[Robbie E Millner]

iBrightDesktop.exe appeared in my tray. I can't remove it using MalwareBytes or SuperAntispyware. Looks like it puts ads on every webpage I go to. I think it came from a download I thought was for bagpipereader.exe which turned out to be for something called FLVVideo or something.

Got any fixes?

[Advertisements]

Hello Robbie E Millner and welcome to GeeksToGo

I'm GLeobas and I'm going to help you fix your problem.

Please note that I'm currently in training and my posts have to be approved by an expert before I reply.

• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.
• Please do not try to fix anything without being asked
• I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread.
• I am currently reviewing your logs.

[WhiteHat]

Hello Robbie E Millner and welcome to GeeksToGo

I'm GLeobas and I'm going to help you fix your problem.

Please note that I'm currently in training and my posts have to be approved by an expert before I reply.

• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.
• Please do not try to fix anything without being asked
• I suggest you print or save any instructions I give you for easy reference. We may be using Safe mode and you will not always be able to access this thread.
• I am currently reviewing your logs.

[WhiteHat]

# Step 1 #

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  

  :process
  iBrightDesktop.exe
  
  :filefind
  iBrightDesktop.exe

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

# Step 2 #

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• In Extra Registry, select Use SafeList
• Under the Custom Scan box paste this in
  netsvcs
  msconfig
  %SYSTEMDRIVE%\*.*
  %systemdrive%\drivers\*.exe
  %systemroot%\system32\drivers\*.* /90
  %PROGRAMFILES%\*.*
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U /s
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /rs
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /64 /rs
  CREATERESTOREPOINT
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

# Step 3 #


Download aswMBR.exe ( 1.8mB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply

[Robbie E Millner]

The OTL would not download and I got this:

AppName: otl.exe AppVer: 3.2.31.0 ModName: kernel32.dll
ModVer: 5.1.2600.5781 Offset: 00012afb
_______________________________________________

SystemLook 30.07.11 by jpshortstuff
Log created at 12:49 on 12/02/2012 by Robbie
Administrator - Elevation successful

========== process ==========

iBrightDesktop.exe - Unable to open process handle.

- Unable to open process handle.

========== filefind ==========

Searching for "iBrightDesktop.exe"
No files found.

-= EOF =-
________________________________________________
aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software
Run date: 2012-02-12 13:00:26
-----------------------------
13:00:26.796 OS Version: Windows 5.1.2600 Service Pack 3
13:00:26.796 Number of processors: 1 586 0x2F02
13:00:26.796 ComputerName: DESKTOP UserName: Robbie
13:00:37.609 Initialize success
13:01:18.203 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
13:01:18.203 Disk 0 Vendor: ST3120026A 8.01 Size: 114473MB BusType: 3
13:01:18.265 Disk 0 MBR read successfully
13:01:18.265 Disk 0 MBR scan
13:01:18.265 Disk 0 Windows XP default MBR code
13:01:18.281 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 114463 MB offset 63
13:01:18.281 Disk 0 scanning sectors +234420480
13:01:18.406 Disk 0 scanning C:\WINDOWS\system32\drivers
13:01:46.171 Service scanning
13:01:46.937 Service MpKsl790dce0a c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{531BE4A0-85D9-4BEF-A2E4-72224F557533}\MpKsl790dce0a.sys **LOCKED** 32
13:01:47.968 Modules scanning
13:02:17.437 Disk 0 trace - called modules:
13:02:17.453 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
13:02:17.453 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86386ab8]
13:02:17.453 3 CLASSPNP.SYS[f76b0fd7] -> nt!IofCallDriver -> \Device\0000007a[0x862e91a0]
13:02:17.453 5 ACPI.sys[f7547620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x862e5940]
13:02:17.453 Scan finished successfully
13:02:57.937 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Robbie\Desktop\MBR.dat"
13:02:57.968 The log file has been saved successfully to "C:\Documents and Settings\Robbie\Desktop\aswMBR.txt"

[WhiteHat]

Hi,

Try to download OTL with one of those links:

• www.itxassociates.com/OT-Tools/OTL.com
• www.itxassociates.com/OT-Tools/OTL.scr

Next, follow this steps:

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• In Extra Registry, select Use SafeList
• Under the Custom Scan box paste this in
  netsvcs
  msconfig
  %SYSTEMDRIVE%\*.*
  %systemdrive%\drivers\*.exe
  %systemroot%\system32\drivers\*.* /90
  %PROGRAMFILES%\*.*
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U /s
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /rs
  HKLM\SOFTWARE\CLIENTS\Startmenuinternet|command /64 /rs
  CREATERESTOREPOINT
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Edited by GLeobas, 13 February 2012 - 05:13 PM.