WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Tricked by fake iTunes, need Adware Malware removal [Solved]

Started by jhess23a , Dec 02 2013 12:15 PM

quickshare

This topic is locked

52 replies to this topic

#31 jhess23a

Authentic Member

Authentic Member
101 posts

Posted 10 December 2013 - 05:07 AM

Malwarebytes Anti-Rootkit BETA 1.07.0.1008

www.malwarebytes.org

Database version: v2013.12.09.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16428

jeffhess :: JEFFHESS-PC [administrator]

12/9/2013 4:51:29 PM

mbar-log-2013-12-09 (16-51-29).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 241845

Time elapsed: 20 minute(s), 49 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

Advertisements

Register to Remove

#32 Jo*

SuperMember

Malware Team
1,208 posts

Posted 10 December 2013 - 11:43 AM

Hi jhess23a,

Scan with SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following code box into the main textfield:

:filefind
*scorpion
saver*
*adpeak*

:regfind
Scorpion Saver
Adpeak

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

***

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:OTL

:Files
C:\wajam_validate.exe
C:\Windows\SysNative\AdpeakProxy64.dll
C:\temp\InstallServices64.msi 
C:\Windows\Installer\212bab5.msi 


:Commands
[resethosts]
[purity]
[emptytemp]
[Reboot]
```
NOTICE: This script was written specifically for this user, for use on that particular machine.
Running this on another machine may cause damage to your operating system.
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script.

Graduate of the WTT Classroom
Cheers,
Jo

#33 jhess23a

Authentic Member

Authentic Member
101 posts

Posted 10 December 2013 - 12:27 PM

thanks! ScorpionSaver is no longer showing in my Programs and Features, but the QuickShare is. There is also a Microsoft Visual C++ 2008 Redistributable installed on 11/27 which was the day after we first were infected. I don't know if that's a legitimate program.

SystemLook 30.07.11 by jpshortstuff

Log created at 13:21 on 10/12/2013 by jeffhess

Administrator - Elevation successful

========== filefind ==========

Searching for "*scorpion"

No files found.

Searching for "saver*"

No files found.

Searching for "*adpeak*"

C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxy.ini.vir --a---- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E

C:\AdwCleaner\Quarantine\C\Windows\System32\AdpeakProxyOff.ini.vir --a---- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347

C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxy.ini.vir --a---- 5360 bytes [20:42 06/11/2013] [20:42 06/11/2013] 18DFC8C69730221B2CFEFFCCB565A90E

C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\AdpeakProxyOff.ini.vir --a---- 2312 bytes [20:32 06/11/2013] [20:32 06/11/2013] 1ED56540E72D15EA63DF19D70636A347

C:\Windows\System32\AdpeakProxy64.dll --a---- 439296 bytes [11:07 02/12/2013] [15:18 16/10/2013] 78857BF5996E9BC8E82C1B671CBF85E6

========== regfind ==========

Searching for "Scorpion Saver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Scorpion Saver]

[HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\Scorpion Saver]

[HKEY_USERS\S-1-5-18\Software\AppDataLow\Software\Scorpion Saver]

Searching for "Adpeak"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4f77-802C-5B295919C205}]

"LocalService"="AdpeakProxy"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}\LocalServer32]