This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

bad case of system check [Solved]

78 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi anas_dad,

Everyone here at home says that I should go for it, so I think I will sign up for the WTT classroom

Go ahead and apply once we are done here.



We'll try a different temporary file cleaner, the one in OTL doesn't seem to agree with this computer.

Please download ATF Cleaner by Atribune.

Right click ATF-Cleaner.exe and click "Run as Administrator" to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Note your computer may boot a little slower the first couple of times.




OTL should run this time.

Next, Right click on OTL.exe and chose Run as Administrator to run it
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
[2012/02/15 17:31:39 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D599B5D8-9F77-4267-8BEC-976E9C1DF647}
[2012/02/15 17:31:36 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{6A86C66B-A280-49DE-A88F-3FBDDBA60C30}
O37 - HKU\S-1-5-21-3397783422-3384463677-1815793419-1000\…com [@ = ComFile] – Reg Error: Key error. File not found
[2012/02/11 17:01:29 | 000,000,000 | —D | C] – C:\Users\Ana\AppData\Local\{D15A6F1B-B210-44A7-8F82-D124A3AEF183}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56303
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56303

:files
C:\Windows\System32\config\systemprofile\AppData\Roaming\569F3





One more scan to check for stragglers.

As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.



Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • When the scan completes, click List of found threats
  • click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
  • Include the contents of this report in your next reply

    Note - when ESET doesn't find any threats, no report will be created.
  • Push the back button.
  • Push Finish
  • Re-enable your Antivirus software.


Please post back with
  • OTL fix log
  • ESET log if there was one
Oldman960, ESET is still running, and after 1 1/2 hrs it is only at 47% with 11 infected files found. Please note that your ATF link is dead. I found a good one at Majorgeeks OTL ran with no problems I will post scan logs as soon as it is done Patrick
OK, Here are the results ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\Users\Ana\AppData\Local\{D599B5D8-9F77-4267-8BEC-976E9C1DF647} folder moved successfully. C:\Users\Ana\AppData\Local\{6A86C66B-A280-49DE-A88F-3FBDDBA60C30} folder moved successfully. Registry key HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1000_Classes\.com\ not found. Registry key HKEY_USERS\S-1-5-21-3397783422-3384463677-1815793419-1000_Classes\ComFile\ not found. HKEY_LOCAL_MACHINE\Software\Classes\.com\\|comfile /E : value set successfully! Folder C:\Users\Ana\AppData\Local\{D15A6F1B-B210-44A7-8F82-D124A3AEF183}\ not found. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully! ========== FILES ========== C:\Windows\System32\config\systemprofile\AppData\Roaming\569F3 folder moved successfully. OTL by OldTimer - Version 3.2.31.0 log created on 02202012_202000 ESET scan results C:\Qoobox\Quarantine\C\Program Files\LP\6875\810.exe.vir a variant of Win32/Kryptik.AAPW trojan C:\Qoobox\Quarantine\C\Program Files\LP\6875\90F6.tmp.vir a variant of Win32/Kryptik.AAJB trojan C:\Qoobox\Quarantine\C\Program Files\Search Toolbar\SearchToolbar.dll.vir Win32/Toolbar.Zugo application C:\Qoobox\Quarantine\C\Users\Ana\AppData\Roaming\firefox.exe.vir a variant of Win32/Kryptik.AAPS trojan C:\Qoobox\Quarantine\C\Users\Brie\AppData\Roaming\Mozilla\Firefox\Profiles\vntc5lax.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\chrome.manifest.vir Win32/TrojanDownloader.Tracur.F trojan C:\TDSSKiller_Quarantine\16.02.2012_21.53.57\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\16.02.2012_21.53.57\mbr0000\tdlfs0000\tsk0005.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\16.02.2012_21.53.57\mbr0000\tdlfs0000\tsk0006.dta a variant of Win32/Rootkit.Kryptik.GK trojan C:\TDSSKiller_Quarantine\17.02.2012_19.52.53\tdlfs0000\tsk0002.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\17.02.2012_19.52.53\tdlfs0000\tsk0005.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\17.02.2012_19.52.53\tdlfs0000\tsk0006.dta a variant of Win32/Rootkit.Kryptik.GK trojan C:\_OTL\MovedFiles\02142012_064351\C_Program Files\LP\6875\354.exe a variant of Win32/Kryptik.AAPS trojan C:\_OTL\MovedFiles\02142012_064351\C_Users\Ana\AppData\Roaming\mozilla\Firefox\Profiles\d5btn3lz.default\extensions\{c8d9ff79-5aaa-4de6-afb9-fbbf30daa013}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan C:\_OTL\MovedFiles\02162012_115350\c_program files\F3C43\lvvm.exe a variant of Win32/Kryptik.AAPL trojan C:\_OTL\MovedFiles\02162012_115350\C_Users\Ana\AppData\Roaming\Microsoft\6875\354.exe a variant of Win32/Kryptik.AAPS trojan Next, I do not currently have any antivirus / malware protection on this computer. I have not used this machine for web browsing other than trusted sites (NOAA weather, NPR) since I started this cleaning process. I usually run AVG, spybot, & adaware. I can reinstall any or all of these unless you have a better suggestion. I should be home by noon CST & I'll check posts then. Thanks, Patrick
Hi anas_dad,

The ESET detections are files we havw all ready quarantined. they will be removed when we remove the tools.

You can install your antivirus probgram shortly. I suggest you install Spybot rather than Spybot and Ad-Aware, they do the same thing. With Spybot and MBAM installed you will have a resident and an on demand antispyware/malware scanner. Did you uninstall Spybot or just disable it via msconfig?


Keep Defogger, we will use it shortly. Also do not delete this file
C:\Users\Ana\defogger_reenable


From your desktop, please delete, if present
  • any notepads/logs that we created
  • Rogue Killer
  • aswMBR.exe
  • mbr.dat
  • mbr.zip
  • RK_Quarantine
  • TDSSKiller
You can also delete anything we saved to your usb device and this folder C:\TDSSKiller_Quarantine



Keep the xPUD CD, it may come in handy.

I suggest you keep MBAM. Keep it updated and use it regularly.

You can also keep ATF


Next

Press the Windows key and the R key at the same time. The run box will appear. Into the run box copy and paste the following line and click ok.

Combofix /uninstall


Next
Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.


Updates

You can now install AVG or a different one. Only install one though.

There are some traces of AVG 2012 on your computer. Before installing AVG or an alternative antivirus run the AVG Removal tool from HERE .

Here are some choices including AVG.

Avast
Help and support can be found here Avast Forum
AVG
Help and support can be found here AVG Forum
Antivir PersonalEditionClassic
Help and support can be found here Avira Personal Support Forum
Microsoft Security Essentials
Support


Adobe

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources. If you choose to go with Foxit decline the FoxitToolbar during the install.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 8.1.4 first. Be sure to move any PDF documents to another folder first though.



Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall. Just add a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.



-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Make sure you have reset Automatic Updates to your chosen optionClick your start button > All Programs > Windows updates


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE

Please post back if you have any problems with these steps.

Thanks
Hello Oldman960, One slight problem, When OTL cleanup ran, Defogger was removed I typed defogger into the search box & found a file called defogger_reenable but no program to run it. Patrick
Hello Oldman960, Well it took me awhile but I think I've got everything back and working. Am now loaded with: Spybot S&D - Spyware blaster - MBAM I put these three on the right side of the desktop & pinned a note to remind her to update and run them at least twice a month. I removed all the unneeded programs IE and updates are as you suggested The hover ads were solved when I reinstalled Adblock plus I even managed to reinstall the trash bin icon Is there anything else we should be doing?

Attachments:

Hi anas_dad, We're all done. You can delete the 2 xPUD items in the lower left of the desktop. They are just the setup files for burning the CD. Take care.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI