system
July 21, 2012, 9:49am
1
My child downloaded a game from internet and now I have to deal with Incredibar…http://forum.avast.com/index.php?topic=53253.0
Malwarebytes Anti-Malware (Prova) 1.62.0.1300www.malwarebytes.org
Versione database: v2012.07.18.08
Windows 7 Service Pack 1 x64 NTFS
Protezione: Attivata
18/07/2012 21:21:03
Tipo di scansione: Scansione veloce
Processi rilevati in memoria: 0
Moduli di memoria rilevati: 0
Chiavi di registro rilevate: 0
Valori di registro rilevati: 0
Voci rilevate nei dati di registro: 0
Cartelle rilevate: 0
File rilevati: 2
(fine)
21:58:08.772 OS Version: Windows x64 6.1.7601 Service Pack 1
welcome to the forum. a malware expert will check those logs and give you instruction on how to proceed. i think you have not attached the otl log in there please do so.
system
July 21, 2012, 11:53am
3
The file is attached, it is called OTLANSI.txt
I attach it again
OK lets get shot of the lot… Do you want to keep sweetim ?
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:OTL
SRV:64bit: - [2012/06/06 09:14:32 | 000,185,856 | ---- | M] () [Auto | Running] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-3126821588-40386997-737668875-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredibar.com/mb164?a=6PQDz1YZp8&i=26
IE - HKU\S-1-5-21-3126821588-40386997-737668875-1001\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKU\S-1-5-21-3126821588-40386997-737668875-1001\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-3126821588-40386997-737668875-1001\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6PQDz1YZp8&i=26
FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb164/?loc=IB_DS&a=6PQDz1YZp8&&i=26&search="
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "My Web Search"
FF - prefs.js..browser.startup.homepage: "http://home.mywebsearch.com/index.jhtml?ptb=ED105BAB-E41C-4AA2-BA41-EE810A6E4F0E&n=77edc466&ptnrS=Z7xdm189YYit&si=jenya"
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012/07/15 20:40:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\webbooster@iminent.com: C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\emoticoons-toolbar@emoticoons.com: C:\Users\Public\Documents\Emoticoons\emoticoons-toolbar@emoticoons.com [2012/07/10 11:00:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012/07/15 20:40:34 | 000,000,000 | ---D | M]
[2012/07/10 14:36:56 | 000,009,629 | ---- | M] () -- C:\Users\Andreolli\AppData\Roaming\Mozilla\Firefox\Profiles\2zdv2dii.default\searchplugins\my-web-search.xml
[2012/07/08 13:05:30 | 000,002,519 | ---- | M] () -- C:\Users\Andreolli\AppData\Roaming\Mozilla\Firefox\Profiles\2zdv2dii.default\searchplugins\Search_Results.xml
O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()
O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll ()
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3126821588-40386997-737668875-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll (Bandoo Media, inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll (Bandoo Media, inc)
[2012/07/10 11:12:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/07/10 11:00:20 | 000,000,000 | ---D | C] -- C:\Users\Andreolli\AppData\Roaming\EmoticoonsToolbar
[2012/07/10 11:00:11 | 000,000,000 | ---D | C] -- C:\Users\Andreolli\AppData\Local\SoftwareUpdater
[2012/07/10 11:00:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emoticoons
[2012/07/10 11:00:09 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Emoticoons
[2012/07/08 13:20:46 | 000,000,000 | ---D | C] -- C:\Users\Andreolli\AppData\Local\Ilivid Player
[2012/07/08 13:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/07/08 13:05:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Searchqu Toolbar
:Files
:Commands
[*]Then click the
Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the
Quick Scan button. Post the log it produces in your next reply.
system
July 21, 2012, 8:57pm
5
Sorry but it is not clear or not present the script to paste in the lower box, without it OTO does not start to fix
Pondus
July 21, 2012, 9:00pm
6
what do you mean…that you cant see the script?
it is in essexboys post above here in the blue box…copy and paste it in
system
July 21, 2012, 9:06pm
7
Do you mean this part?
:Commands
Pondus
July 21, 2012, 9:12pm
8
everything inside the blue box… posting it below this line
:OTLhttp://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} http://mystart.incredibar.com/mb164?a=6PQDz1YZp8&i=26 http://dts.search-results.com/sr?src=ieb&appid=390&systemid=406&sr=0&q={searchTerms} http://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6PQDz1YZp8&i=26 http://mystart.incredibar.com/mb164/?loc=IB_DS&a=6PQDz1YZp8&&i=26&search= ”http://home.mywebsearch.com/index.jhtml?ptb=ED105BAB-E41C-4AA2-BA41-EE810A6E4F0E&n=77edc466&ptnrS=Z7xdm189YYit&si=jenya ”
:Files
:Commands
system
July 21, 2012, 9:43pm
9
ok,
In attach the log.
Pondus
July 21, 2012, 9:59pm
10
essexboy is in bed now so check back tomorrow
HAs it totally gone now ?
system
July 22, 2012, 9:30am
12
looks so.
Thank you very much for your help
Pondus
July 22, 2012, 10:01am
13
he is not done yet…come back later and he will remove the tools used
Ok as this was an easy one and it was only a toolbar
Run OTL and hit the cleanup button to remove the programme
As long as it has disappeared then yes
