TechSpot

Trojan.agent in svchost.exe

Solved
By Katherine4422
Aug 17, 2012
  1. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    Yay!!
    ADW:
    # AdwCleaner v2.002 - Logfile created 09/16/2012 at 20:11:27
    # Updated 16/09/2012 by Xplode
    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
    # User : Kate - KATE-HP
    # Boot Mode : Normal
    # Running from : C:\Users\Kate\Desktop\adwcleaner.exe
    # Option [Delete]

    ***** [Services] *****

    ***** [Files / Folders] *****

    ***** [Registry] *****
    Key Deleted : HKCU\Software\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    Key Deleted : HKCU\Software\ilivid
    Key Deleted : HKCU\Software\Softonic
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    ***** [Internet Browsers] *****
    -\\ Internet Explorer v9.0.8112.16421
    Restored : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    *************************
    AdwCleaner[R1].txt - [4323 octets] - [11/09/2012 15:02:51]
    AdwCleaner[S1].txt - [4565 octets] - [16/09/2012 20:11:27]
    ########## EOF - C:\AdwCleaner[S1].txt - [4625 octets] ##########
     
  2. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    OTL:
    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User

    User: Kate
    ->Temp folder emptied: 20648428 bytes
    ->Temporary Internet Files folder emptied: 6866065 bytes
    ->Java cache emptied: 1878 bytes
    ->Flash cache emptied: 506 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 512737 bytes

    Total Files Cleaned = 27.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Kate
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: Kate
    ->Java cache emptied: 0 bytes

    User: Public

    Total Java Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.61.5 log created on 09162012_202110
    Files\Folders moved on Reboot...
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\0[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\0[2].htm moved successfully.
    File\Folder C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\bind[1].htm not found!
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\GSYGTYEY\0[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\GSYGTYEY\0[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NR03M464\partner[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NR03M464\partner[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JD9PIZC4\918[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JD9PIZC4\net[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\aclk[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\billboard[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\billboard[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\partner[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AC5Z5FCY\aclk[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AC5Z5FCY\bizo_multi[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
    PendingFileRenameOperations files...
    Registry entries deleted on Reboot...
     
  3. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    Thank you for all your help - I really can't thank you enough. I've downloaded the recommened programs, and will be keeping a closer eye on computer security now. My computer's working lovely, all thanks to you :)
     
  4. Broni

    Broni Malware Annihilator Posts: 47,718   +268

    Way to go!! [​IMG]
    Good luck and stay safe :)
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.