SVCHOST.EXE process with URL:MAL infection

system · 2015-06-04T20:58:36.000Z

Hi

edited links so they shouldn’t be clickable now - sorry.

Looks like the problem has been resolved, but I will run ZOEK again now.

system · 2015-06-04T21:35:53.000Z

Zoek results attached (can’t paste as exceeds max characters)

TwinHeadedEagle · 2015-06-04T21:42:26.000Z

We need to run one more Zoek fix.

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Fix with ZOEK

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
chrdefaults;

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-04T22:07:43.000Z

results attached.

TwinHeadedEagle · 2015-06-05T06:07:09.000Z

How is your PC behaving now?

system · 2015-06-05T06:47:28.000Z

seems fine now…will watch it today and let you know

many thanks for the rapid replies and assistance

system · 2015-06-08T11:03:25.000Z

Hi everyone. I have the same problem. Would you be so kind as to give me a hand? Thank you very much.

TwinHeadedEagle · 2015-06-08T11:04:01.000Z

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · 2015-06-08T11:22:22.000Z

Thank you for your kind reply. The two files are attached.

TwinHeadedEagle · 2015-06-08T11:24:02.000Z

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
chrdefaults;
bitsadmin /reset /allusers;b
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-06-08T11:44:29.000Z

I have tried to disable Avast for 10 minutes and when I tried to right click on ZOEK to run it as administrator I got this message: “si è verificato un errore improvviso e Windows deve riavviare il computer…e in corso una raccolta…alla fine della raccolta il computer verrà riavviato automaticamente.” Then the computer restarted/rebooted by itself. What shall I do?

TwinHeadedEagle · 2015-06-08T11:47:40.000Z

Try to download all of three Zoek versions from this link:

http://download.bleepingcomputer.com/smeenk/

One will work. Make sure that Avast is disabled.

system · 2015-06-08T12:27:35.000Z

Thank you again. So, here’s the content on Zoek. Do I have to reboot the computer now? Zoek says: “A reboot is needed to complete zoek.exe tasks.”

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Nick Berchisan on 08/06/2015 at 13.51.30,61.
Microsoft Windows 8 6.2.9200 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\Nick Berchisan\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

08/06/2015 13.54.57 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\predm deleted successfully
C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully
C:\Users\Nick Berchisan\AppData\Local\calibre-cache deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\NICKBE~1\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default

user.js not found
---- Lines istart removed from prefs.js ----
user_pref(“browser.search.defaultenginename”, “istartsurf”);
user_pref(“browser.search.selectedEngine”, “istartsurf”);
---- Lines browser.startup.page removed from prefs.js ----
user_pref(“browser.startup.page”, 1);
---- FireFox user.js and prefs.js backups ----

prefs_062015_14.15_.backup

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\predm not found
C:\Users\Nick Berchisan\AppData\Roaming\calibre deleted
C:\PROGRA~3{09aa1dbf-c125-fe30-09aa-a1dbfc1276ff} deleted
C:\Users\Nick Berchisan.android deleted
C:\PROGRA~2\AnyProtectEx deleted
C:\PROGRA~2\SearchProtect deleted
C:\Users\Nick Berchisan\AppData\Roaming\AnyProtectEx deleted
C:\Users\Nick Berchisan\AppData\Roaming\Thinstall deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Nick Berchisan\AppData\Local\nsy3B63.tmp deleted
C:\Users\Nick Berchisan\AppData\Local\CRE deleted
C:\Users\Nick Berchisan\AppData\Local\tbccint deleted
C:\Users\Nick Berchisan\AppData\Local\SmartWeb deleted
C:\Users\Nick Berchisan\AppData\Local\Thinstall deleted
C:\Users\Nick Berchisan\AppData\Local\NativeMessaging deleted
C:\Users\Nick Berchisan\Downloads\Babylon (OED) Oxford English Dictionary (20-Volume version) 2012.bgl deleted
C:\Users\Nick Berchisan\Downloads\Babylon_English_Italian.BGL deleted
C:\Users\Nick Berchisan\Downloads\Babylon_English_Spanish.BGL deleted
C:\Users\Nick Berchisan\AppData\LocalLow\SmartWeb deleted
C:\Users\Nick Berchisan\AppData\LocalLow\TB deleted
C:\Users\Nick Berchisan\Documents\Optimizer Pro deleted
C:\PROGRA~3\MakeMarkerFile.exe deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\NICKBE~1\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default
user_pref(“browser.search.defaulturl”, “https://www.google.com/search/?trackid=sp-006”);
user_pref(“browser.search.defaultengine”, “Google (avast)”);
user_pref(“keyword.URL”, “https://www.google.com/search/?trackid=sp-006”);

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
“searchffv2@gmail.com”=“C:\Users\Nick Berchisan\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default\extensions\searchffv2@gmail.com” [13/05/2015 18.38]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
“mozilla_cc@internetdownloadmanager.com”=“C:\Users\Nick Berchisan\AppData\Roaming\IDM\idmmzcc5” [19/04/2014 05.38]

==== Firefox Extensions ======================

ProfilePath: C:\Users\NICKBE~1\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default

QuickSearch - C:\Users\Nick Berchisan\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default\extensions\searchffv2@gmail.com
QuickSearch - %ProfilePath%\extensions\searchffv2@gmail.com

AppDir: C:\Program Files (x86)\Mozilla Firefox

Default - %AppDir%\browser\extensions{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Nick Berchisan\AppData\Roaming\Mozilla\Firefox\Profiles\jkhqlbn3.default
9E2ACEFA9A03FA35133459B0F8613B40 - C:\windows\SysWoW64\Adobe\Director\np32dsw_1215155.dll - Shockwave for Director / Shockwave for Director
9291708CCD967887AF94BE708B43D64D - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll - Microsoft Office 2013
18CF51689186AEB9D1D149AEB0E92D03 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL - Microsoft Office 2013
0E8B2D0D9E3415A91EF259CE1112C579 - C:\windows\SysWoW64\Adobe\Director\np32dsw_1210150.dll - Shockwave for Director / Shockwave for Director

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[20/03/2015 11.46]
imdmgjpgpplkmnlcccneaiffmgklaeod - C:\Users\Nick Berchisan\AppData\Local\CRE\imdmgjpgpplkmnlcccneaiffmgklaeod.crx
mjdepfkicdcciagbigfcmdhknnoaaegf - [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf\path]
mjdepfkicdcciagbigfcmdhknnoaaegf\path - [HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf\path]
mjdepfkicdcciagbigfcmdhknnoaaegf\Version - No path found

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
imdmgjpgpplkmnlcccneaiffmgklaeod - C:\Users\Nick Berchisan\AppData\Local\CRE\imdmgjpgpplkmnlcccneaiffmgklaeod.crx

==== Chromium Fix ======================

C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.azlyrics.com_0.localstorage deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.azlyrics.com_0.localstorage-journal deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.intelliwebsearch.com_0.localstorage deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.intelliwebsearch.com_0.localstorage-journal deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_static.audienceinsights.net_0.localstorage deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_static.audienceinsights.net_0.localstorage-journal deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_static.olark.com_0.localstorage deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.edufind.com_0.localstorage deleted successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Local Storage\http_www.edufind.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“http://go.microsoft.com/fwlink/p/?LinkId=255141”
“Search Page”=“https://it.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}”
“Use Search Asst”=“yes”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
“Default”=“www.google.com”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
“Default”=“www.google.com”
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
“DefaultScope”=“{0633EE93-D776-472f-A0FF-E1416B8B2E3A}”
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] not found

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Search Page”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Start Page”=“http://go.microsoft.com/fwlink/p/?LinkId=255141”
“Use Search Asst”=“no”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]
“(Default)”=“http://search.msn.com/results.asp?q=%s”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]
“(Default)”=“http://search.msn.com/results.asp?q=%s”
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
“DefaultScope”=“{012E1000-F331-11DB-8314-0800200C9A66}”

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url=“http://www.google.com/search?q={searchTerms}”
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url=“http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC”

==== Reset Google Chrome ======================

C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Preferences was reset successfully
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Web Data will be reset at reboot
C:\Users\Nick Berchisan\AppData\Roaming\Opera Software\Opera Stable\Web Data-journal will be reset at reboot

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\firefox@gingersoftware.2.0.0.74.com deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\imdmgjpgpplkmnlcccneaiffmgklaeod deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\imdmgjpgpplkmnlcccneaiffmgklaeod deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\7365B9B519B34174A993458933955466 deleted successfully

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Nick Berchisan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Nick Berchisan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Nick Berchisan\AppData\Local\Opera Software\Opera Stable\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=186 folders=67 562494010 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Nick Berchisan\AppData\Local\Temp will be emptied at reboot
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

system · 2015-06-08T12:30:49.000Z

I forget to say that I use an Internet Stick provided by Wind Italy.

TwinHeadedEagle · 2015-06-08T13:32:46.000Z

Yes, reboot your PC and let me know how is the situation now?

system · 2015-06-08T13:37:55.000Z

OK. Rebooted. Even though I had to click on “Show Desktop” after rebooting, now everything seems to work fine. Let’s wait a couple of days to see if the problem (hope not) shows up again. Thank you very much!

TwinHeadedEagle · 2015-06-08T13:40:24.000Z

No need to wait couple of days. Couple of minutes/hours will be enough.

system · 2015-06-08T13:44:55.000Z

OK then. I’ll get back to you later on today. Thanks a million.
Edit: Until now everything seems to be working just fine.

system · 2015-06-14T11:04:54.000Z

Hey,

I have the same problem, as the thread owner. I already ran Zoek and would ask kindly for your help.

Here are my first logs:
Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by user on 14.06.2015 at 12:38:40,11.
Microsoft Windows 8.1 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\user\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

14.06.2015 12:40:20 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\Ashampoo deleted successfully
C:\Program Files\stinger deleted successfully
C:\PROGRA~3\CLSK deleted successfully
C:\PROGRA~3\Riot Games deleted successfully
C:\Users\user\AppData\Local\GGEmpire deleted successfully
C:\Users\user\AppData\Local\Sparta deleted successfully
C:\Users\user\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-8586824-2265057808-709542309-1002\Software\Microsoft\Internet Explorer\SearchScopes{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9} deleted successfully
HKEY_USERS\S-1-5-21-8586824-2265057808-709542309-1002\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully
HKEY_USERS\S-1-5-21-8586824-2265057808-709542309-1002\Software\Microsoft\Internet Explorer\SearchScopes{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} deleted successfully
HKEY_USERS\S-1-5-21-8586824-2265057808-709542309-1002\Software\Microsoft\Internet Explorer\SearchScopes{8FDCBBB7-E601-4983-8491-E3431DAB6774} deleted successfully
HKEY_USERS\S-1-5-21-8586824-2265057808-709542309-1002\Software\Microsoft\Internet Explorer\SearchScopes{E733165D-CBCF-4FDA-883E-ADEF965B476C} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\u4m3q2a2.default

---- Lines myhome removed from prefs.js ----
user_pref(“browser.search.searchengine.iconURL”, “http://myhome.vi-view.com/favicon.ico”);
user_pref(“browser.search.searchengine.url”, "http://myhome.vi-view.com/web/?type=ds&ts=1421436880&from=cor&uid=ST1000DM003-1ER162_Z4Y1X3K9XXXXZ4Y1X3K
---- FireFox user.js and prefs.js backups ----

user__1253_.backup
prefs__1253_.backup

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Ashampoo not found
C:\windows\SysNative\Tasks\Periodic Synchronize Task deleted
C:\PROGRA~3{faf1bc49-621b-8e49-faf1-1bc49621f125} deleted
C:\PROGRA~2\GreenTree Applications deleted
C:\Users\user\AppData\Roaming\sparta111 deleted
C:\PROGRA~3\simplitec deleted
C:\PROGRA~3\YTD Video Downloader deleted
C:\PROGRA~3\Package Cache deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader deleted
C:\windows\SysNative\Tasks\avastBCLRestartS-1-5-21-8586824-2265057808-709542309-1002 deleted
C:\windows\SysNative\drivers\innfd_1_10_0_14.sys deleted
C:\Windows\AppPatch\Custom{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\u4m3q2a2.default\jetpack deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
“wrc@avast.com”=“C:\Program Files\AVAST Software\Avast\WebRep\FF” [27.01.2015 20:32]

==== Firefox Extensions ======================

ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\u4m3q2a2.default

Rocket Beans TV Sendeplan fr Firefox - %ProfilePath%\extensions\javos-firebeans-rbtvfx@jetpack.xpi
Adblock Plus - %ProfilePath%\extensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox

Default - %AppDir%\browser\extensions{972ce4c6-7e08-4474-a285-3208198ce6fd}
Skype Click to Call - %AppDir%\browser\extensions{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\u4m3q2a2.default
F4C5E12008B713FE1B2F2A5990F00A43 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1218158.dll - Shockwave for Director / Shockwave for Director
2E661988463BCFA1B95D4DAAB9B0B6FA - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll - Shockwave Flash

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
eofcbnmajmjmplflapaojjnihcjkigck - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx[22.11.2014 18:00]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[22.11.2014 18:00]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“https://www.google.com/?trackid=sp-006”
“Search Page”=“https://www.google.com/search?trackid=sp-006&q={searchTerms}”
“Search Bar”=“https://www.google.com/?trackid=sp-006”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Start Page”=“https://www.google.com/?trackid=sp-006”
“Search Page”=“https://www.google.com/search?trackid=sp-006&q={searchTerms}”
“Search Bar”=“https://www.google.com/?trackid=sp-006”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
“Start Page”=“https://www.google.com/?trackid=sp-006”
“Search Page”=“https://www.google.com/search?trackid=sp-006&q={searchTerms}”
“Search Bar”=“https://www.google.com/?trackid=sp-006”

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“Search Page”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Search Bar”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Start Page”=“https://www.google.com/?trackid=sp-006”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
“Search Page”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Search Bar”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Start Page”=“http://go.microsoft.com/fwlink/?LinkId=69157”
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
“Search Page”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Search Bar”=“http://go.microsoft.com/fwlink/?LinkId=54896”
“Start Page”=“http://go.microsoft.com/fwlink/?LinkId=69157”

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
“DefaultScope”=“{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}”
{012E1000-F331-11DB-8314-0800200C9A66} Google Url=“http://www.google.com/search?q={searchTerms}”
{E9410C70-B6AE-41FF-AB71-32F4B279EA5F} Google Url=“https://www.google.com/search?trackid=sp-006&q={searchTerms}”

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\u4m3q2a2.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=102 folders=53 57695648 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\user\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\user\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

“C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low” not deleted

==== EOF on 14.06.2015 at 12:58:38,89 ======================

Your help would be much appreciated!

Asyn · 2015-06-14T12:08:59.000Z

nico_popovic post:24:

I have the same problem, as the thread owner. I already ran Zoek and would ask kindly for your help.

Start a new topic in V&W and post your logs there: https://forum.avast.com/index.php?action=post;board=4.0

Announcements