This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Bitdefender keeps finding Kazy infected .tmp files

11 min read

This thread's last reply is from August 28, 2018, 9:07 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

andy__b
August 18, 2018, 10:58 PM UTC
Bitdefender keeps popping up with 'Threat Detected' notifications followed by 'Detected threats are being disinfected' Example of notification is:

"Successfully blocked infected file
4 minutes ago
Feature:
Antivirus
The file C:\Windows\temp\tmp00000431\tmp0000295b is infected with Gen:Variant.Kazy.129450.The threat has been successfully blocked, your device is safe."

Each time this pops up it's a different .tmp file.

After running Bitdefender scan this is the resulting message: "The file C:\Windows\temp\tmp000000c6\tmp001995d1 has been detected as infected. Bitdefender could not clean this item. A reboot is required to complete the cleaning process. Threat name: Gen:Variant.Kazy.129450"

However a reboot does not solve the problem and the popups continue. Grateful for any help.... FRST logs attached

Attachments:

Gary R
August 19, 2018, 7:07 AM UTC
Looking over your logs, back as soon as I've finished analysing them.
Gary R
August 19, 2018, 7:55 AM UTC
Questions ....

Are you using the Free or the paid for versions of Malwarebytes and BitDefender ?

Have you previously used AVG as your anti-virus ?

Do you recognise any of the following files and/or folders, and/or know why they may be present on your computer ?

2018-08-18 07:27 - 2018-08-18 07:27 - 000528708 ____N C:\Users\Ac8hj5\border duration stations.xlsx
2018-08-18 07:27 - 2018-08-18 07:27 - 000527719 ____N C:\Users\Qj1t5zg\wit.poems.xlsx
2018-08-18 07:27 - 2018-08-18 07:27 - 000212077 ____N C:\Users\Ac8hj5\bet flower.mdb
2018-08-18 07:27 - 2018-08-18 07:27 - 000209341 ____N C:\Users\Qj1t5zg\consciousness-lungs.mdb
2018-08-18 07:27 - 2018-08-18 07:27 - 000071437 ____N C:\Users\Qj1t5zg\access_amounts.xls
2018-08-18 07:27 - 2018-08-18 07:27 - 000060345 ____N C:\Users\Ac8hj5\nothing_church_obey.xls
2018-08-18 07:27 - 2018-08-18 07:27 - 000059857 ____N C:\Users\Ac8hj5\diffusion-compound.pem
2018-08-18 07:27 - 2018-08-18 07:27 - 000051183 ____N C:\Users\Qj1t5zg\devil.dictionary.pem
2018-08-18 07:27 - 2018-08-18 07:27 - 000027243 ____N C:\Users\Ac8hj5\mistake.thousands.gear.angle.txt
2018-08-18 07:27 - 2018-08-18 07:27 - 000020160 ____N C:\Users\Qj1t5zg\consideration.suffer.sql
2018-08-18 07:27 - 2018-08-18 07:27 - 000018364 ____N C:\Users\Qj1t5zg\maybe improve distant.txt
2018-08-18 07:27 - 2018-08-18 07:27 - 000017989 ____N C:\Users\Ac8hj5\realizemean.sql
2018-08-18 07:27 - 2018-08-18 07:27 - 000000000 ___HD C:\Users\Qj1t5zg
2018-08-18 07:27 - 2018-08-18 07:27 - 000000000 ___HD C:\Users\Ac8hj5
2018-08-18 07:27 - 2018-08-18 07:27 - 000000000 ___DC C:\Xpackage238
2018-08-18 07:27 - 2018-08-18 07:27 - 000000000 ___DC C:\833650065972511557 package234
2018-08-17 23:30 - 2018-08-17 23:32 - 000000000 ____D C:\Users\Andy\Desktop\BStALBCRP items


There are a number of matters that need addressing on your machine, but I need you to answer my questions first before we proceed with dealing with them.
andy__b
August 19, 2018, 9:41 AM UTC
Hello Gary - thanks for responding so promptly

In reply to your Questions ....

Are you using the Free or the paid for versions of Malwarebytes and BitDefender ? Paid BitDefender and Free Malwarebytes - although this may still be in the 21 day trial period for the full programme. Malwarebytes had reported it had cleaned out the offending file but it came back on next startup....

Have you previously used AVG as your anti-virus ? Yes - had a subscription a while ago which ran out - Bit defender required that this be uninstalled before it would load up

Do you recognise any of the following files and/or folders, and/or know why they may be present on your computer ? I'd spotted those and Googling revealed that they may be comparison files connected with the ransomware software I installed a while ago (CyberReasonRansomfree). The last file folder (BStALBCRP) I can confirm is mine.
Gary R
August 19, 2018, 10:26 AM UTC
OK, that's pretty much what I thought.

If Malwarebytes is still in the "trial period" then it will have its real-time-protection active, and this may interfere with the real-time-protection offered by BitDefender, so if you're going to use BitDefender as your main protection program, then I would advise you to disable the RTP for Malwarebytes.

To do that ....

  • Open Malwarebytes.
  • Click on Settings > Protection
  • Uncheck all the Real Time Protection options.
  • Exit Malwarebytes


Next ....

Before we start: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

As an added safety precaution, before we start removing anything, I'd like you to make a backup of your Registry, which we can restore to if necessary.

Please click on THIS link, and follow the instructions for installing TCRB and creating a backup of your Registry.

Please observe these rules while we work:
  • Do not edit your logs in any way whatsoever.
  • Perform all actions in the order given.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with it till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to install any new software (other than those I ask you to) until we've got your computer clean.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. If your defensive programmes warn you about any of those tools, be assured that they are not infected, and are safe to use.

If you can do these things, everything should go smoothly.

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.


Next ....

Please Uninstall the following programs ....

  • FlvPlayer
  • Java 8 Update 40 (64-bit)
  • Java 8 Update 40


FLV has been flagged by FRST as a suspect version, and may therefore well have come with "fellow travellers".
Old out of date versions of Java can be, and usually are exploited.

Most people do not need to have Java installed on their computers. Java is not the same as Javascript, which pretty much all websites use. Javascript interpretation is already built into all mainline browsers.

If you do have a specific need for Java, then when we've finished cleaning your machine you need to install the latest version .... https://java.com/en/download/

Please reboot your computer once you have uninstalled these programs.

Next ...

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  • Press Ctrl+y (Ctrl and y keys at the same time)
  • A blank randomly named .txt Notepad file will open.
  • Copy and paste the following into it (don't include Code: Select all) ....

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3324328&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPAE492A57-3D69-483E-A711-A1A614198A73&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={0DDCE928-A284-4C33-9227-568D206F0132}&mid=a734080af82847d0a6c93909b407b0ca-a003bb232cc8640b52a2a8d277a0dc13de7ba3e0&lang=en&ds=AVG&coid=avgtbavg&cmpid=0116avz&pr=fr&d=2016-01-26 13:34:18&v=4.2.4.155&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3324328&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPAE492A57-3D69-483E-A711-A1A614198A73&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={0DDCE928-A284-4C33-9227-568D206F0132}&mid=a734080af82847d0a6c93909b407b0ca-a003bb232cc8640b52a2a8d277a0dc13de7ba3e0&lang=en&ds=AVG&coid=avgtbavg&cmpid=0116avz&pr=fr&d=2016-01-26 13:34:18&v=4.2.4.155&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021844803 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021844803 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3324328&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPAE492A57-3D69-483E-A711-A1A614198A73&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021844803 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021844803 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={0DDCE928-A284-4C33-9227-568D206F0132}&mid=a734080af82847d0a6c93909b407b0ca-a003bb232cc8640b52a2a8d277a0dc13de7ba3e0&lang=en&ds=AVG&coid=avgtbavg&cmpid=0116avz&pr=fr&d=2016-01-26 13:34:18&v=4.2.4.155&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021848422 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021848422 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3324328&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPAE492A57-3D69-483E-A711-A1A614198A73&q={searchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021848422 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021848422 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={0DDCE928-A284-4C33-9227-568D206F0132}&mid=a734080af82847d0a6c93909b407b0ca-a003bb232cc8640b52a2a8d277a0dc13de7ba3e0&lang=en&ds=AVG&coid=avgtbavg&cmpid=0116avz&pr=fr&d=2016-01-26 13:34:18&v=4.2.4.155&pid=wtu&sg=&sap=dsp&q={searchTerms}

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846129 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846129 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849826 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849826 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=dsites0101&cd=2XzuyEtN2Y1L1Qzu0EzzyEtD0FtB0EtAyDzytAzy0AyEtCyCtN0D0Tzu0SyByDtBtN1L2XzutBtFtBtFtCyDtFtCyDzytBtN1L1CzutDzytDtCtG1T&cr=732785863&ir=

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846269 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1067577084-1865836317-3027311478-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849935 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 



Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021844709 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021848344 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846019 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849748 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846129 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1005-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849826 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021846191 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

Toolbar: HKU\S-1-5-21-1067577084-1865836317-3027311478-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-08182018021849873 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File

FF Extension: (AVG Do Not Track) - C:\Users\Andy\AppData\Roaming\Mozilla\Firefox\Profiles\e82nx50n.default-1428330935139\Extensions\{F53C93F1-07D5-430c-86D4-C9531B27DFAF} [2016-04-28] [Legacy]

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

C:\ComboFix

2018-07-23 22:51 - 2015-06-02 09:41 - 000000000 ____D C:\Users\Guest\AppData\Local\Avg

2018-07-23 22:51 - 2015-06-02 09:41 - 000000000 ____D C:\Users\Charlotte\AppData\Local\Avg

2018-07-23 22:51 - 2015-03-30 20:40 - 000000000 ____D C:\Users\Julie\AppData\Roaming\AVG

2018-07-23 22:51 - 2015-03-30 19:41 - 000000000 ____D C:\Users\Julie\AppData\Local\Avg

2018-07-23 22:51 - 2015-03-27 21:45 - 000000000 ____D C:\Users\Alex\AppData\Roaming\AVG

2018-07-23 22:51 - 2015-03-27 20:05 - 000000000 ____D C:\Users\Alex\AppData\Local\Avg

2018-07-23 22:51 - 2015-03-27 12:43 - 000000000 ____D C:\Users\Andy\AppData\Local\Avg

2018-07-23 22:51 - 2015-03-27 07:45 - 000000000 ____D C:\Users\Admin\AppData\Local\Avg

Task: {49230476-A3F3-482E-BA9E-FE03748B8DA1} - System32\Tasks\Digital Sites => C:\Users\Andy\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {AEE38D03-1941-4B0D-BA4F-7F78B0C595DD} - \RealPlayer Cloud (32-bit)  -> No File <==== ATTENTION

EmptyTemp:

Hosts:

cmd: ipconfig /flushdns

  • Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
  • Now press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log


Next ...

Please download AdwCleaner and save it to your desktop.

  • Double click AdwCleaner.exe to run it.
  • Click Scan.
  • A logfile will automatically open after the scan has finished.
  • Close the adwCleaner window, click ok to the prompt.
  • Please post the contents of that logfile with your next reply.
  • You can also find the logfile at C:\AdwCleaner[R1].txt.


AT THIS POINT, DO NOT ATTEMPT TO CLEAN ANYTHING THAT MAY BE FOUND
andy__b
August 19, 2018, 11:08 PM UTC
Ok Gary - sorry not to have replied earlier - lost internet access for a while this afternoon but have carried out all the tasks you specified.

Logfiles are attached

Over to you...

Andy

Attachments:

Gary R
August 20, 2018, 5:05 AM UTC
OK, looks like we've still got things to do.

First ....

  • Double click AdwCleaner.exe to run it.
  • Click Scan and allow the scan to finish.
  • Now click Clean to remove the items found.
  • Click OK to the prompt.
  • The tool will run & your computer will be rebooted automatically. A logfile will open after the restart.
  • Post the contents of the logfile with your next reply.
  • You can also find the logfile at C:\AdwCleaner[s1].txt.




Next .... looks like some of the things I scripted for removal were not removed, so we need to check whether they're still there. Please run a new scan for me with FRST, and post me the new FRST.txt and Addition.txt logs.



Next .... I'd like you to run a search for me using FRST ....

  • Double click Frst64.exe to launch it.
  • FRST will start to run.
    • When the tool opens click Yes to the disclaimer.
    • Copy/Paste or Type the following line into the Search: box.

    Fun4IM;Bandoo;Searchnu;Searchqu;iLivid;whitesmoke;datamngr;kelkoopartners;trolltech;babylon;conduit;trovi;clientconnect

    • Press the Search Registry button.
    • When finished searching a log will open on your Desktop ... Search.txt
    • Please post it in your next reply.
andy__b
August 20, 2018, 7:20 AM UTC
Just a quicky then I'll have to catch the bus - back this evening

I get a notification that a new version of AdwCleaner (7.2.2) is available - should I use the newer version or the one you previously linked?
Gary R
August 20, 2018, 7:44 AM UTC
Yes, if there's a newer version then please use that.

PS. We only ever close topics if they've gone 3 days without a reply, so don't worry if you can't always reply as quickly as you'd like to.

PPS. I will usually always reply to one of your posts within 24 hours, if I ever fail to do so, then it's because I haven't got an auto notification from the forum software, in which case please feel free to send me a reminder by Personal Message.
andy__b
August 21, 2018, 8:48 AM UTC
Sorry Gary Only had time to run adwcleaner

Here's the log

Will run frst later

# -------------------------------
# Malwarebytes AdwCleaner 7.2.2.0
# -------------------------------
# Build: 07-17-2018
# Database: 2018-08-20.1
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 08-21-2018
# Duration: 00:00:01
# OS: Windows 7 Professional
# Cleaned: 36
# Failed: 1


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\ProgramData\Auslogics
Deleted C:\Users\Andy\AppData\Roaming\DigitalSites
Deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLVPlayer
Deleted C:\Users\Admin\Documents\TotalAV
Deleted C:\Users\Andy\AppData\Local\SwvUpdater

***** [ Files ] *****

Deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TotalAV.lnk

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKU\S-1-5-18\Software\Auslogics
Deleted HKU\.DEFAULT\Software\Auslogics
Deleted HKLM\Software\Wow6432Node\Auslogics
Deleted HKCU\Software\dsiteproducts
Deleted HKLM\Software\DomaIQ
Deleted HKCU\Software\InstallCore
Deleted HKLM\Software\Wow6432Node\FlvPlayer
Deleted HKLM\Software\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
Deleted HKLM\Software\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mysearch.avg.com
Deleted HKLM\Software\Wow6432Node\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Deleted HKU\S-1-5-18\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Deleted HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Deleted HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Deleted HKLM\SOFTWARE\Mozilla\NativeMessagingHosts\com.totalav.passwordvaultassistant
Deleted HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.totalav.passwordvaultassistant

***** [ Chromium (and derivatives) ] *****

Deleted Bing Search Engine
Deleted FromDocToPDF

***** [ Chromium URLs ] *****

Deleted Mysearchdial
Deleted AVG Secure Search
Deleted Ask Jeeves
Deleted Ask Jeeves
Deleted Ask Jeeves
Deleted Ask Jeeves
Deleted Ask Jeeves
Deleted Ask Jeeves
Deleted delta-homes
Deleted delta-homes

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

Not Deleted mysearch.avg.com


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [3770 octets] - [20/08/2018 00:01:17]
AdwCleaner[S01].txt - [3831 octets] - [21/08/2018 09:45:19]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########
Gary R
August 21, 2018, 9:36 AM UTC
No problem. Please post me the other logs as soon as you're able to.
andy__b
August 22, 2018, 6:54 AM UTC
latest Frst files attached

Search results below:

Farbar Recovery Scan Tool (x64) Version: 19.08.2018 02
Ran by [removed] (22-08-2018 07:47:39)
Running from E:\Downloads
Boot Mode: Normal

================== Search Registry: "Fun4IM;Bandoo;Searchnu;Searchqu;iLivid;whitesmoke;datamngr;kelkoopartners;trolltech;babylon;conduit;trovi;clientconnect" ===========


===================== Search result for "Fun4IM" ==========


===================== Search result for "Bandoo" ==========


===================== Search result for "Searchnu" ==========


===================== Search result for "Searchqu" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
""="ISearchQueryHelper"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF63}]
""="ISearchQueryHelper"


===================== Search result for "iLivid" ==========


===================== Search result for "whitesmoke" ==========


===================== Search result for "datamngr" ==========


===================== Search result for "kelkoopartners" ==========


===================== Search result for "trolltech" ==========

[HKEY_USERS\S-1-5-21-1067577084-1865836317-3027311478-1003\Software\Trolltech]

[HKEY_USERS\S-1-5-21-1067577084-1865836317-3027311478-1003\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.6\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]

[HKEY_USERS\S-1-5-21-1067577084-1865836317-3027311478-1003\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]


===================== Search result for "babylon" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"


===================== Search result for "conduit" ==========


===================== Search result for "trovi" ==========


===================== Search result for "clientconnect" ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8DD5142F-7E23-4c44-9DD7-98B9C7032535}]
""="INapEnforcementClientConnectionPrivate"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BD244906-70DD-4690-BEEA-648653393500}]
""="INapEnforcementClientConnection2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FB3A3505-DDB1-468A-B307-F328A57419D8}]
""="INapEnforcementClientConnection"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DD5142F-7E23-4c44-9DD7-98B9C7032535}]
""="INapEnforcementClientConnectionPrivate"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BD244906-70DD-4690-BEEA-648653393500}]
""="INapEnforcementClientConnection2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FB3A3505-DDB1-468A-B307-F328A57419D8}]
""="INapEnforcementClientConnection"

====== End of Search ======

Attachments:

Gary R
August 22, 2018, 11:01 AM UTC
  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  • Press Ctrl+y (Ctrl and y keys at the same time)
  • A blank randomly named .txt Notepad file will open.
  • Copy and paste the following into it (don't include Code: Select all) ....

[-HKEY_USERS\S-1-5-21-1067577084-1865836317-3027311478-1003\Software\Trolltech]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]

DeleteValue: HKU\S-1-5-21-1067577084-1865836317-3027311478-1006\Software\Microsoft\Internet Explorer\Toolbar|{47833539-D0C5-4125-9FA8-0819E2EAAC93}

DeleteValue: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers|{472083B0-C522-11CF-8763-00608CC02F24}

EmptyTemp:

  • Press Ctrl+s to save fixlist.txt

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system
  • Now press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
  • Please post me the log


Next ....

Please uinstall the extensions listed below from Google Chrome ... https://support.google.com/chrome_webstore/answer/2664769?hl=en

Mysearchdial-speeddial


... and any others that you do not recognise and/or did not intentionally install.

Next ....

Please run a scan with ESET Online Scanner (please note that this can sometimes take hours to complete)

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
  • Please go HERE then click on Scan Now
  • You will need to download esetsmartinstaller_enu.exe when prompted, and then double click on it to install.

  • Select the option Accept to accept the terms and conditions, and when prompted by UAC, allow E-Set to make changes.
  • Select the following option.

    • Enable detection of potentially unwanted applications


  • Now click on Scan
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When complete the scan will begin.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed you will be presented with a list of found threats ....
    • Do not clean any of the found threats
    • Click on Save to text file
    • Save as ESET.txt to your Desktop
  • Exit out of ESET Online Scanner.
  • Post me the contents of ESET.txt please.
andy__b
August 26, 2018, 11:41 AM UTC
Hi Gary - apologies - have been away - will come back as soon as I can
Gary R
August 28, 2018, 9:07 PM UTC
a lack of response,