snap.do How do I get rid of it?!?!

Discussion in 'Malware Help (A Specialist Will Reply)' started by TheVicChick, Feb 2, 2014.

  1. TheVicChick

    TheVicChick Private E-2

    I have done the read and run first instruction and here are my logs. For some reason I have 2 TDSSKiller logs a few seconds apart (I attached both), not sure why... sorry... This is my mother's computer and I just can't get it to go away! :(

    Thanks for any help! :)

    Vic View attachment MGlogs.zip

    View attachment TDSSKiller.3.0.0.19_02.02.2014_10.13.34_log.txt

    View attachment TDSSKiller.3.0.0.19_02.02.2014_10.13.16_log.txt

    View attachment RKreport[0]_S_02022014_095059.txt

    View attachment HitmanPro_20140202_1026.log
     
    TheVicChick, Feb 2, 2014
    #1
  2. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Hello, TheVicChick

    Please also attach the missing MBAM log.txt -

    C:\Users\Nash\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2014-02-02 (09-58-42).txt
     
    dr.moriarty, Feb 2, 2014
    #2
  3. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Hello again -

    I don't see an anti-virus application installed - why?

    Following your attachment of the MBAMlog.txt -

    Please re-scan with Hitman Pro and have it delete everything under the heading of
    • Potential Unwanted Programs
    Uninstall the outdated Java and the adware toolbars
    Java Auto Updater
    Java(TM) 6 Update 30
    Retrogamer Firefox Toolbar
    Retrogamer Internet Explorer Toolbar

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista/Windows7, don't double click, use right-click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Open notepad and copy and paste the following text in the quote box into the window:
    Save this as fix.bat and choose to save as "all files".
    Doubleclick fix.bat and let the program run.
    A small black dos window will flash, this is normal.

    Next, copy the bold text below to notepad. (Do not include any space above the word "REGEDIT4")Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" . Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me whether or not you receive a success message about adding the above to the registry. If you do not get a success message, it definitely did not work.

    Please download AdwCleaner by Xplode and save it to your Desktop.
    • Double click on AdwCleaner.exe to run the tool. (Vista & Win7 users should right-click and "Run As Administrator")
    • Click on the Scan button.
    • After the scan has finished..
    • Click on the Clean button.
    • Press OK when asked to close all programs and follow the onscreen prompts.
    • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    • After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
    • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
    • Attach this log to your next reply.

    http://imageshack.us/a/img841/7292/thisisujrt.gif Now download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach the JRT.txt to your next message.

    Now install the current version of Sun Java
    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Windows 7, use right click and select Run As Administrator).
    Attach the new C:\MGlogs.zip file that will be created by running this.

    * Make sure you tell me if you had any problems running this procedure; and answer this - "What malware problems are you still experiencing?"
     
    dr.moriarty, Feb 2, 2014
    #3
  4. TheVicChick

    TheVicChick Private E-2

    Sorry I didn't realize I had missed one.

    THANKS! :)
     

    Attached Files:

    TheVicChick, Feb 3, 2014
    #4
  5. TheVicChick

    TheVicChick Private E-2

    ** I will edit this as I go through the list of things to do... (just to let you know)

     
    TheVicChick, Feb 3, 2014
    #5
  6. TheVicChick

    TheVicChick Private E-2

    ^^^ I guess I can't edit past 10 mins... so strike this... ;)

     
    TheVicChick, Feb 3, 2014
    #6
  7. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    :)

    All of the tools downloaded as part of our guide are "on demand" scanners, and would not interfere with malware removal instructions.

    NOTE: To reduce thread clutter, please quote only portions of replies if needed, rather than entire replies - which can be rather long and detailed. Thanks!
     
    dr.moriarty, Feb 3, 2014
    #7
  8. TheVicChick

    TheVicChick Private E-2

    ** Update

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista/Windows7, don't double click, use right-click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    Quote:
    R3 - URLSearchHook: (no name) - {4cff1016-c2e2-4fdd-9c67-e32200c25ff9} - C:\Program Files (x86)\Retrogamer_4w\bar\1.bin\4wSrcAs.dll
    O2 - BHO: Toolbar BHO - {03123bb6-a811-407e-b323-66cf0be510b1} - C:\PROGRA~2\RETROG~2\bar\1.bin\4wbar.dll
    O2 - BHO: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\Program Files (x86)\iWin Games\iWinGamesHookIE.dll
    O2 - BHO: Search Assistant BHO - {d757dbfc-1494-4647-a8b3-abd654988dd8} - C:\Program Files (x86)\Retrogamer_4w\bar\1.bin\4wSrcAs.dll
    O3 - Toolbar: Retrogamer - {3392cfec-56f8-41ee-bdb4-4e301efd2c93} - C:\Program Files (x86)\Retrogamer_4w\bar\1.bin\4wbar.dll
    O23 - Service: iWinTrusted - iWin Inc. - C:\Program Files (x86)\iWin Games\iWinTrusted.exe
    O23 - Service: RetrogamerService (Retrogamer_4wService) - COMPANYVERS_NAME -
    C:\PROGRA~2\RETROG~2\bar\1.bin\4wbarsvc.exe
    After clicking Fix, exit HJT.
    ** The "retrogamer" entries didn't seem to be there, could this be because I fixed them while uninstalling toolbars?

    Open notepad and copy and paste the following text in the quote box into the window:
    Quote:

    sc stop Retrogamer_4wService
    sc delete Retrogamer_4wService
    Save this as fix.bat and choose to save as "all files".
    Doubleclick fix.bat and let the program run.
    A small black dos window will flash, this is normal.
    ** This seemed to have worked exactly as you have described

    Next, copy the bold text below to notepad. (Do not include any space above the word "REGEDIT4")Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" . Once you have saved it double click it and allow it to merge with the registry.
    Quote:
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03123bb6-a811-407e-b323-66cf0be510b1}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990}]
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d757dbfc-1494-4647-a8b3-abd654988dd8}]
    Make sure that you tell me whether or not you receive a success message about adding the above to the registry. If you do not get a success message, it definitely did not work.
    ** This did, in fact, have a success message at the end, I am pleased! :)
     
    TheVicChick, Feb 3, 2014
    #8
  9. TheVicChick

    TheVicChick Private E-2

    Please download AdwCleaner by Xplode and save it to your Desktop.
    Double click on AdwCleaner.exe to run the tool. (Vista & Win7 users should right-click and "Run As Administrator")
    Click on the Scan button.
    After the scan has finished..
    Click on the Clean button.
    Press OK when asked to close all programs and follow the onscreen prompts.
    Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
    After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
    A copy of that logfile will also be saved in the C:\AdwCleaner folder.
    Attach this log to your next reply.
    ** Done
    View attachment AdwCleaner[S0].txt

    Now download Junkware Removal Tool to your desktop.
    Shut down your protection software now to avoid potential conflicts.
    Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    The tool will open and start scanning your system.
    Please be patient as this can take a while to complete depending on your system's specifications.
    On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    Attach the JRT.txt to your next message.
    ** Done
    View attachment JRT.txt

    Now install the current version of Sun Java
    Go here for 64 bit OS = Sun Java 64 bit Runtime Environment *Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.
    Go here for 32 bit OS = Sun Java 32 bit Runtime Environment *Make sure that when you see the form asking about installing Ask Toolbar that you uncheck this.
    ** It did NOT ask me about installing Ask Toolbar???

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Windows 7, use right click and select Run As Administrator).
    Attach the new C:\MGlogs.zip file that will be created by running this.
    ** Done and THANK YOU! :)
    View attachment MGlogs.zip


    * Make sure you tell me if you had any problems running this procedure; and answer this - "What malware problems are you still experiencing?"

    ** I didn't seem to have any problems with the procedure except for as I previously mentioned where the "retrogamer" entries seemed to be missing but I believe it is because I was able to remove that with an uninstall. :) I do not know if there are still any malware problems yet but I will be sure to let you know if there. THANK YOU SOOOOO MUCH for your time ! I am very grateful that you are guys here and that you have helped me a number of times over the years! :)

    Vic
     
    TheVicChick, Feb 3, 2014
    #9
  10. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    ;)
    ..and your new logs does not show that the install slipped past you. Thanks - will make a note of that.

    You are correct, Retrogamer was uninstalled.

    You're very welcome, Vic... are you ready for our final cleanup steps?
     
    dr.moriarty, Feb 3, 2014
    #10
  11. TheVicChick

    TheVicChick Private E-2

    Ready to go! :)
     
    TheVicChick, Feb 3, 2014
    #11
  12. TheVicChick

    TheVicChick Private E-2

    But you mean ready to clean up everything I put there right? I hope... because I don't want my mom seeing something and starting it and saying "Oooohhhh What does this do???" lol I am pretty sure that is why she had all this crap here to begin with! ;)
     
    TheVicChick, Feb 3, 2014
    #12
  13. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    ;)

    Yes, the below steps will deal with the tools we used.

    * If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. It provides no "real-time" protection unless you purchase it and does not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. Go back to step 4 of the READ ME and re-enable your Disk Emulation software with Defogger if you had disabled it.
    3. If running Vista or Win 7, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    4. Go to add/remove programs and uninstall HijackThis.
    5. Go to the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.
    7. Any other miscellaneous tools we may have had you install or download can be uninstalled and/or deleted.
    8. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work through the below link:
    Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif
     
    dr.moriarty, Feb 3, 2014
    #13

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds