Help cleaning machine after infection

You forgot to attach the log from Malware Bytes, I'd like to see that too please.



http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

• [Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : c:\programdata\lolliscan\lolliscan32.dll [x] -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...and the same for these entries on the Tasks tab please:

• [Suspicious.Path] 0cObXWUnbvCB.job -- C:\Users\echappee\AppData\Roaming\0cObXWUnbvCB.exe -> Found
• [Suspicious.Path] AUSAMRFZ.job -- C:\Users\echappee\AppData\Roaming\AUSAMRFZ.exe -> Found
• [Suspicious.Path] d9xplUyL4.job -- C:\Users\echappee\AppData\Roaming\d9xplUyL4.exe -> Found
• [Suspicious.Path] GuV7KCUiddGjsCmkM.job -- C:\Users\echappee\AppData\Roaming\GuV7KCUiddGjsCmkM.exe -> Found
• [Suspicious.Path] jsh1U9rvBJB.job -- C:\Users\echappee\AppData\Roaming\jsh1U9rvBJB.exe -> Found
• [Suspicious.Path] LQGVVK1.job -- C:\ProgramData\LolliScan\LolliScan.exe -> Found
• [Suspicious.Path] sWbqBNmLZySYDqbpz6WaT.job -- C:\Users\echappee\AppData\Roaming\sWbqBNmLZySYDqbpz6WaT.exe -> Found
• [Suspicious.Path] YOMC1N6dDQmIo82.job -- C:\Users\echappee\AppData\Roaming\YOMC1N6dDQmIo82.exe -> Found
• [Suspicious.Path] \\0cObXWUnbvCB -- C:\Users\echappee\AppData\Roaming\0cObXWUnbvCB.exe -> Found
• [Suspicious.Path] \\AUSAMRFZ -- C:\Users\echappee\AppData\Roaming\AUSAMRFZ.exe -> Found
• [Suspicious.Path] \\d9xplUyL4 -- C:\Users\echappee\AppData\Roaming\d9xplUyL4.exe -> Found
• [Suspicious.Path] \\GuV7KCUiddGjsCmkM -- C:\Users\echappee\AppData\Roaming\GuV7KCUiddGjsCmkM.exe -> Found
• [Suspicious.Path] \\jsh1U9rvBJB -- C:\Users\echappee\AppData\Roaming\jsh1U9rvBJB.exe -> Found
• [Suspicious.Path] \\LQGVVK1 -- C:\ProgramData\LolliScan\LolliScan.exe -> Found
• [Suspicious.Path] \\sWbqBNmLZySYDqbpz6WaT -- C:\Users\echappee\AppData\Roaming\sWbqBNmLZySYDqbpz6WaT.exe -> Found
• [Suspicious.Path] \\YOMC1N6dDQmIo82 -- C:\Users\echappee\AppData\Roaming\YOMC1N6dDQmIo82.exe -> Found
• [Suspicious.Path] \\ZFNENS -- "C:\ProgramData\75b516f7def3449383a44752d9f6e6a9\75b516f7def3449383a44752d9f6e6a9.exe" -> Found

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.






Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

• Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:Files
C:\Users\echappee\AppData\Local\nsd9773.tmp
C:\Users\echappee\AppData\Local\Temp.dat
C:\ProgramData\5ce74c860000276f

:reg
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Boxerexe"=-
[HKEY_USERS\S-1-5-21-558076522-1652849927-1738531854-1001\Software\Microsoft\Windows\CurrentVersion\run]
"Boxerexe"=-

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it into a text file to ATTACH into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.




http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
• Vista/Windows 7/8 users right-click and select Run As Administrator
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Attach the logfile to your next next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

• Now re run RogueKiller and attach log.
• Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
• Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!

 

Delete this: C:\Program Files (x86)\Priceless
Now explain how things are running when you next post, please.