Same user with WinXP 32-bit laptop with loads of infections. Sorry!

Hi. I'm missing the log from Hitman.

 

Uninstall the below softwares:

• Wajam
• SpeedyPC Pro
• Search Protect
• Re-markit
• Mysearchdial
• Mobogenie
• Media View
• FindRight

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O1 - Hosts: 54.225.95.126 cbaiddeoemldinncijanafifphajjppj

After clicking Fix exit HJT.




http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

• [V1][SUSP PATH] At1.job : C:\DOCUME~1\Jeff\APPLIC~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE - /Check [-] -> FOUND
• [V1][SUSP PATH] At2.job : C:\DOCUME~1\Jeff\APPLIC~1\SAVESE~1\UPDATE~1\UPDATE~1.EXE - /Check [7] -> FOUND
• [V1][SUSP PATH] At3.job : C:\DOCUME~1\NETWOR~1\APPLIC~1\SAVESE~1\UPDATE~1\UPDATE~1.EXE - /Check [-] -> FOUND
• [V1][SUSP PATH] At4.job : C:\DOCUME~1\NETWOR~1\APPLIC~1\MYSEAR~1\UPDATE~1\UPDATE~1.EXE - /Check [-] -> FOUND

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

... now also try and locate these entries and do the same:

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.






Re run Hitman and I want you to have it fix this only, ignore the rest that it finds:

(On the repairs section)




Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:Files
C:\Documents and Settings\Jeff\Application Data\systweak
C:\Documents and Settings\Jeff\Application Data\Bubble Dock.installation.log
C:\Documents and Settings\Jeff\Application Data\SpeedyPC Software
C:\Documents and Settings\Jeff\Application Data\Nosibay
C:\Documents and Settings\Jeff\Application Data\DriverCure
C:\Documents and Settings\Jeff\Local Settings\Application Data\BIT18.tmp
C:\DOCUME~1\Jeff\APPLIC~1\MYSEAR~1
C:\Documents and Settings\All Users\Application Data\APN
C:\Documents and Settings\Holly\Local Settings\Application Data\MoboGenie
C:\Documents and Settings\Jeff\Local Settings\Application Data\Mobogenie
C:\Documents and Settings\Jeff\Start Menu\Programs\Mobogenie
C:\Program Files\FindRight
C:\Program Files\Mobogenie
C:\Documents and Settings\Jeff\Local Settings\Application Data\SearchProtect
C:\Program Files\SearchProtect
  
:reg
[-HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}]
[-HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}]
[-HKLM\SOFTWARE\Classes\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D}]
[-HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore.1]
[-HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore]
[-HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mysearchdial]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
[-HKLM\SOFTWARE\mysearchdial]
[-HKLM\SOFTWARE\SearchProtect]
[-HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\MySearchDial]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\InstallCore\mysearchdial]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\mysearchdial]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}]
[-HKLM\SOFTWARE\Classes\AppID\escort.DLL]
[-HKLM\SOFTWARE\Classes\AppID\escortApp.DLL]
[-HKLM\SOFTWARE\Classes\AppID\escortEng.DLL]
[-HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL]
[-HKLM\SOFTWARE\Classes\AppID\esrv.EXE]
[-HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]
[-HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]
[-HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}]
[-HKLM\SOFTWARE\Classes\CLSID\{A928E66C-F501-4E66-9953-855C712F93B2}]
[-HKLM\SOFTWARE\Classes\escort.escortIEPane.1]
[-HKLM\SOFTWARE\Classes\escort.escortIEPane]
[-HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}]
[-HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}]
[-HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}]
[-HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}]
[-HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}]
[-HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[-HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]
[-HKLM\SOFTWARE\Classes\wtb.Band.1]
[-HKLM\SOFTWARE\Classes\wtb.Band]
[-HKLM\SOFTWARE\Classes\wtb.NotificationSource.1]
[-HKLM\SOFTWARE\Classes\wtb.NotificationSource]
[-HKLM\SOFTWARE\Classes\wtb.SourceSinkImpl.1]
[-HKLM\SOFTWARE\Classes\wtb.SourceSinkImpl]
[-HKLM\SOFTWARE\Classes\wtb.ToolbarInfo.1]
[-HKLM\SOFTWARE\Classes\wtb.ToolbarInfo]
[-HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{cfd485f0-96bd-47cd-bb6d-cd7dda95f102}]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Mobogenie.exe]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mobilegeni daemon]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FindRight]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie]
[-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam]
[-HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_APNMCP]
[-HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_CLTMNGSVC]
[-HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\WajamUpdater]
[-HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_APNMCP]
[-HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_CLTMNGSVC]
[-HKLM\SYSTEM\ControlSet002\Services\CltMngSvc]
[-HKLM\SYSTEM\ControlSet002\Services\Eventlog\Application\WajamUpdater]
[-HKLM\SYSTEM\ControlSet002\Services\WajamUpdaterV3]
[-HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_APNMCP]
[-HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLTMNGSVC]
[-HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater]
[-HKU\.DEFAULT\Software\AskPartnerNetwork]
[-HKU\.DEFAULT\Software\VNT]
[-HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\AskPartnerNetwork]
[-HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\VNT]
[-HKU\S-1-5-18\Software\AskPartnerNetwork]
[-HKU\S-1-5-18\Software\VNT]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\FindRight]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Wajam]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1003\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\FindRight]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Wajam]
[-HKU\S-1-5-21-682003330-1606980848-1417001333-1004\Software\Wajam]
:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it into a text file to ATTACH into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.



http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

• Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
• I'll check the next set of logs over and see what remains . . .

 

No problem.