Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

help

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: help

Unread postby larnault » January 10th, 2012, 10:37 am

it seems to be better
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
File C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll not found.
HKU\S-1-5-21-4051198292-3032509420-350528711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\BC Native Housing\Desktop\cmd.bat deleted successfully.
C:\Users\BC Native Housing\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: BC Native Housing

User: Default

User: Default User

User: Kristin Hilder

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: BC Native Housing
->Flash cache emptied: 28903 bytes

User: Default

User: Default User

User: Kristin Hilder
->Flash cache emptied: 8306 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: All Users

User: BC Native Housing
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 223734238 bytes
->FireFox cache emptied: 54464709 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Kristin Hilder
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 590093 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 847872 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 525 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 267.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


OTL by OldTimer - Version 3.2.31.0 log created on 01102012_051833

Files\Folders moved on Reboot...
File\Folder C:\Users\BC Native Housing\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(552)\Content.IE5\WUH1HC7M\55OX7Ag,XqdvJrbT4IqlllYFZWTUU6MuVO3g3349TG0vXs9oi7dTaJ7g2_rAlcYs9M0_bqWfjIb-omaMn8z3rKvu8WEAB8k9M8cSPHpjNjmJKZKjWN5klbgXxgyvBcGYJ-DqhOo8_ixVSA[1].gif not found!

Registry entries deleted on Reboot...
larnault
Active Member
 
Posts: 10
Joined: January 7th, 2012, 4:36 am
Advertisement
Register to Remove

Re: help

Unread postby askey127 » January 10th, 2012, 11:34 am

larnault,
Since you have had a rootkit infection, please understand that any Usernames, passwords, account numbers, etc. that have passed thru the machine are likely to have been stolen.
This is especially true of any financial info.
A rootkit can do anything it wants, undetected, while it is onboard.

For that reason, we can never be 100% sure that the machine is completely secure afterward.
You machine does look OK now, but its always possible that some security settings have been changed without our knowledge.

We will do one more scan. If it looks clean, we will do a cleanup and our job will be done.

-------------------------------------------------
Run the ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.
You will, however, need to disable your current installed Anti-Virus. Additional information on how to do it is shown here.

Vista/Windows 7 users: You will need to to right-click on the either the Internet Explorer or FireFox icon in the Start Menu or Quick Launch Bar and select Run as Administrator.

  • Please go here to run the scan.
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13903
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: help

Unread postby larnault » January 10th, 2012, 7:55 pm

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=333431dec2fc7b47a1dd7efb917732a4
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-01-10 11:32:49
# local_time=2012-01-10 03:32:49 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 0 162841810 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=142742
# found=0
# cleaned=0
# scan_time=4086
larnault
Active Member
 
Posts: 10
Joined: January 7th, 2012, 4:36 am

Re: help

Unread postby askey127 » January 11th, 2012, 11:42 am

larnault,
Looks fine.
If you start OTL one more time, and click on the Clean Up button, it will remove itself and the tools we used.
You did a good job, and should be OK to go.

Glad we could help.
askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13903
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Re: help

Unread postby askey127 » January 14th, 2012, 9:35 am

this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13903
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA
Advertisement
Register to Remove

Previous

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 35 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware