Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!
This topic is locked
New Member
hello, at first i couldn t instal an video player from a surveillance receiver, because i was missing some *.dll. then, i''ve tried to instal avg antivirus, but the instalation stoped at 75%. Also, online scan from bitdefender it doesn't start.
i think i might have some virus or malware. what shell i do? thank you.
Addition.txt 30.44KB
597 downloads
FRST.txt 42.34KB
537 downloads
GeekU Moderator
CreateRestorePoint:
HKU\S-1-5-21-27391591-736041179-2425490622-1000\...\Run: [{65A9E976-6D7B-47DE-BC45-67FA44D3F254}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\BQrzIMbRx').CIWPHJXAZTNUMZV)));
AppInit_DLLs: c:\progra~2\browse~2\261562~1.220\{c16c1~1\browse~1.dll => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
HKU\S-1-5-21-27391591-736041179-2425490622-1000\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=20B9001E4C40B41E&affID=124033&tsp=4988
SearchScopes: HKU\S-1-5-21-27391591-736041179-2425490622-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119828&tt=190313_wo1&babsrc=SP_ss_obla&mntrId=20B9001E4C40B41E
SearchScopes: HKU\S-1-5-21-27391591-736041179-2425490622-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=945&r=2014/01/19&hid=2947519474016363976&lg=EN&cc=RO&unqvl=46
BHO: DefaultTab Browser Helper -> {7F6AFBF1-E065-4627-A2FD-810366367D01} -> C:\Windows\system32\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll [2015-06-23] (Search Results LLC.)
BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
S2 DefaultTabUpdate; "C:\Users\nikon\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe" [X]
Task: {A1FDD439-7A1D-4C2D-890B-52A2078787F7} - System32\Tasks\DefaultCheck => c:\Users\All Users\dtdata\R002.exe [2015-06-23] () <==== ATTENTION
Task: {AB4479D1-6691-438E-BC5E-03D7A68AE84E} - System32\Tasks\4724 => Wscript.exe C:\Users\nikon\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {CFDFDF2D-611B-4974-AAE9-5C9D357BAC7A} - System32\Tasks\DefaultReg => c:\Users\All Users\dtdata\R001.exe [2015-06-23] () <==== ATTENTION
Task: {FEC28936-DE60-4FF4-8593-250092008D1F} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
C:\Users\nikon\AppData\Roaming\DefaultTab
c:\Users\All Users\dtdata
C:\Users\nikon\AppData\Local\Temp\launchie.vbs
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg delete HKCU\Software\Classes\BQrzIMbRx
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
New Member
Try and install AVG after this
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
HKU\S-1-5-21-27391591-736041179-2425490622-1000\...\Run: [{65A9E976-6D7B-47DE-BC45-67FA44D3F254}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\BQrzIMbRx').CIWPHJXAZTNUMZV)));
AppInit_DLLs: c:\progra~2\browse~2\261562~1.220\{c16c1~1\browse~1.dll => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
HKU\S-1-5-21-27391591-736041179-2425490622-1000\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www2.delta-search.com/?babsrc=HP_ss&mntrId=20B9001E4C40B41E&affID=124033&tsp=4988
SearchScopes: HKU\S-1-5-21-27391591-736041179-2425490622-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119828&tt=190313_wo1&babsrc=SP_ss_obla&mntrId=20B9001E4C40B41E
SearchScopes: HKU\S-1-5-21-27391591-736041179-2425490622-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.toolksearchbook.info/?l=1&q={searchTerms}&pid=945&r=2014/01/19&hid=2947519474016363976&lg=EN&cc=RO&unqvl=46
BHO: DefaultTab Browser Helper -> {7F6AFBF1-E065-4627-A2FD-810366367D01} -> C:\Windows\system32\config\systemprofile\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll [2015-06-23] (Search Results LLC.)
BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
S2 DefaultTabUpdate; "C:\Users\nikon\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe" [X]
Task: {A1FDD439-7A1D-4C2D-890B-52A2078787F7} - System32\Tasks\DefaultCheck => c:\Users\All Users\dtdata\R002.exe [2015-06-23] () <==== ATTENTION
Task: {AB4479D1-6691-438E-BC5E-03D7A68AE84E} - System32\Tasks\4724 => Wscript.exe C:\Users\nikon\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {CFDFDF2D-611B-4974-AAE9-5C9D357BAC7A} - System32\Tasks\DefaultReg => c:\Users\All Users\dtdata\R001.exe [2015-06-23] () <==== ATTENTION
Task: {FEC28936-DE60-4FF4-8593-250092008D1F} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
C:\Users\nikon\AppData\Roaming\DefaultTab
c:\Users\All Users\dtdata
C:\Users\nikon\AppData\Local\Temp\launchie.vbs
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg delete HKCU\Software\Classes\BQrzIMbRx
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
<script pagespeed_no_defer="" type="text/javascript">//=d.offsetWidth&&0>=d.offsetHeight)a=!1;else{c=d.getBoundingClientRect();var f=document.body;a=c.top+("pageYOffset"in window?window.pageYOffset:(document.documentElement||f.parentNode||f).scrollTop);c=c.left+("pageXOffset"in window?window.pageXOffset:(document.documentElement||f.parentNode||f).scrollLeft);f=a.toString()+","+c;b.b.hasOwnProperty(f)?a=!1:(b.b[f]=!0,a=a<=b.e.height&&c<=b.e.width)}a&&(b.a.push(e),b.d[e]=!0)};p.prototype.checkImageForCriticality=function(b){b.getBoundingClientRect&&q(this,b)};h("pagespeed.CriticalImages.checkImageForCriticality",function(b){n.checkImageForCriticality(b)});h("pagespeed.CriticalImages.checkCriticalImages",function(){r(n)});var r=function(b){b.b={};for(var d=["IMG","INPUT"],a=[],c=0;c=a.length+e.length&&(a+=e)}b.g&&(e="&rd="+encodeURIComponent(JSON.stringify(s())),131072>=a.length+e.length&&(a+=e),d=!0);t=a;if(d){c=b.f;b=b.h;var f;if(window.XMLHttpRequest)f=new XMLHttpRequest;else if(window.ActiveXObject)try{f=new ActiveXObject("Msxml2.XMLHTTP")}catch(k){try{f=new ActiveXObject("Microsoft.XMLHTTP")}catch(u){}}f&&(f.open("POST",c+(-1==c.indexOf("?")?"?":"&")+"url="+encodeURIComponent(b)),f.setRequestHeader("Content-Type","application/x-www-form-urlencoded"),f.send(a))}}},s=function(){var b={},d=document.getElementsByTagName("IMG");if(0==d.length)return{};var a=d[0];if(!("naturalWidth"in a&&"naturalHeight"in a))return{};for(var c=0;a=d[c];++c){var e=a.getAttribute("pagespeed_url_hash");e&&(!(e in b)&&0=b[e].k&&a.height>=b[e].j)&&(b[e]={rw:a.width,rh:a.height,ow:a.naturalWidth,oh:a.naturalHeight})}return b},t="";h("pagespeed.CriticalImages.getBeaconData",function(){return t});h("pagespeed.CriticalImages.Run",function(b,d,a,c,e,f){var k=new p(b,d,a,e,f);n=k;c&&m(function(){window.setTimeout(function(){r(k)},0)})});})();pagespeed.CriticalImages.Run('/mod_pagespeed_beacon','http://www.geekstogo.com/forum/index.php?s=46bfab869237aad5ab3cc01b981ce705&app=forums&module=ajax§ion=topics&do=quote&t=361250&p=2563579&md5check=813eca10e70a518b7ae0a4bc7a1c33c9&isRte=1,zBX8hFeDQI,true,true,tnqR4iZOWKc');//]]></script>
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S0].txt as well.
&&0
hy,
this is the fix log
New Member
an this is the log after running adwcleaner
GeekU Moderator
Does AVG install properly now ?
Scan with Malwarebytes Anti-Malware
GeekU Moderator
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
0 members, 0 guests, 0 anonymous users
Community Forum Software by IP.Board
Licensed to: Geeks to Go, Inc.
Sign In
Create Account
