Hi there,
My father complained about his computer being awfully slow, so I ran a malwarebyte scan and found more than 300 threats, most of them being ad-wares.
I put everything in quarantine, but some of those threats were worms and trojan, and files in system 32 were infected… Now I don’t really know how to make a clean removal of all these.
He was using Bitdefender as Antivirus but I made him switch to Avast.
I’ve attached the scan report in the post.
Thanks for your help.
follow instructions and attach logs (not copy and paste) http://forum.avast.com/index.php?topic=53253.0
run in order listed
AdwCleaner / Malwarebytes / OTL / aswMBR
when done, removal experts will be notified and help you
when finish, all tools used will be removed
How has he uninstalled Bitdefender?
Via Control Panel or with removal Tool from Bitdefender?
Via removal tool (I did it), the uninstall via control panel wouldn’t work.
You made that right. Via Control Panel there are remnants which could interfear with Avast.
I had AVG before, but it slowed down my laptop too much, im using Avast since version 7.0.1456 i think.
My Grandpa had some files of an Gema-Virus on his computer, only Avast detected all of them.
oK, here are the different log files required
I reattached the first scan of malwarebyte as the files I put in quarantine do not appear in the last report.
For OTL, I just had one log file (no Extras.txt) I don’t know if it’s normal or not.
And the last log file from aswMBR.
removers are notified and should be here soon…
A veritable malware city 
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=151&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={4EFE0BB5-CE5F-11E1-9EFE-000FFE5BE81D}
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2851639&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=867034"
FF - prefs.js..browser.startup.homepage: "http://www.searchnu.com/406"
FF - prefs.js..extensions.enabledAddons: 4ff968cf833e8@4ff968cf83422.info:1.0
FF - prefs.js..extensions.enabledAddons: crossriderapp5060@crossrider.com:0.85.36
FF - HKLM\Software\MozillaPlugins\@www.dlmanager.net/omaha/tools//Software Update;version=8: C:\Program Files\Software\Update\1.2.201.0\npSoftwareOneClick8.dll (Boxore OU.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\webbooster@iminent.com: C:\Program Files\Iminent\webbooster@iminent.com
[2010/06/04 09:36:39 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/09/09 10:20:09 | 000,000,000 | ---D | M] (appbario6 Community Toolbar) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\{474dcbf4-0db1-4c6a-a014-1c2544e82698}
[2012/09/09 15:45:39 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2012/05/13 10:18:55 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}
[2012/07/08 18:16:44 | 000,000,000 | ---D | M] (ADDICT-THING) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\4ff968cf833e8@4ff968cf83422.info
[2012/10/07 16:07:45 | 000,000,000 | ---D | M] ("Savings Sidekick") -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\crossriderapp5060@crossrider.com
[2012/10/07 16:07:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\crossriderapp5060@crossrider.com\chrome\content\extensionCode
[2013/05/13 15:32:34 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\staged\crossriderapp5060@crossrider.com\chrome\content\extensionCode
[2013/07/15 15:09:54 | 000,176,710 | ---- | M] () (No name found) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\jid1-FCM5fDwCW5M3AQ@jetpack.xpi
[2013/05/13 15:32:35 | 000,190,000 | ---- | M] () (No name found) -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
[2012/07/16 23:07:04 | 000,000,931 | ---- | M] () -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\searchplugins\conduit.xml
[2012/03/24 07:49:39 | 000,002,203 | ---- | M] () -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\searchplugins\MyStart Search.xml
[2012/09/09 15:45:08 | 000,002,519 | ---- | M] () -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\searchplugins\Search_Results.xml
[2012/09/23 19:18:26 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Mozilla\Firefox\Profiles\cacx4p6a.default\searchplugins\sweetim.xml
[2012/10/24 16:20:03 | 000,002,387 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/09/09 15:45:08 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1614895754-602162358-839522115-500\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - Startup: C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\LimeWire On Startup.lnk = File not found
[2013/09/24 06:04:43 | 000,000,000 | ---D | C] -- D:\Mes documents\Freemake
[2013/09/24 06:04:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Freemake
[2012/02/06 19:53:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\(null)
[2013/09/04 14:58:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\BabylonToolbar
[2010/10/03 10:24:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\BitZipper
[2012/03/10 19:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Dealio
[2010/07/25 07:41:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\FreeAudioPack
[2012/09/14 13:08:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\searchquband
[2012/03/05 06:48:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Systweak
[2013/04/05 13:30:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrateur.HUCK-0B29BED431\Application Data\Toolbar4
[2012/05/01 08:44:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Babylon
[2012/09/09 17:12:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\boost_interprocess
[2013/10/13 13:17:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\Freemake
[2013/10/07 12:51:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS\Application Data\OptimizerPro
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN
Please download Junkware Removal Tool to your desktop.
[]Right-mouse click JRT.exe and select “Run as Administrator” the tool will open and start scanning your system
[]please be patient as this can take a while to complete depending on your system’s specifications
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]post the contents of JRT.txt into your next message.
Okay thanks a lot for all this.
I ran OTL and it produced a log after the reboot.
I also have attached the OTL quick scan log file and the JRT.
I also had a desktop.ini file that popped up after the reboot in the note block with these two lines:
[.ShellClassInfo] LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
According to my father it has been acting like that for a while now.
Well that emptied a few junk files Total Files Cleaned = 7 486,00 mb
How is the computer behaving now ?
Yeah the old thing needed it 
It is much faster now, though it still isn’t completely smooth. (The computer is 5 or 6 years old so I guess there isn’t much to do about it)
However I still have all those files in the malwarebyte quarantine (399 now) and this desktop.ini popping up at start.
Should I run some more scans or is it time to remove all the tools ?
and this desktop.ini popping up at start.attach a screenshot
The desktop ini file will be hidden once I tidy up my tools
You can empty MBAM quarantine. What sort of problems remain… It may just need a little TLC now
I emptied the MBAM quarantine, and the computer is working just fine so I guess it’s time to remove all the tools.
Thanks again for your help 
In that case methinks I will send you on your merry way
Subject to no further problems
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Delete JRT from the desktop
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CLEARALLRESTOREPOINTS]
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article and this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
If you use on-line banking then as an added layer of protection install Trusteer Rapport
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe 
Ok after removal of all the tools there are still a few issues on this computer:
The desktop.ini file is still there at start-up.
9 times out of 10 I am unable to stop or reboot the computer. There’s no way to stop it except with hard reboot, which is pretty horrible…
Apart from that it’s running well, and a MBAM scan did not find anything.
The desktop ini must be a duplicate so it can be deleted… When you try to shut down do you get any errors or warnings