Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

program setup1527422440_exe

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: program setup1527422440_exe

Unread postby askey127 » May 30th, 2011, 2:38 pm

erika,
I don't ordinarily suggest removing paid Antivirus programs, but Webroot has a certain history.
I think it would be worth it if it were my machine, since the alternative is a possible broken Windows 7 system.
If you are willing, and especially if you can save your Webroot installation (activation) code, do as follows:
-----------------------------------------------
Download Antivir Free
This program is free for personal, non-business use.
Download AntiVir Free from here : http://www.softpedia.com/get/Antivirus/AntiVir-Personal-Edition.shtml
Click the Download button. Then when the "Download Locations" page comes up, choose the first External Mirror (exe)
Save the Installer to your desktop, but don't run it yet. The installer file will be named avira_antivir_personal_en.exe
Double check to be sure you know where to find it.
------------------------------------------------
Remove Programs Using Control Panel
From Start, Control Panel, click on Uninstall a program under the Programs heading.
Right click each Entry, as follows, one by one, if it exists, choose Uninstall/Change, and give permission to Continue:

Webroot Software
Webroot ... anything

Take extra care in answering questions posed by any Uninstaller.
-----------------------------------------------------------
REBOOT (RESTART) Your Machine
-----------------------------------------------
Install Antivir
Right Click the Avira Antivir Installer you saved on your desktop, choose "Run as administrator", and let it Install Antivir.
-----------------------------------------------
Update and Scan with Antivir
Right click the red umbrella icon and choose Start Antivir.
When the window comes up click Start Update.
When the update is complete, click on Scan System Now.
This full scan could take a hour or more.
It will ask what to do with any item it finds.
IMPORTANT >> tell it to DELETE or QUARANTINE any items it finds.
-----------------------------------------------
Get Last Avira Report
Right click the red umbrella icon in the system tray and click Start Antivir
In the left pane, click Overview, then click Reports
There wil be reports titled Update and reports titled Scan. Find the most recent report in the list titled Scan
Click on the Report File button, or Right click the report and choose Display Report.
The report contents will come up in Notepad. Highlight the entire report (Ctrl+A) and copy to the clipboard (Ctrl+C).
Paste the contents (Ctrl+V) into your next reply.

askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA
Advertisement
Register to Remove

Re: program setup1527422440_exe

Unread postby erika » May 30th, 2011, 9:15 pm

Hi askey127,

I had 45 days left on my webroot spysweeper subscription. Plus the price of Avira is to my liking. And being German, I'm happy to have my countrymen's product keeping my laptop virus free. :)

Avira AntiVir Personal
Report file date: Monday, May 30, 2011 18:11

Scanning for 2777566 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7 x64
Windows version : (plain) [6.1.7600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : OWNER-HP

Version information:
BUILD.DAT : 10.0.0.648 31823 Bytes 4/1/2011 18:36:00
AVSCAN.EXE : 10.0.4.2 442024 Bytes 4/1/2011 21:07:43
AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2011 21:07:57
LUKE.DLL : 10.0.3.2 104296 Bytes 4/1/2011 21:07:53
LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 20:15:47
VBASE002.VDF : 7.11.3.0 1950720 Bytes 2/9/2011 20:15:47
VBASE003.VDF : 7.11.5.225 1980416 Bytes 4/7/2011 22:04:13
VBASE004.VDF : 7.11.5.226 2048 Bytes 4/7/2011 22:04:13
VBASE005.VDF : 7.11.5.227 2048 Bytes 4/7/2011 22:04:13
VBASE006.VDF : 7.11.5.228 2048 Bytes 4/7/2011 22:04:13
VBASE007.VDF : 7.11.5.229 2048 Bytes 4/7/2011 22:04:13
VBASE008.VDF : 7.11.5.230 2048 Bytes 4/7/2011 22:04:13
VBASE009.VDF : 7.11.5.231 2048 Bytes 4/7/2011 22:04:14
VBASE010.VDF : 7.11.5.232 2048 Bytes 4/7/2011 22:04:14
VBASE011.VDF : 7.11.5.233 2048 Bytes 4/7/2011 22:04:14
VBASE012.VDF : 7.11.5.234 2048 Bytes 4/7/2011 22:04:14
VBASE013.VDF : 7.11.6.28 158208 Bytes 4/11/2011 22:04:15
VBASE014.VDF : 7.11.6.74 116224 Bytes 4/13/2011 22:04:16
VBASE015.VDF : 7.11.6.113 137728 Bytes 4/14/2011 22:04:17
VBASE016.VDF : 7.11.6.150 146944 Bytes 4/18/2011 22:04:18
VBASE017.VDF : 7.11.6.192 138240 Bytes 4/20/2011 22:04:19
VBASE018.VDF : 7.11.6.237 156160 Bytes 4/22/2011 22:04:20
VBASE019.VDF : 7.11.7.45 427520 Bytes 4/27/2011 22:04:22
VBASE020.VDF : 7.11.7.64 192000 Bytes 4/28/2011 22:04:24
VBASE021.VDF : 7.11.7.97 182272 Bytes 5/2/2011 22:04:25
VBASE022.VDF : 7.11.7.127 467968 Bytes 5/4/2011 22:04:29
VBASE023.VDF : 7.11.7.183 185856 Bytes 5/9/2011 22:04:30
VBASE024.VDF : 7.11.7.218 133120 Bytes 5/11/2011 22:04:31
VBASE025.VDF : 7.11.7.234 139776 Bytes 5/11/2011 22:04:32
VBASE026.VDF : 7.11.8.16 147456 Bytes 5/13/2011 22:04:33
VBASE027.VDF : 7.11.8.46 169472 Bytes 5/17/2011 22:04:34
VBASE028.VDF : 7.11.8.109 181760 Bytes 5/24/2011 22:04:35
VBASE029.VDF : 7.11.8.158 191488 Bytes 5/27/2011 22:04:37
VBASE030.VDF : 7.11.8.159 2048 Bytes 5/27/2011 22:04:37
VBASE031.VDF : 7.11.8.172 95232 Bytes 5/30/2011 22:04:38
Engineversion : 8.2.5.6
AEVDF.DLL : 8.1.2.1 106868 Bytes 3/28/2011 20:15:27
AESCRIPT.DLL : 8.1.3.65 1606010 Bytes 5/30/2011 22:04:56
AESCN.DLL : 8.1.7.2 127349 Bytes 3/28/2011 20:15:27
AESBX.DLL : 8.2.1.33 323956 Bytes 5/30/2011 22:04:58
AERDL.DLL : 8.1.9.9 639347 Bytes 3/25/2011 16:21:38
AEPACK.DLL : 8.2.6.8 557430 Bytes 5/30/2011 22:04:53
AEOFFICE.DLL : 8.1.1.23 205178 Bytes 5/30/2011 22:04:51
AEHEUR.DLL : 8.1.2.122 3494263 Bytes 5/30/2011 22:04:51
AEHELP.DLL : 8.1.17.2 246135 Bytes 5/30/2011 22:04:42
AEGEN.DLL : 8.1.5.6 401780 Bytes 5/30/2011 22:04:41
AEEMU.DLL : 8.1.3.0 393589 Bytes 3/28/2011 20:15:19
AECORE.DLL : 8.1.21.1 196983 Bytes 5/30/2011 22:04:40
AEBB.DLL : 8.1.1.0 53618 Bytes 3/28/2011 20:15:19
AVWINLL.DLL : 10.0.0.0 19304 Bytes 3/28/2011 20:15:31
AVPREF.DLL : 10.0.0.0 44904 Bytes 4/1/2011 21:07:42
AVREP.DLL : 10.0.0.10 174120 Bytes 5/30/2011 22:05:00
AVREG.DLL : 10.0.3.2 53096 Bytes 4/1/2011 21:07:42
AVSCPLR.DLL : 10.0.4.2 84840 Bytes 4/1/2011 21:07:43
AVARKT.DLL : 10.0.22.6 231784 Bytes 4/1/2011 21:07:38
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 4/1/2011 21:07:41
SQLITE3.DLL : 3.6.19.0 355688 Bytes 6/17/2010 19:27:22
AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/28/2011 20:15:30
NETNT.DLL : 10.0.0.0 11624 Bytes 3/28/2011 20:15:39
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 4/1/2011 21:07:58
RCTEXT.DLL : 10.0.58.0 97128 Bytes 3/28/2011 20:15:52

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Monday, May 30, 2011 18:11

Starting search for hidden objects.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}\ShellFolder\attributes
[NOTE] The registry entry is invisible.
C:\Program Files\Common Files\Microsoft Shared\Windows Live
C:\Program Files\Common Files\Microsoft Shared\Windows Live
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray\BattMeter\Flyout\381b4222-f694-41f0-9685-ff5bb260df2e
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fences Pro\versionmajor
[NOTE] The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fences Pro\versionminor
[NOTE] The registry entry is invisible.
C:\Program Files\Hewlett-Packard\HP Client Services\
C:\Program Files\Hewlett-Packard\HP Client Services\
[NOTE] The registry entry is invisible.

The scan of running processes will be started
Scan process 'avscan.exe' - '74' Module(s) have been scanned
Scan process 'avscan.exe' - '29' Module(s) have been scanned
Scan process 'avcenter.exe' - '77' Module(s) have been scanned
Scan process 'avgnt.exe' - '59' Module(s) have been scanned
Scan process 'sched.exe' - '50' Module(s) have been scanned
Scan process 'avguard.exe' - '68' Module(s) have been scanned
Scan process 'UNS.exe' - '58' Module(s) have been scanned
Scan process 'LMS.exe' - '29' Module(s) have been scanned
Scan process 'YCMMirage.exe' - '42' Module(s) have been scanned
Scan process 'plugin-container.exe' - '77' Module(s) have been scanned
Scan process 'hpqwmiex.exe' - '38' Module(s) have been scanned
Scan process 'firefox.exe' - '104' Module(s) have been scanned
Scan process 'WinPatrol.exe' - '74' Module(s) have been scanned
Scan process 'HPMSGSVC.exe' - '50' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '38' Module(s) have been scanned
Scan process 'DPAgent.exe' - '57' Module(s) have been scanned
Scan process 'RNowSvc.exe' - '27' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '25' Module(s) have been scanned
Scan process 'HPWMISVC.exe' - '37' Module(s) have been scanned
Scan process 'HPDrvMntSvc.exe' - '19' Module(s) have been scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '96' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\Users\Owner\Desktop\Geek Squad Data Transfer\Schatzi\Documents\_delMe\Security Threat Analysis.mht
[0] Archive type: MIME
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
--> http://www2.megarockz9.co.cc/107a68c6ce ... 3010311.js
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
C:\Users\schatzi\cxux.exe
[DETECTION] Is the TR/Alureon.DX.309 Trojan
C:\Users\schatzi\dvmap.exe
[DETECTION] Is the TR/Kazy.GJ.2 Trojan
C:\Users\schatzi\guasuw.exe
[DETECTION] Contains recognition pattern of the WORM/Vobfus.F.2 worm
C:\Users\schatzi\mvmgr.exe
[DETECTION] Is the TR/Kazy.23682.6 Trojan
C:\Users\schatzi\nvqmgr.exe
[DETECTION] Is the TR/Kazy.23682.5 Trojan
C:\Users\schatzi\qaigih.exe
[DETECTION] Contains recognition pattern of the WORM/Vobfus.F.16 worm
C:\Users\schatzi\rsvhost.exe
[DETECTION] Is the TR/Agent.dek Trojan
C:\Users\schatzi\svcnat.exe
[DETECTION] Is the TR/Kazy.23682.5 Trojan
C:\Users\schatzi\Documents\_delMe\Security Threat Analysis.mht
[0] Archive type: MIME
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
--> http://www2.megarockz9.co.cc/107a68c6ce ... 3010311.js
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
Begin scan in 'D:\' <RECOVERY>

Beginning disinfection:
C:\Users\schatzi\Documents\_delMe\Security Threat Analysis.mht
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
[NOTE] The file was moved to the quarantine directory under the name '48749b85.qua'.
C:\Users\schatzi\svcnat.exe
[DETECTION] Is the TR/Kazy.23682.5 Trojan
[NOTE] The file was moved to the quarantine directory under the name '50e3b433.qua'.
C:\Users\schatzi\rsvhost.exe
[DETECTION] Is the TR/Agent.dek Trojan
[NOTE] The file was moved to the quarantine directory under the name '02a1eed8.qua'.
C:\Users\schatzi\qaigih.exe
[DETECTION] Contains recognition pattern of the WORM/Vobfus.F.16 worm
[NOTE] The file was moved to the quarantine directory under the name '6481a10c.qua'.
C:\Users\schatzi\nvqmgr.exe
[DETECTION] Is the TR/Kazy.23682.5 Trojan
[NOTE] The file was moved to the quarantine directory under the name '211d8c27.qua'.
C:\Users\schatzi\mvmgr.exe
[DETECTION] Is the TR/Kazy.23682.6 Trojan
[NOTE] The file was moved to the quarantine directory under the name '5e02be46.qua'.
C:\Users\schatzi\guasuw.exe
[DETECTION] Contains recognition pattern of the WORM/Vobfus.F.2 worm
[NOTE] The file was moved to the quarantine directory under the name '12ae920d.qua'.
C:\Users\schatzi\dvmap.exe
[DETECTION] Is the TR/Kazy.GJ.2 Trojan
[NOTE] The file was moved to the quarantine directory under the name '6ea2d25c.qua'.
C:\Users\schatzi\cxux.exe
[DETECTION] Is the TR/Alureon.DX.309 Trojan
[NOTE] The file was moved to the quarantine directory under the name '43f0fd1f.qua'.
C:\Users\Owner\Desktop\Geek Squad Data Transfer\Schatzi\Documents\_delMe\Security Threat Analysis.mht
[DETECTION] Contains recognition pattern of the JS/Fraud.AJ Java script virus
[NOTE] The file was moved to the quarantine directory under the name '5a86c69a.qua'.


End of the scan: Monday, May 30, 2011 21:05
Used time: 2:28:35 Hour(s)

The scan has been done completely.

31338 Scanned directories
645282 Files were scanned
10 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
10 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
645272 Files not concerned
2532 Archives were scanned
0 Warnings
16 Notes
469424 Objects were scanned with rootkit scan
6 Hidden objects were found
erika
Active Member
 
Posts: 12
Joined: May 22nd, 2011, 6:34 pm

Re: program setup1527422440_exe

Unread postby askey127 » May 31st, 2011, 7:17 am

erika,
Avira is extremely good. You will be satisfied.
---------------------------------------------
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: Select all
    :dir
    C:\Users\schatzi /nodirs
    
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Tell me how it's running. Are you able to do Adobe Reader or Java installs yet?

askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: program setup1527422440_exe

Unread postby erika » May 31st, 2011, 4:29 pm

Hi askey127,
  1. setupnnnnnnnnnnnnnnnnoo.exe has not been seen flashing since uninstalled webroot software
  2. System Look ran OK. See report following.
  3. MS Fix it 50356 ran OK.
  4. jre-6u25-windows-x64 abended on “Error 1606. Could not access network location %APPDATA%\.”
  5. AdbeRdr1001_en_US abended on “Error 1606. Could not access network location %APPDATA%\.”
  6. other than Java & Adobe Reader, my lappy appears to be mine again. :)
  7. question: does my laptop look clean enough to safely install mvp’s HOSTS file?
Regards,
Erika


SystemLook 04.09.10 by jpshortstuff
Log created at 09:45 on 31/05/2011 by eundv
Administrator - Elevation successful

========== dir ==========

C:\Users\schatzi - Parameters: "/nodirs"

---Files---
NTUSER.DAT --ahs-- 1572864 bytes [21:25 05/01/2011] [13:45 31/05/2011]
ntuser.dat.LOG1 --ahs-- 262144 bytes [21:25 05/01/2011] [13:45 31/05/2011]
ntuser.dat.LOG2 --ahs-- 0 bytes [21:25 05/01/2011] [21:25 05/01/2011]
NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf --ahs-- 65536 bytes [21:25 05/01/2011] [21:25 05/01/2011]
NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms --ahs-- 524288 bytes [21:25 05/01/2011] [21:25 05/01/2011]
NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms --ahs-- 524288 bytes [21:25 05/01/2011] [21:25 05/01/2011]
ntuser.ini ---hs-- 20 bytes [21:25 05/01/2011] [21:25 05/01/2011]

-= EOF =-
erika
Active Member
 
Posts: 12
Joined: May 22nd, 2011, 6:34 pm

Re: program setup1527422440_exe

Unread postby askey127 » June 1st, 2011, 2:04 pm

erika,
About the HOSTS file:
Your machine is clean enough, but you may have trouble installing it.
Vista is notoriously picky about allowing it.

You can follow the instructions on the MVPs site.
Be SURE to perform the task to disable the DNS Client service first, or the ensuing bootups will seem to take forever.

You will need to get help from a Systems forum to fix that Windows issue.
I don't think you have malware right now, but malware may have been responsible for what is now incorrect System behavior.
---------------------------------------------------------
Good System/Hardware Help Forums
NutNWorks here: http://www.nutnworks.com/forums/forumdisplay.php?f=60
or
GeekstoGo here for Vista/Windows 7: http://www.geekstogo.com/forum/Windows-Vista-Windows-7-f79.html
or
Computer Trouble here: http://forum.computertrouble.co.uk/index.php
or
TechSupportGuy here : http://forums.techguy.org/21-windows-nt-2000-xp/
or
Security Cadets PC and software help Section at : http://forum.securitycadets.com/

All may require you to register free before posting for help.
askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: program setup1527422440_exe

Unread postby erika » June 1st, 2011, 5:51 pm

Hi askey127,

I appreciate your help to this point.

Would you change anything (conclusions, advice, etc) because my OS is Windows 7, not Vista?

Regards,
erika
erika
Active Member
 
Posts: 12
Joined: May 22nd, 2011, 6:34 pm

Re: program setup1527422440_exe

Unread postby askey127 » June 1st, 2011, 6:42 pm

No.
You still need to disable the DNS Client Service, and install the HOSTS file manually, in my opinion.
I have Win7 x64.
My HOSTS file, according to Start, Computer, is in this folder - C:\Windows\System32\Drivers\etc\
It has no file type (no dot), no extension.
It was downloaded from hpHOSTS. It's 5 times as big, and may have a few false blockages, but a lot more protection.
MVPs is very reliable, and worth doing.
If you need help with disabling DNS Client, I can help.
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: program setup1527422440_exe

Unread postby erika » June 1st, 2011, 7:22 pm

Hi askey127,

Again, thank you for all.

If my Window's site needs answers I can't provide, may I ask you?

Regards,
erika
erika
Active Member
 
Posts: 12
Joined: May 22nd, 2011, 6:34 pm

Re: program setup1527422440_exe

Unread postby askey127 » June 1st, 2011, 7:33 pm

We are here for help, anytime.
We are a specialized site.
Our malware skills are better than our system/hardware skills.
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: program setup1527422440_exe

Unread postby askey127 » June 4th, 2011, 7:52 am

As any remaining issues do not involve malware and therefore fall outside the scope of this forum, this topic is now closed.
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 14025
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 288 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware