Maleware scans and reports

Welcome to Major Geeks!


Please attach the other requested logs from

• Malwarebytes
• TDSSKiller
• MGtools

Did you knowingly install VisualBeeExe ?
What about C:\Users\RUSS\AppData\Local\Autobahn\nexdef.exe ?

 

No! It has nothing to do with RogueKiller. It was simply reported as questionable by RogueKiller. You installed it from somewhere and should know what it is.

Those file named protection....... are not the logs from Malwarebytes scans. The logs are in the below folder:

C:\Users\RUSS\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs

The scan log is mbam-log-2013-08-16 (21-15-13).txt

 

Okay so why do you need the below to load at startup? Are you always running this every time you use your PC? Do you really need to have Chrome automatically startup?
C:\Users\RUSS\AppData\Local\Autobahn\nexdef.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Uninstall the below programs:
DnsBasic 1.0 build 111
ParetoLogic Privacy Controls

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.v9.com/?utm_source=b&utm_...&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.v9.com/?utm_source=b&utm_...&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.v9.com/?utm_source=b&utm_...&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.v9.com/?utm_source=b&utm_...&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073
R3 - URLSearchHook: (no name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - (no file)
O2 - BHO: HelloWorldBHO - {1C8501DD-5580-48AB-B25C-6D5DBE835A6A} - (no file)

After clicking Fix, exit HJT.

Please download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
  (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
  the code box

Code:

:Processes
explorer.exe
 
:Files
C:\Users\RUSS\Desktop\Optimizer Pro.lnk
C:\ProgramData\DnsBasic
C:\ProgramData\ParetoLogic
C:\ProgramData\VisualBee
C:\Users\RUSS\AppData\Local\Temp\Runner.exe
C:\Users\RUSS\AppData\Local\Temp\DNS.exe
C:\Users\RUSS\AppData\Local\VisualBeeExe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Browser Defender
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ParetoLogic
C:\Program Files (x86)\Browser Defender
C:\Program Files (x86)\DnsBasic
C:\Program Files (x86)\OApps
C:\Program Files (x86)\ParetoLogic
C:\$RECYCLE.BIN\S-1-5-21-810344189-637972085-3251273069-1001\$RKKMV3V.exe
C:\$RECYCLE.BIN\S-1-5-21-810344189-637972085-3251273069-1001\$IKKMV3V.exe
C:\windows\tasks\ParetoLogic Registration3.job
C:\windows\tasks\Privacy Controls Startup.job
C:\windows\tasks\Privacy Controls_{70FC59CC-E800-11E2-BE93-4C72B994B184}.job
C:\Users\RUSS\AppData\Local\Temp\*.*

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4C4C7AAB-5854-4241-A414-E2F1EF119C4A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{533A717D-4BF1-4D88-AD53-5BB09759EC3B}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C8501DD-5580-48AB-B25C-6D5DBE835A6A}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
  ) and choose Paste.
• Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
• If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
• Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the C:\_OTM\MovedFiles log
• the JRT.TXTlog
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You're welcome.

What I asked you to run is C:\MGtools\analyse.exe
This is not the MGtools exe file on your desktop. It is the analyse.exe file that is in the C:\MGtools folder that was created when you first ran MGtools.exe. You need to open Windows Explorer and navigate to the C:\MGtools folder and then locate the analyse.exe file to run it.


PS: If you don't know how to run Windows Explorer, there are many ways. Even double clicking My Computer actually runs Windows Explorer but another easy way is to hold down the Windows logo key and press the e key at the same time. This is a shortcut to Windows Explorer.

 

Actuall you are the one yelling. Typing all CAPS is considered shouting and it is annoying too. Please release the caps lock and type normally. ( see >> http://email.about.com/od/netiquettetips/qt/Writing-In-All-Caps-Is-Like-Shouting.htm )

Which browser are you running when you still see v9?

When you ran the OTM fix, did you use right click and select Run As Administrator? It did not run properly.

 

You're welcome.

OTM still dd not work properly. We will try something else.

Okay then try the below:

• Click the Customize and Control Google Chrome button ( the 3 parallel lines down below the X button used to close the window ).
• Then on the pop down form select Settings.
• Now under the Search heading, click the Manage Search Engines button
  • Look in here for anything related to v9 and select it and delete it by click the X button to the far right side.
  • Make sure that you look in both the Default Search Engines and Other Search Engines areas and delete any v9 junk.
  • Select the default search engine you want ( like Google ) and click the Make Default button.
  • When finished, click the Done button
• Now back on the Settings page to the top left you should see an Extensions selection, click on it to bring up th installed extensions.
• Look for any undesired extension ( like v9 or anything else you did not install ) and if found, click the Trash Can icon to delete the extension.
• Now close the Extensions/Setting tab to get back to normal view
• Exit Chrome and reopen.
• Are you still having a problem with v9?

Please download OTL by OldTimer.

• Save it to your desktop.
• Double-click on the OTL icon on your desktopto run it. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  activex
  netsvcs
  drives
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

 

Are you starting Chrome from a shortcut or Quicklaunch button. If so, delete them because this is where it may be coming from. Create new shortcuts.

 

Also do the below with OTL


Now shut down your protection software (antivirus, antispyware...etc) to avoid possible conflicts.

• Double-click OTL.exe to run. (Note: if using Vista, Win7 or Win8 use right-click and select Run as Administrator)
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

:OTL
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL]http://en.v9.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073[/URL]
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [URL]http://en.v9.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=ST500DM002-1BD142_S2A6V9YN&ts=1372462073[/URL]
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = [URL]http://search.ask.com/web?q={searchterms}&l=dis&o=HPDTDF[/URL]
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = [URL]http://search.v9.com/web/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=ST500DM002-1BD142_S2A6V9YN&ts=0[/URL]
IE - HKU\.DEFAULT\..\SearchScopes\{4C4C7AAB-5854-4241-A414-E2F1EF119C4A}: "URL" = [URL]http://www.dnsbasic.com/?prt=DNSBASIC111&sp=&keywords={searchTerms[/URL]}
IE - HKU\S-1-5-18\..\SearchScopes\{4C4C7AAB-5854-4241-A414-E2F1EF119C4A}: "URL" = [URL]http://www.dnsbasic.com/?prt=DNSBASIC111&sp=&keywords={searchTerms[/URL]}
FF - prefs.js..extensions.enabledAddons: crossriderapp19962%40crossrider.com:0.91.51
File not found (No name found) -- C:\USERS\RUSS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LTDD80ZT.DEFAULT\EXTENSIONS\CROSSRIDERAPP19962@CROSSRIDER.COM

:Files
C:\Users\RUSS\Desktop\Optimizer Pro.lnk
C:\ProgramData\DnsBasic
C:\ProgramData\ParetoLogic
C:\ProgramData\VisualBee
C:\Users\RUSS\AppData\Local\Temp\Runner.exe
C:\Users\RUSS\AppData\Local\Temp\DNS.exe
C:\Users\RUSS\AppData\Local\VisualBeeExe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Browser Defender
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ParetoLogic
C:\Program Files (x86)\Browser Defender
C:\Program Files (x86)\DnsBasic
C:\Program Files (x86)\OApps
C:\Program Files (x86)\ParetoLogic
C:\$RECYCLE.BIN\S-1-5-21-810344189-637972085-3251273069-1001\$RKKMV3V.exe
C:\$RECYCLE.BIN\S-1-5-21-810344189-637972085-3251273069-1001\$IKKMV3V.exe
C:\windows\tasks\ParetoLogic Registration3.job
C:\windows\tasks\Privacy Controls Startup.job
C:\windows\tasks\Privacy Controls_{70FC59CC-E800-11E2-BE93-4C72B994B184}.job
C:\Users\RUSS\AppData\Local\Temp\*.*

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
:Commands
[PURITY]
[EMPTYTEMP] 
[EMPTYFLASH]
[REBOOT]

• Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
• If the fix needed a reboot please do it.
• Click the OK button (upon reboot).
• When OTL is finished, Notepad will open. Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (See: How to attach)

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• the log from OTL
• C:\MGlogs.zip

Make sure you tell me how things are working now!