~aproposo removal help needed please

Welcome to Majorgeeks!

You should have emptied your Norton Quarantine in step 0 of the READ ME. It would have made your log smaller and all scans would have run faster.

You mst remember that HijackThis logs must be obtained from normal boot mode. And you must not use MSconfig to control startups. Both of these items are covered in step 7 of the READ ME. So make sure you run MSconfig and select Normal Startup.

One of our other stickies mentioned in the READ & RUN ME, covers Apropos. Please run the below and attach the requested log:

AproposMedia Fix

Now download and install ExplorerXP

It is much better at finding and deleting stuff than Windows Explorer. We will use it later to delete some baddies.


Make sure viewing of hidden files is enabled (per the tutorial).
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe

After clicking Fix, exit HJT.
Now runExplorerXP and use it to find and delete:
C:\WINDOWS\msbb.exe.temp
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8FKCV5T8\package_adp_MARKETING12[1].exe
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\UCmore - The Search Accelerator\How To Uninstall.lnk
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\UCmore - The Search Accelerator\UCmore our.lnk
C:\WINDOWS\Temp\AutoUpdate0\auto_update_uninstall.exe
C:\WINDOWS\Temp\AutoUpdate0\setup.inf
C:\WINDOWS\Temp\~apropos0\CxtPls.exe
C:\WINDOWS\Temp\~apropos0\ProxyStub.dll
C:\WINDOWS\Temp\~apropos0\uninstaller.exe
C:\WINDOWS\Temp\~apropos0\WinGenerics.dll

If you cannot delete these in normal boot mode, reboot into safe mode and again use ExplorerXp to try and delete the files.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot your PC back into normal mode. And attach the Apropos Fix log.

Make sure you tell me how things are working now.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Okay! The AproposMedia Fix program did not find anything. Let me know the results of the other steps.

 

Norton did not fix anything. The steps I had you run removed your problems.

Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!