Another Trojan.Kotver!gm2 infection.

new

« Prev
1
Next »

AuguSTorm
New Helpee

Posts: 4

Another Trojan.Kotver!gm2 infection. Feb 12, 2017 11:13:35 GMT -8

Quote

Post by AuguSTorm on Feb 12, 2017 11:13:35 GMT -8

Firstly, thank you for your attention and diligence in these forums!

This is my Mother's computer, so I am relaying this as best I can.

It is a Compaq with a 64bit AMD Athlon II x2 215 2.70GHz running Windows 7 Home Premium SP1.

Issues include 100% cpu usage, seemingly because of Acrobat reader, which I have removed. Massive bandwidth usage by "explorer.exe". Browsers become completely unresponsive. Norton removes it, but it returns. Changes network type from Home to Public.

I have read "2nd - I think I am Infected. What do I do?"

A full Norton scan and removal has taken place recently.

wikisend.com/download/327202/Addition.txt
wikisend.com/download/176910/FRST.txt

dbrisen
Malware Removalists

Posts: 3,688

Another Trojan.Kotver!gm2 infection. Feb 12, 2017 23:50:27 GMT -8

Quote

Post by dbrisen on Feb 12, 2017 23:50:27 GMT -8

Do you have access to this system? Relayed directions sometimes do more harm than good but we will try our best .....

FIRST >>>>

Open notepad by pressing the Windows Key + R key, typing notepad in the Run box and pressing Enter. Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt

Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-219610590-4023381798-3091215838-1000\...\Run: [*pffiienfp<*>] => "C:\Users\Pat\AppData\Local\20a2fa\23a402.7519931" <===== ATTENTION (Value Name with invalid characters)
C:\Users\Pat\AppData\Local\20a2fa
GroupPolicy: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope {77BF8E8A-75FC-4E30-A5AA-079BCC6E0655} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=CPDTDF&pc=CPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {77BF8E8A-75FC-4E30-A5AA-079BCC6E0655} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=CPDTDF&pc=CPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {C61E4995-64CF-4072-84B3-C019EF8AF7FC} URL = hxxp://www.ask.com/web?q={searchTerms}&l=dis&o=uscqd
BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll [2011-01-21] (Yahoo! Inc.)
C:\Program Files (x86)\Yahoo!\Companion
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
Toolbar: HKU\S-1-5-21-219610590-4023381798-3091215838-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS
C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS
C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS
C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS
C:\Windows\SysWOW64\000*.tmp
Task: {0BB7FB7E-C1D3-4021-93D4-4807916B616D} - System32\Tasks\{EA0E03C1-0BDF-4A9D-B657-BDFBDDCE21C6} => pcalua.exe -a C:\Users\Pat\Desktop\Dr.FelixBigFishGames.exe -d C:\Users\Pat\Desktop
Task: {782E2A67-1E9A-410E-A635-E2604A614D3F} - System32\Tasks\{4B0243D2-5062-4264-AC3E-D9213CCB2B8F} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/en/go/help.faq.installer?LastError=1603
Task: {8FD13FF9-808C-40AE-823B-CFB95B812124} - System32\Tasks\{A63E6928-EE23-49B3-BCDC-656D14D81F1C} => pcalua.exe -a C:\Users\Pat\Desktop\bigfishgames_p73629130_s1_l1.exe -d C:\Users\Pat\Desktop
AlternateDataStreams: C:\ProgramData\Temp:0406003C [120]
AlternateDataStreams: C:\ProgramData\Temp:041C0562 [280]
AlternateDataStreams: C:\ProgramData\Temp:05670151 [218]
AlternateDataStreams: C:\ProgramData\Temp:064877B6 [109]
AlternateDataStreams: C:\ProgramData\Temp:0DACB2B7 [207]
AlternateDataStreams: C:\ProgramData\Temp:0EC7A545 [139]
AlternateDataStreams: C:\ProgramData\Temp:109734F6 [406]
AlternateDataStreams: C:\ProgramData\Temp:124B94C0 [207]
AlternateDataStreams: C:\ProgramData\Temp:12D2EB9C [98]
AlternateDataStreams: C:\ProgramData\Temp:1D6B18F1 [227]
AlternateDataStreams: C:\ProgramData\Temp:260575F1 [197]
AlternateDataStreams: C:\ProgramData\Temp:268BA8AB [211]
AlternateDataStreams: C:\ProgramData\Temp:29F0CA7D [454]
AlternateDataStreams: C:\ProgramData\Temp:2AE74FF9 [126]
AlternateDataStreams: C:\ProgramData\Temp:32A82570 [221]
AlternateDataStreams: C:\ProgramData\Temp:3313A48D [196]
AlternateDataStreams: C:\ProgramData\Temp:3AF262FC [133]
AlternateDataStreams: C:\ProgramData\Temp:441D63A8 [236]
AlternateDataStreams: C:\ProgramData\Temp:4FE42FFC [97]
AlternateDataStreams: C:\ProgramData\Temp:512E1728 [113]
AlternateDataStreams: C:\ProgramData\Temp:5197985B [122]
AlternateDataStreams: C:\ProgramData\Temp:5345C8F6 [206]
AlternateDataStreams: C:\ProgramData\Temp:55F44B88 [121]
AlternateDataStreams: C:\ProgramData\Temp:57CC1FDC [106]
AlternateDataStreams: C:\ProgramData\Temp:58860EF5 [197]
AlternateDataStreams: C:\ProgramData\Temp:5D10C56A [138]
AlternateDataStreams: C:\ProgramData\Temp:62B9E014 [110]
AlternateDataStreams: C:\ProgramData\Temp:6425A235 [115]
AlternateDataStreams: C:\ProgramData\Temp:65AB2A58 [137]
AlternateDataStreams: C:\ProgramData\Temp:69AF9D20 [194]
AlternateDataStreams: C:\ProgramData\Temp:6B7447D4 [137]
AlternateDataStreams: C:\ProgramData\Temp:6BF0805F [107]
AlternateDataStreams: C:\ProgramData\Temp:71187328 [112]
AlternateDataStreams: C:\ProgramData\Temp:71612023 [215]
AlternateDataStreams: C:\ProgramData\Temp:769BB147 [238]
AlternateDataStreams: C:\ProgramData\Temp:7776B809 [101]
AlternateDataStreams: C:\ProgramData\Temp:78739EC9 [462]
AlternateDataStreams: C:\ProgramData\Temp:7C412B92 [113]
AlternateDataStreams: C:\ProgramData\Temp:7E31F87A [348]
AlternateDataStreams: C:\ProgramData\Temp:89A5891E [112]
AlternateDataStreams: C:\ProgramData\Temp:8BE7A048 [112]
AlternateDataStreams: C:\ProgramData\Temp:8C1EFEB8 [118]
AlternateDataStreams: C:\ProgramData\Temp:91A12471 [135]
AlternateDataStreams: C:\ProgramData\Temp:95970EA3 [106]
AlternateDataStreams: C:\ProgramData\Temp:9A7BF72D [227]
AlternateDataStreams: C:\ProgramData\Temp:9C8D5426 [123]
AlternateDataStreams: C:\ProgramData\Temp:A2ADBD5A [129]
AlternateDataStreams: C:\ProgramData\Temp:A3E39C6A [103]
AlternateDataStreams: C:\ProgramData\Temp:A5584049 [223]
AlternateDataStreams: C:\ProgramData\Temp:A57500CB [112]
AlternateDataStreams: C:\ProgramData\Temp:A774141A [119]
AlternateDataStreams: C:\ProgramData\Temp:ABFEED8E [99]
AlternateDataStreams: C:\ProgramData\Temp:AECF4772 [216]
AlternateDataStreams: C:\ProgramData\Temp:B1786630 [229]
AlternateDataStreams: C:\ProgramData\Temp:B60D5127 [446]
AlternateDataStreams: C:\ProgramData\Temp:BF2E2F0E [214]
AlternateDataStreams: C:\ProgramData\Temp:C0692342 [220]
AlternateDataStreams: C:\ProgramData\Temp:C48A983C [476]
AlternateDataStreams: C:\ProgramData\Temp:C5BCA2A0 [107]
AlternateDataStreams: C:\ProgramData\Temp:C63E7DE2 [111]
AlternateDataStreams: C:\ProgramData\Temp:C9CDDE5E [121]
AlternateDataStreams: C:\ProgramData\Temp:CB52BE62 [114]
AlternateDataStreams: C:\ProgramData\Temp:CCB49694 [208]
AlternateDataStreams: C:\ProgramData\Temp:D390A6A7 [232]
AlternateDataStreams: C:\ProgramData\Temp:D3A89E47 [127]
AlternateDataStreams: C:\ProgramData\Temp:D507AEDA [113]
AlternateDataStreams: C:\ProgramData\Temp:D93AABC7 [134]
AlternateDataStreams: C:\ProgramData\Temp:DDF112BD [270]
AlternateDataStreams: C:\ProgramData\Temp:DE875C30 [130]
AlternateDataStreams: C:\ProgramData\Temp:E32966C0 [110]
AlternateDataStreams: C:\ProgramData\Temp:E717F65C [109]
AlternateDataStreams: C:\ProgramData\Temp:E80802C7 [121]
AlternateDataStreams: C:\ProgramData\Temp:EA1919C7 [130]
AlternateDataStreams: C:\ProgramData\Temp:F84B8DB5 [270]
AlternateDataStreams: C:\ProgramData\Temp:FEF0DEE7 [200]
AlternateDataStreams: C:\Users\Pat\Desktop\Facebook.website:TASKICON_0news-1751121550 [2302]
AlternateDataStreams: C:\Users\Pat\Desktop\Facebook.website:TASKICON_1messages-431041656 [2302]
AlternateDataStreams: C:\Users\Pat\Desktop\Facebook.website:TASKICON_2events-250898981 [2302]
AlternateDataStreams: C:\Users\Pat\Desktop\Facebook.website:TASKICON_3friends-215113587 [2302]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-1285746946 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-128701918 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-136299409 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-1425405090 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-1748993538 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-423390199 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-905722121 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-906843979 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned-942727159 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned1010722689 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned2004882992 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned208556692 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned2090537636 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:DESTICON_pinned775920532 [19315]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:TASKICON_0favicon93977637 [77262]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:TASKICON_1favicon-729708308 [77262]
AlternateDataStreams: C:\Users\Pat\Desktop\Pandora.website:TASKICON_2favicon-1789220479 [77262]
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..." and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

SECOND >>>>

Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt .

[/ul]

LAST >>>>

INFO TO REPLY WITH:
How is your system running now?
The Fixlog.txt text file (you should be able to attach this file; no need for wikisend.com usually).
The logs from MBAR - mbar-log.txt and the system-log.txt files please.
Any questions?

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

AuguSTorm
New Helpee

Posts: 4

Another Trojan.Kotver!gm2 infection. Feb 13, 2017 9:09:56 GMT -8

Quote

Post by AuguSTorm on Feb 13, 2017 9:09:56 GMT -8

Yes, I do have ready access to the machine. It seems to be running fine after completing the prescribed actions. Thank you so much! Will let you know if things change over the course of the day.

I sent the second run mbar log, which was clean. The first run had 14 IE temp files infected. If you would like that file please let me know.

Thanks again!

Attachments:

Fixlog.txt (43.45 KB)

mbar-log-2017-02-13 10-05-21.txt (2.08 KB)

system-log.txt (54.48 KB)

dbrisen
Malware Removalists

Posts: 3,688

Another Trojan.Kotver!gm2 infection. Feb 13, 2017 14:51:41 GMT -8

Quote

Post by dbrisen on Feb 13, 2017 14:51:41 GMT -8

Well that is great to hear and the logs look very good. There is one more scanner that may help clean any leftover adware on the system.

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.

NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

[/b][/font] Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
You will see the following console:

Click the Scan button and wait for the scan to finish.

After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.

Click the Clean button.

Everything checked will be deleted.

When the program has finished cleaning a report appears.

Once done it will ask to reboot, allow this

On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C#].txt
[/ul]

Optional:
NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

AuguSTorm
New Helpee

Posts: 4

Another Trojan.Kotver!gm2 infection. Feb 14, 2017 16:55:19 GMT -8

Quote

Post by AuguSTorm on Feb 14, 2017 16:55:19 GMT -8

Machine seems to be maintaining, many thanks. Mom says thank you also!

Michael Proudfit

********************************************

# AdwCleaner v6.043 - Logfile created 14/02/2017 at 18:47:49
# Updated on 27/01/2017 by Malwarebytes
# Database : 2017-02-13.1 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : Pat - PAT-PC
# Running from : C:\Users\Pat\Downloads\adwcleaner_6.043.exe
# Mode: Clean
# Support : www.malwarebytes.com/support

***** [ Services ] *****

[-] Service deleted: YahooAUService

***** [ Folders ] *****

[-] Folder deleted: C:\Users\Pat\AppData\Local\Browsersafeguard
[-] Folder deleted: C:\Users\Pat\AppData\LocalLow\Yahoo! Companion
[-] Folder deleted: C:\Users\Pat\AppData\LocalLow\Yahoo!\Companion
[-] Folder deleted: C:\Users\Pat\AppData\Roaming\iWin
[-] Folder deleted: C:\Users\Pat\AppData\Roaming\Yahoo!\Companion
[!] Folder not deleted: C:\Users\Pat\Desktop\Online
[-] Folder deleted: C:\Program Files\RrFilter
[-] Folder deleted: C:\ProgramData\Tarma Installer
[-] Folder deleted: C:\ProgramData\Trymedia
[-] Folder deleted: C:\ProgramData\Yahoo! Companion
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Tarma Installer
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Trymedia
[#] Folder deleted on reboot: C:\ProgramData\Application Data\Yahoo! Companion
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freeze.com
[-] Folder deleted: C:\Users\Public\Documents\iWin
[-] Folder deleted: C:\Program Files (x86)\Freeze.com
[-] Folder deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yahoo! Companion
[-] Folder deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Yahoo!\Companion

***** [ Files ] *****

[-] File deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
[-] File deleted: C:\Program Files (x86)\Yahoo!\Common\unyt.exe

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\Yahoo.AntiSpyPlugin
[-] Key deleted: HKLM\SOFTWARE\Classes\Yahoo.AntiSpyPlugin.6
[-] Key deleted: HKLM\SOFTWARE\Classes\Yahoo.PopupBlockerPlugin
[-] Key deleted: HKLM\SOFTWARE\Classes\Yahoo.PopupBlockerPlugin.4
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YCAPlugin.CAYASPlugin
[-] Key deleted: HKLM\SOFTWARE\Classes\YCAPlugin.CAYASPlugin.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.BlockerCtrl
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.BlockerCtrl.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.DataStore
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.DataStore.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.PUBHTMLEventHandler
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.PUBHTMLEventHandler.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.StringList
[-] Key deleted: HKLM\SOFTWARE\Classes\YPUBC.StringList.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.CacheLoader.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.Clickstream.1
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YTHelper.2
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand
[-] Key deleted: HKLM\SOFTWARE\Classes\yt.YToolbarBand.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTabBar.YTabBarControl
[-] Key deleted: HKLM\SOFTWARE\Classes\YTabBar.YTabBarControl.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YCAAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YCAAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant
[-] Key deleted: HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTBM.YTBMButton
[-] Key deleted: HKLM\SOFTWARE\Classes\YTBM.YTBMButton.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.YTNavAssistPlugin
[-] Key deleted: HKLM\SOFTWARE\Classes\YTNavAssist.YTNavAssistPlugin.1
[-] Key deleted: HKLM\SOFTWARE\Classes\YTSingleInstance.SingleInstance
[-] Key deleted: HKLM\SOFTWARE\Classes\YTSingleInstance.SingleInstance.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Yahoo.AntiSpyPlugin
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Yahoo.AntiSpyPlugin.6
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Yahoo.PopupBlockerPlugin
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Yahoo.PopupBlockerPlugin.4
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YCAPlugin.CAYASPlugin
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YCAPlugin.CAYASPlugin.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.BlockerCtrl
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.BlockerCtrl.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.DataStore
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.DataStore.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.PUBHTMLEventHandler
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.PUBHTMLEventHandler.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.StringList
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YPUBC.StringList.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.CacheLoader
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.CacheLoader.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.Clickstream
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.Clickstream.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTHelper
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YTHelper.2
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YToolbarBand
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\yt.YToolbarBand.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTabBar.YTabBarControl
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTabBar.YTabBarControl.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YCAAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YCAAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBAutoUpdaterAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBCustomizerAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBGeneralAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBMessengerAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ytbbroker.YTBSingleInstanceAssistant.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTBM.YTBMButton
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTBM.YTBMButton.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpaceCF.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.NameSpacePP.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.YTNavAssistPlugin
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTNavAssist.YTNavAssistPlugin.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTSingleInstance.SingleInstance
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YTSingleInstance.SingleInstance.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{07CDAAD9-1226-4C6D-B774-C00E7B323484}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{1CAE874F-F5C7-4BCC-BA46-9AD26DF35B93}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{35860EFB-1589-4F32-A618-99E847A502B2}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{39DCCEAF-C749-4390-9953-527CF916935C}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{41D7CEE0-D91F-498C-BC88-4A6BEE46C2BC}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{9EDCCD11-960D-49AE-B523-C6B5AB7E1345}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{EB2BA65E-41F6-4F64-92A6-216CDFFDF577}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{EFC0651C-B6D7-49CD-A6E0-B1CE9AB5FE46}
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{FFFFE1D1-E40D-49a1-9622-BC59BD1879C3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1147DC83-6208-4dca-8E88-DD45BAAB3043}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{11CB4723-D5A1-4a55-8D1D-5C2679D54CF5}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1E57256D-9F39-4267-AB39-D7813D644C5A}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{31371420-098D-4C0E-A11E-EBEC2305DD01}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{37B8167C-B9A4-4316-94B2-67B64BB2BA7C}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3A06AA27-D94B-48C2-BB55-9FD0FF2120E3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{46140CE4-76FE-440E-AE88-4C2272BC05C7}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6E40017D-FB6A-4804-BDE4-3BB09F1719C1}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9F9C4C5C-2BA8-4E00-A697-9F710BB1026B}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{B7A0E898-93E5-43f4-B99A-6C70B303699C}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{C60CCE95-6AF9-4E74-B66B-3212D19F1D2F}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{D40A62D1-8FC0-4F03-90C4-0DE03BE73A41}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{DDCED22E-D018-471D-9A5C-A4EA2F21133D}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{E1A2D448-6334-45ec-8800-6D7F71DC87FC}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{F9A10D86-182A-4946-869B-70C3D109D14D}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FBE30D66-39A2-4b72-8B43-6D4C335A6F34}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{F5CC67F7-F6BA-44E3-98EC-EA17D17E6479}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{3C16E079-E4C7-493C-BE9F-E0F2BB0B7430}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{6EB4349D-4333-442F-ACA4-4C72AF28B6ED}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{7DB8B625-DBF0-4491-B544-5A06F7B17BB4}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{9DE77B51-89F6-468E-9402-16050382E950}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{8233093C-178B-484B-979E-3C6B5B147DBC}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{F56ACA29-1C99-40F1-AC64-2E44C4F6BC71}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{11D5E9EA-3117-4389-8E58-742F0975C980}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{12D3E096-0FDF-42CC-8F44-04944F9C1648}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{22389F39-2CF4-47C4-B8B2-273BB16BF70C}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{23E3CEB3-D63A-433E-A5D0-4DB1C501B915}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{26A3152F-CF87-4C5B-8093-4D4B9EC084EB}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{2723E96B-905F-4C64-8999-D868A08E6370}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{29E3319C-4B3C-479F-8692-BDD2CA30BEDD}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{2FCB4E7E-E5C7-4D07-BB2C-78DF2DA867AD}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{367BD1CD-74A3-451F-B1A4-6A2DE4129A2D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{3D592FCB-FEFD-43A6-9A4F-BDE2D4607D07}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{49F018EE-F362-4B5B-8EC8-BCF9246ABF21}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{63B73044-FC1A-4FE1-991B-FDBD4CDAA868}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{67E5E37C-E6B8-4782-877D-E9437C4CD982}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{686D40BC-FA43-4317-8474-E634E6B487F2}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{7207E52B-821E-4C05-A8D6-2965B2BE77CF}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{863FCF5D-DC39-4DA9-AF32-CB0025990EEE}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{A310B105-FB7D-4497-A7E8-E046462B012F}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B09E015A-4D4E-4F8D-A436-95E19140947D}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{B1E712C4-03AA-495F-B0F5-0F057E126E2A}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{D13DC65C-C77B-4986-9078-DEA3D34C71BB}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{DF522774-8CA0-4B15-A93A-5F61AB95DA1C}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{F9A10D86-182A-4946-869B-70C3D109D14D}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{AD34BE7D-2603-43DD-8D1F-E4431D42C44E}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{B82D18E0-1649-48DE-92D7-AA89BBB5F0AD}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{D2EA97F6-6235-4B2D-B5AA-A4472B9CE557}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{0548C79F-7B8C-455D-B228-97D35371BB62}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{4A1E52AC-64F2-49E9-BFD7-0806D9494DBB}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{61A2027D-B837-4080-A925-6E30E10DEF32}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{78DB07DF-483E-4829-AB44-ED7952083584}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{8A1AB044-787D-4309-8410-709768E484AB}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{A2C55651-A23E-43CA-B63D-C10B99EFF7E0}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{A31F34A1-EBD2-45A2-BF6D-231C1B987CC8}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
[-] Key deleted: HKU\.DEFAULT\Software\Yahoo\Companion
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\APN PIP
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\OB
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\SearchProtectINT
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\Yahoo\Companion
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\Yahoo\YFriendsBar
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\YahooPartnerToolbar
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\AppDataLow\Software\Rr Savings
[-] Key deleted: HKU\S-1-5-21-219610590-4023381798-3091215838-1000\Software\AppDataLow\Software\Yahoo\Companion
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\APN PIP
[#] Key deleted on reboot: HKCU\Software\OB
[#] Key deleted on reboot: HKCU\Software\SearchProtectINT
[#] Key deleted on reboot: HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Rr Savings
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\{F2E9660B-98AF-42c0-8258-9CDDF07BF95D}
[-] Key deleted: HKLM\SOFTWARE\Freeze.com
[-] Key deleted: HKLM\SOFTWARE\RrFilter
[-] Key deleted: HKLM\SOFTWARE\Tarma Installer
[-] Key deleted: HKLM\SOFTWARE\Trymedia Systems
[-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar
[#] Key deleted on reboot: [x64] HKCU\Software\APN PIP
[#] Key deleted on reboot: [x64] HKCU\Software\OB
[#] Key deleted on reboot: [x64] HKCU\Software\SearchProtectINT
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: [x64] HKCU\Software\YahooPartnerToolbar
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Rr Savings
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: [x64] HKLM\SOFTWARE\LevelQualityWatcher
[-] Key deleted: [x64] HKLM\SOFTWARE\RrSavings
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MsConfig\StartupReg\Search Protection
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YCAPlugin.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YPUBC.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\yt.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YTabBar.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\ytbbroker.EXE
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YTBM.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YTMsgr.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YTNavAssist.DLL
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\YTSingleInstance.DLL

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [19438 Bytes] - [14/02/2017 18:47:49]
C:\AdwCleaner\AdwCleaner[S0].txt - [18035 Bytes] - [14/02/2017 18:32:13]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [19586 Bytes] ##########

dbrisen
Malware Removalists

Posts: 3,688

Another Trojan.Kotver!gm2 infection. Feb 14, 2017 22:32:25 GMT -8

Quote

Post by dbrisen on Feb 14, 2017 22:32:25 GMT -8

Looks good!

We need to remove the tools we've used during the cleaning of your machine.

[/a]
Ensure the following is ticked:
Remove disinfection tools
Create registry backup
Purge system restore
[/ul]

Then click Run. The program will run for a few moments and then notepad will open with a log.

Please paste the log in your next reply. Once you have the log file saved, please reboot your system to complete the clean up process.

Your system looks clean and your logs are fine. Unless you want something else done, you are done and free to go.

Final words from me: Surf safely, and watch when installing or letting anything add itself to your system. Remember, the best security is not on your system but in the chair in front of it. Take care and thanks for sticking with us in this rushed time.

=== options ====
Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing. By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed.

CryptoPrevent is a free program that prevents CryptoLocker / ransomware from infecting your PC by locking down the OS so the malware can not get a grip on your system. You can read the details about this program here.

Also, consider adding MalwareBytes Antimalware to your arsenal of safe keeping programs. Use the free version (not the paid or trial version) and you won't have a problem with your antivirus scanner program. Keep it updated and run a scan with it once a week.

Lastly, if you use Firefox as your main web browser, consider adding the NoScript and uBlock Origin add-ons to the browser to block scripting hijacks and remove unwanted ads from the pages you view.

You may also find some information and tips at this thread:
How did I get infected in the first place?
and
COMPUTER SECURITY - a short quide to staying safer online

I'll leave this topic open for a few days so that if you have any questions you can come back here. Surf safe, my friend!!

AuguSTorm
New Helpee

Posts: 4

Another Trojan.Kotver!gm2 infection. Feb 23, 2017 15:55:30 GMT -8

Quote

Post by AuguSTorm on Feb 23, 2017 15:55:30 GMT -8

Feb 14, 2017 22:32:25 GMT -8 dbrisen said:

Also, consider adding MalwareBytes Antimalware to your arsenal of safe keeping programs. Use the free version (not the paid or trial version)

I am only seeing Trial or Paid on the site. Am I missing something?

dbrisen Malware Removalists Posts: 3,688	Another Trojan.Kotver!gm2 infection. Feb 23, 2017 22:33:51 GMT -8 Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by dbrisen on Feb 23, 2017 22:33:51 GMT -8 Probably not as I wrote those instruction for a older version. Use the Trial and when the Trial expires, it will convert to the Free version and stay that way.
	I will not provide malware removal by PM; please post in your thread on the Malware Removal board. My help is always free but if you would like to help encourage me or show your thanks -----> *DONATE*

« Prev
1
Next »

Another Trojan.Kotver!gm2 infection.

Post by AuguSTorm on Feb 12, 2017 11:13:35 GMT -8

Post by dbrisen on Feb 12, 2017 23:50:27 GMT -8

Post by AuguSTorm on Feb 13, 2017 9:09:56 GMT -8

Post by dbrisen on Feb 13, 2017 14:51:41 GMT -8

Post by AuguSTorm on Feb 14, 2017 16:55:19 GMT -8

Post by dbrisen on Feb 14, 2017 22:32:25 GMT -8

Post by AuguSTorm on Feb 23, 2017 15:55:30 GMT -8

Post by dbrisen on Feb 23, 2017 22:33:51 GMT -8