Win64:Sirefef-A[Trj] and Win32:Downloader-PKU[Trj]

Viruses and worms
1

Avast keeps detecting the Win64:Sirefef-A[Trj] and Win32:Downloader-PKU[Trj] trojans. I put them in the chest, but every 4-5 minutes, it detects them again. If I shut off the DSL modem, I do not get the detection alert. But as soon as the DSL modem reboots, the detection alerts start again. Thru your guidelines in your “logs to assist” I downloaded and ran the Malwarebytes program, and removed all items detected. While running the scan a few alerts had happened again, so I thought it wise to run the scan again, this time with the DSL modem turned off. It found 3 more items. I removed those items. Upon restart of the computer, it got hung up part way thru and would not finish the booting process. I unplugged the computer, waited a few seconds and tried to reboot once more. I then started it from the reboot from most recent working boot up prompt. I am assuming that by rebooting from the most recent working boot configuration, that the elimination of the last 3 threats did not finish.
Once rerebooted, I downloaded and scanned with OTL and aswMBR. Logs are attached.

Any help to eliminate this continuing problem would be much appreciated.

2

Malwarebytes 1st scan partial log:

www.malwarebytes.org

Database version: v2012.07.29.09

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Barry C Jones :: BARRYCJONES-PC [administrator]

7/29/2012 2:53:45 PM
mbam-log-2012-07-29 (14-53-45).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 203921
Time elapsed: 18 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 141
HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{00A6FAF1-072E-44cf-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00A6FAF1-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{00A6FAF6-072E-44cf-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00A6FAF6-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{07B18EA1-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{07B18EA9-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{07B18EA0-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{07B18EAA-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearchToolBar.SettingsPlugin.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearchToolBar.SettingsPlugin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{07B18EAB-A523-4961-B6BB-170DE4475CCA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{8CA01F0E-987C-49C3-B852-2F1AC4A7094C} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{1093995A-BA37-41D2-836E-091067C4AD17} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.IECookiesManager.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.IECookiesManager (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{147A976F-EEE1-4377-8EA7-4716E4CDD239} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{17DE5E5E-BFE3-4E83-8E1F-8755795359EC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.DataControl.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.DataControl (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{25560540-9571-4D7B-9389-0F166788785A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{3E1656ED-F60E-4597-B6AA-B6A58E171495} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HTMLMenu.2 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HTMLMenu (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{3E720452-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{3E720450-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{3E720451-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.HTMLPanel.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.HTMLPanel (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{3E720452-B472-4954-B7AA-33069EB53906} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{53CED2D0-5E9A-4761-9005-648404E6F7E5} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearchToolBar.ToolbarPlugin.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearchToolBar.ToolbarPlugin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{8E6F1830-9607-4440-8530-13BE7C4B1D14} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.PopSwatterSettingsControl.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.PopSwatterSettingsControl (PUP.MyWebSearch) → Quarantined and deleted successfully.

3

1st scan part 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.PseudoTransparentPlugin.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.PseudoTransparentPlugin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{84DA4FDF-A1CF-4195-8688-3E961F505983} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{8E6F1832-9607-4440-8530-13BE7C4B1D14} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.PopSwatterBarButton.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.PopSwatterBarButton (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{938AA51A-996C-4884-98CE-80DD16A5C9DA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{29D67D3C-509A-4544-903F-C8C1B8236554} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{98D9753D-D73B-42D5-8C85-4469CDA897AB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HTMLMenu.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{98D9753D-D73B-42D5-8C85-4469CDA897AB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\ScreenSaverControl.ScreenSaverInstaller.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\ScreenSaverControl.ScreenSaverInstaller (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{9FF05104-B030-46FC-94B8-81276E4E27DF} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{A4730EBE-43A6-443e-9776-36915D323AD3} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{A9571378-68A1-443d-B082-284F960C6D17} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.OutlookAddin.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.OutlookAddin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{B813095C-81C0-4E40-AA14-67520372B987} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.KillerObjManager.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.KillerObjManager (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HistoryKillerScheduler.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HistoryKillerScheduler (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{CFF4CE82-3AA2-451F-9B77-7165605FB835} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HistorySwatterControlBar.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\FunWebProducts.HistorySwatterControlBar (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{D9FFFB27-D62A-4D64-8CEC-1FF006528805} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\TypeLib{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{72EE7F04-15BD-4845-A005-D6711144D86A} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.ChatSessionPlugin.1 (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\MyWebSearch.ChatSessionPlugin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\CLSID{fe5b2d9d-91b0-b04b-ac20-14a260769687} (Adware.ColorSoft) → Quarantined and deleted successfully.
HKCR\Typelib{D518921A-4A03-425E-9873-B9A71756821E} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{CF54BE1C-9359-4395-8533-1657CF209CFE} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Typelib{F42228FB-E84E-479E-B922-FBBD096E792C} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCR\Interface{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{9170B96C-28D4-4626-8358-27E6CAEEF907} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{F138D901-86F0-4383-99B6-9CDD406036DA} (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{4E674574-3F0B-491d-8AE3-F90B43A34FD6} (Adware.Hotbar) → Quarantined and deleted successfully.
HKCU\SOFTWARE\MyWebSearch (PUP.MyWebSearch) → Quarantined and deleted successfully.

4

this is why we say attach the logs…and not copy and paste. ::slight_smile:

5

1st scan part 3HKCU\SOFTWARE\Smart-Shopper (Adware.SmartShopper) → Quarantined and deleted successfully.
HKCU\SOFTWARE\CLASSES\CLSID{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) → Quarantined and deleted successfully.
HKLM\SOFTWARE\FocusInteractive (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Fun Web Products (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\FunWebProducts (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\MyWebSearch (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (PUP.MyWebSearch) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{00A6FAF1-072E-44cf-8957-5838F569A31D} (Trojan.BHO) → Quarantined and deleted successfully.
HKCR\CLSID{00A6FAF1-072E-44cf-8957-5838F569A31D} (Trojan.BHO) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{00A6FAF1-072E-44CF-8957-5838F569A31D} (Trojan.BHO) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00A6FAF1-072E-44CF-8957-5838F569A31D} (Trojan.BHO) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{0aa4adc6-37c8-d55c-35d6-b1d426017830} (Adware.Adrotator) → Quarantined and deleted successfully.
HKCR\CLSID{0aa4adc6-37c8-d55c-35d6-b1d426017830} (Adware.Adrotator) → Quarantined and deleted successfully.

Registry Values Detected: 7
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{00A6FAF6-072E-44CF-8957-5838F569A31D} (PUP.MyWebSearch) → Data: → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks{00A6FAF6-072E-44cf-8957-5838F569A31D} (PUP.MyWebSearch) → Data: → Quarantined and deleted successfully.
HKCU\SOFTWARE\CLASSES\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) → Data: C:\Users\Barry C Jones\AppData\Local{22ad06b2-f6dc-602f-5279-6ccc61d40c49}\n. → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt&Search| (Adware.Hotbar) → Data: http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm380TTUS → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources|f3PopularScreensavers (PUP.MyWebSearch) → Data: C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform|FunWebProducts (PUP.MyWebSearch) → Data: → Quarantined and deleted successfully.
HKLM\SOFTWARE\Mozilla\Firefox\extensions|HBLite@HBLite.com (Adware.HotBar) → Data: C:\Program Files\HBLite\bin\11.0.181.0\firefox\extensions → Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 17
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) → Quarantined and deleted successfully.
C:\Users\Barry C Jones\AppData\Roaming\HBLite (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA (Adware.Hotbar) → Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch (PUP.MyWebSearch) → Delete on reboot.
C:\Program Files\MyWebSearch\bar (PUP.MyWebSearch) → Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin (PUP.MyWebSearch) → Delete on reboot.
C:\Program Files\MyWebSearch\bar\Avatar (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotbar (Adware.Hotbar) → Quarantined and deleted successfully.

6

Files Detected: 80
C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (PUP.MyWebSearch) → Delete on reboot.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Windows\System32\f3PSSavr.scr (PUP.FunWebProducts) → Quarantined and deleted successfully.
C:\Users\Barry C Jones\Downloads\setup.exe (PUP.GameBot) → Quarantined and deleted successfully.
C:\Windows\assembly\GAC\Desktop.ini (Trojan.0access) → Delete on reboot.
C:\Windows\Installer{22ad06b2-f6dc-602f-5279-6ccc61d40c49}\n (Trojan.Zaccess) → Quarantined and deleted successfully.
C:\Windows\Installer{22ad06b2-f6dc-602f-5279-6ccc61d40c49}\U\00000004.@ (Rootkit.Zaccess) → Quarantined and deleted successfully.
C:\Windows\Installer{22ad06b2-f6dc-602f-5279-6ccc61d40c49}\U\00000008.@ (Trojan.Dropper.BCMiner) → Quarantined and deleted successfully.
C:\Windows\System32\f3PSSavr.scr (Trojan.Agent) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA\HBLiteSA.dat (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA\HBLiteSAAbout.mht (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA\HBLiteSAau.dat (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA\HBLiteSAEULA.mht (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\HBLiteSA\HBLiteSA_kyf_update.dat (Adware.Hotbar) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3AUXSTB.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3DLGHK.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\CM.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\WB.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (PUP.MyWebSearch) → Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotbar\About Hotbar.lnk (Adware.Hotbar) → Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotbar\Hotbar Customer Support Center.lnk (Adware.Hotbar) → Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Trojan.BHO) → Quarantined and deleted successfully.

(end)

7

Actually, on the “logs to assist page” it does say, “Copy&Paste the entire report in your next reply.” when refering to the Malwarebytes log.

8

usually a mbam log is very short, but yepp it does…we need Essexboy to change that.

9

Sorry about the long long log. Did not know it wouldn’t be allowed to be posted as one long post. Here are attached logs for Malwarebytes

10
Did not know it wouldn't be allowed to be posted as one long post
it is not forbidden.......it just makes it easier for the removers when all logs are attached
11

Hi :slight_smile:
I will be working on your Malware issues…

Step1

[*] Please download BlitzBlank by emsisoft and save it to your desktop.

[*] Open Blitzblank.exe by double click on it.

[*] Click OK at the warning (and take note of it, this is a VERY powerful tool!).

[*] Click the Script tab and copy/paste the following text there:

     
DeleteFolder:
C:\Windows\Installer\{22ad06b2-f6dc-602f-5279-6ccc61d40c49}
C:\Users\Barry C Jones\AppData\Local\{22ad06b2-f6dc-602f-5279-6ccc61d40c49}

[*] Click Execute Now. Your computer will need to reboot in order to replace the files.
[*] When done, post me the report created by Blitzblank. you can find it at the root of the drive C:\

Step2

Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this Instruction.

Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.

When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
Attach log reports ( ComboFix.txt) back to topic.

Step3

[*]Download AdwCleaner (by Xplode) on your desktop.

[*]Launch it, click on [Search] and wait for the scan.
[*]When the scan ends, a report appears.

Note : This report is also saved to C:\AdwCleaner[R1].txt
Attach here that report.

12

After copying and pasting your text under the script tab, when I click on execute for BlitzBank, it says" Syntax error in line 3, Invalid folder path."

13

Script is correct, maybe you do not paste something wright.

Try it again. :wink:
If it still reports an error,then skip that and run ComboFix
note: if you fail to run COmbofix, try it from safe mode.

Do not forget to run and AdwCleaner :wink:

14

OK, looking good! No avast alerts like before!! ;D ;D

Logs for Combofix and AdwCleaner are attached.

15

I dont see attachments? :frowning:

Attach them again:
C:\AdwCleaner[R1].txt
C:\Combofix.txt

16

Ok…attachments, take 2… :wink:

17

Don’t know why there’s 2 sets, but whatever, there they are :smiley:

18

[*] Re-run AdwCleaner
[*] Click on the [Delete] Wait for the programme ends.
The program will close all active programs and out the window with the warning. Click OK to confirm.
On the next two windows that open ( Informations and Restart required ) click OK
[] The computer will restart.
[] Will open a notepad with the report.
[*] Copy the contents of that report in the subject.

Note: The report will also be stored on C:\AdwCleaner[S1].txt

Please re-run Combofix and attach here fresh Combofix.txt

19

New logs

20

Can you send me the following folder?
C:\Qoobox[b]Quarantine[/b]

Archive that folder (zip - par ) and send it to me on mail:

testb70@rocketmail.com

As for the logs, they now looks good. :slight_smile:
How’s your computer behaving now ?