TechSpot

Trojan.agent in svchost.exe

By Katherine4422
Aug 17, 2012
  1. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    Yay!!
    ADW:
    # AdwCleaner v2.002 - Logfile created 09/16/2012 at 20:11:27
    # Updated 16/09/2012 by Xplode
    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
    # User : Kate - KATE-HP
    # Boot Mode : Normal
    # Running from : C:\Users\Kate\Desktop\adwcleaner.exe
    # Option [Delete]

    ***** [Services] *****

    ***** [Files / Folders] *****

    ***** [Registry] *****
    Key Deleted : HKCU\Software\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    Key Deleted : HKCU\Software\ilivid
    Key Deleted : HKCU\Software\Softonic
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
    ***** [Internet Browsers] *****
    -\\ Internet Explorer v9.0.8112.16421
    Restored : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
    *************************
    AdwCleaner[R1].txt - [4323 octets] - [11/09/2012 15:02:51]
    AdwCleaner[S1].txt - [4565 octets] - [16/09/2012 20:11:27]
    ########## EOF - C:\AdwCleaner[S1].txt - [4625 octets] ##########
     
  2. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    OTL:
    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User

    User: Kate
    ->Temp folder emptied: 20648428 bytes
    ->Temporary Internet Files folder emptied: 6866065 bytes
    ->Java cache emptied: 1878 bytes
    ->Flash cache emptied: 506 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 512737 bytes

    Total Files Cleaned = 27.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: Kate
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYJAVA]

    User: All Users

    User: Default

    User: Default User

    User: Kate
    ->Java cache emptied: 0 bytes

    User: Public

    Total Java Files Cleaned = 0.00 mb

    Restore point Set: OTL Restore Point

    OTL by OldTimer - Version 3.2.61.5 log created on 09162012_202110
    Files\Folders moved on Reboot...
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\0[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\0[2].htm moved successfully.
    File\Folder C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\Q3POBP0T\bind[1].htm not found!
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\GSYGTYEY\0[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5\GSYGTYEY\0[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NR03M464\partner[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\NR03M464\partner[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JD9PIZC4\918[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\JD9PIZC4\net[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\aclk[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\billboard[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\billboard[2].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CQRIPCG7\partner[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AC5Z5FCY\aclk[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AC5Z5FCY\bizo_multi[1].htm moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
    C:\Users\Kate\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
    PendingFileRenameOperations files...
    Registry entries deleted on Reboot...
     
  3. Katherine4422

    Katherine4422 TS Rookie Topic Starter Posts: 18

    Thank you for all your help - I really can't thank you enough. I've downloaded the recommened programs, and will be keeping a closer eye on computer security now. My computer's working lovely, all thanks to you :)
     
  4. Broni

    Broni Malware Annihilator Posts: 52,747   +342

    Way to go!! [​IMG]
    Good luck and stay safe :)
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...