also @ TechSpot: Google, NASA join forces to build quantum computing laboratory

Hi, I have a couple trojans and can't get rid of them

Discussion in 'Virus and Malware Removal' started by CyberNerd, Dec 12, 2012.

Page 2 of 2

  1. Jay Pfoutz Malware Helper Posts: 4,286   +49

    How did it work out, for you or your girlfriend on the scan?
    Jay Pfoutz, Dec 20, 2012
    #21

  2. CyberNerd Newcomer, in training Posts: 16

    Hey, sorry for taking ages to reply, I ended up not having a functional computer at my parent's house to use, and my girlfriend ended up coming with me there instead of to my house.
    I will run the scan now and see what the end result is. I've noticed though when I turn on the computer every time there's some program called regcleanpro that comes on and does a scan of my pc. is this a legit program or something else dodgy?
    CyberNerd, Dec 30, 2012
    #22

  3. CyberNerd Newcomer, in training Posts: 16

    Alrighty, Well I ran the thing once and as I last saw it 7 threats were found, but then I had to go out. When I got back my friend stepped on the plug and turned off ym computer before I could save a report or anything so I have now ran the scanner again and this time it only found and removed one threat.

    This is the file it exported:

    C:\$RECYCLE.BIN\S-1-5-21-4103919597-2999294590-3050275627-1000\$RR2EJC0.exea variant of Win32/Adware.Trymedia.A applicationcleaned by deleting - quarantined
    CyberNerd, Dec 30, 2012
    #23

  4. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Let's do the following please...since it's been so long:

    Hitman Pro

    Please download Hitman Pro

    • After the download completes please double click the program to run it.
    • Accept the terms of the license agreement and click Next
    • Let the scan run. It will not take long
    • When the scan finishes, and all the files have been uploaded to the Scan Cloud, click Next
    • Click Next again. At the bottom left you will see Export Scan Results To XML File. Click that and save it in a convenient location
    • Upload log.xml here for review please
    Jay Pfoutz, Dec 30, 2012
    #24

  5. CyberNerd Newcomer, in training Posts: 16

    Downloaded and ran the program, I used the 30 day free licence for it.

    Here is the log:
    HitmanPro 3.7.0.185
    www.hitmanpro.com

    Computer name . . . . : STEAMSERVER-X
    Windows . . . . . . . : 6.1.1.7601.X64/4
    User name . . . . . . : SteamServer-X\Brendan
    UAC . . . . . . . . . : Enabled
    License . . . . . . . : Trial (30 days left)

    Scan date . . . . . . : 2012-12-31 15:47:53
    Scan mode . . . . . . : Normal
    Scan duration . . . . : 5m 2s
    Disk access mode . . : Direct disk access (SRB)
    Cloud . . . . . . . . : Internet
    Reboot . . . . . . . : No

    Threats . . . . . . . : 1
    Traces . . . . . . . : 104

    Objects scanned . . . : 1,713,256
    Files scanned . . . . : 57,651
    Remnants scanned . . : 575,552 files / 1,080,053 keys

    Malware _____________________________________________________________________

    C:\$RECYCLE.BIN\S-1-5-21-4103919597-2999294590-3050275627-1000\$RWOVIZ1\Setup_MagicISO.exe -> Quarantined
    Size . . . . . . . : 3,083,776 bytes
    Age . . . . . . . : 2.0 days (2012-12-29 15:04:09)
    Entropy . . . . . : 8.0
    SHA-256 . . . . . : 9447B7A609A420FCACAC265314284A26B3C1269ECAA7D0206CA2478800D6B697
    Description . . . :
    Version . . . . . : 0.0.0.0
    Copyright . . . . :
    > Ikarus . . . . . . : Trojan.Crypt!IK
    Fuzzy . . . . . . : 116.0


    Cookies _____________________________________________________________________

    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:112.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:247realmedia.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad-emea.doubleclick.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.directrev.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.propellerads.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yabuka.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adbrite.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adlegend.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ad4game.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.audience2media.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.bleepingcomputer.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.creative-serving.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.intergi.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.lanistaads.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.lzjl.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ookla.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.p161.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.undertone.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.videohub.tv
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserver.adreactor.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adserver.adtechus.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechus.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:adviva.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ar.atwola.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:atwola.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:bmuk.burstnet.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:burstnet.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:c.atdmt.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:c1.atdmt.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:checkngo.122.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:clickbank.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:cms.ad.yieldmanager.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:collective-media.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:dg.specificclick.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:dmtracker.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:eas.apm.emediate.eu
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:emjcd.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:eset.122.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:h.atdmt.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:interclick.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ipcmedia.122.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:kontera.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:mm.chitika.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:mswmwpapolloprod.122.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:mtvn.112.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:muk.247realmedia.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:myroitracking.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:eek:asn-en1.247realmedia.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:paypal.112.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:questionmarket.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:rts.pgmediaserve.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:server.cpmstar.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:specificclick.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ssp-csync.smartadserver.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:stat.dealtime.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:stats.paypal.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:studiocom.122.2o7.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.at.atwola.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:uk.at.atwola.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:uk.sitestat.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww251.smartadserver.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.burstnet.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.smartadserver.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:www4.smartadserver.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:xiti.com
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:yadro.ru
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:yieldmanager.net
    C:\Users\Brendan\AppData\Local\Google\Chrome\User Data\Default\Cookies:zedo.com
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\3DBQK9L0.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\50HV12LL.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\LIQP7940.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\R7ILYD7L.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\VNHLD953.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\WK9WWNKS.txt
    C:\Users\Brendan\AppData\Roaming\Microsoft\Windows\Cookies\YQASO8SO.txt
    CyberNerd, Dec 31, 2012
    #25

  6. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Any more issues?

    We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

    Many of the things to note for us would be:

    • Slow computer
    • Error messages
    • Fake antivirus alerts or the icon in the system tray
    • svchost.exe running at 100%
    • System crashes or blue screen of death

    Note: Absence of issues does not mean that you're protected in the future.
    Jay Pfoutz, Dec 31, 2012
    #26
     

  7. CyberNerd Newcomer, in training Posts: 16

    Not really any other issues that I noticed, there's still this RegCleanPro thing coming on each time I turn on my pc which is new since I got back and it looks like adware but I've uninstalled it so hopefully it wasn't anything actually malicious.

    Chrome takes a strangely long time to close though. I have a lot of tabs open at any time usually around 6-10 but it never used to take as long as it does now, I'll hit the x and it seems to take almost twice as long as it used to, to close.
    CyberNerd, Jan 1, 2013
    #27

  8. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Just remove that from your Programs list, should be fine. It's a safe program, but Registry Cleaners are bad news.

    Is Chrome Updated? We'll find out...


    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

    To manually create a new Restore Point
    • Go to Control Panel and select System and Maintenance
    • Select System
    • On the left select Advance System Settings and accept the warning if you get one
    • Select System Protection Tab
    • Select Create at the bottom
    • Type in a name I.e. Clean
    • Select Create


    Remove tools, temp files, old Restore Points

    Please run OTL
    • Under the Custom Scans/Fixes box at the bottom, copy and paste in the following:

    • Then click the Run Fix button at the top.
    • Note: The fix for OTL sometimes hides your Desktop and Start menu so the cleanup can be completed. Do not be alerted, as this is normal.
    • It may open a log for you, but I don't need that.

    To remove all of the tools we used and the files and folders they created do the following:
    Double click OTL.exe.
    • Click the CleanUp button.
    • Select Yes when the "Begin cleanup Process?" prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.


    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    Jay Pfoutz, Jan 1, 2013
    #28

  9. Jay Pfoutz Malware Helper Posts: 4,286   +49

    Topic marked solved.
    Jay Pfoutz, Jan 6, 2013
    #29
Page 2 of 2
Topic Status:
Not open for further replies.

Add New Comment

Social Login & Guest Posting

TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.