I have Windows xp,I have run a full scan of MBAM,avast, RogueKiller, but I still have the virus and/or malware on my PC.The computer is too slow and on booting there is no icon on the screen for few minutes. Also vlc media player has stopped working.I can’t get rid of the virus/malware of my pc. Especially internet is too slow.
Follow these instructions:http://forum.avast.com/index.php?topic=53253.0
all things have been tried out but nothing works out! it seems to be the hardest virus/malware of all
Please post the logs.
Not all has been tried.
If it was, the malware would have been gone.
OTL log has been posted here
aswMBR log
I found several things that need to be fixed.
Please do nothing untill one of the people who know more about OTL tell you to do so.
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-861567501-1123561945-839522115-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.trovigo.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&SSPV=SE1CGNB1_sp_ie
FF - prefs.js..browser.search.selectedEngine: "http://www.trovigo.com/Results.aspx?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&q={searchTerms}&SSPV=SE1CGNB1_sp_ff"
FF - prefs.js..browser.startup.homepage: "http://www.trovigo.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&SSPV=SE1CGNB1_sp_ff"
CHR - default_search_provider: Conduit Search (Enabled)....(rest of the code here)
CHR - default_search_provider: search_url = http://www.trovigo.com/Results.aspx?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&q={searchTerms}&SSPV=SE1CGNB1_sp_ch
CHR - default_search_provider: suggest_url = http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms},
CHR - plugin: Error reading preferences file
O4 - HKU\S-1-5-21-861567501-1123561945-839522115-500..\Run: [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log File not found
O20 - AppInit_DLLs: (c:\progra~1\ws-ena~1\assist~1.dll) - File not found
OK Firefox has been compromised, we will clear that first and then see what’s left
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:OTL
DRV - File not found [File_System | On_Demand | Stopped] -- -- (yeibbiie)
[2014/03/12 04:57:53 | 000,000,000 | ---D | M] (SaveSense) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\extensions\{2fab2e94-d6f9-42de-8839-3510cef6424b}
[2014/02/15 10:49:42 | 000,000,000 | ---D | M] (YoTuberAdsRemov) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\extensions\a_zjld@oo-aagur.edu
[2014/02/07 00:45:02 | 000,000,000 | ---D | M] (webseavvE) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\extensions\evxmsolyao@ao-ye.com
[2014/02/07 00:45:02 | 000,000,000 | ---D | M] (YoutubeAdblocker) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\extensions\iiemyo@eaye.edu
O4 - HKU\S-1-5-21-861567501-1123561945-839522115-500..\Run: [LiveSupport] "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log File not found
[2014/03/12 04:57:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\SearchProtect
[2014/03/12 04:35:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DOSBox
[2014/03/08 20:32:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Search Protection
[2014/03/08 20:31:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\YTD Video Downloader
[2014/03/08 20:30:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\YTD Video Downloader
[2014/02/13 14:39:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\YoTuberAdsRemov
[2014/02/13 14:39:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\fmcgnbjgipbbpdfgnhallmcmlmngnfah
[2014/03/12 03:09:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Search Protection
[2014/02/02 03:41:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Smadav
[2014/02/07 01:03:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\systweak
[2014/02/13 14:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\16a2801affcc246b
[2014/02/13 14:39:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\fmcgnbjgipbbpdfgnhallmcmlmngnfah
[2014/02/05 05:52:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\greaatosaaver
[2014/02/13 14:39:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YoTuberAdsRemov
[2014/03/08 20:31:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\YTD Video Downloader
:Files
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\fmcgnbjgipbbpdfgnhallmcmlmngnfah
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mpdcfdklflbadebnimcanpkminhcbnii
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
THEN
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.
FINALLY
Run a fresh OTL scan selecting all users
AdwCleaner v3.022 - Report created 14/03/2014 at 09:12:53
Updated 13/03/2014 by Xplode
Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
Username : Administrator - ADMIN-AEAE7CBC3
Running from : C:\Documents and Settings\Administrator\My Documents\Downloads\adwcleaner.exe
Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Program Files\GreenTree Applications
Folder Deleted : C:\Program Files\Optimizer Pro
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\SearchProtect
Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\torch
File Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\user.js
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\Optimizer Pro v3.2
Key Deleted : HKLM\SOFTWARE\Classes\CLSID{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\AppDataLow{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\Software{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache{CA41BB14-E67B-1653-C57B-5CA99418A866}
***** [ Browsers ] *****
-\ Internet Explorer v8.0.6001.18702
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\ Mozilla Firefox v6.0.1 (en-US)
[ File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5d808ga4.default\prefs.js ]
Line Deleted : user_pref(“browser.search.selectedEngine”, "hxxp://www.trovigo.com/Results.aspx?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&q={searchT[…]
Line Deleted : user_pref(“browser.startup.homepage”, “hxxp://www.trovigo.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464&SSPV=SE1CGNB1_sp_ff”);
Line Deleted : user_pref(“extensions.11OKfL.scode”, "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf("acebook")>-1||url.indexOf("txtlnkusaolp00000800")>-1||url.indexOf("sumo[…]
Line Deleted : user_pref(“extensions.TTE.scode”, "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf("acebook")>-1||url.indexOf("txtlnkusaolp00000800")>-1||url.indexOf("sumorob[…]
Line Deleted : user_pref(“extensions.XVaIZLtkb1.scode”, "(function(){try{var url=window.self.location.href;if(url.indexOf("acebook")>-1||url.indexOf("txtlnkusaolp00000800")>-1||url.indexOf("sumorobo")>-1||url.[…]
Line Deleted : user_pref(“browser.newtab.url”, “hxxp://www.trovigo.com/?gd=&ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=SE1CGNB1_sp_ff&Lay=1&UM=4&UP=SP0AE52F69-ACF2-4CEA-B4E2-B1AB48329464”);
-\ Google Chrome v
[ File : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]
Deleted : suggest_url
Deleted : keyword
Deleted : search_url
AdwCleaner[R0].txt - [4056 octets] - [14/03/2014 09:06:00]
AdwCleaner[S0].txt - [3843 octets] - [14/03/2014 09:12:53]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3903 octets] ##########
OTL log is posted here.
What problems are you experiencing at the moment ?
the pc is hanging at times and isn’t responding for a few seconds. some 20-30 virus is there in my avast virus chest.i wan’t to remove them completely out of my computer.please help.
OK for the virus chest you can just empty it by right clicking the files and selecting delete
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
- IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
- Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
- Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
- If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
combofix log has been posted here
Let me know how it is on completion of this
-
Close any open browsers.
-
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-
Open notepad and copy/paste the text in the quotebox below into it:
Driver:: wgapldfq
Save this as CFScript.txt, in the same location as ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
combo
Is there any improvement in the system response ?
combo
yes of of course .it is better now
Test it out for a bit, and if you are happy let me know and we will tidy up