also @ TechSpot: Android 4.0: Tracking Ice Cream Sandwich's Availability on Smartphones

TechSpot

[Solved] Trojan virus crypt.aexd removal?

Discussion in 'Virus and Malware Removal' started by quizzr, Jan 30, 2012.

  1. quizzr Newcomer, in training

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe" = C:\Program Files\World of Warcraft\WoW-3.2.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
    "C:\Program Files\World of Warcraft\Launcher.exe" = C:\Program Files\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
    "C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe -- (Flagship Industries, Inc.)
    "C:\Program Files\World of Warcraft\BackgroundDownloader.exe" = C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:BackgroundDownloader -- (Blizzard Entertainment)
    "C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
    "{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
    "{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
    "{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
    "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
    "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
    "{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
    "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
    "{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
    "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
    "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
    "{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
    "{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 285.58
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 285.58
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 135.95
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.11.0621
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
    "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C2425F91-1F7B-4037-9A05-9F290184798D}" = NETGEAR WNA3100 wireless USB 2.0 adapter
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
    "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Free PDF Tablet" = Free PDF Tablet 0.1
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.1.1000
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Security Client" = Microsoft Security Essentials
    "Mozilla Firefox (3.6.25)" = Mozilla Firefox (3.6.25)
    "NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
    "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "winusb0100" = Microsoft WinUsb 1.0
    "World of Warcraft" = World of Warcraft
    "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 8/30/2011 1:10:18 AM | Computer Name = DFXX6GK1 | Source = ESENT | ID = 470
    Description = Catalog Database (1284) Database C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
    is partially attached. Attachment stage: 1. Error: -1032.

    Error - 8/31/2011 12:00:39 PM | Computer Name = DFXX6GK1 | Source = Application Hang | ID = 1002
    Description = Hanging application firefox.exe, version 1.9.2.4232, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 9/13/2011 1:30:48 PM | Computer Name = DFXX6GK1 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: The server name or address could not be resolved

    Error - 9/13/2011 1:30:49 PM | Computer Name = DFXX6GK1 | Source = crypt32 | ID = 131080
    Description = Failed auto update retrieval of third-party root list sequence number
    from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
    with error: This network connection does not exist.

    Error - 9/18/2011 1:41:25 AM | Computer Name = DFXX6GK1 | Source = MPSampleSubmission | ID = 5000
    Description = EventType mptelemetry, P1 0, P2 moaccapability, P3 3.0.8402.0, P4
    0, P5 0, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

    Error - 10/16/2011 12:59:27 AM | Computer Name = DFXX6GK1 | Source = ESENT | ID = 490
    Description = svchost (1096) An attempt to open the file "C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb"
    for read / write access failed with system error 32 (0x00000020): "The process
    cannot access the file because it is being used by another process. ". The open
    file operation will fail with error -1032 (0xfffffbf8).

    Error - 10/16/2011 12:59:27 AM | Computer Name = DFXX6GK1 | Source = ESENT | ID = 470
    Description = Catalog Database (1096) Database C:\WINDOWS\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
    is partially attached. Attachment stage: 3. Error: -1032.

    Error - 11/4/2011 11:40:44 PM | Computer Name = DFXX6GK1 | Source = Bonjour Service | ID = 100
    Description = Client application bug: DNSServiceResolve(BZDN1668942330-QkxaMDAwMl9MRDV0PEZDOENLOEREN0E1UDk5OUQwQg==._bzdn._tcp.local.)
    active for over two minutes. This places considerable burden on the network.

    Error - 11/10/2011 6:01:25 AM | Computer Name = DFXX6GK1 | Source = Application Hang | ID = 1002
    Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 11/27/2011 11:41:12 PM | Computer Name = DFXX6GK1 | Source = MPSampleSubmission | ID = 5000
    Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
    P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
    P8 NIL, P9 NIL, P10 NIL.

    [ System Events ]
    Error - 1/31/2012 5:33:13 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:33:59 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:36:07 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:39:24 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:40:02 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:41:46 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:42:31 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:43:02 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 1/31/2012 5:43:48 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}

    Error - 2/2/2012 2:07:19 PM | Computer Name = DFXX6GK1 | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service SeaPort with
    arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}


    < End of report >
  2. quizzr Newcomer, in training

    I had to break up the Extras.Txt file into separate posts due to image restraints.

    Also, the computer seems to be working better, but Firefox still will not open. I was going to seek the go-ahead before uninstalling and reinstalling.
  3. Broni Malware Annihilator

    If Firefox still doesn't work AFTER running OTL fix listed below....
    Uninstall Firefox completely using this manual: http://kb.mozillazine.org/Uninstalling_Firefox
    Install fresh copy.

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      SRV - File not found [Disabled | Stopped] -- -- (LiveTurbineNetworkService)
      SRV - File not found [Disabled | Stopped] -- -- (LiveTurbineMessageService)
      SRV - File not found [Disabled | Stopped] -- -- (AVG Security Toolbar Service)
      PRC - [2011/12/12 13:02:10 | 000,827,232 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
      MOD - [2011/12/12 13:02:10 | 000,827,232 | ---- | M] () -- C:\Program Files\AVG Secure Search\vprot.exe
      SRV - [2011/12/12 13:02:15 | 000,855,904 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe -- (vToolbarUpdater)
      FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
      FF - prefs.js..extensions.enabledItems: avg@toolbar:9.0.0.18.1
      FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B74010240-18c6-4919-a5fc-724b6bd4c12e%7D&mid=673eb5a2634298266b1eb8818f5e061c-159fe39ce932a5d91e36590ab67d288bc0130b56&ds=AVG&v=9.0.0.18.1&lang=us&pr=fr& d=2011-12-12%2013%3A01%3A56&sap=ku&q="
      FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox
      FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\9.0.0.18\ [2011/12/12 13:02:23 | 000,000,000 | ---D | M]
      [2011/12/12 13:02:23 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18
      File not found (No name found) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
      O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
      O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll ()
      O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll ()
      O3 - HKU\S-1-5-21-3591089480-1478790723-2234277580-1005\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
      O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
      O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll ()
      [2012/01/16 13:12:42 | 000,011,165 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\7b2c1a22
      [2012/01/16 13:10:41 | 000,011,262 | ---- | C] () -- C:\Documents and Settings\LocalService\Application Data\d757730c
      [2012/01/16 13:10:41 | 000,011,165 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\7b2c1a22
      [2012/01/16 12:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Secure Search
      [2010/12/25 00:32:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nPjGb06300
      [2012/01/21 10:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Hailey\Application Data\AVG Secure Search
      [2011/12/22 01:51:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Taylor Bills\Application Data\AVG Secure Search
      
      
      :Services
      
      :Reg
      
      :Files
      C:\Program Files\AVG Secure Search
      
      :Commands
      [purity]
      [emptytemp]
      [emptyjava]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ============================================================

    1. Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    2. Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.
    • Do NOT post JavaRa log.

    ===========================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

    2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.


    3. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    4. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
  4. quizzr Newcomer, in training

    All processes killed
    ========== OTL ==========
    Service LiveTurbineNetworkService stopped successfully!
    Service LiveTurbineNetworkService deleted successfully!
    Service LiveTurbineMessageService stopped successfully!
    Service LiveTurbineMessageService deleted successfully!
    Service AVG Security Toolbar Service stopped successfully!
    Service AVG Security Toolbar Service deleted successfully!
    No active process named vprot.exe was found!
    Service vToolbarUpdater stopped successfully!
    Service vToolbarUpdater deleted successfully!
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\9.0.1\ToolbarUpdater.exe moved successfully.
    Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
    Prefs.js: avg@toolbar:9.0.0.18.1 removed from extensions.enabledItems
    Prefs.js: "http://isearch.avg.com/search?cid=%7B74010240-18c6-4919-a5fc-724b6bd4c12e%7D&mid=673eb5a2634298266b1eb8818f5e061c-159fe39ce932a5d91e36590ab67d288bc0130b56&ds=AVG&v=9.0.0.18.1&lang=us&pr=fr& d=2011-12-12%2013%3A01%3A56&sap=ku&q=" removed from keyword.URL
    File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox not found.
    File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\9.0.0.18\ not found.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\modules\skin folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\modules folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\locale\en-US folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\locale folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\components\FF4 folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\components folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18\chrome folder moved successfully.
    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\9.0.0.18 folder moved successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ deleted successfully.
    C:\Program Files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll moved successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
    File C:\Program Files\AVG Secure Search\9.0.0.18\AVG Secure Search_toolbar.dll not found.
    Registry value HKEY_USERS\S-1-5-21-3591089480-1478790723-2234277580-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully.
    C:\Program Files\AVG Secure Search\vprot.exe moved successfully.
    C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol\ deleted successfully.
    Invalid CLSID key: C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll
    File C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\9.0.1\ViProtocol.dll not found.
    C:\Documents and Settings\All Users\Application Data\7b2c1a22 moved successfully.
    C:\Documents and Settings\LocalService\Application Data\d757730c moved successfully.
    File C:\Documents and Settings\All Users\Application Data\7b2c1a22 not found.
    C:\Documents and Settings\All Users\Application Data\AVG Secure Search\10.0.0.7 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\AVG Secure Search folder moved successfully.
    Folder C:\Documents and Settings\All Users\Application Data\nPjGb06300\ not found.
    C:\Documents and Settings\Hailey\Application Data\AVG Secure Search\cache\tmp folder moved successfully.
    C:\Documents and Settings\Hailey\Application Data\AVG Secure Search\cache folder moved successfully.
    C:\Documents and Settings\Hailey\Application Data\AVG Secure Search folder moved successfully.
    C:\Documents and Settings\Taylor Bills\Application Data\AVG Secure Search\cache\tmp folder moved successfully.
    C:\Documents and Settings\Taylor Bills\Application Data\AVG Secure Search\cache folder moved successfully.
    C:\Documents and Settings\Taylor Bills\Application Data\AVG Secure Search folder moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Program Files\AVG Secure Search\skin folder moved successfully.
    C:\Program Files\AVG Secure Search\radio folder moved successfully.
    C:\Program Files\AVG Secure Search\9.0.0.18\radio folder moved successfully.
    C:\Program Files\AVG Secure Search\9.0.0.18 folder moved successfully.
    C:\Program Files\AVG Secure Search folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->FireFox cache emptied: 5736621 bytes
    ->Flash cache emptied: 434 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: Hailey
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->FireFox cache emptied: 140984476 bytes
    ->Flash cache emptied: 3398 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32835 bytes
    ->Java cache emptied: 37127 bytes
    ->Flash cache emptied: 14256 bytes

    User: NetworkService
    ->Temp folder emptied: 10470 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->Java cache emptied: 38 bytes
    ->Flash cache emptied: 18524 bytes

    User: Taylor Bills
    ->Temp folder emptied: 96787 bytes
    ->Temporary Internet Files folder emptied: 104198811 bytes
    ->Java cache emptied: 5604399 bytes
    ->FireFox cache emptied: 82327079 bytes
    ->Flash cache emptied: 43072 bytes

    User: UpdatusUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1219183 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 9537407 bytes

    Total Files Cleaned = 334.00 mb


    [EMPTYJAVA]

    User: Administrator

    User: All Users

    User: Default User

    User: Hailey

    User: LocalService
    ->Java cache emptied: 0 bytes

    User: NetworkService
    ->Java cache emptied: 0 bytes

    User: Taylor Bills
    ->Java cache emptied: 0 bytes

    User: UpdatusUser

    Total Java Files Cleaned = 0.00 mb


    [EMPTYFLASH]

    User: Administrator
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User

    User: Hailey
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    User: Taylor Bills
    ->Flash cache emptied: 0 bytes

    User: UpdatusUser

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 02032012_011535

    Files\Folders moved on Reboot...
    File\Folder C:\WINDOWS\temp\TMP00000002CC74528AFAF5986E not found!

    Registry entries deleted on Reboot...


    Results of screen317's Security Check version 0.99.24
    Windows XP Service Pack 3 x86
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    Microsoft Security Essentials
    Antivirus up to date!
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Spybot - Search & Destroy
    Java(TM) 6 Update 30
    Out of date Java installed!
    Adobe Flash Player ( 10.3.183.11) Flash Player Out of Date!
    Mozilla Firefox (3.6.25) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Windows Defender MSMpEng.exe
    Microsoft Security Essentials msseces.exe
    Microsoft Security Client Antimalware MsMpEng.exe
    ``````````End of Log````````````


    Farbar Service Scanner Version: 02-02-2012
    Ran by Taylor Bills (administrator) on 03-02-2012 at 01:32:21
    Microsoft Windows XP Professional Service Pack 3 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ===========

    File Check:
    ========
    C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
    C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
    C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
    C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
    C:\WINDOWS\system32\netman.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\srsvc.dll => MD5 is legit
    C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
    C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
    C:\WINDOWS\system32\qmgr.dll => MD5 is legit
    C:\WINDOWS\system32\es.dll => MD5 is legit
    C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
    C:\WINDOWS\system32\svchost.exe => MD5 is legit
    C:\WINDOWS\system32\rpcss.dll => MD5 is legit
    C:\WINDOWS\system32\services.exe => MD5 is legit

    Extra List:
    =======
    Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
    0x080000000400000001000000020000000300000056000000050000000600000007000000
    IpSec Tag value is correct.

    **** End of log ****

    C:\TDSSKiller_Quarantine\31.01.2012_12.20.59\mbr0000\tdlfs0000\tsk0006.dta Win32/Olmarik.AWO trojan
  5. Broni Malware Annihilator

    Update Adobe Flash Player
    Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

    =============================================================

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
    :Commands
    [purity]
    [emptytemp]
    [EMPTYFLASH]
    [emptyjava]
    [CLEARALLRESTOREPOINTS]
    [Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. (Windows XP only) Run defrag at your convenience.

    11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

    12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    13. Please, let me know, how your computer is doing.
  6. quizzr Newcomer, in training

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Hailey
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 2384 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Taylor Bills
    ->Temp folder emptied: 489 bytes
    ->Temporary Internet Files folder emptied: 6718753 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 405 bytes

    User: UpdatusUser
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 2093 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 6.00 mb


    [EMPTYFLASH]

    User: Administrator
    ->Flash cache emptied: 0 bytes

    User: All Users

    User: Default User

    User: Hailey
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    User: Taylor Bills
    ->Flash cache emptied: 0 bytes

    User: UpdatusUser

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYJAVA]

    User: Administrator

    User: All Users

    User: Default User

    User: Hailey

    User: LocalService
    ->Java cache emptied: 0 bytes

    User: NetworkService
    ->Java cache emptied: 0 bytes

    User: Taylor Bills
    ->Java cache emptied: 0 bytes

    User: UpdatusUser

    Total Java Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.31.0 log created on 02032012_132851

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Taylor Bills\Local Settings\Temporary Internet Files\Content.IE5\G8RATCVN\topic176870-2[1].html moved successfully.
    C:\Documents and Settings\Taylor Bills\Local Settings\Temporary Internet Files\Content.IE5\89MNOPE3\partner[1].htm moved successfully.
    C:\Documents and Settings\Taylor Bills\Local Settings\Temporary Internet Files\Content.IE5\678RJKU4\918[1].htm moved successfully.

    Registry entries deleted on Reboot...
  7. quizzr Newcomer, in training

    What is this that the ESET Scanner found?

    C:\TDSSKiller_Quarantine\31.01.2012_12.20.59\mbr0000\tdlfs0000\tsk0006.dta Win32/Olmarik.AWO trojan
  8. Broni Malware Annihilator

    It was already quarantined by TDSSKiller previously.
    Nothing to worry about.

  9. Broni Malware Annihilator

    The issue seems to be resolved.