[tyler4402]

Hi, I have tried several different online instructions to remove the mocaflix.com search bar which is said to be a virus started from a trojan?
Most of the online instructions are to delete the values of the virus but when I follow them through for example HKCU\Software\Microsoft\Windows\Current Version\Internet\ Settings etc the last important value which needs to be deleted is missing.
Can anybody guide me through the process of zapping websearch.mocaflix.com? Thanks Robert.

[Advertisements]

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.




I need to get some reports to get a base to start from so I need you to run these programs first.


-DeFogger-

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


-Security Check-

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

• Please download DDS from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs

• In your next post I need the following
  
  
• both reports from DDS
• report from security check
• let me know of any problems you may have had

Gringo

[gringo_pr]

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.




I need to get some reports to get a base to start from so I need you to run these programs first.


-DeFogger-

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


-Security Check-

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

• Please download DDS from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs

• In your next post I need the following
  
  
• both reports from DDS
• report from security check
• let me know of any problems you may have had

Gringo

[tyler4402]

Hi Gringo, thanks for your reply and help, I hope that I have appended what you need, unfortunately the DDS Process opened and the blue line went quickly up for three quarters of the slide and stopped, the DDS Process then ran for 20 minutes so I stopped the Avast AV and the Comodo firewall for another 5 minutes but after 25 mins the program did not finish, I did try to open it again and a note said that the program was already running, it just seems to be frozen.

After the defogger finished there was no request to re-boot so I just closed down the finished box, but I must have clicked it off without re-enabling the drivers, will they re-enable themselves when I boot up the PC in the morning? or is there a way to do it when you tell me its ok to do so, regards Robert.

Ps After writing this note I just checked the DDS and it has not moved in 45 minutes.

Attached Files

•  defogger_disable.log   474bytes   71 downloads
•  checkup.txt   1.39KB   65 downloads

[tyler4402]

Hi Sorry in my haste I attached, here is the copy:-), the DDS is still frozen, regards Robert.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:45 on 21/11/2012 (Robert)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Results of screen317's Security Check version 0.99.54
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
Out of date HijackThis installed!
Spybot - Search & Destroy
SUPERAntiSpyware
Secunia PSI (3.0.0.2004)
Malwarebytes Anti-Malware version 1.65.0.1400
HijackThis 2.0.2
CCleaner
Auslogics Registry Cleaner
JavaFX 2.1.0
Java™ 7 Update 1
Java 7 Update 9
Adobe Flash Player 11.5.502.110
Google Chrome 21.0.1180.83
Google Chrome 21.0.1180.89
Google Chrome 22.0.1229.79
Google Chrome 22.0.1229.92
Google Chrome 22.0.1229.94
Google Chrome 23.0.1271.64
````````Process Check: objlist.exe by Laurent````````
WinPatrol winpatrol.exe is disabled!
Spybot Teatimer.exe is disabled!
Comodo Firewall cmdagent.exe
Comodo Firewall cfp.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive I: 0%
````````````````````End of Log``````````````````````

[gringo_pr]

Hello


These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.


-AdwCleaner-

• Please download AdwCleaner by Xplode onto your desktop.
  
• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

--RogueKiller--

• Download & SAVE to your Desktop RogueKiller or from here
  
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or Windows 7, right-click and select "Run as Administrator to start"
• For Windows XP, double-click to start.
• Wait until Prescan has finished ...
• Then Click on "Scan" button
• Wait until the Status box shows "Scan Finished"
• click on "delete"
• Wait until the Status box shows "Deleting Finished"
• Click on "Report" and copy/paste the content of the Notepad into your next reply.
• The log should be found in RKreport[1].txt on your Desktop
• Exit/Close RogueKiller+

Gringo

[tyler4402]

RogueKiller V8.3.1 [Nov 22 2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Website: http://tigzy.geeksto...roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Robert [Admin rights]
Mode : Remove -- Date : 11/22/2012 10:26:55

¤¤¤ Bad processes : 2 ¤¤¤
[SUSP PATH] Dit.exe -- I:\Windows\Dit.exe -> KILLED [TermProc]
[SUSP PATH] DitExp.exe -- I:\Windows\DitExp.exe -> KILLED [TermProc]

¤¤¤ Registry Entries : 12 ¤¤¤
[STARTUP][SUSP PATH] TalkTalk Setup CD Reporting Tool.exe @Robert : I:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TalkTalk Setup CD Reporting Tool.exe ->
[DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{9547F408-0CEE-42E5-87F0-D38FB133271B} : NameServer (8.26.56.26,156.154.70.22) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet001\Services\Interfaces\{A2674B42-430A-4A43-B95D-B6A5F751A3A8} : NameServer (8.26.56.26,156.154.70.22) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{9547F408-0CEE-42E5-87F0-D38FB133271B} : NameServer (8.26.56.26,156.154.70.22) -> NOT REMOVED, USE DNSFIX
[DNS] HKLM\[...]\ControlSet002\Services\Interfaces\{A2674B42-430A-4A43-B95D-B6A5F751A3A8} : NameServer (8.26.56.26,156.154.70.22) -> NOT REMOVED, USE DNSFIX
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
[HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> I:\Windows\system32\drivers\etc\hosts



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3250820ACE ATA Device +++++
--- User ---
[MBR] 7ec8aa0f1970bbacacdd273e1c780511
[BSP] ee8e0cbbf9eba302cc9fba8367922ba4 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 238464 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Maxtor 6L080L0 ATA Device +++++
--- User ---
[MBR] 31565af3f013f79202cef4640ff4f8a7
[BSP] 219d2e31b5ed9556cf3f6497407c62fe : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 78152 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive2: ST3500418AS ATA Device +++++
--- User ---
[MBR] 2c083f56d679851928ee898ec7421f47
[BSP] bb9f78f2523a8e3d56d167045cba4160 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2]_D_11222012_02d1026.txt >>
RKreport[1]_S_11222012_02d1024.txt ; RKreport[2]_D_11222012_02d1026.txt


# AdwCleaner v2.008 - Logfile created 11/22/2012 at 10:15:41
# Updated 17/11/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : Robert - BLACKBESS
# Boot Mode : Normal
# Running from : I:\Users\Robert\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Application Updater

***** [Files / Folders] *****

File Deleted : I:\user.js
Folder Deleted : I:\Program Files\Application Updater
Folder Deleted : I:\Program Files\TotalRecipeSearch_14EI
Folder Deleted : I:\Program Files\Windows iLivid Toolbar
Folder Deleted : I:\ProgramData\~0
Folder Deleted : I:\ProgramData\boost_interprocess
Folder Deleted : I:\ProgramData\bProtector
Folder Deleted : I:\ProgramData\InstallMate
Folder Deleted : I:\ProgramData\Premium
Folder Deleted : I:\Users\Robert\AppData\Local\Ilivid
Folder Deleted : I:\Users\Robert\AppData\Local\Ilivid Player
Folder Deleted : I:\Users\Robert\AppData\Local\OpenCandy
Folder Deleted : I:\Users\Robert\AppData\LocalLow\Application Updater
Folder Deleted : I:\Users\Robert\AppData\LocalLow\PriceGong
Folder Deleted : I:\Users\Robert\AppData\LocalLow\Search Settings
Folder Deleted : I:\Users\Robert\AppData\LocalLow\Searchqutoolbar
Folder Deleted : I:\Users\Robert\AppData\LocalLow\Toolbar4
Folder Deleted : I:\Users\Robert\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKLM\Software\Application Updater
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler
Key Deleted : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0016912.BHO
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0016912.BHO.1
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0016912.Sandbox
Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0016912.Sandbox.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6E4C89CF-3061-4EE4-B22A-B7A8AAEA5CB3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Key Deleted : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO
Key Deleted : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO.1
Key Deleted : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl
Key Deleted : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl.1
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Key Deleted : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Key Deleted : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{8B3372D0-09F0-41A5-8D9B-134E148672FB}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
Key Deleted : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook
Key Deleted : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Searchqu Toolbar
Key Deleted : HKLM\Software\Search Settings
Key Deleted : HKLM\Software\SearchquMediabarTb
Key Deleted : HKLM\Software\TotalRecipeSearch_14EI
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16443

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://blekko.com/ws/?source=5691efc7&tbp=tab&u= --> hxxp://www.google.com

-\\ Mozilla Firefox v [Unable to get version]

Profile name : default
File : I:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\ju1fxsg5.default\prefs.js

I:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\ju1fxsg5.default\user.js ... Deleted !

Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationThankYouPage", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationTime", 1349106517);
Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationUserSettings.searchUserConifrmation", fal[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationUserSettings.setHomepage", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationUserSettings.setNewTab", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.InstallationUserSettings.setSearch", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.active", true);
Deleted : user_pref("extensions.crossriderapp16912.16912.addressbar", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.backgroundjs", "\n\n/********************************[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.backgroundver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.can_run_bg_code", true);
Deleted : user_pref("extensions.crossriderapp16912.16912.certdomaininstaller", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.changeprevious", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.cookie.InstallationTime.expiration", "Fri Feb 01 2030[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.cookie.InstallationTime.value", "1349106517");
Deleted : user_pref("extensions.crossriderapp16912.16912.cookie.InstallerParams.expiration", "Fri Feb 01 2030 [...]
Deleted : user_pref("extensions.crossriderapp16912.16912.description", "Update and optimize your installation"[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.domain", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.enablesearch", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.fbremoteurl", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.group", 0);
Deleted : user_pref("extensions.crossriderapp16912.16912.homepage", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.iframe", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.InstallerIdentifiers.expiration", "Fri Feb[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.InstallerIdentifiers.value", "%7B%22instal[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_appVer.expiration", "Fri Feb 01 [...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_appVer.value", "13");
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_lastVersion.expiration", "Fri Fe[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_lastVersion.value", "0");
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_meta.expiration", "Fri Feb 01 20[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_meta.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_nextCheck.expiration", "Sat Oct [...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_nextCheck.value", "true");
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_queue.expiration", "Fri Feb 01 2[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_queue.value", "%7B%7D");
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_remote_resources.expiration", "F[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.internaldb.Resources_remote_resources.value", "%7B%22[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.js", "\n\n /****************************************[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.manifesturl", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.name", "Installation Assistant");
Deleted : user_pref("extensions.crossriderapp16912.16912.newtab", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.opensearch", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_1.code", "appAPI._cr_config={appID:fun[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_1.name", "base");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_1.ver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_13.code", "(function(a){a.selectedText[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_13.name", "CrossriderAppUtils");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_13.ver", 2);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_14.code", "if(typeof(appAPI)===\"undef[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_14.name", "CrossriderUtils");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_14.ver", 2);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_15.code", "(function(f){var u={};var e[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_15.name", "FacebookFFIE");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_15.ver", 1);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_16.code", "(function(f,b){if(typeof(b)[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_16.name", "FFAppAPIWrapper");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_16.ver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_17.code", "if(typeof window!==\"undefi[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_17.name", "jQuery");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_17.ver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_21.code", "var CrossriderDebugManager=[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_21.name", "debug");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_21.ver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_22.code", "(function(a){appAPI.queueMa[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_22.name", "resources");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_22.ver", 2);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_28.code", "var CrossriderInitializerPl[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_28.name", "initializer");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_28.ver", 2);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_4.code", "/*! jQuery v1.7.1 jquery.com[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_4.name", "jquery_1_7_1");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_4.ver", 3);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_47.code", "(function(){appAPI.ready=fu[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_47.name", "resources_background");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins.plugin_47.ver", 1);
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins_lists.plugins_0", "17,14,16,47");
Deleted : user_pref("extensions.crossriderapp16912.16912.plugins_lists.plugins_1", "17,14,13,16,15,4,1,21,22,2[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.pluginsurl", "hxxp://app-static.crossrider.com/plugin[...]
Deleted : user_pref("extensions.crossriderapp16912.16912.pluginsversion", 1);
Deleted : user_pref("extensions.crossriderapp16912.16912.publisher", "Installation Assistant");
Deleted : user_pref("extensions.crossriderapp16912.16912.searchstatus", 0);
Deleted : user_pref("extensions.crossriderapp16912.16912.setnewtab", false);
Deleted : user_pref("extensions.crossriderapp16912.16912.settingsurl", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.thankyou", "");
Deleted : user_pref("extensions.crossriderapp16912.16912.updateinterval", 360);
Deleted : user_pref("extensions.crossriderapp16912.16912.ver", 13);
Deleted : user_pref("extensions.crossriderapp16912.adsOldValue", -1);
Deleted : user_pref("extensions.crossriderapp16912.apps", "16912");
Deleted : user_pref("extensions.crossriderapp16912.bic", "13a1d084324e72c192bfabc6e7f06e8f");
Deleted : user_pref("extensions.crossriderapp16912.cid", 16912);
Deleted : user_pref("extensions.crossriderapp16912.firstrun", false);
Deleted : user_pref("extensions.crossriderapp16912.hadappinstalled", true);
Deleted : user_pref("extensions.crossriderapp16912.installationdate", 1349106812);
Deleted : user_pref("extensions.crossriderapp16912.lastcheck", 22511215);
Deleted : user_pref("extensions.crossriderapp16912.lastcheckitem", 22511215);
Deleted : user_pref("extensions.crossriderapp16912.modetype", "production");
Deleted : user_pref("extensions.crossriderapp16912.reportInstall", true);
Deleted : user_pref("extensions.enabledAddons", "[email protected]:0.85.12,{CAFEEFAC-0017-0000[...]
Deleted : user_pref("extensions.spamfreesearch.dspNew", "blekko");
Deleted : user_pref("extensions.spamfreesearch.hmpgUrl", "hxxp://blekko.com/ws/?source=5691efc7&tbp=homepage&u[...]
Deleted : user_pref("extensions.spamfreesearch.hpNew", "hxxp://blekko.com/ws/?source=5691efc7&tbp=homepage&u=0[...]
Deleted : user_pref("extensions.spamfreesearch.keyWordUrl", "hxxp://blekko.com/ws/?source=5691efc7&tbp=rbox&u=[...]
Deleted : user_pref("extensions.spamfreesearch.prtnrId", "blekko");
Deleted : user_pref("extensions.spamfreesearch.srchPrvdr", "blekko");
Deleted : user_pref("extensions.spamfreesearch.tlbrSrchUrl", "hxxp://blekko.com/ws/?source=5691efc7&tbp=main&u[...]

-\\ Google Chrome v [Unable to get version]

File : I:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Opera v [Unable to get version]

File : I:\Users\Robert\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [21987 octets] - [22/11/2012 10:15:41]

########## EOF - I:\AdwCleaner[S1].txt - [22048 octets] ##########

Hi Gringo, hope this helps, regards Robert.

[gringo_pr]

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

[tyler4402]

Hi Gringo, I started Combo Fix but after a few moments I got a Warning of “ Error saving file” continue with next file? Etc, I clicked (No) and the run commenced.

Then I got another box with Pev.3XE has stopped working, “Check on line to” etc (I do seem to be getting a lot of these warnings about programs not working, usually I click off the warning and the prog continues)

A little later a catchme.log was produced, but the PC did not reboot, next I tried running ComboFix again and I got the same warnings except this time with the Error saving file warning,I clicked (Yes) and each file in turn could not be saved.

There was also another box with a RootKit activity warning, and asked me to jot down the files as follows
All starting with I:\Windows\System23 ...\ntos.exe ...oembios.exe...twixt.exe...twixt.exe...sdra64.exe ...\Localsys64.exe ...64.dlls.exe ...sdra73.exe ...sjdfh.exe ...host32.exe ...win32avs.exe

Please find below the catchme.log

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-11-22 19:35:19
Windows 6.1.7601 Service Pack 1 NTFS

detected NTDLL code modification:
ZwEnumerateKey 0 != 116, ZwQueryKey 0 != 244, ZwOpenKey 0 != 182, ZwClose 0 != -1739490221, ZwEnumerateValueKey 0 != 119, ZwQueryValueKey 0 != 266, ZwOpenFile 0 != 179, ZwQueryDirectoryFile 0 != 223, ZwQuerySystemInformation 0 != 261Initialization error

The PC is still very slow to close down, regards Robert.

[gringo_pr]

Hello

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

[gringo_pr]

Greetings


I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools




Gringo

[gringo_pr]

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
• do you need more time?
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

[tyler4402]

Hi Gringo, I am sorry for the break, only two hours ago I got my computer back, and unfortunately I think it was ComboFix which scrambled it and removed some of it's brains :-) I do believe the ComboFix scan failed, with your instructions I ran the program but as the Administrator AutoScan box had not moved or told me to do anything after three hours I had to stop the program.

Again a little later I stopped the Firewall and Anti virus programs and went off-line to run the scan, and I then ran the program again in safe mode, unfortunately as the program usually takes about ten or twenty minutes to scan, and with no way of telling if the program was actually scanning again I had to stop it after 2½ hours, and of course there was no log produced.
After that attempt my PC refused to go on line, my ISP tech department checked the router and as it was ok they advised my to buy a wireless adapter, and that did not work either, so I took the PC to a local shop and they put back the host files and the ipv6?? the IP address had also been changed, they said that I would not have got it going myself, anyway its working now but the “mocaflix” file is still listed in ProgFiles, I was wondering if I could zap it using something simple like HiJack This
Regards Robert.

[gringo_pr]

Run a new OTL scan and lets see if it still shows up



gringo

[tyler4402]

Hi Gringo
After I mailed you I realised that I had a prog called SuperAntiSpyware which I tried to turn off before the ComboFix scan but it would not turn off, I found it in a folder of downloaded progs so decided to delete from the folder it which I did and immediately my PC shut down and the screen went black for a long time before rebooting, it seems ok now but SuperAntiSpyware is still in program files, as is mocaflix search.

I have run a scan with OTL which I had in a folder on my PC I hope its what you want, regards Robert.
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0}\ deleted successfully.
I:\Program Files\Windows iLivid Toolbar\Datamngr\BrowserConnection.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c23b756a-bd9f-4ca6-aded-17ab8ccf3e8b}\ not found.
I:\Users\Robert\AppData\Local\{E5C908D0-58B8-4B26-9241-F8232E155C19} folder moved successfully.
I:\Users\Robert\AppData\Local\{D24946D8-B776-4142-AA20-F8200C457487} folder moved successfully.
I:\Users\Robert\AppData\Local\{38275344-EB51-48B9-95F1-4308EF29BB04} folder moved successfully.
I:\Users\Robert\AppData\Local\{FE1C66B0-537B-412C-8BE7-F494A4A08976} folder moved successfully.
I:\Users\Robert\AppData\Local\{21CEE890-05BA-4B28-A3F3-1855B421E727} folder moved successfully.
I:\Users\Robert\AppData\Local\{1F775DC4-4458-4041-A759-640A6B80D1F1} folder moved successfully.
I:\Users\Robert\AppData\Local\{EB4D1158-B26E-48CC-90DE-828CF111CF29} folder moved successfully.
I:\Users\Robert\AppData\Local\{5A5C3ED6-6811-4833-8649-00C3AF61FE07} folder moved successfully.
I:\Users\Robert\AppData\Local\{26D8EF3C-E91A-4590-9758-D8194924688C} folder moved successfully.
I:\Users\Robert\AppData\Local\{056C4185-5B2F-4DDE-83E9-019907FA476F} folder moved successfully.
I:\Users\Robert\AppData\Local\{1A08FC77-CAB6-4FFB-B7C0-37F18F35A6DD} folder moved successfully.
I:\Users\Robert\AppData\Local\{45858EB9-E2FC-4FE2-8E22-090B3E239319} folder moved successfully.
I:\Users\Robert\AppData\Local\{DD9E6883-5AAE-4AEF-89FE-9AFE1D0CF170} folder moved successfully.
I:\Users\Robert\AppData\Local\{BF216367-8236-43C9-8823-C4D308A7BA4A} folder moved successfully.
I:\Users\Robert\AppData\Local\{C74C6EA7-ACBE-42FB-AD67-BDCBC4635026} folder moved successfully.
I:\Users\Robert\AppData\Local\{BAE8DDF3-9AE8-4805-B8FC-B321826B217D} folder moved successfully.
I:\Users\Robert\AppData\Local\{EC5E8C17-ECD5-4750-B0FA-8AD31F9C4F50} folder moved successfully.
I:\Users\Robert\AppData\Local\{1F58AEE5-5762-4073-ABA6-54981F20F3DF} folder moved successfully.
I:\Users\Robert\AppData\Local\{57C512A9-4DE4-4016-A140-07FEAD47C5CC} folder moved successfully.
I:\Users\Robert\AppData\Local\{BE47556B-9CEF-4934-B55B-109F6ECBD338} folder moved successfully.
I:\Users\Robert\AppData\Local\{C1DA2010-EDCC-47E9-8B99-9699670C57BA} folder moved successfully.
I:\Users\Robert\AppData\Local\{F553B805-66BE-49A4-9531-6F2C22F5BEF3} folder moved successfully.
I:\Users\Robert\AppData\Local\{D23375AA-6A1F-4A2D-A805-B40242622186} folder moved successfully.
I:\Users\Robert\AppData\Local\{44BCA1B4-F475-4DDF-BC85-F8C0780DB300} folder moved successfully.
I:\Users\Robert\AppData\Local\{39589F5D-3CFF-44DC-BF4D-7341D013FE25} folder moved successfully.
I:\Users\Robert\AppData\Local\{3528144E-6485-471B-ADB4-CE7F457664DB} folder moved successfully.
I:\Users\Robert\AppData\Local\{0A1736D3-DCA4-4E0F-8FE1-01818310A281} folder moved successfully.
I:\Users\Robert\AppData\Local\{E085C2F1-BE1A-46C3-9AA5-91B9BF46E2C1} folder moved successfully.
I:\Users\Robert\AppData\Local\{BE5CEADB-7B17-433D-91F6-5347770A7F93} folder moved successfully.
I:\Users\Robert\AppData\Local\{AF25ABB4-CE77-4DB1-AA7F-F204ED52CE62} folder moved successfully.
I:\Users\Robert\AppData\Local\{432F4755-EECB-4219-8823-DDF6BC8D8CDE} folder moved successfully.
I:\Users\Robert\AppData\Local\{23F15876-D66A-46C7-99B2-75E7BC02D35D} folder moved successfully.
I:\Users\Robert\AppData\Local\{0DC05435-EE9E-47BE-8B23-71E94463106C} folder moved successfully.
I:\Users\Robert\AppData\Local\{C46BF6FF-CF8C-406F-A189-C57F6BD4AE9E} folder moved successfully.
I:\Users\Robert\AppData\Local\{08F21B2A-A40E-4401-BE52-274EDFE59BF2} folder moved successfully.
I:\Users\Robert\AppData\Local\{80A5165C-D6A3-4E26-B04F-6E75C1AC0749} folder moved successfully.
I:\Users\Robert\AppData\Local\{59D72107-E3C0-4103-9FAB-4A2638854E8B} folder moved successfully.
I:\Users\Robert\AppData\Local\{E5CF08F2-0408-4C57-802A-D53FA73AC351} folder moved successfully.
I:\Users\Robert\AppData\Local\{43C055A4-0085-4C46-A5EB-FE63505D89D8} folder moved successfully.
I:\Users\Robert\AppData\Local\{D5846A2F-BB12-4C72-8AD2-50B1B5649E32} folder moved successfully.
I:\Users\Robert\AppData\Local\{05753801-FB5C-4D13-9624-46268623FE29} folder moved successfully.
I:\Users\Robert\AppData\Local\{9F09D7E0-24DB-4621-A570-9899C28A09EE} folder moved successfully.
I:\Users\Robert\AppData\Local\{0E5D1C94-02D8-40BE-83C4-9A003AC00278} folder moved successfully.
I:\Users\Robert\AppData\Local\{BDEDCA5A-F9D0-443D-8568-4DFDE2645778} folder moved successfully.
I:\Users\Robert\AppData\Local\{718B7F89-66CF-47B3-84B8-DBA7E6A1F0E3} folder moved successfully.
I:\Users\Robert\AppData\Local\{9DA2CC67-1DD7-4D43-ABA4-826AAB6D5BBF} folder moved successfully.
I:\Users\Robert\AppData\Local\{CC0147E1-7A51-40AD-B7F1-11B4E44511F4} folder moved successfully.
I:\Users\Robert\AppData\Local\{3D2C6EDC-C377-43FD-AF80-B9673EA5BD1A} folder moved successfully.
I:\Users\Robert\AppData\Local\{72C32E02-2F63-40AC-850C-219CE5A0D149} folder moved successfully.
I:\Users\Robert\AppData\Local\{FCE20D5E-CD1B-4ED9-8A44-2B03DEC46EA5} folder moved successfully.
I:\Users\Robert\AppData\Local\{A2B7B9C0-0042-4A5E-BEB2-7C36251BBFA7} folder moved successfully.
I:\Users\Robert\AppData\Local\{C68D1D2F-D064-4F5E-871E-A854BA55A127} folder moved successfully.
I:\Users\Robert\AppData\Local\{798C8A85-E4C8-4D05-A801-424A168921F4} folder moved successfully.
I:\Users\Robert\AppData\Local\{87844FE5-4006-4E5C-B138-D6E086A6F349} folder moved successfully.
I:\Users\Robert\AppData\Local\{312D78EF-4526-450D-A519-C401DE5BC6A3} folder moved successfully.
I:\Users\Robert\AppData\Local\{285FC9EC-2624-4308-8A86-B6CE224A97A6} folder moved successfully.
I:\Users\Robert\AppData\Local\{CA9D2999-6C31-42C3-92E6-F497B58FD7D2} folder moved successfully.
I:\Users\Robert\AppData\Local\{F7F3AE42-D526-43E0-B882-9CCF6786FDB6} folder moved successfully.
I:\Users\Robert\AppData\Local\{ED07AACC-E135-4898-B7D0-03A9A22F1B45} folder moved successfully.
I:\Users\Robert\AppData\Local\{B4F8AAC1-8326-4131-A921-E42BB141CB7E} folder moved successfully.
I:\Users\Robert\AppData\Local\{5D700B43-9A1E-4EBA-9BE8-0B9794077C4D} folder moved successfully.
I:\Users\Robert\AppData\Local\{2E852820-AD04-49E3-952C-A26A61665B56} folder moved successfully.
I:\Users\Robert\AppData\Local\{0EBE2B19-BD4A-4E75-B933-BD1E2B69EE33} folder moved successfully.
I:\Users\Robert\AppData\Local\{320B7FAF-A9B0-4BEF-A176-04F1B5B6545F} folder moved successfully.
I:\Users\Robert\AppData\Local\{F1C73DEF-06B5-41F6-BC10-8CDFA1C46F71} folder moved successfully.
I:\Users\Robert\AppData\Local\{39D65FDB-35A7-4B0D-8A9A-6DF101022BB0} folder moved successfully.
I:\Users\Robert\AppData\Local\{73DDC856-DFAD-4843-A9BB-68C49FAE483A} folder moved successfully.
I:\Users\Robert\AppData\Local\{6C388EFD-7860-4E3A-A884-FCCB6EADEC33} folder moved successfully.
I:\Users\Robert\AppData\Local\{BF3AA28B-FB6E-46B3-A3FF-5B01B9B7D94B} folder moved successfully.
I:\Users\Robert\AppData\Local\{366E122D-FAAF-431C-BEB6-7F305D209DD4} folder moved successfully.
I:\Users\Robert\AppData\Local\{7059DAAD-C32A-4976-941A-5E4789FC9F65} folder moved successfully.
I:\Users\Robert\AppData\Local\{8C3A8027-30BC-4801-B2AD-FD72673AFFF4} folder moved successfully.
I:\Users\Robert\AppData\Local\{948038DB-259A-4E4F-B0DE-23BE8711AF43} folder moved successfully.
I:\Users\Robert\AppData\Local\{AB215320-57B6-4378-B4CC-6E2816B4543A} folder moved successfully.
I:\Users\Robert\AppData\Local\{A7C1626B-392D-4266-903D-FCCDD348EC19} folder moved successfully.
I:\Users\Robert\AppData\Local\{C6C9A368-3B2E-4F67-A03D-A7D3A512460C} folder moved successfully.
I:\Users\Robert\AppData\Local\{4A40CC98-3662-459E-9008-61A74DF24E46} folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Robert
->Temp folder emptied: 146359764 bytes
->Temporary Internet Files folder emptied: 41581564 bytes
->Java cache emptied: 1537138 bytes
->Google Chrome cache emptied: 20647981 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 6516 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 31074958 bytes
RecycleBin emptied: 2685820889 bytes

Total Files Cleaned = 2,791.00 mb


OTL by OldTimer - Version 3.2.43.1 log created on 05242012_100130

Files\Folders moved on Reboot...
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF02087C2E21AB3171.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF050A81B64F3750CA.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF05450AA11B2E6BB0.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF0D1A2C187A6E9AB4.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF0EA87BBEADD3DDE6.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF0FD78BAF663B0EDB.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF1A26FF4C0368A2E9.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF1BE09CFA4ADE6CBF.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF1E075CEEBE161FD2.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF2BCCB02860077148.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF2BE5D50ADC2E8C02.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF332F0A40488B6C3C.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF3674E651833926E7.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF3A0740168D81618A.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF3AC05F2A1BDD6585.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF3C9E6ACAC1B14E60.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF3E87A0A2716AF285.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF401476B775EAC71A.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF40B6AD3969641505.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF45C99FB05E775327.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF4A96994DB3718EC9.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF4BECC42A926D16F0.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF4D326177AA706316.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF4E5F05D2EE093B76.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF5456CA2CD751B6B7.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF56161C3DAE09C96D.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF5796617AFFE03995.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF5A2B0651FE882498.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF6144BD41CDFE51C0.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF675EB1DBC833DF2D.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF7766D97FF241D0A6.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF788C5E89B299C810.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF7CCC61FB5AF184FE.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF852B8D724FEF45FF.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF856A98D2CC7490E4.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF8AB8F1349002FB5E.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF8AD4D70517C5AE5F.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DF9466BB4705B626C1.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFA1E859D3EA7729E6.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFB0891099DF74BCA1.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFB2F152CFD4E8806E.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFBF7485B851237222.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFC021CCD99456D47A.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFC4FD86AFFBFE06ED.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFC6235592627B1395.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD0A36092C74DC205.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD1CEB7C0815C0D39.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD595D8F1EAEBD611.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD6E93F7A1FCD26B9.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD741416C6E48F72E.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD8557132E48391C8.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD855F705FF9FE413.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFD8C2F761FBDBA91A.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFDA1CD7858C040815.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFDB858619721DC932.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFE03C9D769149B720.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFE05416F40181BBC5.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFE18D3C25916478D1.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFE57AF313DE6F9532.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFF2FAE7BF4C88D4FF.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFF333180C3AAA45D4.TMP not found!
File\Folder I:\Users\Robert\AppData\Local\Temp\~DFFDD699FD91FE7FF0.TMP not found!
I:\Users\Robert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.

Registry entries deleted on Reboot...

[gringo_pr]

Hello


I would like an OTL scan only with no fixes please



gringo