[Dakeyras]

Hi.

The computer seems to be running normally.

Good...

TFC(Temp File Cleaner):

• Please download TFC to your desktop,
• Save any unsaved work. TFC will close all open application windows.
• Right-click TFC.exe and select Run as Administrator to run the program.
• Click the Start button in the bottom left of TFC
• If prompted, click "Yes" to reboot.

Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It should not take longer than a couple of minutes , and may only take a few seconds. Only if needed will you be prompted to reboot.

I advice you consider keeping TFC on your desktop after I give the all clear and run it say at least once per week as it is a very effective piece of software for cleaning out temp' files etc.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan...
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then right click on it and select Run as Administrator to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is Not checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[Advertisements]

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK


I don't know if this is correct or not. It did say that 13 files were infected.

[martinj]

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK


I don't know if this is correct or not. It did say that 13 files were infected.

[Dakeyras]

Hi.

I don't know if this is correct or not. It did say that 13 files were infected.

OK, is that the complete Eset online scan log ? Please check it again...

Quick easy way to open it would be via:-

Click on Start(Vista Orb) >> Run..., (or depress the Windows Key & R together to bring up the run box) then copy/paste the following command into the box:

C:\Program Files\ESET\ESET Online Scanner\log.txt

and click on OK

[martinj]

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=8
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=8b4a4b9ee7c04b49b4996e81c965fddd
# engine=13531
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-04-02 04:09:02
# local_time=2013-04-02 12:09:02 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=3592 16777213 83 91 751517 115495038 0 0
# compatibility_mode=5121 16777214 0 3 92035961 92035961 0 0
# compatibility_mode=5892 16776574 100 100 92045397 201517648 0 0
# scanned=175105
# found=13
# cleaned=0
# scan_time=8286
sh=BAEFCB03679575349E01668C4F0938643BAAA022 ft=1 fh=45ba6b521529362d vn="a variant of Win32/Toolbar.MyWebSearch.A application" ac=I fn="C:\Program Files (x86)\CouponXplorer_5z\bar\1.bin\5zdatact.dll"
sh=EAA9D46B8FAB8F3D48BB239ADFE46BA312434017 ft=1 fh=2506fdd3752ff6fe vn="probably a variant of Win32/Toolbar.MyWebSearch.B application" ac=I fn="C:\Program Files (x86)\CouponXplorer_5z\bar\1.bin\5zhtmlmu.dll"
sh=92AC05FFF3AD68271062A3DCB87E12EE6B816DDB ft=1 fh=acec1e59f99ab2fd vn="probably a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Program Files (x86)\CouponXplorer_5z\bar\1.bin\5zieovr.dll"
sh=857980A7B7AB77FF8E34A090CCD76B8BA628E7E4 ft=1 fh=6c9ac10ea3ee1cdd vn="a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Program Files (x86)\CouponXplorer_5z\bar\1.bin\5zskin.dll"
sh=A8B583E2BFA2B7E04C3719FF000CCF7151AEEA7F ft=1 fh=c7c54f98ed54b65c vn="probably a variant of Win32/Toolbar.MyWebSearch.F application" ac=I fn="C:\Program Files (x86)\CouponXplorer_5z\bar\1.bin\T8HTML.DLL"
sh=BAEFCB03679575349E01668C4F0938643BAAA022 ft=1 fh=45ba6b521529362d vn="a variant of Win32/Toolbar.MyWebSearch.A application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0cdatact.dll"
sh=91434EB0C345139654B34C6D76531FA3B5F0DC00 ft=1 fh=7c9caf43afc84ef8 vn="probably a variant of Win32/Toolbar.MyWebSearch.F application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0chtml.dll"
sh=53F3044159FFCF82C746898941DBE3DC2AC9A24C ft=1 fh=09fa8c8598e549f8 vn="probably a variant of Win32/Toolbar.MyWebSearch.B application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0chtmlmu.dll"
sh=92AC05FFF3AD68271062A3DCB87E12EE6B816DDB ft=1 fh=acec1e59f99ab2fd vn="probably a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0cieovr.dll"
sh=FD0E8EE8F0C71E865A62634A7E5FCA7670F0342B ft=1 fh=41a3b4e25a462956 vn="a variant of Win32/Toolbar.MyWebSearch application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0cPlugin.dll"
sh=857980A7B7AB77FF8E34A090CCD76B8BA628E7E4 ft=1 fh=6c9ac10ea3ee1cdd vn="a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Program Files (x86)\Maps4PC_0c\bar\1.bin\0cskin.dll"
sh=4E7DE790892B2EEB966ADFBAE7742B87904D7FA3 ft=1 fh=e665c59a9d8942b2 vn="a variant of Win32/Toolbar.MyWebSearch.O application" ac=I fn="C:\Users\Jessica\AppData\LocalLow\Maps4PC_0cEI\Installr\Cache\120B7CAC.exe"
sh=50772310001B246F112AD6FBE120D2C85EE5A877 ft=0 fh=0000000000000000 vn="a variant of WMA/TrojanDownloader.GetCodec.gen trojan" ac=I fn="C:\Users\Jessica\Music\music\Coldplay - Viva La Vida (2008)Full plus artwork-320Kbps\06 Coldplay - Yes.mp3"

[Dakeyras]

Hi.

Lets deal with the results of the online scan as follows and carry out a few more tasks also...

Please go to Start(Vista Orb) >> Control Panel >> Programs and Features and remove the following (if present):

CouponXplorer
Maps4PC

To do so click once on each of the above to highlight then click on Uninstall/Change and follow the prompts.

Note: Take extra care in answering questions posed by any Uninstaller. Some questions may be worded to deceive you into keeping the program.

Next:

Using Windows Explorer (to get there right-click yourStart/Vista Orb button and go to "Explore"), please delete these folders (if present):

C:\Program Files (x86)\CouponXplorer_5z
C:\Program Files (x86)\Maps4PC_0c
C:\Users\Jessica\AppData\LocalLow\Maps4PC_0cEI

Then empty the Recycle Bin.

Reset Vista Firewall:

Click on Start(Vista Orb) >> Run... and cut/paste in the following and click on OK

firewall.cpl

Or Start(Vista Orb) >> Control Panel >> Windows Firewall

Click on the Change Settings >> Advanced >> Restore Defaults >> At the prompt click on Yes >> OK

Now click back on Change Settings again >> General >> and select Off(not recommended) >> Apply >> OK.

Note: No need for it to be active after the reset because the presently installed Norton Security Suite has a firewall component.

Next:

Let check/update some software as follows shall we...

• Download and install FileHippo Update Checker from here.
• Once installed(during the installation process deselect the option:- Run at Startup >> Start(Vista Orb) >> All Programs >> right-click on Update Checker and select Run as Administrator >> a browser window will open after the scan is complete.
• Download any updates detected(apart from beta updates) to the desktop >> uninstall anything that requires updating via Programs and Features in the Control Panel.
• Re-install the updated software, delete the installers and then empty the Recycle Bin.
• When completed the above let myself know and if any further issues remaining, thank you.

Note: When I give the all clear my advice would be to consider keeping FileHippo Update Checker installed. Then periodically use it to check for any updates as having certain software outdated is a potential for malware to gain a foothold and exploit a system etc.

[Dakeyras]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

[Dakeyras]

Re-opened per OP's request.

[martinj]

I did all of the steps above and the computer seems to be running smoothly.

[Dakeyras]

Hi.

I did all of the steps above and the computer seems to be running smoothly.

Good.

Next:

Congratulations your computer appears to be malware free!

Now I have some tasks for your good self to carry out as part of a clean up process and some advice about online safety.

Importance of Regular System Maintenance:

I advice you read both of the below listed topics as this will go a long way to keeping your Computer performing well.

Help! My computer is slow!

Also so is this:

What to do if your Computer is running slowly

Uninstall ComboFix:

• Click on Start >> Run...(or the Windows key and R together) to bring up the Run box:
• Now type in ComboFix /Uninstall into the and click OK.
• Note the space between the X and the /Uninstall, it needs to be there.
• 

Clean up with OTL:

• Right-click OTL and select Run as Administrator to start the program.
• Close all other programs apart from OTL as this step will require a reboot.
• On the OTL main screen, depress the CleanUp button.
• Say Yes to the prompt and then allow the program to reboot your computer.

The above process should clean up and remove the vast majority of scanners used and logs created etc.

Any left over merely delete yourself and empty the Recycle Bin.

Reset the System Restore points:

Create a new, clean System Restore point:-

• Right click on Computer and select Properties >> System protection >> Create.
• Give this restore point a descriptive name and click Create.
• When the new restore point is created click on OK >> close the System propities window.

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

Flush Old System Restore points:-

• Next click Start(Vista Orb) >> Run (or the Windows key and R together) to bring up the Run box and and copy and paste in:
  

  cleanmgr

• in the box and press OK.
• Select the system drive, C >> OK.
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Click on Clean up system files >> Select the system drive, C >> OK.
• Now click on the More Options tab.
• Under:-

System Restore and Shadow Copies

• Click on Clean up... >> Delete >> OK >> Delete Files.

Now some advice for on-line safety:

Malwarebyte's Anti-Malware:

This is a excellent application and I advise you keep this installed. Check for updates and run a scan at least once per a week.

Other installed security software:

Your presently installed security application, Norton Security Suite(the actual anti-virus component) automatically checks for updates and downloads/installs them with every system reboot and or periodically if the machine is left running providing a internet connection is active.

I advise you also run a complete scan with this also at least once per week.

Tweaking.com - Registry Backup:

I advice you keep this installed as a means to keep a complete backup of your registry and restore it when needed.

Myself I would actually create a new back up once per week as this along with System Restore may prove to be invaluable if something unforeseen occurs!

As mentioned prior a tutorial for Registry Backup explaining the various features be viewed here.

Keep your system updated:

Microsoft releases patches for Windows and other products regularly:

• Click on Start(Vista Orb) >> All Programs >> Windows Update.
• In the navigation pane, click Check for updates.
• After Windows Update has finished checking for updates, click View available updates.
• Click to select the check box for any found, then click Install.
• When completed Reboot(restart) your computer if not prompted to do so.

Next:

This article is worth reading/bookmarking for future reference.

Any questions? Feel free to ask, if not stay safe!

[Dakeyras]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.