Originally posted by 2oldGeek:

---

Guess you see what I ment by a Lot of infection.. :)

You are on the way but, there's a lot left. So let's get started:


-Security Check-

Download Security Check by screen317.
Save it to your Desktop.

Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.





?Junkware Removal Tool--

Please download Junkware Removal Tool to your Desktop.
? Please close your security software to avoid potential conflicts.
? Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
? The tool will open and start scanning your system.
? Please be patient as this can take a while to complete, depending on your system's specifications.
? On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
? Please post the contents of JRT.txt into your reply.





--RogueKiller--

? Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
? Quit all programs that you may have started.
? Please disconnect any USB or external drives from the computer before you run this scan!
? For Vista or Windows 7, right-click and select "Run as Administrator to start"
? For Windows XP, double-click to start.
? Wait until pre-scan has finished ...
? Then Click on "Scan" button
? Wait until the Status box shows "Scan Finished"
? click on "delete"
? Wait until the Status box shows "Deleting Finished"
? Click on "Report" and copy/paste the content of the Notepad into your next reply.
? The log should be found in RKreport[1].txt on your Desktop
? Exit/Close RogueKiller+


Please paste the logs in your next reply.
Let me know what problem persists.


2oG

---

Originally posted by Heaseba:

---

Originally posted by 2oldGeek:

---

Guess you see what I ment by a Lot of infection.. :)

You are on the way but, there's a lot left. So let's get started:


-Security Check-

Download Security Check by screen317.
Save it to your Desktop.

Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.





?Junkware Removal Tool--

Please download Junkware Removal Tool to your Desktop.
? Please close your security software to avoid potential conflicts.
? Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
? The tool will open and start scanning your system.
? Please be patient as this can take a while to complete, depending on your system's specifications.
? On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
? Please post the contents of JRT.txt into your reply.





--RogueKiller--

? Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
? Quit all programs that you may have started.
? Please disconnect any USB or external drives from the computer before you run this scan!
? For Vista or Windows 7, right-click and select "Run as Administrator to start"
? For Windows XP, double-click to start.
? Wait until pre-scan has finished ...
? Then Click on "Scan" button
? Wait until the Status box shows "Scan Finished"
? click on "delete"
? Wait until the Status box shows "Deleting Finished"
? Click on "Report" and copy/paste the content of the Notepad into your next reply.
? The log should be found in RKreport[1].txt on your Desktop
? Exit/Close RogueKiller+


Please paste the logs in your next reply.
Let me know what problem persists.


2oG

---

Results of screen317's Security Check version 0.99.74
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Firewall Disabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 33
Java version out of Date!
Adobe Flash Player 11.8.800.168
Adobe Reader 10.1.7 Adobe Reader out of Date!
Mozilla Firefox (24.0)
Google Chrome 29.0.1547.76
Google Chrome 30.0.1599.69
````````Process Check: objlist.exe by Laurent````````
tds TDS Backup Online fshoster32.exe
tds TDS Backup Online apps Online Backup\agmailagent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

---

Originally posted by Heaseba:

---

Originally posted by 2oldGeek:

---

Guess you see what I ment by a Lot of infection.. :)

You are on the way but, there's a lot left. So let's get started:


-Security Check-

Download Security Check by screen317.
Save it to your Desktop.

Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.





?Junkware Removal Tool--

Please download Junkware Removal Tool to your Desktop.
? Please close your security software to avoid potential conflicts.
? Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
? The tool will open and start scanning your system.
? Please be patient as this can take a while to complete, depending on your system's specifications.
? On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
? Please post the contents of JRT.txt into your reply.





--RogueKiller--

? Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
? Quit all programs that you may have started.
? Please disconnect any USB or external drives from the computer before you run this scan!
? For Vista or Windows 7, right-click and select "Run as Administrator to start"
? For Windows XP, double-click to start.
? Wait until pre-scan has finished ...
? Then Click on "Scan" button
? Wait until the Status box shows "Scan Finished"
? click on "delete"
? Wait until the Status box shows "Deleting Finished"
? Click on "Report" and copy/paste the content of the Notepad into your next reply.
? The log should be found in RKreport[1].txt on your Desktop
? Exit/Close RogueKiller+


Please paste the logs in your next reply.
Let me know what problem persists.


2oG

---

Results of screen317's Security Check version 0.99.74
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Firewall Disabled!
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 33
Java version out of Date!
Adobe Flash Player 11.8.800.168
Adobe Reader 10.1.7 Adobe Reader out of Date!
Mozilla Firefox (24.0)
Google Chrome 29.0.1547.76
Google Chrome 30.0.1599.69
````````Process Check: objlist.exe by Laurent````````
tds TDS Backup Online fshoster32.exe
tds TDS Backup Online apps Online Backup\agmailagent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

---

Originally posted by 2oldGeek:

---

don't mess with the tabs. just click Delete button and if it doesn't give you a report, then click the report button..

---

Originally posted by 2oldGeek:

---

Hi Heaseba,

It's OK, and yes you had a tub full of malware... :(

Bare with me and we'll get you clean as an "Old Maid's Parlor" lol

Did you install Avast?

You have F-Secure TDS backup online showing. Do you use it or is it just a remnant left over?

It will take me some time to go over the logs so I can see what we need to do next. This cleanup may take some time but I know you will be happy when it's done. :)

I need one or two more logs so I can dig a little deeper:

first:

--OTL--

Please download OTL by OldTimer to your Desktop.

If you already have a copy of OTL, delete it and use this version.

Double click OTL.exe to launch the program.

Check the following.
Scan all users.
Standard Output.
Lop check.
Purity check.
Under Extra Registry section, select Use SafeList
Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).

When finished it will produce two logs.
OTL.txt (open on your desktop).
Extras.txt (minimized in your taskbar)

Please post me both logs



If you have trouble, just ask....
2oG

---

Originally posted by 2oldGeek:

---

Hi Heaseba,

It's OK, and yes you had a tub full of malware... :(

Bare with me and we'll get you clean as an "Old Maid's Parlor" lol

Did you install Avast?

You have F-Secure TDS backup online showing. Do you use it or is it just a remnant left over?

It will take me some time to go over the logs so I can see what we need to do next. This cleanup may take some time but I know you will be happy when it's done. :)

I need one or two more logs so I can dig a little deeper:

first:

--OTL--

Please download OTL by OldTimer to your Desktop.

If you already have a copy of OTL, delete it and use this version.

Double click OTL.exe to launch the program.

Check the following.
Scan all users.
Standard Output.
Lop check.
Purity check.
Under Extra Registry section, select Use SafeList
Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).

When finished it will produce two logs.
OTL.txt (open on your desktop).
Extras.txt (minimized in your taskbar)

Please post me both logs



If you have trouble, just ask....
2oG

---

Originally posted by 2oldGeek:

---

OK Heather, you're doing OK.

As I said, it will take me some time to review the logs and write a fix for you so, don't get too impatient.

While I am going over the logs I have, please do the following:

1.) Run Combofix:

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer.

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?


2.) Right now you don't have an AntiVirus and this is the best one....

Download and install Avast Antivirus from here -> HERE.



OH, just a guess are you in or near Madison, Wisc.?

Any Problems? Please let me know so I may help...

2oG

---

Originally posted by Heaseba:

---

Originally posted by 2oldGeek:

---

OK Heather, you're doing OK.

As I said, it will take me some time to review the logs and write a fix for you so, don't get too impatient.

While I am going over the logs I have, please do the following:

1.) Run Combofix:

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer.

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?


2.) Right now you don't have an AntiVirus and this is the best one....

Download and install Avast Antivirus from here -> HERE.



OH, just a guess are you in or near Madison, Wisc.?

Any Problems? Please let me know so I may help...

2oG

---

I installed Avast, but I can't see how to disable it while I run combofix..nvm I found it. will post log shortly

---

Originally posted by 2oldGeek:

---

Hi Heather,

I hope this is about all it will take to get you clean. Do the following and we will see.:)

-Uninstall some programs-

NOTE** Because of the cleanup process some of the programs I have listed may not
be in add/remove anymore this is fine just move to the next item on the list.

Hold down the Windows key (bottom left on keyboard next to the Ctrl key) then
press the ?R? key. The Run box will open. Then type or copy/past appwiz.cpl
into the box and click OK.

The Unistall or change a program list will be opened.
Click each Entry, as follows, one by one, if it exists, choose
Uninstall, and give permission to Continue:

Java(TM) 6 Update 33
Java Auto Updater
InstallIQ Updater
TDS Backup Online
SUPERAntiSpyware
Adobe Reader 10.1.7


Take extra care in answering questions posed by any Uninstaller.
When the program(s) have been uninstalled, please close Control Panel

Your Java was out of date. Older versions have vulnerabilities that
malware can use to infect your system.
Because you have OpenOffice, you will need to install the latest version of Java.

Upgrading Java:
? Download the latest version of JRE 7 Update 40.
? Click the "Free Java Download" button.
? Click the ?Agree and Start Free Download? button.
? Click on the download link for your system and save it to your desktop.
Close any programs you may have running - especially your web browser.
? Then from your desktop double-click on the download to install the
newest version.(Vista/7 users, right click on the JRE download and select "Run
as an Administrator.")

Upgrading Adobe Reader
The installed version of Adobe Reader on this computer was out-dated. Install
the latest version of Adobe Reader available from Adobe. OR because Adobe is a target for malware. My recommendation is SumatraPDF which is light and will do the same thing as Adobe without being a target for malware?


Let me know How things are doing.
If this clears it, we may not need to go any deeper, let me know and I will finish up. You will need to run a cleanup of the programs I had you use..

2oG

---

Quote:

---

ok.. I have done everything you have asked, including the reinstalls of java and the alternate adobe. So far, so good :D How do I clean up the programs I used?
I was wondering.. hubby's comp is running slowly also. Would it hurt anything for him to do all these things, also?

---

Quote:

---

Would it hurt anything for him to do all these things, also?

---

Originally posted by 2oldGeek:

---

Quote:

---

ok.. I have done everything you have asked, including the reinstalls of java and the alternate adobe. So far, so good :D How do I clean up the programs I used?
I was wondering.. hubby's comp is running slowly also. Would it hurt anything for him to do all these things, also?

---

Quote:

---

Would it hurt anything for him to do all these things, also?

---

Yes it would hurt. Computers are like people and snowflakes, no two are alike and the fixes for one can completely destroy another.....

Before we declare you clean, I saw a few things in one of the logs I would like to get rid of before we finish, that is if you have the time.

Also after we finish you can have your hubby come on with his puter and I fix him up....

Right now please start OTL, run a scan and post it for a last look before we close the doors on this one.

2oG

---

Originally posted by 2oldGeek:

---

Hi Heather,

Well, you were clean enough but, I?m fussy about sweeping up after. This will clean up the leftover remnants and clean behind the refrigerator, so to speak :)


Run OTL Script

I would like you to run this custom script for me now and when it is complete please give me the report and a status update for the computer.

Double-click OTL.exe to start the program.

Copy and Paste the following code into the
text box.

---

:Commands
[clearallrestorepoints]

:OTL
DRV:64bit: - [2013/09/09 19:25:55 | 000,046,368 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
IE - HKCU\..\URLSearchHook: {1C4AB6A5-595F-4e86-B15F-F93CCE2BBD48} - C:\Program Files (x86)\Family Toolbar\tbhelper.dll ()
FF - prefs.js..extensions.enabledItems: avg@toolbar:11.0.0.9
O2 - BHO: (MHTBPos00 Class) - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files (x86)\Family Toolbar\tbcore3.dll ()
O2:64bit: - BHO: (no name) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - No CLSID value found.
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - Reg Error: Key error. File not found
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - Reg Error: Key error. File not found
O13 - gopher Prefix: missing
[2013/09/09 19:27:10 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\AVG SafeGuard toolbar
[2013/09/09 19:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG SafeGuard toolbar
[2013/09/09 19:26:20 | 000,046,368 | ---- | C] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys
[2013/09/09 19:26:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG SafeGuard toolbar
[2013/09/09 19:25:55 | 000,046,368 | ---- | M] (AVG Technologies) -- C:\Windows\SysNative\drivers\avgtpx64.sys
[2011/12/13 10:50:49 | 000,000,101 | ---- | C] () -- C:\Users\Administrator\AppData\Local\fusioncache.dat
[2010/02/20 16:10:59 | 000,032,256 | ---- | C] () -- C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
@Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:0B4227B4

:Files
ipconfig /flushdns /c
C:\Program Files (x86)\Family Toolbar

:Commands
[PURITY]
[emptytemp]

---

Then click the Run Fix button at the top.
Click OK.

OTL may ask to reboot the machine. Please do so if asked.

The report should appear in Notepad after the reboot. Copy and Paste that report in your next reply.

Note** if the report does not popup after the computer reboots you can find it here in this folder:
C:\_OTL\MovedFiles - It will be named ? mmddyyyy_hhmmss.log
Where mmddyyyy_hhmmss - are numbers representing the date and time the fix was run.



On the malware front, you're clean!


We have a couple last things to take care of and then you're good to go.

Uninstall ComboFix from your computer:
? Click on Start > Run
? Type Combofix /u in the run box and click Ok. Note the space between the x and the /u, it needs to be there.




Over the course of the fix you've used a variety of special tools to help with the cleaning process - none of these are of any use to you now that you're clean, and it's best not to have them hanging around on your computer. OTC is a small program that removes all the leftover tools and logs from cleanup of malware.

Please download OTC to your desktop.
? Double-click OTC to run it. (Win7 right click on OTC and select "Run as an Administrator")
? Click on the CleanUp! button and follow the prompts.
? You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
? After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.


I had you remove SuperAntiSpyware because it is just not as good as MalwareBytes AntiMalware. So I suggest you download -> MBAM and use it once a week or so?


That about does it so, let me know how things are doing.

2oG

---

Quote:

---

didn't ask to reboot.Hope this is the right report.

---

Originally posted by 2oldGeek:

---

Quote:

---

didn't ask to reboot.Hope this is the right report.

---

Hi Heather,
Let's not worry about it, you're clean. How is your computer doing now?
You shouldn't have any problems and should be running faster...

Avast! is very good and should keep you well protected. Run MalwareBytes ever so often and you will be able to keep the bad guys out.:)

Have your Hubby come on to this thread and we will get him cleaned up also.

Nice working with you. You did an excellent job and I thank you for not making it rough on me. LOL

Til we meet again, have a "happy and safe surfing".

2old Geek, The number "2" not Too, old with a small "o" and Geek with a Capital "G"

I get the Bugs Out!



Oops!

---