Babylon [Solved]

Hey Bob,

No, it's a glimmer at an error .

I think you may have left out the very first line when pasting the "code" in the custom scans/fixes box.

Try running the fix again, this time making sure to include everything in the code box, including the line at the very top that says :OTL.

OK, NT. I see how you are…just tease me… Lets see if I got it right this time! All processes killed ========== OTL ========== HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\BrowserMngr Start Page| /E : value set successfully! HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found. Use Chrome's Settings page to change the HomePage. Use Chrome's Settings page to change the HomePage. ========== COMMANDS ========== Restore point Set: OTL Restore Point [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Joyce ->Temp folder emptied: 177792 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->Google Chrome cache emptied: 8630345 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 33320 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 8.00 mb OTL by OldTimer - Version 3.2.57.0 log created on 08182012_131554 Files\Folders moved on Reboot… C:\Users\Joyce\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files… File C:\Users\Joyce\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found! Registry entries deleted on Reboot…

Nicely done .

How is your computer behaving at the moment? Any sign of Babylon?

Update Adobe Reader
Earlier versions of Adobe Reader have known security flaws so it is recommended that you update your copy

• Go to Start > Control Panel > Add/Remove Programs
• Remove ALL instances of Adobe Reader
• Re-boot your computer if required.
• Once ALL versions of Adobe Reader have been uninstalled, visit: <> and download the latest version of Adobe Reader.
• Make sure you uncheck Yes, install McAfee Security Scan Plus - optional if prompted.

Alternative Option: after uninstalling Adobe Reader, you could try downloading and installing SlimPDF Reader from >here< SlimPDF Reader comes with no bloatware and loads extremely quickly.

===================================================

Please run Malwarebytes' Anti-Malware.

• Click the Update tab, then click Check for Updates.
• If an update is found, download and install the latest version.
• Next, click Scanner, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

===================================================

I need you to run the following scan: Eset Online Scanner

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button.
• Click Start.  The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button.  The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.

Hi, NT. No sign of Babylon. Chrome seems to come up fine. IE comes up with Bing as the home page now. Not sure, but she may have set it that way. IE does say it needs to upgrade to IE9, so one more task to do later. Adobe has been upgraded. It didn't offer me the option of saying no to McAfee, just dumped it in on the fly. No problem, I'll uninstall it. Had to stay with Adobe since this computer is used for her college classes and they specify it. Can I still download the SlimPDF and have both? Having a little trouble with Eset. It says it needs to down load something first since IE is not the browser I came in on. Said ok, but haven't been able to get it to run. I'll try a little later when I return. In the mean time, here is the Malwarebytes log. Thanks again! Malwarebytes Anti-Malware (Trial) 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.18.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Joyce :: JOYCE-PC [administrator] Protection: Enabled 8/18/2012 2:14:10 PM mbam-log-2012-08-18 (14-14-10).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 199046 Time elapsed: 1 minute(s), 26 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

No sign of Babylon. Chrome seems to come up fine. IE comes up with Bing as the home page now. Not sure, but
she may have set it that way. IE does say it needs to upgrade to IE9, so one more task to do later.

Excellent. Yes, please upgrade to IE9.

Adobe has been upgraded. It didn't offer me the option of saying no to McAfee, just dumped it in on the fly.
No problem, I'll uninstall it. Had to stay with Adobe since this computer is used for her college classes and
they specify it.
Can I still download the SlimPDF and have both?

You only need one PDF reader, so there is no point in downloading SlimPDF. Adobe Reader will do you just fine

Having a little trouble with Eset. It says it needs to down load something first since IE is not the browser I came in on.
Said ok, but haven't been able to get it to run. I'll try a little later when I return.
In the mean time, here is the Malwarebytes log.

Try to run it in IE after upgrading to version 9.

Thanks again!

You are very welcome :).

Hi, NT. Sorry about the delay. I managed to run the Eset Online Scanner this morning. The only txt log it saved was showed that it was installed. ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK I did write down what it listed before trying to save it: "a varient of Win32/installllQ appliation" "Win 32/Adware.Yontoo B application" "Win 32/Adware.Yontoo B application" I can rerun it this evening or in the morning if you think I should. Thanks

Hi Bob,

No need :). Your logs appear to be malware free.

Now let's clean up the tools we used and send you on your way. Please delete DDS and aswMBR.

Follow these steps to uninstall Combofix

* Click START
* Now type ComboFix /Uninstall in the searchbox and hit ENTER. Note the space between the X and the /, it needs to be there.
(Note: There is a space between the ..X and the /U that needs to be there.)


[external image: Posted Image]

===================================================

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Here are some tips to reduce the potential for spyware infection in the future:

Updates

• It is very important that you keep your Operating System and applications up to date so that you will be less susceptible to malware.
• It's a good idea to have Windows Update automatically download and install updates as they become available.
• Secunia Online Software Inspector is a great tool that will tell you which of your applications are outdated and vulnerable to attack.

Run Anti-Virus Software

• For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
• IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system.
• When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
• Once complete, remember to re-engage your resident security before going online.

Passwords

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection.
• Refer to this Microsoft article
  Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Spyware Protection

• This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
• How to Prevent Malware by miekiemoes
• PC Safety and Security–What Do I Need?

Additional Software

• To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
• SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here
• MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements.
• Google Chrome is a great alternative to Internet Explorer and Firefox.

Follow these steps, keep your antivirus program and antispyware programs updated, and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically. 

Hopefully this should take care of your problems! Good luck.

Do you have any further questions? 

**Please respond one more time to confirm your problem is resolved so I can close this thread.

Thank you very much, Noodle Tech! All appears well and Combofix and OTL have been removed. A couple of quick questions if you don't mind… ESET Online Scanner still shows in the program files…should I uninstall it or is it OK to keep? Is it OK to remove McAfee since she runs Norton 360? The Yontoo program is still listed…OK to dump? Do you know anything about this Privacy SafeGuard program? We still can't figure where it came from. I noticed a program calle Zinio Reader 4…I think that might have come from the Adobe upgrade…right? Okay, a couple more than a couple! Lastly…Are you really in Antarctica? I don't like winters in Ohio! Thanks again for all your help!

Thank you very much, Noodle Tech!

You are very welcome Bob :).

ESET Online Scanner still shows in the program files…should I uninstall it or is it OK to keep?

It's okay to keep, but it's your call. If you see any use for it, keep it.

Is it OK to remove McAfee since she runs Norton 360?

Yes, you should only run one antivirus product.

The Yontoo program is still listed…OK to dump?

Yup.

Do you know anything about this Privacy SafeGuard program? We still can't figure where it came from.

Go ahead and remove it. It probably came bundled with some other software you downloaded.

I noticed a program calle Zinio Reader 4…I think that might have come from the Adobe upgrade…right?

I doubt it. It's for reading magazines on your computer. You can get rid of it if you don't use it.

Okay, a couple more than a couple!

Lastly…Are you really in Antarctica? I don't like winters in Ohio!

Yes, I am in Antarctica.

Thanks again for all your help!

You're welcome!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.