This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Redirect trojan

88 min read

This thread's last reply is from February 5, 2013, 9:42 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\emelcf deleted successfully.
========== FILES ==========
C:\Program Files (x86)\Coupon Companion\Coupon Companion.dll moved successfully.
C:\Program Files (x86)\EaseUS\Todo Backup\bin\PxeServer.dll moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Jerry\Documents\Computer info\Startup and spyware folder\Maleware removal forum programs\cmd.bat deleted successfully.
C:\Users\Jerry\Documents\Computer info\Startup and spyware folder\Maleware removal forum programs\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Jerry
->Temp folder emptied: 31112310 bytes
->Temporary Internet Files folder emptied: 275972653 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 1603 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16886 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 207662037 bytes

Total Files Cleaned = 491.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02042013_102409

Files\Folders moved on Reboot...
C:\Users\Jerry\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Jerry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Hi Jerry,
I do notice that every time i start up my computer, i get an error.
It says "RunDll There was a problem starting C:\Users\Jerry\AppData\Roaming\emelcf.dll The specified module could not be found."

Does this still happen after the last fix?
"Cypher" wrote:Hi Jerry,
I do notice that every time i start up my computer, i get an error.
It says "RunDll There was a problem starting C:\Users\Jerry\AppData\Roaming\emelcf.dll The specified module could not be found."

Does this still happen after the last fix?

Looks like that is no longer happening after the last fix.
Hi Jerry,
Looks like that is no longer happening after the last fix.

Great, in that case you should be good to go, your latest logs appear to be clean.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Clean up with OTL

  • Right click on OTL.exe And select Run as administrator to run it.
  • This will remove some of the tools we used to clean your pc.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CleanUp! button
  • Say Yes to the prompt and then allow the program to reboot your computer.


Next.

adwcleaner
  • Right click on adwcleaner.exe and select " Run as administrator " to run it.
  • Click on Uninstall.
  • Confirm with yes.


You can now delete any tools/logs we used if they remain on your Desktop.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Remember to update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Microsoft Windows Update
Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Install the updates immediately if they are found.
To update Windows
Go to Start > All Programs > Windows Update > Check for updates.
To update Office
Open up any Office program.
Go to Help > Check for Updates

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!
I have read the last post and everything else has been done.

Thanks again for your help Cypher. I'll be back if i need any more help, but honestly i hope it's a long time from now.

Thanks. Jerry.
Hi Jerry,
Thanks again for your help Cypher.

You're most welcome, good luck and stay safe.

As your problems appear to have been resolved,