Search engine redirect and system tray icons not reappearing

Inactive
By msmall10
Dec 31, 2010
Topic Status:
Not open for further replies.
  1. msmall10

    msmall10 Newcomer, in training Topic Starter Posts: 44

    C:\Documents and Settings\matt small\Documents\anywherets_installer\setup.EXE a variant of Win32/TFTPD32.B application
    C:\Program Files\AnywhereTS\srv\tftpd32.exe a variant of Win32/TFTPD32.B application
    C:\Users\matt small\Documents\anywherets_installer\setup.EXE a variant of Win32/TFTPD32.B application
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\ehep0.jar a variant of Java/TrojanDownloader.Agent.NAL trojan
    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner.ocx - registred OK
    # version=7
    # plugin-container.exe=1.9.2.13
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=eb83c9ce817ac54ab89fa3e4d56f56ec
    # end=finished
    # remove_checked=false
    # archives_checked=true
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-01-05 09:54:19
    # local_time=2011-01-05 04:54:19 (-0500, Eastern Standard Time)
    # country="United States"
    # lang=1033
    # osver=6.1.7600 NT
    # compatibility_mode=2560 16777215 100 0 0 0 0 0
    # compatibility_mode=5893 16776574 100 94 3726552 45740588 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=393459
    # found=12
    # cleaned=0
    # scan_time=25463
    C:\Documents and Settings\All Users\Application Data\VistaCodecs\{485E22DC-9EFE-4E26-AAA2-792BB0784D74}\Vista Codec Package.msi Win32/Packed.Autoit.C.Gen application (unable to clean) 00000000000000000000000000000000 I
    C:\Documents and Settings\All Users\VistaCodecs\{485E22DC-9EFE-4E26-AAA2-792BB0784D74}\Vista Codec Package.msi Win32/Packed.Autoit.C.Gen application (unable to clean) 00000000000000000000000000000000 I
    C:\Documents and Settings\matt small\Downloads\registrybooster(2).exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
    C:\Program Files\Uniblue\RegistryBooster\Launcher.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
    C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
    C:\ProgramData\VistaCodecs\{485E22DC-9EFE-4E26-AAA2-792BB0784D74}\Vista Codec Package.msi Win32/Packed.Autoit.C.Gen application (unable to clean) 00000000000000000000000000000000 I
    C:\Programs&Games\Microsoft Office 2010 Activator [KMS Activator] - www.GuruFuel.com.rar a variant of Win32/HackKMS.A application (unable to clean) 00000000000000000000000000000000 I
    C:\Programs&Games\Sony Vegas Pro 9 + Crack and KeyGen.rar a variant of Win32/Keygen.AR application (unable to clean) 00000000000000000000000000000000 I
    C:\Users\All Users\Application Data\VistaCodecs\{485E22DC-9EFE-4E26-AAA2-792BB0784D74}\Vista Codec Package.msi Win32/Packed.Autoit.C.Gen application (unable to clean) 00000000000000000000000000000000 I
    C:\Users\All Users\VistaCodecs\{485E22DC-9EFE-4E26-AAA2-792BB0784D74}\Vista Codec Package.msi Win32/Packed.Autoit.C.Gen application (unable to clean) 00000000000000000000000000000000 I
    C:\Users\matt small\Downloads\registrybooster(2).exe Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\ehep0.jar a variant of Java/TrojanDownloader.Agent.NAL trojan (unable to clean) 00000000000000000000000000000000 I
    # version=7
    # plugin-container.exe=1.9.2.13
    # OnlineScanner.ocx=1.0.0.6419
    # api_version=3.0.2
    # EOSSerial=eb83c9ce817ac54ab89fa3e4d56f56ec
    # end=finished
    # remove_checked=false
    # archives_checked=true
    # unwanted_checked=true
    # unsafe_checked=true
    # antistealth_checked=true
    # utc_time=2011-01-10 10:58:35
    # local_time=2011-01-10 05:58:35 (-0500, Eastern Standard Time)
    # country="United States"
    # lang=1033
    # osver=6.1.7600 NT
    # compatibility_mode=2560 16777215 100 0 0 0 0 0
    # compatibility_mode=5893 16776574 100 94 4162992 46177028 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=410909
    # found=4
    # cleaned=0
    # scan_time=24880
    C:\Documents and Settings\matt small\Documents\anywherets_installer\setup.EXE a variant of Win32/TFTPD32.B application (unable to clean) 00000000000000000000000000000000 I
    C:\Program Files\AnywhereTS\srv\tftpd32.exe a variant of Win32/TFTPD32.B application (unable to clean) 00000000000000000000000000000000 I
    C:\Users\matt small\Documents\anywherets_installer\setup.EXE a variant of Win32/TFTPD32.B application (unable to clean) 00000000000000000000000000000000 I
    C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV\ehep0.jar a variant of Java/TrojanDownloader.Agent.NAL trojan (unable to clean) 00000000000000000000000000000000 I
  2. crunchie

    crunchie Malware Helper Posts: 761

    Looks like you have posted two logs there. The 2nd log is the latest.

    Are you able to manually delete the files found?
    If not, let me know and we will use one of the tools to delete them.
  3. msmall10

    msmall10 Newcomer, in training Topic Starter Posts: 44

    i deleted the last 4 things. Good so far.
  4. crunchie

    crunchie Malware Helper Posts: 761

    No worries. Just give it a couple of days then let me know how it is.
  5. msmall10

    msmall10 Newcomer, in training Topic Starter Posts: 44

    the explorer.exe crashed two times today.
  6. crunchie

    crunchie Malware Helper Posts: 761

  7. msmall10

    msmall10 Newcomer, in training Topic Starter Posts: 44

    I wasn't on the computer yesterday, so no crashes i know of. I ran the scan, but it came up empty again.
  8. crunchie

    crunchie Malware Helper Posts: 761

    Sorry for the late reply. How is it going?
  9. msmall10

    msmall10 Newcomer, in training Topic Starter Posts: 44

    Nothing has crashed and it seems to be running fine. thanks again for the help and ill let you know if anything comes up.
  10. crunchie

    crunchie Malware Helper Posts: 761

    Good news :).

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC by OldTimer:
    Save it to your Desktop.
    Double click OTC.exe.
    Click the CleanUp! button.
    If you are prompted to Reboot during the cleanup, select Yes. The tool will delete itself once it finishes.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.