TechSpot

[A] Trojan svchost.exe picked up by Avast

Inactive
By insound
Oct 23, 2012
  1. insound

    insound TS Rookie Topic Starter Posts: 21

    # AdwCleaner v2.005 - Logfile created 10/29/2012 at 18:49:54
    # Updated 14/10/2012 by Xplode
    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
    # User : Main PC - MAINPC-PC
    # Boot Mode : Normal
    # Running from : C:\Users\Main PC\Desktop\adwcleaner.exe
    # Option [Delete]


    ***** [Services] *****


    ***** [Files / Folders] *****

    Folder Deleted : C:\Program Files (x86)\Vuze_Remote
    Folder Deleted : C:\ProgramData\boost_interprocess
    Folder Deleted : C:\Users\Main PC\AppData\LocalLow\Conduit
    Folder Deleted : C:\Users\Main PC\AppData\LocalLow\PriceGong
    Folder Deleted : C:\Users\Main PC\AppData\LocalLow\Vuze_Remote
    Folder Deleted : C:\Users\Main PC\AppData\Roaming\Mozilla\Firefox\Profiles\ecckv26j.default\ConduitCommon

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
    Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
    Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
    Key Deleted : HKCU\Software\AppDataLow\Software\Vuze_Remote
    Key Deleted : HKCU\Software\AppDataLow\Toolbar
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
    Key Deleted : HKLM\Software\Vuze_Remote
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7365E26-7900-412E-BB34-8B64454C26A4}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C1C8539A-6F13-476E-93F7-1BC1F21BC206}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA14329E-9550-4989-B3F2-9732E92D17CC}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Vuze_Remote Toolbar
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
    Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{BA14329E-9550-4989-B3F2-9732E92D17CC}]

    ***** [Internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Registry is clean.

    -\\ Mozilla Firefox v16.0.2 (en-US)

    Profile name : default
    File : C:\Users\Main PC\AppData\Roaming\Mozilla\Firefox\Profiles\ecckv26j.default\prefs.js

    Deleted : user_pref("CT2504091..clientLogIsEnabled", false);
    Deleted : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
    Deleted : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
    Deleted : user_pref("CT2504091.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
    Deleted : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
    Deleted : user_pref("CT2504091.BrowserCompStateIsOpen_129707804829376918", true);
    Deleted : user_pref("CT2504091.CTID", "CT2504091");
    Deleted : user_pref("CT2504091.CurrentServerDate", "3-4-2012");
    Deleted : user_pref("CT2504091.DSInstall", false);
    Deleted : user_pref("CT2504091.DialogsAlignMode", "LTR");
    Deleted : user_pref("CT2504091.DialogsGetterLastCheckTime", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylight T[...]
    Deleted : user_pref("CT2504091.DownloadReferralCookieData", "");
    Deleted : user_pref("CT2504091.EMailNotifierPollDate", "Tue Apr 03 2012 14:43:52 GMT+0100 (GMT Daylight Time)"[...]
    Deleted : user_pref("CT2504091.FeedLastCount129079840422964131", 0);
    Deleted : user_pref("CT2504091.FeedPollDate128891351169457140", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylig[...]
    Deleted : user_pref("CT2504091.FeedPollDate129079840422964131", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylig[...]
    Deleted : user_pref("CT2504091.FeedTTL128891351169457140", 40);
    Deleted : user_pref("CT2504091.FirstServerDate", "3-4-2012");
    Deleted : user_pref("CT2504091.FirstTime", true);
    Deleted : user_pref("CT2504091.FirstTimeFF3", true);
    Deleted : user_pref("CT2504091.FixPageNotFoundErrors", true);
    Deleted : user_pref("CT2504091.GroupingServerCheckInterval", 1440);
    Deleted : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
    Deleted : user_pref("CT2504091.HPInstall", false);
    Deleted : user_pref("CT2504091.HasUserGlobalKeys", true);
    Deleted : user_pref("CT2504091.Initialize", true);
    Deleted : user_pref("CT2504091.InitializeCommonPrefs", true);
    Deleted : user_pref("CT2504091.InstallationAndCookieDataSentCount", 1);
    Deleted : user_pref("CT2504091.InstallationId", "ConduitNSISIntegration");
    Deleted : user_pref("CT2504091.InstallationType", "ConduitXPEIntegration");
    Deleted : user_pref("CT2504091.InstalledDate", "Tue Apr 03 2012 14:43:52 GMT+0100 (GMT Daylight Time)");
    Deleted : user_pref("CT2504091.IsGrouping", false);
    Deleted : user_pref("CT2504091.IsInitSetupIni", true);
    Deleted : user_pref("CT2504091.IsMulticommunity", false);
    Deleted : user_pref("CT2504091.IsOpenThankYouPage", false);
    Deleted : user_pref("CT2504091.IsOpenUninstallPage", false);
    Deleted : user_pref("CT2504091.LanguagePackLastCheckTime", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylight Ti[...]
    Deleted : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440);
    Deleted : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
    Deleted : user_pref("CT2504091.LastLogin_3.10.0.1", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylight Time)");
    Deleted : user_pref("CT2504091.LatestVersion", "3.10.0.1");
    Deleted : user_pref("CT2504091.Locale", "en-us");
    Deleted : user_pref("CT2504091.MCDetectTooltipHeight", "83");
    Deleted : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
    Deleted : user_pref("CT2504091.MCDetectTooltipWidth", "295");
    Deleted : user_pref("CT2504091.MyStuffEnabledAtInstallation", true);
    Deleted : user_pref("CT2504091.OriginalFirstVersion", "3.10.0.1");
    Deleted : user_pref("CT2504091.SearchCaption", "Web Search");
    Deleted : user_pref("CT2504091.SearchFromAddressBarIsInit", true);
    Deleted : user_pref("CT2504091.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT250[...]
    Deleted : user_pref("CT2504091.SearchInNewTabEnabled", true);
    Deleted : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440);
    Deleted : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Daylight [...]
    Deleted : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
    Deleted : user_pref("CT2504091.SearchProtectorToolbarDisabled", true);
    Deleted : user_pref("CT2504091.SendProtectorDataViaLogin", true);
    Deleted : user_pref("CT2504091.ServiceMapLastCheckTime", "Tue Apr 03 2012 14:43:51 GMT+0100 (GMT Daylight Time[...]
    Deleted : user_pref("CT2504091.SettingsLastCheckTime", "Tue Apr 03 2012 14:43:51 GMT+0100 (GMT Daylight Time)"[...]
    Deleted : user_pref("CT2504091.SettingsLastUpdate", "1331729343");
    Deleted : user_pref("CT2504091.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2504091&SearchSource=13");
    Deleted : user_pref("CT2504091.ThirdPartyComponentsInterval", 504);
    Deleted : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Tue Apr 03 2012 14:43:51 GMT+0100 (GMT Dayligh[...]
    Deleted : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1312887586");
    Deleted : user_pref("CT2504091.ToolbarDisabled", true);
    Deleted : user_pref("CT2504091.ToolbarShrinkedFromSetup", false);
    Deleted : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091");
    Deleted : user_pref("CT2504091.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
    Deleted : user_pref("CT2504091.UserID", "UN49179006037103534");
    Deleted : user_pref("CT2504091.alertChannelId", "897164");
    Deleted : user_pref("CT2504091.autoDisableScopes", -1);
    Deleted : user_pref("CT2504091.backendstorage.cbfirsttime", "5475652041707220303320323031322031343A34333A35362[...]
    Deleted : user_pref("CT2504091.backendstorage.shoppingapp.gk.exipres", "53756E2041707220303820323031322031343A[...]
    Deleted : user_pref("CT2504091.backendstorage.shoppingapp.gk.geolocation", "756E69746564206B696E67646F6D");
    Deleted : user_pref("CT2504091.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
    Deleted : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Tue Apr 03 2012 14:43:52 GMT+0100 (GMT Dayl[...]
    Deleted : user_pref("CT2504091.homepageProtectorEnableByLogin", true);
    Deleted : user_pref("CT2504091.initDone", true);
    Deleted : user_pref("CT2504091.isAppTrackingManagerOn", true);
    Deleted : user_pref("CT2504091.myStuffEnabled", true);
    Deleted : user_pref("CT2504091.myStuffPublihserMinWidth", 400);
    Deleted : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
    Deleted : user_pref("CT2504091.myStuffServiceIntervalMM", 1440);
    Deleted : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
    Deleted : user_pref("CT2504091.navigateToUrlOnSearch", false);
    Deleted : user_pref("CT2504091.revertSettingsEnabled", true);
    Deleted : user_pref("CT2504091.searchProtectorDialogDelayInSec", 10);
    Deleted : user_pref("CT2504091.searchProtectorEnableByLogin", true);
    Deleted : user_pref("CT2504091.testingCtid", "");
    Deleted : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Tue Apr 03 2012 14:43:52 GMT+0100 (GMT Dayli[...]
    Deleted : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Tue Apr 03 2012 14:43:53 GMT+0100 (GMT Dayli[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2504091/CT2504091[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/897164/892962/UK", "\"0\"")[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", [...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091",[...]
    Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
    Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Main PC\\AppData\\Roaming\\Mozilla\[...]
    Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
    Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "");
    Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2504091");
    Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091");
    Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2504091");
    Deleted : user_pref("CommunityToolbar.globalUserId", "5de30a69-ead7-4702-abb3-6dfe4a94c387");
    Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
    Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
    Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2504091");
    Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Tue Apr 03 2012 14:43:5[...]
    Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);
    Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Tue Apr 03 2012 14:44:01 GMT+010[...]
    Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
    Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
    Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
    Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Tue Apr 03 2012 14:43:51 GMT+0100 (G[...]
    Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
    Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
    Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
    Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
    Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
    Deleted : user_pref("CommunityToolbar.notifications.userId", "936cc0e6-6958-4e8f-8fff-5f8291a28547");
    Deleted : user_pref("CommunityToolbar.originalHomepage", "www.google.co.uk");
    Deleted : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]

    *************************

    AdwCleaner[S1].txt - [13978 octets] - [29/10/2012 18:49:54]

    ########## EOF - C:\AdwCleaner[S1].txt - [14039 octets] ##########
     
  2. insound

    insound TS Rookie Topic Starter Posts: 21

    I can't get to the last site, the ESET online scanner. I think the site may be down or at least having difficulties (the frontpage loaded the first time, but the scanning tool didn't. Now neither load).

    Or maybe it is just me. I'll try again in a little while.
     
  3. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Works for me. Try different browser.
     
  4. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    Still with me?
     
  5. Broni

    Broni Malware Annihilator Posts: 47,078   +258

    This topic is marked as abandoned and closed due to inactivity.
    This member will NOT be eligible to receive any more help in malware removal forum.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.