-4049-36A2-EB4E-A1ABEA9E68BB}, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.TidyNetwork.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D7CD9955-4049-36A2-EB4E-A1ABEA9E68BB}, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.TidyNetwork.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D7CD9955-4049-36A2-EB4E-A1ABEA9E68BB}, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.DataMangr.A, HKLM\SOFTWARE\DataMngr, , [bfbc8f8bc8b4ab8b2b164bf6bf446d93],

PUP.Optional.AdPeak.A, HKLM\SOFTWARE\LevelQualityWatcher, , [d6a52ded790389ad205be75307fcb24e],

PUP.Optional.SavingsBull.A, HKLM\SOFTWARE\Savings Bull, , [c9b2ce4c9ede1b1b76511d3c5ca729d7],

PUP.Optional.InstallBrain.A, HKLM\SOFTWARE\WOW6432NODE\InstallIQ, , [7a01cb4f95e763d358b38dcb699a0df3],

PUP.Optional.MyWordTool.A, HKLM\SOFTWARE\WOW6432NODE\MyWordTool, , [d5a681994b312b0b9655d5ac798bc53b],

PUP.Optional.Albrechto.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update albrechto, , [5427cb4f0e6eb185e3d0d5adfc08c040],

PUP.Optional.DataMngr.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Datamngr, , [f08b45d5d5a71a1c04fce58fca3a55ab],

PUP.Optional.MyWordTool.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MyWordTool, , [522936e44d2fa1954f9dbcc5ea1a926e],

PUP.Optional.TidyNetwork.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\TidyNetwork, , [e497d2484d2f71c503cd59f81ee55da3],

PUP.Optional.SavingsBull.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Savings Bull, , [433863b7186493a3e8debe9b9c67da26],

PUP.Optional.TidyNetwork.A, HKU\S-1-5-21-32805412-3330798947-4050630682-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\TidyNetwork, , [8dee001a5725bf77c173dd796d9627d9],

PUP.Optional.SavingsBull.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Level Quality Watcher, , [8cef53c7532996a09d3d877223dfa45c],

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 9

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TidyNetwork, , [374454c6cdafa096dcfec9b88b797789],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.SavingsBull.A, C:\Program Files\SavingsBull, , [8cef53c7532996a09d3d877223dfa45c],

PUP.Optional.Datamngr.A, C:\Users\Michael Roberts\AppData\LocalLow\DataMngr, , [4e2d8793fa8257df64dbf10b9a682fd1],

PUP.Optional.SearchProtect.A, C:\Users\Michael Roberts\AppData\Local\SearchProtect, , [78031109691389adea9d62a9f0138a76],

PUP.Optional.SearchProtect.A, C:\Users\Michael Roberts\AppData\Local\SearchProtect\Logs, , [78031109691389adea9d62a9f0138a76],

PUP.Optional.Adpeak, C:\Program Files\Level Quality Watcher, , [06754cce0d6f2e08b59be7267291dd23],

PUP.Optional.Adpeak, C:\Program Files\Level Quality Watcher\v1.01, , [06754cce0d6f2e08b59be7267291dd23],

Files: 68

Backdoor.Bot, C:\Users\Michael Roberts\AppData\Local\Temp\android\android.exe, , [4338f02a522ade5856823f44659ca55b],

Backdoor.Bot, C:\Users\Michael Roberts\AppData\Local\Temp\5c89efb4-98ed-4b59-820b-bccafb8995bd\android.exe, , [8af1b268413bf046e6f2146fcd34a858],

PUP.Optional.Conduit.A, C:\Users\Michael Roberts\AppData\Local\Temp\5c89efb4-98ed-4b59-820b-bccafb8995bd\spidentifierimpl.exe, , [6b109f7ba0dcbe78325c673325dc4bb5],

PUP.Optional.SafeInstall.A, C:\Users\Michael Roberts\Downloads\applianflv (1).exe, , [552627f3cfad8aacca73273c8e7309f7],

PUP.Optional.SafeInstall.A, C:\Users\Michael Roberts\Downloads\applianflv.exe, , [ec8faa708cf039fdfb429ec530d1768a],

PUP.Optional.OptimumInstaller.A, C:\Users\Michael Roberts\Downloads\Player-Chrome.exe, , [611a60ba14681125421fb9abe31eaa56],

PUP.Optional.Mowdig, C:\Users\Michael Roberts\Downloads\Installer (1).exe, , [433835e5017b7cba0d8d495d9a6a926e],

PUP.Optional.Mowdig, C:\Users\Michael Roberts\Downloads\Installer (2).exe, , [a3d878a2d8a4bb7b7624129411f346ba],

PUP.Optional.Mowdig, C:\Users\Michael Roberts\Downloads\Installer.exe, , [215a25f5fc80ed497c1e099d848010f0],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (1).exe, , [4a31fc1e88f4d95d16d53b7044c01ee2],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (12).exe, , [b7c41a00a1dbd1650cdf4e5d6c9820e0],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (14).exe, , [0a71cc4e700cec4af6f5f9b2768e9769],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (15).exe, , [3f3c63b7e6964fe7effc3477976d13ed],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (2).exe, , [6d0ebc5e394330069c4fc5e6709432ce],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (3).exe, , [502ba476bdbf76c05c8fedbea85c21df],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (4).exe, , [99e2af6be399ec4af1fa2f7c7c88dc24],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (5).exe, , [a3d89d7d205c2115b6353f6c4cb81ce4],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (6).exe, , [5b2043d72b516ec8cd1eecbfdf25d42c],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (7).exe, , [98e39783c0bc93a377742a81d133e31d],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup (8).exe, , [d0abe8327efeae88ac3f9714798bb64a],

PUP.Optional.BundleInstaller.A, C:\Users\Michael Roberts\Downloads\uplayermediaplayer-setup.exe, , [2e4dd545b7c5ff3717d4adfe44c0619f],

PUP.Optional.InstallBrain.A, C:\Users\Michael Roberts\Downloads\CodecPerformerSetup.exe, , [3c3f0d0d4339b383d8cc70e8ee13a65a],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TidyNetwork\TidyNetwork.exe, , [2c4fee2c2e4e37ffc3d0425acd34a15f],

PUP.Optional.TidyNetwork.A, C:\Windows\System32\Tasks\TidyNetwork Update, , [93e8df3b97e5cc6a95a63cff13f06e92],

PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TidyNetwork\petn.dll, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TidyNetwork\petn64.dll, , [710a2ded96e66fc7bcec233a39ca22de],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TidyNetwork\sidTRUS26.tidy, , [374454c6cdafa096dcfec9b88b797789],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TidyNetwork\log.log, , [374454c6cdafa096dcfec9b88b797789],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TidyNetwork\petnupdate.exe, , [374454c6cdafa096dcfec9b88b797789],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\passport.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\TNT2UserPS.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\Autorun.inf, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\crx.tar, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\GameApps.ini, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\GameConsole.exe, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\GameEngine.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\GLOBALUNINSTALL.TNT, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\hmac.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\iestage2.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\IEToolbar.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\IEToolbar64.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\INSTALL.TNT, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\log.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\MinecraftShims64.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\npTNT2.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\npTNT2Ghost.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\PARTNER.TNT, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\passport64.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\pinnedSearch.htm, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\pinnedSearch_FindWide.htm, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\progress.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\regsvr.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\RemoteSkin.wms, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\sqlite.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\tnt2chrome.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\TNT2User.exe, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\TNT2UserPS64.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\TntMagicDel.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\UnInjLib.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\UnInjLib64.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\UNINSTALL.TNT, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\UninstallDlg.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\untar.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\UPDATE.TNT, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\xpi.tar, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.TidyNetwork.A, C:\Users\Michael Roberts\AppData\Local\TNT2\2.0.0.1702\zipunzip.1.dll, , [077475a50b71b1857763e21581813bc5],

PUP.Optional.SavingsBull.A, C:\Program Files\SavingsBull\uninstaller.exe, , [8cef53c7532996a09d3d877223dfa45c],

PUP.Optional.Datamngr.A, C:\Users\Michael Roberts\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, , [4e2d8793fa8257df64dbf10b9a682fd1],

Physical Sectors: 0

(No malicious items detected)

(end)

BrassRat87 · October 29, 2014

I did quarantine the items that MBAM found. It seemed to cause a reboot, but the process seems to have removed the infection. Seems too easy... --Mike

kevinf80 · October 29, 2014

Hiya Mike,

Your system has Poweliks infection, Malwarebytes does not kill that infection. Run the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs in your next reply, also give an update on any remaining issues or concerns...

Thank you,

Kevin..

Fixlist.txt

BrassRat87 · October 30, 2014

Argh. FRST64 crashed with Windows error, so I ran it again (mistake?). Same results. Contents of FIXLOG:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-10-2014 01

Ran by Michael Roberts at 2014-10-29 20:23:06 Run:2

Running from C:\Users\Michael Roberts\Desktop

Loaded Profile: Michael Roberts (Available profiles: Michael Roberts)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

Winlogon\Notify\ScCertProp: wlnotify.dll [X]

Winlogon\Notify\DkWLNP-x32: DkWLNP.dll [X]

HKU\S-1-5-21-32805412-3330798947-4050630682-1000\...\MountPoints2: {166cd1e6-0ed1-11e4-a3f9-b870f42c677a} - E:\Windows\PTMHS291LVW_V4_14_1_0.exe

HKU\S-1-5-21-32805412-3330798947-4050630682-1000\...\MountPoints2: {3f78db4f-51eb-11e3-a695-b870f42c677a} - E:\ZTE_Handset_USB_Driver.exe

HKU\S-1-5-21-32805412-3330798947-4050630682-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL =

Filter: application/msword - {DFF82902-0B96-3B98-6F62-D655E146A23A} - No File

Filter: application/octet-stream - {F969FE8E-1937-45AD-AF42-8A4D11CBDC2A} - No File

Filter: application/vnd-viewer - {CD4527E8-4FC7-48DB-9806-10537B501237} - No File

Filter: application/vnd.ms-excel - {DFF82902-0B96-3B98-6F62-D655E146A23A} - No File

Filter: application/vnd.ms-powerpoint - {DFF82902-0B96-3B98-6F62-D655E146A23A} - No File

Filter: application/x-microsoft-rpmsg-message - {DFF82902-0B96-3B98-6F62-D655E146A23A} - No File

Filter-x32: application/vnd-viewer - {CD4527E8-4FC7-48DB-9806-10537B501237} - No File

U3 BcmSqlStartupSvc; No ImagePath

U2 IviRegMgr; No ImagePath

U2 RichVideo; No ImagePath

U3 SQLWriter; No ImagePath

C:\Users\Michael Roberts\AppData\Local\Temp\DeleteVF.exe

C:\Users\Michael Roberts\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfnijlr.dll

C:\Users\Michael Roberts\AppData\Local\Temp\en_ww_Package.exe

C:\Users\Michael Roberts\AppData\Local\Temp\installhelper.dll

C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe

C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe

C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe

C:\Users\Michael Roberts\AppData\Local\Temp\MSNDDA3.exe

C:\Users\Michael Roberts\AppData\Local\Temp\SHSetup.exe

C:\Users\Michael Roberts\AppData\Local\Temp\SRAssetsHelper.dll

C:\Users\Michael Roberts\AppData\Local\Temp\uninstall.exe

CustomCLSID: HKU\S-1-5-21-32805412-3330798947-4050630682-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?

AlternateDataStreams: C:\Users\Michael Roberts\Desktop\DUST.mp4:com.dropbox.attributes

EmptyTemp:

End

*****************

"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp" => Key not found.

"HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\DkWLNP" => Key not found.

"HKU\S-1-5-21-32805412-3330798947-4050630682-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{166cd1e6-0ed1-11e4-a3f9-b870f42c677a}" => Key not found.

"HKCR\CLSID\{166cd1e6-0ed1-11e4-a3f9-b870f42c677a}" => Key not found.

"HKU\S-1-5-21-32805412-3330798947-4050630682-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3f78db4f-51eb-11e3-a695-b870f42c677a}" => Key not found.

"HKCR\CLSID\{3f78db4f-51eb-11e3-a695-b870f42c677a}" => Key not found.

"HKU\S-1-5-21-32805412-3330798947-4050630682-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key not found.

"HKU\S-1-5-21-32805412-3330798947-4050630682-1000\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

"HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

"HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.

"HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found.

"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

"HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/msword" => Key not found.

"HKCR\CLSID\{DFF82902-0B96-3B98-6F62-D655E146A23A}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/octet-stream" => Key not found.

"HKCR\CLSID\{F969FE8E-1937-45AD-AF42-8A4D11CBDC2A}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/vnd-viewer" => Key not found.

"HKCR\CLSID\{CD4527E8-4FC7-48DB-9806-10537B501237}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/vnd.ms-excel" => Key not found.

"HKCR\CLSID\{DFF82902-0B96-3B98-6F62-D655E146A23A}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/vnd.ms-powerpoint" => Key not found.

"HKCR\CLSID\{DFF82902-0B96-3B98-6F62-D655E146A23A}" => Key not found.

"HKCR\PROTOCOLS\Filter\application/x-microsoft-rpmsg-message" => Key not found.

"HKCR\CLSID\{DFF82902-0B96-3B98-6F62-D655E146A23A}" => Key not found.

"HKCR\Wow6432Node\PROTOCOLS\Filter\application/vnd-viewer" => Key not found.

"HKCR\Wow6432Node\CLSID\{CD4527E8-4FC7-48DB-9806-10537B501237}" => Key not found.

BcmSqlStartupSvc => Service not found.

IviRegMgr => Service not found.

RichVideo => Service not found.

SQLWriter => Service not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\DeleteVF.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfnijlr.dll" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\en_ww_Package.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\installhelper.dll" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\MSNDDA3.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\SHSetup.exe" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\SRAssetsHelper.dll" => File/Directory not found.

"C:\Users\Michael Roberts\AppData\Local\Temp\uninstall.exe" => File/Directory not found.

"HKU\S-1-5-21-32805412-3330798947-4050630682-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key not found.

"C:\Users\Michael Roberts\Desktop\DUST.mp4" => ":com.dropbox.attributes" ADS not found.

kevinf80 · October 30, 2014

Yes that log shows as "Run 2" all entries are listed as not found, is safe to assume they were removed with "Run 1"

Have you completed the other steps, can I see those logs?

BrassRat87 · October 30, 2014

Results of subsequent MBAM scan (I haven't followed the later steps yet):

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 10/29/2014

Scan Time: 8:32:24 PM

Logfile:

Administrator: Yes

Version: 2.00.3.1025

Malware Database: v2014.10.29.08

Rootkit Database: v2014.10.22.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7

CPU: x64

File System: NTFS

User: Michael Roberts

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 329902

Time Elapsed: 18 min, 41 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

BrassRat87 · October 30, 2014

ADW Log:

*******************************************

# AdwCleaner v3.311 - Report created 29/10/2014 at 21:01:18

# Updated 30/09/2014 by Xplode

# Operating System : Windows 7 Home Premium (64 bits)

# Username : Michael Roberts - BODHRAN

# Running from : C:\Users\Michael Roberts\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AGI

Folder Deleted : C:\Program Files (x86)\AGI

Folder Deleted : C:\Program Files (x86)\jZip

Folder Deleted : C:\Program Files (x86)\TidyNetwork

Folder Deleted : C:\Program Files (x86)\Toolbar Cleaner

Folder Deleted : C:\Users\Michael Roberts\AppData\Local\AGI

Folder Deleted : C:\Users\Michael Roberts\AppData\Local\jZip

Folder Deleted : C:\Users\Michael Roberts\AppData\Local\PackageAware

Folder Deleted : C:\Users\Michael Roberts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Toolbar Cleaner

Folder Deleted : C:\Users\Michael Roberts\Documents\Optimizer Pro

File Deleted : C:\END

File Deleted : C:\Users\Michael Roberts\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk

***** [ Scheduled Tasks ] *****

Task Deleted : driverupdate startup

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\jZip.file

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\jZip_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\jZip_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPath\jZip.exe

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}

Key Deleted : HKCU\Software\AGI

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\jZip

Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKCU\Software\AppDataLow\Software\searchqutoolbar

Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Key Deleted : HKLM\SOFTWARE\AGI

Key Deleted : HKLM\SOFTWARE\jZip

Key Deleted : HKLM\SOFTWARE\PIP

Key Deleted : HKLM\SOFTWARE\Toolbar Cleaner

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\jZip

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16476

-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Michael Roberts\AppData\Roaming\Mozilla\Firefox\Profiles\szwephwo.default\prefs.js ]

-\\ Google Chrome v38.0.2125.111

[ File : C:\Users\Michael Roberts\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

Deleted [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Deleted [search Provider] : hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

*************************

AdwCleaner[R0].txt - [4113 octets] - [29/10/2014 20:57:31]

AdwCleaner[s0].txt - [4274 octets] - [29/10/2014 21:01:18]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4334 octets] ##########

BrassRat87 · October 30, 2014

JRT log:

************************

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.3 (10.21.2014:1)

OS: Windows 7 Home Premium x64

Ran by Michael Roberts on Wed 10/29/2014 at 21:16:29.07

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-32805412-3330798947-4050630682-1000\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update albrechto

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\albrechto_11202013_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\albrechto_11202013_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\albrechto_Setup_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\albrechto_Setup_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\utilalbrechto_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\utilalbrechto_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\albrechto_11202013_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\albrechto_11202013_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\albrechto_Setup_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\albrechto_Setup_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\utilalbrechto_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\utilalbrechto_RASMANCS

~~~ Files

Successfully deleted: [File] "C:\windows\s.bat"

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Michael Roberts\AppData\Roaming\mywordtool"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 10/29/2014 at 21:20:38.97

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

BrassRat87 · October 30, 2014

I thought I had previously posted the ADW log, but dont see it in the thread. It was run before JTR. Here is output:

********************************************