Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

Spy Hunter 4 [Solved]

  • This topic is locked This topic is locked



    Trusted Helper

  • Malware Removal
  • 2,083 posts

"C:\Program Files (x86)\ESET\Eset Online Scanner\log.txt"


Sorry this is my bad - for some reason the spaces have gone from my script.

  • 1


[email protected]

[email protected]


  • Topic Starter
  • Member
  • PipPip
  • 37 posts

Bingo that did it haha 


[email protected] as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=
# OnlineScanner.ocx=
# api_version=3.0.2
# EOSSerial=0047aeeb68766c4580b474aa1debc220
# engine=21926
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-01-12 06:02:00
# local_time=2015-01-12 06:02:00 (+0000, GMT Standard Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1299 16777213 100 100 23795 48653750 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 255835 173550770 0 0
# scanned=114626
# found=13
# cleaned=0
# scan_time=10541
sh=EDB6E1477166B32FE95301005E15A4EEB8BCF137 ft=1 fh=d29cf5027c7fc6c4 vn="a variant of MSIL/Adware.PullUpdate.H application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Browser\prompt.exe.vir"
sh=860D56970608ECCBCF47A836BADAB55AD635AD2D ft=1 fh=e407d3600efa5264 vn="a variant of Win32/PriceGong.C potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\SmartWeb\SmartWebApp.exe.vir"
sh=E5F8CC1670AF84869FDE86260EFA12ACEF9A0F14 ft=1 fh=07c30822a8cdf5dd vn="a variant of Win32/PriceGong.C potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\SmartWeb\SmartWebHelper.exe.vir"
sh=D7756069C1B52701F55C69634BFD36D00C71A267 ft=1 fh=d99e2dcc872416fc vn="a variant of Win32/PriceGong.C potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\SmartWeb\swhk.dll.vir"
sh=51332ED3EAEFF9BCA7D43ED52B063DAA2C611990 ft=1 fh=9c38169ad328b11b vn="a variant of Win32/PriceGong.C potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\User\AppData\Local\SmartWeb\uninst.exe.vir"
sh=B6B12E4F8E59C61EC67A5E17DEDA7EA5B2FEF364 ft=1 fh=65d7fe9609cd6c74 vn="Win32/Bundled.Toolbar.Google.D potentially unsafe application" ac=I fn="C:\Users\User\Downloads\ccsetup500 (1).exe"
sh=B6B12E4F8E59C61EC67A5E17DEDA7EA5B2FEF364 ft=1 fh=65d7fe9609cd6c74 vn="Win32/Bundled.Toolbar.Google.D potentially unsafe application" ac=I fn="C:\Users\User\Downloads\ccsetup500.exe"
sh=13EE8C9FCE6F74512DCD188CCA0655C5EDE37612 ft=1 fh=756c61b76c471ca8 vn="MSIL/HackKMS.A potentially unsafe application" ac=I fn="C:\Windows\AutoKMS\AutoKMS.exe"
sh=CA6D73F1A0F2C4B2A735A19946C9DA0E0E92F0A3 ft=1 fh=406e5b677f650464 vn="a variant of MSIL/Adware.PullUpdate.G.gen application" ac=I fn="C:\_OTL\MovedFiles\01082015_150945\C_ProgramData\EKAfRti\Zoqctjxcdc.exe"
sh=A67E3817FC13A1C440340279CF8DFBBB89077B3D ft=1 fh=8ae44ea6de42b5ae vn="a variant of MSIL/Adware.PullUpdate.K.gen application" ac=I fn="C:\_OTL\MovedFiles\01082015_150945\C_ProgramData\EKAfRti\dat\cQzYZBXxQ.dll"
sh=0AE6F44A6D15BF13DF19BE1EC38D021D6960BE55 ft=1 fh=69709f074978429f vn="a variant of MSIL/Adware.PullUpdate.K.gen application" ac=I fn="C:\_OTL\MovedFiles\01082015_150945\C_ProgramData\EKAfRti\dat\fzaIOmVpVYv.dll"
sh=D8A4874AE13F80C590F7AEFE3E39D63DE58E8279 ft=1 fh=94eb3d3789549135 vn="a variant of MSIL/Adware.PullUpdate.G.gen application" ac=I fn="C:\_OTL\MovedFiles\01082015_150945\C_ProgramData\EKAfRti\dat\lsmBxWRmVIu.exe"
sh=7A792FB5ECA9AEB4E47733E74B87A697CBFAE399 ft=1 fh=da0f60eedddab4c2 vn="a variant of MSIL/Adware.PullUpdate.G.gen application" ac=I fn="C:\_OTL\MovedFiles\01082015_150945\C_ProgramData\EKAfRti\dat\pJtWEYGMyU.exe"


  • 0



    Trusted Helper

  • Malware Removal
  • 2,083 posts

Good news, it looks like your system is now clean, nothing in that scan that won't be dealt with here. A good workman cleans up after himself so let's now attend to that :D

Tool Removal

We need to remove the tools we've used during cleaning your machine

  • Download Delfix from here
  • Ensure Remove disinfection tools is ticked
    Also tick:
    • Activate UAC
    • Create registry backup
    • Purge system restore
    • Reset System Settings
  • Click Run

The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply

We need to uninstall a program
Open Programs and Features by clicking the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.
Select the following programs from the list below, one at a time and click Uninstall.

  • ESET Online Scanner

Delete the following Files and Folders (If Present):
C:\Program Files (x86)\ESET
Delete any other .bat, .log, .reg, .txt, and any other files created during this process, and left on the desktop and empty the Recycle Bin.

Keep your machine updated

Due to the ever-present tide of malware, it is important to ensure your computer is kept up-to-date to minimize the risk of future infection. An important step is to ensure that automatic updates are enabled.

To enable automatic updates:

Windows 7
To turn on Automatic Updates yourself, follow these steps:

  • Click Start, type Windows update in the search box, and then click Windows Update in the Programs list.
  • In the left pane, click Change settings.
  • Select the option that you want.
  • Under Recommended updates, select the Give me recommended updates the same way I receive important updates or Include recommended updates when downloading, installing, or notifying me about updates check box, and then click OK.

It is recommended to install an anti-malware to help prevent reinfection.
Below are some free ones that can help keep you clean.

Malwarebytes AntiMalware

As you have installed Malwarebytes, I recommend that you keep this program and use it to help you stay clean.

The free version will scan your computer and fix the problems it finds but will not provide real-time protection. You must scan regularly to find any threats.
Consider purchasing the full version for active monitoring of threats.

JAVA Advice
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software or need it to play games on-line.
In that instance I would recommend that you only use Firefox or Chrome to visit those sites and do the following:

  • For Firefox, install the NoScript add-on.
  • For Chrome, install the ScriptNo add-on.
    -->IMPORTANT<--: After installing the add-ons you will need to tell them that the site you are visiting is allowed to run Javascript. If you don't, the sites won't work properly. Or not at all. You can go to the NoScript home page here to learn how to use the add-on.
  • Disable Java in your browsers until you need it for that software and then enable it. (See How to disable Java in your web browser or How to unplug Java from the browser)

If you still want to update your Java, follow the instructions below:

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older versions of Java components and update:

  • Download the latest version of the Java Runtime Environment (JRE) Version from Here and save it to your desktop.
  • Look for "Java Platform, Standard Edition". You will see the current Java version and update number under listed under the heading. Example: The newest update is Java SE 8u25
  • Click the "Download button under "JRE".
  • On the Java SE Runtime Environment page, click the button to "Accept License Agreement".
  • Under the Java SE Runtime Environment 8u25 heading:
    To install the version for your system:
    • For Windows 64bit systems, look for Windows x64 - 88.37MB, click the jre-8u25-windows-64.exe file and save it to your desktop. Do Not run it from the Java site.
  • Close any programs you may have running - especially your web browser.

Uninstall all versions of Java

  • Click Start > Control Panel > Add/Remove Programs. The list of installed programs will populate.
  • Click the Start Orb, then Control Panel. Under the Programs or Programs and Features section click Uninstall a program. The list of installed programs will populate.
  • Remove all older versions of Java. These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE or J2SE
    The versions I see on the computer are:
    • Java 7 Update
    • Java 8 (64-bit)
    • Java SE Development Kit 8
  • Right click each program and click Uninstall and follow the on screen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.

Install the latest JAVA

Back on your desktop:

  • Right click the jre-8u25-windows-x64.exe file, click Run as Administrator and OK the UAC prompt to install the newest version.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

[Note:] The Java Quick Starter (JQS.exe) adds a service to improve the initial start up time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > You will have to be in Classic View to see Java(It looks like a coffee cup). Double-click on Java click the Advanced Tab click Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.

Update Adobe Flash Player

NOTE: Depending on your settings, you may have to temporarily disable your antivirus software and firewall.

  • Please click here to go to the FlashPlayer Installation page.
  • In the first column, Adobe Flash Player, make sure the system version (64bit) and the browser are correct.
    • Note: If you use IE and other browsers you will need to install both Flash Player for IE and Flash Player for Other Browsers.
  • In the middle column, Optional offer:, UNCHECK the box next to Yes, install free McAfee Security Scan Plus
  • Click the Install now button. A download window for the install_flashplayer15x64_mssd_aaa_aih.exe file will open. Save it to the desktop.
  • Close the browser and all open windows.
  • Back on the desktop, right click the install_flashplayer15x64_mssd_aaa_aih.exe file and click Run as Administrator to install Flash Player.

Cryptolocker Warning
Go here for information about CryptoLocker Ransomeware.
The main thing with this infection is ~ Backup.
If you're using an external hard drive, keep it unplugged from the computer when you're not backing up files or using it. This will prevent the infection from getting to your backed up files if you ever do come across it.

Recommended Programs
Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing. By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed.
CryptoPrevent is a free program that prevents CryptoLocker / ransomware from infecting your PC by locking down the OS so the malware can not get a grip on your system.
Web Of Trust is a browser add-on designed to alert the user before interacting with a potentially malicious website. It will highlight green if a site is known to be safe.

Adblock is a firefox browser add-on that blocks annoying banners, pop-ups and video ads.

General Advice

  • When browsing the internet, look closely at the links you click on. Some aren't always what they seem
  • Avoid Peer to Peer file sharing utilities, these are a minefield of malware infections.
  • Don't open email attachments unless you are expecting them. Even an email from your best friend can be infected, they might not have sent it.
  • Pay attention when installing a program to your computer, particularly to any check boxes that may appear during installation, it is common for unwanted software to be installed in this way.

  • 1

[email protected]

[email protected]


  • Topic Starter
  • Member
  • PipPip
  • 37 posts

Thankyou very much for all the patience and time you have shown over the last few days I have deleted and added all advised from above just one recomended programme I have a query with crypto prevent sends you to this website here https://www.foolishit.com/ and asks for a subscription of 179 dollars ?? Just to clarify a question you asked earlier re the Microsoft office I had a new hard drive installed in a Computer shop a couple of months ago so everything that is on my Laptop was installed by them I wasnt aware they had not put valid programmes back on !!!!! I do need this programme as my grand daughter uses it for homework etc so it will have to stay for the time being Once again Thankyou you have been a star and good luck on your upgrade to fully qualified Geek you deserve it :)

  • 0



    Trusted Helper

  • Malware Removal
  • 2,083 posts

Firstly, thank you for your kind words and for being patient to the end as well :D Especially with my formatting errors :oops;


Normally we refuse to help when we discover unofficial software but due to your computer being free of downloading software and any other naughties, I presumed that is what had happened and gave you the benefit of the doubt - it happens a lot.


As per the cryptolocker prevent - it looks like they have hidden the download  : https://www.foolishi.../cryptoprevent/


Then scroll all the way to the bottom to the blue installer link.


That's it you are good to go :D Safe surfing

  • 0



    Anti-Malware Mammoth

  • Expert
  • 9,719 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP