Malware, Adware in Windows 7 [Solved]

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

• First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
• Perform everything in the correct order. Sometimes one step requires the previous one.
• If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
• Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
• Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
• Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
• My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

• Important: To help me reviewing your logs, please post them in code boxes. You can create them by clicking on the <>-symbol on top of the reply window.

 

 

 

 

Going over your logs I noticed that you have uTorrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall uTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.
If you wish to keep it, please do not use it until your computer is cleaned.

 

 

 

 

 

We need to remove some programs with Revo Uninstaller Free:


Note: Revo Uninstaller is more thorough in deleting programs on your computer than using the Add/Remove option in Windows. Since it is a more powerful tool, please be sure to follow the instructions carefully.
Note: If the program you want to uninstall is not listed by Revo, let me know and we will try an altenate method of removal.

• Please download and install Revo Uninstaller Free
  note: there is no need to click anything on that page, the download will start automatically
• Double click Revo Uninstaller to run it
• From the list of programs double click on the listed program(s), or anything similar, to remove it:
  

  AnyProtect
  
  HitsBlender

• When prompted if you want to uninstall click Yes
• Be sure the Moderate option is selected then click Next
• The program will run, If prompted again click Yes
• When the built-in uninstaller is finished click on Next
• Once the program has searched for leftovers click Next
• Check the items in bold only on the list then click Delete
  note: you may have to expand some folders by clicking the "+" mark
• When prompted click on Yes and then on Next
• Put a check on any folders that are found and select Delete
• When prompted select Yes then Next
• Once done click Finish

 

 

 

 

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 

• Download the attached fixlist.txt and save it to the location where FRST is saved to.
• Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
• The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

 

 

 

 

 

Full System Scan with Malwarebytes Antimalware
 

• If not existing, please download Malwarebytes Anti-Malware to your desktop.
• Double-click the downloaded setup file and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
  • Launch Malwarebytes Anti-Malware
  • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish.

If the program is already installed:

• Run Malwarebytes Antimalware
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-10-2014 02
Ran by [removed] at 2014-10-14 10:06:07 Run:1
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: {DB78C641-F7C6-4D6D-8A20-347288A091A8} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-13] (AnyProtect.com) <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {8C734488-7E68-4C0E-B08E-F2B42A19517B} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ATTENTION
Task: {9F9771BC-9D59-4043-8188-B11E2E90716E} - \WSE_Astromenda No Task File <==== ATTENTION
Task: {5B469382-0887-4F49-82ED-5C2852AC19A1} - \Advanced-System Protector_startup No Task File <==== ATTENTION
Task: {60E9E589-B3C0-4B5B-AA89-A71C7DA51B68} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-13] (AnyProtect.com) <==== ATTENTION
Task: {6954AED3-427F-409D-848D-186F98A72B97} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-10-13] (AnyProtect.com) <==== ATTENTION
Task: {246599A1-3E01-4F84-8B38-B9BF8A56E65A} - \BlockAndSurf Update No Task File <==== ATTENTION
Task: {2B716B13-3F00-4339-A656-A71EAEFACCEA} - \RegClean Pro_DEFAULT No Task File <==== ATTENTION
Task: {34EE09F1-DA78-41A9-85DA-615AE51ADB38} - \Update Service YourFileDownloader No Task File <==== ATTENTION
Task: {4E8BEF54-10DC-4E6D-A934-745B4FEC0103} - \RegClean Pro No Task File <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR Extension: (PriceLess) - C:\Users\AthlonX4\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdjjfhfjceapcnapdhbkimaojpadfde\5.2 [2014-10-13]
CHR Extension: (PriceLess) - C:\Users\AthlonX4\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdjjfhfjceapcnapdhbkimaojpadfde [2014-10-13]
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKCU - {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = http://www.trovi.com…rchTerms}&SSPV=
SearchScopes: HKLM - {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = 
HKU\S-1-5-21-3478498415-794229227-1261764834-1000\…\Run: [HitsBlender] => C:\Program Files (x86)\HitsBlender\hitsblender.exe [1596472 2014-10-13] ()
HKU\S-1-5-21-3478498415-794229227-1261764834-1000\…\MountPoints2: {2be1db6c-08cb-11e3-9bec-001cf09f0e76} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\drivers\setup.exe
HKU\S-1-5-21-3478498415-794229227-1261764834-1000\…\MountPoints2: {5358d9e2-d87c-11e2-af39-90fba64bf37d} - J:\INSTALL.EXE
HKU\S-1-5-21-3478498415-794229227-1261764834-1000\…\MountPoints2: {ca287faf-b868-11e3-8e8d-001cf09f0e76} - E:\HTC_Sync_Manager_PC.exe

R2 webinstrNew; C:\Windows\system32\Drivers\webinstrNew.sys [56504 2014-10-13] (Corsica)

2014-10-13 16:15 - 2014-10-13 19:59 - 00000000 ____D () C:\Users\AthlonX4\AppData\Local\HitsBlender
2014-10-13 16:15 - 2014-10-13 19:55 - 00000000 ____D () C:\Users\AthlonX4\AppData\Roaming\Systweak
2014-10-13 16:15 - 2014-10-13 19:55 - 00000000 ____D () C:\ProgramData\Systweak
2014-10-13 16:15 - 2014-10-13 16:15 - 00003026 _____ () C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2014-10-13 16:15 - 2014-10-13 16:15 - 00000000 ____D () C:\Users\AthlonX4\AppData\Local\cache
2014-10-13 16:15 - 2014-10-06 16:36 - 00020296 _____ () C:\Windows\system32\roboot64.exe
2014-10-13 16:14 - 2014-10-13 16:55 - 00000600 __RSH () C:\ProgramData\ntuser.pol
2014-10-13 16:14 - 2014-10-13 16:15 - 00000004 _____ () C:\end
2014-10-13 16:14 - 2014-10-13 16:14 - 00003118 _____ () C:\Windows\System32\Tasks\Update Service HitsBlender
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Guest\AppData\Local\Torch
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Guest\AppData\Local\Chromatic Browser
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Guest
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\AthlonX4\AppData\Local\Torch
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\AthlonX4\AppData\Local\Comodo
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\AthlonX4\AppData\Local\Chromatic Browser
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Users\Administrator
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\HitsBlender
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\ProgramData\HitsBlender
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\ProgramData\c4ca3d2e5a673ccf
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Program Files (x86)\HitsBlenderUpdater
2014-10-13 16:14 - 2014-10-13 16:14 - 00000000 ____D () C:\Program Files (x86)\HitsBlender
2014-10-13 16:12 - 2014-10-13 16:13 - 03611152 _____ (http://yourfile-downloader.com) C:\Users\AthlonX4\Downloads\lol_a_plus_v1_2_downloader.exe 
2014-10-13 16:56 - 2014-10-13 17:16 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-10-13 16:56 - 2014-10-13 17:07 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-10-13 16:56 - 2014-10-13 17:07 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-10-13 16:56 - 2014-10-13 16:57 - 00001238 _____ () C:\Users\AthlonX4\AppData\Roaming\aps.scan.quick.results
2014-10-13 16:56 - 2014-10-13 16:56 - 00612152 _____ (CMI Limited) C:\Users\AthlonX4\AppData\Local\nsxFD83.tmp
2014-10-13 16:56 - 2014-10-13 16:56 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-10-13 16:56 - 2014-10-13 16:56 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-10-13 16:56 - 2014-10-13 16:56 - 00002832 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-10-13 16:56 - 2014-10-13 16:56 - 00000000 ____D () C:\Users\AthlonX4\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2014-10-13 16:56 - 2014-10-13 16:56 - 00000000 ____D () C:\Users\AthlonX4\AppData\Roaming\ap_movie
2014-10-13 16:56 - 2014-10-13 16:56 - 00000000 ____D () C:\Users\AthlonX4\AppData\Roaming\AnyProtectEx
2014-10-13 16:56 - 2014-10-13 16:56 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2014-10-13 16:56 - 2014-10-13 16:56 - 00000000 _____ () C:\Users\AthlonX4\AppData\Roaming\aps.scan.results
2014-10-13 16:55 - 2014-10-13 16:55 - 00056504 _____ (Corsica) C:\Windows\system32\Drivers\webinstrNew.sys
2014-10-13 16:55 - 2014-10-13 16:55 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf
C:\Program Files (x86)\AnyProtectEx
C:\Program Files (x86)\RCP

EmptyTemp:
*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB78C641-F7C6-4D6D-8A20-347288A091A8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB78C641-F7C6-4D6D-8A20-347288A091A8}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => Key deleted successfully.
C:\Windows\Tasks\APSnotifierPP1.job => Moved successfully.
C:\Windows\Tasks\APSnotifierPP2.job => Moved successfully.
C:\Windows\Tasks\APSnotifierPP3.job => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C734488-7E68-4C0E-B08E-F2B42A19517B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C734488-7E68-4C0E-B08E-F2B42A19517B}" => Key deleted successfully.
C:\Windows\System32\Tasks\RegClean Pro_UPDATES => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_UPDATES" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9F9771BC-9D59-4043-8188-B11E2E90716E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9F9771BC-9D59-4043-8188-B11E2E90716E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WSE_Astromenda" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5B469382-0887-4F49-82ED-5C2852AC19A1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5B469382-0887-4F49-82ED-5C2852AC19A1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced-System Protector_startup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{60E9E589-B3C0-4B5B-AA89-A71C7DA51B68}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60E9E589-B3C0-4B5B-AA89-A71C7DA51B68}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6954AED3-427F-409D-848D-186F98A72B97}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6954AED3-427F-409D-848D-186F98A72B97}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{246599A1-3E01-4F84-8B38-B9BF8A56E65A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{246599A1-3E01-4F84-8B38-B9BF8A56E65A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BlockAndSurf Update" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2B716B13-3F00-4339-A656-A71EAEFACCEA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2B716B13-3F00-4339-A656-A71EAEFACCEA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro_DEFAULT" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{34EE09F1-DA78-41A9-85DA-615AE51ADB38}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{34EE09F1-DA78-41A9-85DA-615AE51ADB38}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Update Service YourFileDownloader" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4E8BEF54-10DC-4E6D-A934-745B4FEC0103}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4E8BEF54-10DC-4E6D-A934-745B4FEC0103}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\AthlonX4\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdjjfhfjceapcnapdhbkimaojpadfde\5.2 => Moved successfully.
C:\Users\AthlonX4\AppData\Local\Google\Chrome\User Data\Default\Extensions\abdjjfhfjceapcnapdhbkimaojpadfde => Moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}" => Key deleted successfully.
"HKCR\CLSID\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}" => Key deleted successfully.
"HKCR\CLSID\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}" => Key not found.
HKU\S-1-5-21-3478498415-794229227-1261764834-1000\Software\Microsoft\Windows\CurrentVersion\Run\\HitsBlender => Value not found.
"HKU\S-1-5-21-3478498415-794229227-1261764834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2be1db6c-08cb-11e3-9bec-001cf09f0e76}" => Key deleted successfully.
"HKCR\CLSID\{2be1db6c-08cb-11e3-9bec-001cf09f0e76}" => Key not found.
"HKU\S-1-5-21-3478498415-794229227-1261764834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5358d9e2-d87c-11e2-af39-90fba64bf37d}" => Key deleted successfully.
"HKCR\CLSID\{5358d9e2-d87c-11e2-af39-90fba64bf37d}" => Key not found.
"HKU\S-1-5-21-3478498415-794229227-1261764834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca287faf-b868-11e3-8e8d-001cf09f0e76}" => Key deleted successfully.
"HKCR\CLSID\{ca287faf-b868-11e3-8e8d-001cf09f0e76}" => Key not found.
webinstrNew => Service stopped successfully.
webinstrNew => Service deleted successfully.
C:\Users\AthlonX4\AppData\Local\HitsBlender => Moved successfully.
C:\Users\AthlonX4\AppData\Roaming\Systweak => Moved successfully.
C:\ProgramData\Systweak => Moved successfully.
"C:\Windows\System32\Tasks\RegClean Pro_UPDATES" => File/Directory not found.
C:\Users\AthlonX4\AppData\Local\cache => Moved successfully.
C:\Windows\system32\roboot64.exe => Moved successfully.
C:\ProgramData\ntuser.pol => Moved successfully.
C:\end => Moved successfully.
C:\Windows\System32\Tasks\Update Service HitsBlender => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Torch => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Google => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Comodo => Moved successfully.
C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\HomeGroupUser$ => Moved successfully.
C:\Users\Guest\AppData\Local\Torch => Moved successfully.
C:\Users\Guest\AppData\Local\Google => Moved successfully.
C:\Users\Guest\AppData\Local\Comodo => Moved successfully.
C:\Users\Guest\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\Guest => Moved successfully.
C:\Users\AthlonX4\AppData\Local\Torch => Moved successfully.
C:\Users\AthlonX4\AppData\Local\Comodo => Moved successfully.
C:\Users\AthlonX4\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\Administrator\AppData\Local\Torch => Moved successfully.
C:\Users\Administrator\AppData\Local\Google => Moved successfully.
C:\Users\Administrator\AppData\Local\Comodo => Moved successfully.
C:\Users\Administrator\AppData\Local\Chromatic Browser => Moved successfully.
C:\Users\Administrator => Moved successfully.
"C:\ProgramData\Microsoft\Windows\Start Menu\HitsBlender" => File/Directory not found.
C:\ProgramData\HitsBlender => Moved successfully.
C:\ProgramData\c4ca3d2e5a673ccf => Moved successfully.
C:\Program Files (x86)\HitsBlenderUpdater => Moved successfully.
"C:\Program Files (x86)\HitsBlender" => File/Directory not found.
C:\Users\AthlonX4\Downloads\lol_a_plus_v1_2_downloader.exe => Moved successfully.
"C:\Windows\Tasks\APSnotifierPP1.job" => File/Directory not found.
"C:\Windows\Tasks\APSnotifierPP3.job" => File/Directory not found.
"C:\Windows\Tasks\APSnotifierPP2.job" => File/Directory not found.
"C:\Users\AthlonX4\AppData\Roaming\aps.scan.quick.results" => File/Directory not found.
C:\Users\AthlonX4\AppData\Local\nsxFD83.tmp => Moved successfully.
"C:\Windows\System32\Tasks\APSnotifierPP1" => File/Directory not found.
"C:\Windows\System32\Tasks\APSnotifierPP3" => File/Directory not found.
"C:\Windows\System32\Tasks\APSnotifierPP2" => File/Directory not found.
"C:\Users\AthlonX4\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup" => File/Directory not found.
C:\Users\AthlonX4\AppData\Roaming\ap_movie => Moved successfully.
C:\Users\AthlonX4\AppData\Roaming\AnyProtectEx => Moved successfully.
"C:\Program Files (x86)\AnyProtectEx" => File/Directory not found.
"C:\Users\AthlonX4\AppData\Roaming\aps.scan.results" => File/Directory not found.
C:\Windows\system32\Drivers\webinstrNew.sys => Moved successfully.
C:\Windows\system32\Drivers\Msft_Kernel_webinstrNew_01009.Wdf => Moved successfully.
"C:\Program Files (x86)\AnyProtectEx" => File/Directory not found.
"C:\Program Files (x86)\RCP" => File/Directory not found.
EmptyTemp: => Removed 4.6 GB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/14/2014
Scan Time: 10:14:57 AM
Logfile: 
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.10.14.09
Rootkit Database: v2014.10.11.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: AthlonX4

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 348798
Time Elapsed: 45 min, 8 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Scan with ESET Online Scan

Go here to run an online scannner from ESET. Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

• Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Here's how.
• Click the blue Run ESET Online Scanner button
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
• Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
• Click on Advanced Settings
• Make sure that the option Remove found threats is unticked.
• Ensure these options are ticked
• Scan archives
• Scan for potentially unsafe applications
• Enable Anti-Stealth technology
• Click Start
• Wait for the scan to finish
• When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…"
• Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
• Close the ESET online scan, and let me know how things are now.

C:\FRST\Quarantine\C\Program Files (x86)\HitsBlenderUpdater\Uninstall.exe	a variant of Win32/ExpressDownloader.K potentially unwanted application
C:\FRST\Quarantine\C\Users\AthlonX4\AppData\Local\nsxFD83.tmp.xBAD	Win32/AnyProtect.F potentially unwanted application
C:\FRST\Quarantine\C\Users\AthlonX4\Downloads\lol_a_plus_v1_2_downloader.exe.xBAD	a variant of Win32/ExpressDownloader.K potentially unwanted application
C:\FRST\Quarantine\C\Windows\System32\roboot64.exe.xBAD	a variant of Win64/Systweak.A potentially unwanted application
C:\Users\AthlonX4\Downloads\BloodlineChampionsInstaller.exe	Win32/OpenCandy potentially unsafe application
C:\Users\AthlonX4\Downloads\rcsetup151.exe	Win32/Bundled.Toolbar.Google.D potentially unsafe application
X:\Games\Bridgebuilder\Bridge Project version 1.dat	Win32/HackTool.Crack.BQ potentially unsafe application
X:\Games2\The Cave w updates\The Cave.dat	a variant of Win32/HackTool.Crack.CC potentially unsafe application

Computer seems to run fine, settings seem to be back to normal in all of my browsers.

Hi lamaroo,

TB-Psychotic isn't available for a day or two so let's see if I can help you get back to your regularly scheduled life.

It looks like you're pretty much done. The one thing I'd add is that it appears that your version of a couple of games, Bridge Builder and The caves, may be hacked versions. I'd delete them immediately.

That being said, it appears we can do some housekeeping:

We need to remove the tools we've used during cleaning your machine

• Download Delfix from here
• Ensure Remove disinfection tools is ticked
  Also tick:
  • Create registry backup
  • Purge system restore
  [external image: delfix.jpg]
• Click Run

The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply


Also please let me know if you have any outstanding issues.

# DelFix v10.8 - Logfile created 22/10/2014 at 14:45:58
# Updated 29/07/2014 by Xplode
# Username : AthlonX4 - ATHLONX4-PC
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)

~ Removing disinfection tools …

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\AthlonX4\Desktop\Addition.txt
Deleted : C:\Users\AthlonX4\Desktop\adwcleaner_4.001.exe
Deleted : C:\Users\AthlonX4\Desktop\aswMBR.exe
Deleted : C:\Users\AthlonX4\Desktop\aswMBR.txt
Deleted : C:\Users\AthlonX4\Desktop\Fixlog.txt
Deleted : C:\Users\AthlonX4\Desktop\FRST.txt
Deleted : C:\Users\AthlonX4\Desktop\FRST64.exe
Deleted : C:\Users\AthlonX4\Desktop\JRT.exe
Deleted : C:\Users\AthlonX4\Desktop\JRT.txt
Deleted : C:\Users\AthlonX4\Desktop\MBR.dat
Deleted : C:\Users\AthlonX4\Desktop\SecurityCheck.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup … OK

~ Cleaning system restore …

Deleted : RP #273 [Revo Uninstaller's restore point - AnyProtect | 10/14/2014 13:56:58]
Deleted : RP #274 [Revo Uninstaller's restore point - HitsBlender | 10/14/2014 14:00:31]
Deleted : RP #275 [Windows Update | 10/15/2014 23:13:24]
Deleted : RP #276 [Windows Update | 10/16/2014 22:54:17]
Deleted : RP #277 [Windows Update | 10/21/2014 02:05:21]

New restore point created !

########## - EOF - ##########

I don't think there are any other issues. Thanks to both of you for your help.

lamaroo,
 

The following is my standard advice for the future.  Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing.  Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware" 
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions.  Otherwise, this thread will be closed Resolved. 
 

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.