This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

help

8 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

This thread's last reply is from January 14, 2012, 1:35 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

larnault
January 10, 2012, 2:37 PM UTC
it seems to be better
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
File C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll not found.
HKU\S-1-5-21-4051198292-3032509420-350528711-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\[redacted]\Desktop\cmd.bat deleted successfully.
C:\Users\[redacted]\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: [redacted]

User: Default

User: Default User

User: [redacted]

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: [redacted]
->Flash cache emptied: 28903 bytes

User: Default

User: Default User

User: [redacted]
->Flash cache emptied: 8306 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: All Users

User: [redacted]
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 223734238 bytes
->FireFox cache emptied: 54464709 bytes
->Flash cache emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: [redacted]
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 590093 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 847872 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 525 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 267.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


OTL by OldTimer - Version 3.2.31.0 log created on 01102012_051833

Files\Folders moved on Reboot...
File\Folder C:\Users\[redacted]\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low(552)\Content.IE5\WUH1HC7M\55OX7Ag,XqdvJrbT4IqlllYFZWTUU6MuVO3g3349TG0vXs9oi7dTaJ7g2_rAlcYs9M0_bqWfjIb-omaMn8z3rKvu8WEAB8k9M8cSPHpjNjmJKZKjWN5klbgXxgyvBcGYJ-DqhOo8_ixVSA[1].gif not found!

Registry entries deleted on Reboot...
askey127 Admin/Teacher
January 10, 2012, 3:34 PM UTC
larnault,
Since you have had a rootkit infection, please understand that any Usernames, passwords, account numbers, etc. that have passed thru the machine are likely to have been stolen.
This is especially true of any financial info.
A rootkit can do anything it wants, undetected, while it is onboard.

For that reason, we can never be 100% sure that the machine is completely secure afterward.
You machine does look OK now, but its always possible that some security settings have been changed without our knowledge.

We will do one more scan. If it looks clean, we will do a cleanup and our job will be done.

-------------------------------------------------
Run the ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.
You will, however, need to disable your current installed Anti-Virus. Additional information on how to do it is shown here.

Vista/Windows 7 users: You will need to to right-click on the either the Internet Explorer or FireFox icon in the Start Menu or Quick Launch Bar and select Run as Administrator.

  • Please go here to run the scan.
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:

    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on:
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.


Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
askey127
larnault
January 10, 2012, 11:55 PM UTC
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=333431dec2fc7b47a1dd7efb917732a4
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-01-10 11:32:49
# local_time=2012-01-10 03:32:49 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776573 100 100 0 162841810 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=142742
# found=0
# cleaned=0
# scan_time=4086
askey127 Admin/Teacher
January 11, 2012, 3:42 PM UTC
larnault,
Looks fine.
If you start OTL one more time, and click on the Clean Up button, it will remove itself and the tools we used.
You did a good job, and should be OK to go.

Glad we could help.
askey127
askey127 Admin/Teacher
January 14, 2012, 1:35 PM UTC

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.