[ti]SOLVED[/ti]Another vosteran infection

hd5032 New Helpee Posts: 15	[ti]SOLVED[/ti]Another vosteran infection Jan 23, 2015 5:09:43 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by hd5032 on Jan 23, 2015 5:09:43 GMT -8 Addition.txt

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Another vosteran infection Jan 23, 2015 10:20:40 GMT -8

Post by dbrisen on Jan 23, 2015 10:20:40 GMT -8

First, please uninstall the following (if you can):

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features[/i][/b] and remove the following (if listed):

Ad-Aware Antivirus
Ad-Aware Security Add-on
BitTorrent
Catalina Savings Printer
Coupon Printer for Windows
CouponMatcher
Settings Alerter
WSE_Vosteran

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

Next, run the Fixlist script in FRST

You may want to read carefully all of this message first before starting the steps.

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the script file that is attached by right clicking on it and selecting "Save Target As..." or "Save Link As ...." (depends on the browser you are using). Please make sure that the file type is set as Text File (or All Files but NOT as a HTML file) and the files name is Fixlist.txt , have it on the Desktop, so that fixlist.txt is next to FRST64.exe,

DO NOT DRAG AND DROP to download the script, it won't work properly for FRST.

The script tells FRST what to do.

Start FRST that is on the desktop by right clicking on file and selecting "Run as Administrator..."

When the tool opens click Yes to disclaimer. (if it still does)

Press the Fix button just once and wait. The script will be processed and your system restarted to complete the removal / breakage of the malware.

The tool will make a log on the Desktop (Fixlog.txt) please post it to your reply (attach or paste)

Attachments:

Fixlist.txt (12.23 KB)

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

hd5032
New Helpee

Posts: 15

[ti]SOLVED[/ti]Another vosteran infection Jan 24, 2015 12:25:58 GMT -8

Post by hd5032 on Jan 24, 2015 12:25:58 GMT -8

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-01-2015 01
Ran by Owner at 2015-01-24 15:12:57 Run:1
Running from C:\Users\Owner\Desktop
Loaded Profiles: Owner (Available profiles: Owner)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [SearchProtection] => C:\ProgramData\Search Protection\_run.bat [168 2013-03-02] ()
HKLM-x32\...\Run: [DATAMNGR] => C:\PROGRA~2\SETTIN~1\Datamngr\DATAMN~1.EXE
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\MountPoints2: {b45a83b0-7c3f-11e4-8842-dc0ea10bf152} - E:\LGAutoRun.exe
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\MountPoints2: {b45a83bc-7c3f-11e4-8842-dc0ea10bf152} - E:\windows\AutoRun.exe
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\MountPoints2: {c177cc3d-e58c-11e2-8463-dc0ea10bf152} - E:\LGAutoRun.exe
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\MountPoints2: {d61f72ac-be1c-11e1-877b-dc0ea10bf152} - E:\TL-Bootstrap.exe
AppInit_DLLs: C:\PROGRA~2\SETTIN~1\Datamngr\x64\datamngr.dll => C:\PROGRA~2\SETTIN~1\Datamngr\x64\datamngr.dll File Not Found
AppInit_DLLs: C:\PROGRA~2\SETTIN~1\Datamngr\x64\IEBHO.dll => C:\PROGRA~2\SETTIN~1\Datamngr\x64\IEBHO.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SETTIN~1\Datamngr\datamngr.dll => "C:\PROGRA~2\SETTIN~1\Datamngr\datamngr.dll" File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SETTIN~1\Datamngr\IEBHO.dll => "C:\PROGRA~2\SETTIN~1\Datamngr\IEBHO.dll" File Not Found
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\Software\Microsoft\Internet Explorer\Main,Start Page = Vosteran.com/?f=1&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2StBtDtDtCtAyByC0EtG0EtDtC0DtGyC0A0CzztGyB0EtD0FtGtAyCyD0E0CzytCyE0BzzyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByBtAtD0AyDzytG0E0B0ByCtGyEyDzzzytG0BtAyBzytGtByCyDtBzytDyDzyzy0Ezz0B2Q&cr=832639186&ir=
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} URL = isearch.fantastigames.com/web?src=ieb&gct=ds&appid=100&systemid=440&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} URL = isearch.fantastigames.com/web?src=ieb&gct=ds&appid=100&systemid=440&q={searchTerms}
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} URL = isearch.fantastigames.com/web?src=ieb&gct=ds&appid=100&systemid=440&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} URL = isearch.fantastigames.com/web?src=ieb&gct=ds&appid=100&systemid=440&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> DefaultScope {C8DF3399-DD58-4208-A75D-0F9F36E73FC5} URL = Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2StBtDtDtCtAyByC0EtG0EtDtC0DtGyC0A0CzztGyB0EtD0FtGtAyCyD0E0CzytCyE0BzzyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByBtAtD0AyDzytG0E0B0ByCtGyEyDzzzytG0BtAyBzytGtByCyDtBzytDyDzyzy0Ezz0B2Q&cr=832639186&ir=
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {0FA204D4-5326-43C7-A4D2-EDFB78E6EA59} URL = www.ask.com/web?q={searchterms}&l=dis&o=ushpl
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = lavasoft.blekko.com/ws/?source=f439e2c0&tbp=rbox&toolbarid=adawaretb&u=A5BB9B885A3F9DF92FA82B51324B229D&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} URL = isearch.fantastigames.com/web?src=ieb&gct=ds&appid=100&systemid=440&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = www.ask.com/web?&o=101881&l=dis&q={SEARCHTERMS}
SearchScopes: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000 -> {C8DF3399-DD58-4208-A75D-0F9F36E73FC5} URL = Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2StBtDtDtCtAyByC0EtG0EtDtC0DtGyC0A0CzztGyB0EtD0FtGtAyCyD0E0CzytCyE0BzzyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByBtAtD0AyDzytG0E0B0ByCtGyEyDzzzytG0BtAyBzytGtByCyDtBzytDyDzyzy0Ezz0B2Q&cr=832639186&ir=
BHO: DataMngr -> {F2D6C718-7E52-428E-8852-365C4B1A6E36} -> C:\PROGRA~2\SETTIN~1\Datamngr\x64\BROWSE~1.DLL No File
BHO-x32: Coupon-Matcher BHO -> {F0B3FA34-C3B2-4B72-B8FE-A4148C2FA663} -> C:\Program Files (x86)\CouponMatcher\1.1\Extension.dll (Coupon-Matcher)
BHO-x32: DataMngr -> {F2D6C718-7E52-428E-8852-365C4B1A6E36} -> C:\PROGRA~2\SETTIN~1\Datamngr\BROWSE~1.DLL No File
Toolbar: HKLM-x32 - Coupon-Matcher - {AC5183D8-28A9-4A36-850D-8C8846855EED} - C:\Program Files (x86)\CouponMatcher\1.1\Extension.dll (Coupon-Matcher)
FF DefaultSearchEngine: Vosteran
FF SearchEngineOrder.1: Secure Search
FF SelectedSearchEngine: Vosteran
FF Homepage: hxxp://Vosteran.com/?f=1&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2StBtDtDtCtAyByC0EtG0EtDtC0DtGyC0A0CzztGyB0EtD0FtGtAyCyD0E0CzytCyE0BzzyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDyByBtAtD0AyDzytG0E0B0ByCtGyEyDzzzytG0BtAyBzytGtByCyDtBzytDyDzyzy0Ezz0B2Q&cr=832639186&ir=
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin HKU\S-1-5-21-4059772642-3558261170-1923146660-1000: CouponNetwork.com/CMDUniversalCouponPrintActivator -> C:\Users\Owner\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll (Coupons, Inc.)
FF SearchPlugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\Vosteran.xml
FF SearchPlugin: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\WebSearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF Extension: Coupon-Matcher - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\Extensions\{71988F2A-67DE-4A7F-B20F-B6D0CF8469AF}.xpi [2013-07-28]
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Always Smile) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpaapignoneonaghhkoddkghglbppdmg [2014-04-26]
CHR Extension: (AmazonSmile 1Button for Chrome) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdgenjhkjihnmigcommchefpajjhdmba [2014-05-23]
CHR Extension: (Smile Always) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgpmhnmjbhgkhpbgelalfpplebgfjmbf [2014-07-23]
CHR Extension: (SecureSearch) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik [2013-03-02]
CHR Extension: (SecureSearch) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik [2013-03-02]
CHR HKLM\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path
CHR HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKLM-x32\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CustomCLSID: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Owner\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Owner\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Owner\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Owner\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {051CEA54-8D24-4946-A226-F9D21C6D560A} - System32\Tasks\{BE04F1BF-4444-4EDD-9C22-484D8F606CB2} => pcalua.exe -a "C:\Users\Owner\Downloads\ActiveSetupN (1).exe" -d C:\Users\Owner\Downloads
Task: {9D75A068-5838-49B7-BECC-52ABF24BA89D} - System32\Tasks\WSE_Vosteran => C:\Users\Owner\AppData\Roaming\WSE_Vosteran\UpdateProc\UpdateTask.exe [2015-01-01] () <==== ATTENTION
Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\Owner\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
C:\ProgramData\Search Protection
C:\PROGRA~2\SETTIN~1\Datamngr
C:\Program Files (x86)\CouponMatcher
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\user.js
C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\Vosteran.xml
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\WebSearch.xml
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\Extensions\{71988F2A-67DE-4A7F-B20F-B6D0CF8469AF}.xpi
C:\Users\Owner\AppData\Roaming\WSE_Vosteran
2015-01-01 20:49 - 2015-01-01 20:49 - 00000000 ____D () C:\Program Files\20130918085301786
2015-01-01 20:47 - 2015-01-01 20:49 - 02602967 _____ () C:\Users\Owner\Downloads\20130918085301786 (1).rar
2015-01-01 20:46 - 2015-01-01 20:46 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\IHlpr
2015-01-01 20:45 - 2015-01-01 20:59 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Philipp Winterberg
2015-01-01 20:45 - 2015-01-01 20:45 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\OpenCandy
2015-01-01 20:44 - 2015-01-01 20:44 - 01450496 _____ (Philipp Winterberg) C:\Users\Owner\Downloads\InstallFreeRARExtractFrog (1).exe
2015-01-01 20:41 - 2015-01-01 20:41 - 01450496 _____ (Philipp Winterberg) C:\Users\Owner\Downloads\InstallFreeRARExtractFrog.exe
2015-01-01 20:40 - 2015-01-23 07:40 - 00000292 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-01 20:40 - 2015-01-01 20:40 - 00003232 _____ () C:\Windows\System32\Tasks\WSE_Vosteran
2015-01-01 20:40 - 2015-01-01 20:40 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\WSE_Vosteran
2015-01-01 20:40 - 2015-01-01 20:40 - 00000000 ____D () C:\Program Files (x86)\WSE_Vosteran
2015-01-01 13:13 - 2015-01-01 13:14 - 02602967 _____ () C:\Users\Owner\Downloads\20130918085301786.rar
2013-11-18 13:20 - 2013-11-18 13:20 - 0893239 _____ () C:\Users\Owner\AppData\Local\a.zip
2013-11-18 13:20 - 2013-11-18 13:20 - 2162416 _____ (Catalina Marketing Corp) C:\Users\Owner\AppData\Local\BcsKtYcHW.dll
C:\Users\Owner\AppData\Local\Temp\2aa3848c-c8c9-4bb6-b697-b1e0fea1633b.exe
C:\Users\Owner\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Owner\AppData\Local\Temp\contentDATs.exe
C:\Users\Owner\AppData\Local\Temp\CouponMatcher.exe
C:\Users\Owner\AppData\Local\Temp\EasyTorrent.exe
C:\Users\Owner\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Owner\AppData\Local\Temp\GUR46F3.exe
C:\Users\Owner\AppData\Local\Temp\installhelper.dll
C:\Users\Owner\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe
C:\Users\Owner\AppData\Local\Temp\install_flashplayer11x32ax_mssd_au_aih.exe
C:\Users\Owner\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\Owner\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Owner\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\Owner\AppData\Local\Temp\mssinstaller.exe
C:\Users\Owner\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Owner\AppData\Local\Temp\propsys.dll
C:\Users\Owner\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Owner\AppData\Local\Temp\setup_3.2.20.exe
C:\Users\Owner\AppData\Local\Temp\SRAssetsHelper.dll
Reboot:
end

*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SearchProtection => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR => Value not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b45a83b0-7c3f-11e4-8842-dc0ea10bf152}" => Key deleted successfully.
HKCR\CLSID\{b45a83b0-7c3f-11e4-8842-dc0ea10bf152} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b45a83bc-7c3f-11e4-8842-dc0ea10bf152}" => Key deleted successfully.
HKCR\CLSID\{b45a83bc-7c3f-11e4-8842-dc0ea10bf152} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c177cc3d-e58c-11e2-8463-dc0ea10bf152}" => Key deleted successfully.
HKCR\CLSID\{c177cc3d-e58c-11e2-8463-dc0ea10bf152} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d61f72ac-be1c-11e1-877b-dc0ea10bf152}" => Key deleted successfully.
HKCR\CLSID\{d61f72ac-be1c-11e1-877b-dc0ea10bf152} => Key not found.
"C:\PROGRA~2\SETTIN~1\Datamngr\x64\datamngr.dll" => Value Data not found.
"C:\PROGRA~2\SETTIN~1\Datamngr\x64\IEBHO.dll" => Value Data not found.
"C:\PROGRA~2\SETTIN~1\Datamngr\datamngr.dll" => Value Data not found.
"C:\PROGRA~2\SETTIN~1\Datamngr\IEBHO.dll" => Value Data not found.
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77}" => Key deleted successfully.
HKCR\CLSID\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} => Key not found.
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0FA204D4-5326-43C7-A4D2-EDFB78E6EA59}" => Key deleted successfully.
HKCR\CLSID\{0FA204D4-5326-43C7-A4D2-EDFB78E6EA59} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}" => Key deleted successfully.
HKCR\CLSID\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2440} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}" => Key deleted successfully.
HKCR\CLSID\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} => Key not found.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C8DF3399-DD58-4208-A75D-0F9F36E73FC5}" => Key deleted successfully.
HKCR\CLSID\{C8DF3399-DD58-4208-A75D-0F9F36E73FC5} => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2D6C718-7E52-428E-8852-365C4B1A6E36}" => Key deleted successfully.
"HKCR\CLSID\{F2D6C718-7E52-428E-8852-365C4B1A6E36}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0B3FA34-C3B2-4B72-B8FE-A4148C2FA663} => Key not found.
HKCR\Wow6432Node\CLSID\{F0B3FA34-C3B2-4B72-B8FE-A4148C2FA663} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2D6C718-7E52-428E-8852-365C4B1A6E36}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{F2D6C718-7E52-428E-8852-365C4B1A6E36}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{AC5183D8-28A9-4A36-850D-8C8846855EED} => Value not found.
HKCR\Wow6432Node\CLSID\{AC5183D8-28A9-4A36-850D-8C8846855EED} => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\Software\MozillaPlugins\CouponNetwork.com/CMDUniversalCouponPrintActivator => Key not found.
C:\Users\Owner\AppData\Roaming\CATALI~2\NPBCSK~1.DLL not found.
"C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll" => not found.
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\Vosteran.xml => Moved successfully.
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\WebSearch.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml => Moved successfully.
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\Extensions\{71988F2A-67DE-4A7F-B20F-B6D0CF8469AF}.xpi => Moved successfully.
Chrome DefaultSuggestURL deleted successfully.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpaapignoneonaghhkoddkghglbppdmg => Moved successfully.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdgenjhkjihnmigcommchefpajjhdmba => Moved successfully.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgpmhnmjbhgkhpbgelalfpplebgfjmbf => Moved successfully.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik directory not found.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik directory not found.
"HKLM\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Google\Chrome\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.
"HKU\S-1-5-21-4059772642-3558261170-1923146660-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{051CEA54-8D24-4946-A226-F9D21C6D560A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{051CEA54-8D24-4946-A226-F9D21C6D560A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{BE04F1BF-4444-4EDD-9C22-484D8F606CB2} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{BE04F1BF-4444-4EDD-9C22-484D8F606CB2}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9D75A068-5838-49B7-BECC-52ABF24BA89D} => Key not found.
C:\Windows\System32\Tasks\WSE_Vosteran not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WSE_Vosteran => Key not found.
C:\Windows\Tasks\WSE_Vosteran.job not found.
"C:\ProgramData\Search Protection" => File/Directory not found.
"C:\PROGRA~2\SETTIN~1\Datamngr" => File/Directory not found.
C:\Program Files (x86)\CouponMatcher => Moved successfully.
C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\user.js => Moved successfully.
"C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll" => File/Directory not found.
"C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\Vosteran.xml" => File/Directory not found.
"C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\searchplugins\WebSearch.xml" => File/Directory not found.
"C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml" => File/Directory not found.
"C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\sjp3f2y6.default\Extensions\{71988F2A-67DE-4A7F-B20F-B6D0CF8469AF}.xpi" => File/Directory not found.
C:\Users\Owner\AppData\Roaming\WSE_Vosteran => Moved successfully.
C:\Program Files\20130918085301786 => Moved successfully.
C:\Users\Owner\Downloads\20130918085301786 (1).rar => Moved successfully.
C:\Users\Owner\AppData\Roaming\IHlpr => Moved successfully.
C:\Users\Owner\AppData\Roaming\Philipp Winterberg => Moved successfully.
C:\Users\Owner\AppData\Roaming\OpenCandy => Moved successfully.
C:\Users\Owner\Downloads\InstallFreeRARExtractFrog (1).exe => Moved successfully.
C:\Users\Owner\Downloads\InstallFreeRARExtractFrog.exe => Moved successfully.
"C:\Windows\Tasks\WSE_Vosteran.job" => File/Directory not found.
"C:\Windows\System32\Tasks\WSE_Vosteran" => File/Directory not found.
"C:\Users\Owner\AppData\Roaming\WSE_Vosteran" => File/Directory not found.
"C:\Program Files (x86)\WSE_Vosteran" => File/Directory not found.
C:\Users\Owner\Downloads\20130918085301786.rar => Moved successfully.
"C:\Users\Owner\AppData\Local\a.zip" => File/Directory not found.
"C:\Users\Owner\AppData\Local\BcsKtYcHW.dll" => File/Directory not found.
C:\Users\Owner\AppData\Local\Temp\2aa3848c-c8c9-4bb6-b697-b1e0fea1633b.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\BundleSweetIMSetup.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\contentDATs.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\CouponMatcher.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\EasyTorrent.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\fp_pl_pfs_installer.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\GUR46F3.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\installhelper.dll => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\install_flashplayer11x32au_mssa_aaa_aih.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\install_flashplayer11x32ax_mssd_au_aih.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\mssinstaller.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\MybabylonTB.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\propsys.dll => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\SecurityScan_Release.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\setup_3.2.20.exe => Moved successfully.
C:\Users\Owner\AppData\Local\Temp\SRAssetsHelper.dll => Moved successfully.

The system needed a reboot.

==== End of Fixlog 15:14:03 ====

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Another vosteran infection Jan 24, 2015 23:46:21 GMT -8

Post by dbrisen on Jan 24, 2015 23:46:21 GMT -8

How is the system running now? Better or .......??

Read carefully

Download Adwcleaner from here to your desktop and run a scan.

You may have to right click adwcleaner.exe and choose "Run as Administrator" from the menu. (Click the Scan button to start the scanning).

It will create a log after it is finished scanning. If not (or if it just asks for you to uncheck what you don't wanted deleted), there is a Report button in the middle of the main window; click that and it will make the log file.

Once the report file is made, you can leave AdwCleaner running (but don't delete anything yet) or you can close it down (we can always get a fresh scan done before the deletions).

ONE SCAN ONLY, PLEASE

Attach or paste the log back here for review and further instructions. Thanks.

hd5032 New Helpee Posts: 15	[ti]SOLVED[/ti]Another vosteran infection Jan 25, 2015 10:14:46 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by hd5032 on Jan 25, 2015 10:14:46 GMT -8 Yes, seems ok. It wasn't having major issues, but I did have the home and search pages hijacked on my browsers.

hd5032
New Helpee

Posts: 15

[ti]SOLVED[/ti]Another vosteran infection Jan 25, 2015 10:18:32 GMT -8

Post by hd5032 on Jan 25, 2015 10:18:32 GMT -8

# AdwCleaner v4.109 - Report created 25/01/2015 at 13:16:20
# Updated 24/01/2015 by Xplode
# Database : 2015-01-24.3 [Local]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Found : C:\Program Files (x86)\Coupons
Folder Found : C:\Program Files (x86)\Coupons
Folder Found : C:\ProgramData\Browser Manager
Folder Found : C:\Users\Owner\AppData\LocalLow\DataMngr
Folder Found : C:\Users\Owner\AppData\LocalLow\Datamngr

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
Key Found : HKCU\Software\DataMngr
Key Found : HKCU\Software\InstallCore
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\blekko.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\isearch.fantastigames.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F2D6C718-7E52-428E-8852-365C4B1A6E36}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F2D6C718-7E52-428E-8852-365C4B1A6E36}
Key Found : [x64] HKCU\Software\DataMngr
Key Found : [x64] HKCU\Software\InstallCore
Key Found : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Found : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Found : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Found : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard
Key Found : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Found : [x64] HKLM\SOFTWARE\DataMngr
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v29.0.1 (en-US)

[sjp3f2y6.default] - Line Found : user_pref("extensions.srchvstrn.hmpgUrl", "hxxp://Vosteran.com/?f=1&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzyt[...]
[sjp3f2y6.default] - Line Found : user_pref("extensions.srchvstrn.newTabUrl", "hxxp://Vosteran.com/?f=2&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBz[...]
[sjp3f2y6.default] - Line Found : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");
[sjp3f2y6.default] - Line Found : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");
[sjp3f2y6.default] - Line Found : user_pref("extensions.srchvstrn.tlbrSrchUrl", "hxxp://Vosteran.com/?f=3&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEt[...]

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [4420 octets] - [25/01/2015 13:16:20]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4480 octets] ##########

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Another vosteran infection Jan 25, 2015 20:38:47 GMT -8

Post by dbrisen on Jan 25, 2015 20:38:47 GMT -8

FIRST

Please run AdwCleaner again (if you don't have it running from the last scan) and

a) Click the Scan Button and wait for the scan to finish, (If Adwcleaner has been left open at the finish of the scan this is already done).

b) Make sure in your case all the items under each TAB are ticked / checked then.

c) Click the Clean Button and Adwcleaner will process all the items ticked / checked and then may ask for the system to be restarted.

d) It should create a new log afterwards (with S0 in the name).

e) Please attach or copy the log into your reply here.

SECOND

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from Here

Double Click on the mbam-setup.exe file to install the application.

Do not check on the Trial of Professional version. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link

Once the program has loaded and updated, select "Scan Now >>" to start the scan.

The scan may take some time to finish, so please be patient.

If any malware is found, you will be presented with a screen like the one below.

Please click on the Export Log button and select the As text file from the dropdown list. I would suggest you save the file on your desktop (as we need the report attached here for review and it is easy to find on the desktop).

After you have saved the report file, return to the Potential Threats Detected page and click on Cancel. You can close MBAM after that.

Please attach the report file to a post here; I will review the file and script what needs to be removed.

hd5032
New Helpee

Posts: 15

[ti]SOLVED[/ti]Another vosteran infection Jan 26, 2015 5:21:52 GMT -8

Post by hd5032 on Jan 26, 2015 5:21:52 GMT -8

# AdwCleaner v4.109 - Report created 26/01/2015 at 08:18:09
# Updated 24/01/2015 by Xplode
# Database : 2015-01-24.3 [Local]
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

[#] Folder Deleted : C:\ProgramData\Browser Manager
Folder Deleted : C:\Program Files (x86)\Coupons
Folder Deleted : C:\Users\Owner\AppData\LocalLow\DataMngr

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lfffjahnfbocnaooecgijfnbpcfekoik
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Deleted : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\iLividIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F2D6C718-7E52-428E-8852-365C4B1A6E36}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F2D6C718-7E52-428E-8852-365C4B1A6E36}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{8DCB7100-DF86-4384-8842-8FA844297B3F}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D2CE3E00-F94A-4740-988E-03DC2F38C34F}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{8DCB7100-DF86-4384-8842-8FA844297B3F}]
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Key Deleted : [x64] HKLM\SOFTWARE\DataMngr
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\blekko.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\isearch.fantastigames.com
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v29.0.1 (en-US)

[sjp3f2y6.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.hmpgUrl", "hxxp://Vosteran.com/?f=1&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzyt[...]
[sjp3f2y6.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.newTabUrl", "hxxp://Vosteran.com/?f=2&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBz[...]
[sjp3f2y6.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran");
[sjp3f2y6.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran");
[sjp3f2y6.default\prefs.js] - Line Deleted : user_pref("extensions.srchvstrn.tlbrSrchUrl", "hxxp://Vosteran.com/?f=3&a=vst_wnzp01_15_01_ch&cd=2XzuyEtN2Y1L1Qzu0D0CtD0E0AtCtD0B0FtCyDtB0AtDzz0BtN0D0Tzu0StCtDzyyCtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEt[...]

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [4588 octets] - [25/01/2015 13:16:20]
AdwCleaner[R1].txt - [4648 octets] - [26/01/2015 08:15:44]
AdwCleaner[S0].txt - [4481 octets] - [26/01/2015 08:18:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4541 octets] ##########

hd5032
New Helpee

Posts: 15

[ti]SOLVED[/ti]Another vosteran infection Jan 26, 2015 6:14:48 GMT -8

Post by hd5032 on Jan 26, 2015 6:14:48 GMT -8

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/26/2015
Scan Time: 8:26:07 AM
Logfile: malawarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.01.26.05
Rootkit Database: v2015.01.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 392843
Time Elapsed: 43 min, 46 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.SavingsPlugin, HKU\S-1-5-21-4059772642-3558261170-1923146660-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{AC5183D8-28A9-4A36-850D-8C8846855EED}, , [ab52d2293d4c231396fe6fc15ca78a76],
PUP.Optional.SavingsPlugin, HKU\S-1-5-21-4059772642-3558261170-1923146660-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{AC5183D8-28A9-4A36-850D-8C8846855EED}, , [ab52d2293d4c231396fe6fc15ca78a76],
PUP.Optional.SavingsPlugin, HKU\S-1-5-21-4059772642-3558261170-1923146660-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F0B3FA34-C3B2-4B72-B8FE-A4148C2FA663}, , [768768935a2f8fa7aee8b97716edfc04],
PUP.Optional.SavingsPlugin, HKU\S-1-5-21-4059772642-3558261170-1923146660-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F0B3FA34-C3B2-4B72-B8FE-A4148C2FA663}, , [768768935a2f8fa7aee8b97716edfc04],

Registry Values: 1
PUP.Optional.Vosteran, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Vosteran\\, , [29d4ea118702979f049d99682cd9ff01]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

dbrisen
Malware Removalists

Posts: 3,688

[ti]SOLVED[/ti]Another vosteran infection Jan 26, 2015 15:36:44 GMT -8

Post by dbrisen on Jan 26, 2015 15:36:44 GMT -8

This next step may take a while (just to warn you) .....

ESET Online does not work with IE 11 (Internet Explorer) at the moment (a few weeks ago anyway) so if you have IE 11, Chrome or Firefox has to be used instead. ESET Online does work with IE 10 and earlier.

You can leave Norton Enabled even though ESET may warn about it. just makes the scan take longer. The pictures below showing what to click may be blue instead of green on the ESET website now, but the procedure is still the same

Please read carefully and Slowly, Notice all the settings listed below to check before starting the scan. Stop and ask if you have any questions.

Take note of the NO tick in the Remove found threats setting below at it needs to have the tick removed.

Hold down Control key and click on the following link to open ESET OnlineScan in a new window.

Link =>> ESET Online Scanner <<

Click the Run ESET Online Scanner located on the left side of the page (not the free trial).

For browsers other than Internet Explorer only: (Microsoft Internet Explorer users can skip this step)
Click on the esetsmartinstaller link in the popup window that opens. Save it to your desktop.

Double click on the icon on your desktop.

Check (accept) the Terms of Use.

Click the START button.
Accept any security warnings from your browser.

Now in the Computer scan settings window that appears:-
Make sure that the option Enable detection of potentially unwanted applications is selected.
Now click on Advanced Settings and configure the options as follows:

Remove found threats is Not checked
Scan archives is checked
Scan for potentially unsafe applications is checked
Enable Anti-Stealth Technology is checked

Now click on: Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan is finished, if any threats are found you will see the screen below. Click to view the found threats.

At the bottom of the listed threats, there is an option to save the results to a text file. Please do this so you can attach the results here for review and removal of the items that are not false positives (these will be scripted out so do not worry).

Once the log text file is saved, return to the Scan Finished screen by clicking "<<Back", then click on the uninstall button and click Finish.

Attach the saved log file in your next reply please. Thanks.

[ti]SOLVED[/ti]Another vosteran infection

Post by hd5032 on Jan 23, 2015 5:09:43 GMT -8

Post by dbrisen on Jan 23, 2015 10:20:40 GMT -8

Post by hd5032 on Jan 24, 2015 12:25:58 GMT -8

Post by dbrisen on Jan 24, 2015 23:46:21 GMT -8

Post by hd5032 on Jan 25, 2015 10:14:46 GMT -8

Post by hd5032 on Jan 25, 2015 10:18:32 GMT -8

Post by dbrisen on Jan 25, 2015 20:38:47 GMT -8

Post by hd5032 on Jan 26, 2015 5:21:52 GMT -8

Post by hd5032 on Jan 26, 2015 6:14:48 GMT -8

Post by dbrisen on Jan 26, 2015 15:36:44 GMT -8