What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] An application called "Favorit" has appeared o

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
RainyDayInParis,

It appears the Favorit is left over from a program called Messenger Skinner.

It should uninstall by use of add/remove programs in the control panel. I believe you've already tried that.

Lets get rid of Favorit this way:

  • Start HijackThis
  • Click on the Config button
  • Click on the Misc Tools button
  • Click on the Open Uninstall Manager button.
  • A screen will appear with a list of the programs in the Add/Remove Software list in the control panel


Locate Favorit on the list then click on the Delete this entry button.

Then

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
c:\windows\sed.exe
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #17
ComboFix 09-03-15.01 - A 2009-03-18 15:53:18.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.319.74 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\A\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090317-0] *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\sed.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\sed.exe

.
((((((((((((((((((((((((( Files Created from 2009-02-18 to 2009-03-18 )))))))))))))))))))))))))))))))
.

2009-03-16 20:05 . 2009-03-16 20:05 d——– c:\program files\Malwarebytes' Anti-Malware
2009-03-16 20:05 . 2009-03-16 20:05 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-03-16 20:05 . 2009-03-16 20:05 d——– c:\documents and settings\A\Application Data\Malwarebytes
2009-03-16 20:05 . 2009-02-11 10:19 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-16 20:05 . 2009-02-11 10:19 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-03-16 08:08 . 2009-03-16 08:08 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-17 19:45 ——— d—–w c:\documents and settings\A\Application Data\OpenOffice.org2
2009-02-09 11:13 1,846,784 —-a-w c:\windows\system32\win32k.sys
2009-01-21 19:37 ——— d—–w c:\program files\Common Files\Adobe
2008-12-20 23:15 826,368 —-a-w c:\windows\system32\wininet.dll
2007-07-31 06:14 30,924 -c–a-w c:\windows\inf\USBkey.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-03-16_21.30.45.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-18 13:57:35 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_5a0.dat
+ 2009-03-18 13:57:47 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_72c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Google Update"="c:\documents and settings\A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-21 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 57344]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-16 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2006-03-12 127488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.rhetorex"= rhetorex.acm
"MSACM.nvsadpcm"= nvsadpcm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"64:TCP"= 64:TCP:ps
"1703:TCP"= 1703:TCP:PS1
"1702:TCP"= 1702:TCP:PS2

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-10 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-04-10 20560]
R3 atimtai;atimtai;c:\windows\system32\drivers\atimtai.sys [2005-07-08 281600]
R3 AUCBCFG;Adaptec CardBus Configuration Driver;c:\windows\system32\drivers\aucbcfg.sys [2002-11-14 5360]
R3 maestro;ESS Maestro 3 Audio Driver (WDM);c:\windows\system32\drivers\es198x.sys [2005-07-08 174464]
R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;c:\windows\system32\drivers\wg511nd5.sys [2006-05-03 395840]
S2 Parclass;Parclass;c:\windows\system32\drivers\parclass.sys [2007-07-31 19920]
S3 ADPTEHCD;Adaptec USB 2.0 Enhanced Host Controller Driver;c:\windows\system32\drivers\aehcd.sys [2002-11-14 42512]
S3 AUSBD_FilterService;Adaptec USB 2.0 Port Enumeration Driver;c:\windows\system32\drivers\ausbd.sys [2002-11-14 23056]
S3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys –> c:\windows\system32\drivers\av5flt.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-03-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1547161642-152049171-1708537768-1004.job
- c:\documents and settings\A\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-21 20:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
FF - ProfilePath - c:\documents and settings\A\Application Data\Mozilla\Firefox\Profiles\yi8z2u77.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/?auth=DQAAAIEAAABgrx2fGpI7Re_1YXC-3a3nHxtmsQiwTeCFBtTPopvbLZz8ok9i2_geYk8Hiaqx71KHKqgJPiEe5FO9waxSrAlxuyZx_bCh972F
AOrawWi7xd_K8OGDKMdfS6i_MDLlrY8IKBueZyVeNJbGjQmNMI7fopsw-5WyQe34ceFBM-Ep_eVWW_6I-BieZB5utUV1RnM
FF - plugin: c:\documents and settings\A\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-18 15:57:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-18 16:02:31
ComboFix-quarantined-files.txt 2009-03-18 15:01:20
ComboFix2.txt 2009-03-16 20:34:09

Pre-Run: 1,373,134,848 bytes free
Post-Run: 1,423,958,016 bytes free

109 — E O F — 2009-03-13 21:29:24
Post #19
Everything seems to be running normally. But there should be 3 more gigs of hard drive space freed up if Favorit is gone, and my C: drive properties box does not say that. It still says I have about 1 free gig. The recycle bin is empty, and the disk cleanup tool says I can only free 41 more kilobytes if I run it. If Favorit is gone, where are my 3 gigs? Thanks, as always, RainyDayInParis
Post #20
RainyDayInParis,

Ok. If I understand correctly, the uninstall routine only stops the advertising. However, the company provides an uninstaller to actually remove the program.

Go here? to give it a try. The only information you should put in the boxes on the right is the security code. After inputting the security code in the appropriate box, click on Uninstall Advertising. Then just follow the directions.

Let me know how it goes.
Post #21
Hi Tomk, I just tried twice, and I input the security code. It brings up a page with a button to download the uninstall software. The button leads to a 404 Not Found page. RainyDayInParis
Post #23
RainyDayInParis,

Please wander over to our "Windows Made Easy" section. In this article, ztrucker explains some harddrive cleanup procedures. I'm thinking specifically about his directions for Revo Uninstaller. Give it a try and see how you go.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI