Reply to thread

Message

<blockquote data-quote="Vitesse" data-source="post: 122252" data-attributes="member: 8287">Apologies for long gap.Ran HitMan and forgot to save the file (was sort of expecting it to do it automatically after all the others so ran again and saved the one here.The original one had 98 items - think 94 were tracking. Two were not removed and are in the second file here with yellow markers. Two had red markers and were deleted (hope that makes sense).Have tried to do Kaspersky but had to abort until I could have time to run (and not leave computer on unattended) as it seems to be about 10 hours (had to cancel it after 5 hours). So running today - now.HitMan is as below as file type? is not allowed to be posted as attachment? (yellow marked items are the ones listed as suspicious below)[code]HitmanPro 3.7.3.194www.hitmanpro.com&nbsp;&nbsp; Computer name . . . . : HOME-PC&nbsp;&nbsp; Windows . . . . . . . : 5.1.3.2600.X86/1&nbsp;&nbsp; User name . . . . . . : HOME-PC\Graham&nbsp;&nbsp; License . . . . . . . : Trial (30 days left)&nbsp;&nbsp; Scan date . . . . . . : 2013-05-22 23:48:59&nbsp;&nbsp; Scan mode . . . . . . : Normal&nbsp;&nbsp; Scan duration . . . . : 36m 6s&nbsp;&nbsp; Disk access mode&nbsp; . . : Direct disk access (SRB)&nbsp;&nbsp; Cloud . . . . . . . . : Internet&nbsp;&nbsp; Reboot&nbsp; . . . . . . . : No&nbsp;&nbsp; Threats . . . . . . . : 15&nbsp;&nbsp; Traces&nbsp; . . . . . . . : 20&nbsp;&nbsp; Objects scanned . . . : 914,516&nbsp;&nbsp; Files scanned . . . . : 96,759&nbsp;&nbsp; Remnants scanned&nbsp; . . : 218,136 files / 599,621 keysSuspicious files ____________________________________________________________&nbsp;&nbsp; F:\Documents and Settings\Tracy\Local Settings\Temp\nsb6.tmp\installhelper.dll&nbsp; &nbsp; &nbsp; Size . . . . . . . : 130,840 bytes&nbsp; &nbsp; &nbsp; Age&nbsp; . . . . . . . : 1112.3 days (2010-05-06 16:46:46)&nbsp; &nbsp; &nbsp; Entropy&nbsp; . . . . . : 6.5&nbsp; &nbsp; &nbsp; SHA-256&nbsp; . . . . . : 0411AB18ECB0D3D6292EABB89B4C8E41112B3E0BE272B087555C2CB8CB0BFC28&nbsp; &nbsp; &nbsp; Product&nbsp; . . . . . : ALOT&nbsp; &nbsp; &nbsp; Publisher&nbsp; . . . . : ALOT Inc.&nbsp; &nbsp; &nbsp; Description&nbsp; . . . : ALOT&nbsp; &nbsp; &nbsp; Version&nbsp; . . . . . : 1.0.4.0&nbsp; &nbsp; &nbsp; Copyright&nbsp; . . . . : Copyright (C) 2009&nbsp; &nbsp; &nbsp; RSA Key Size . . . : 1024&nbsp; &nbsp; &nbsp; Authenticode . . . : Blacklisted&nbsp; &nbsp; &nbsp; Fuzzy&nbsp; . . . . . . : 100.0&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; Program is code signed with a known fraudulent certificate.&nbsp;&nbsp; F:\Documents and Settings\Tracy\Local Settings\Temp\nsn3.tmp\installhelper.dll&nbsp; &nbsp; &nbsp; Size . . . . . . . : 130,840 bytes&nbsp; &nbsp; &nbsp; Age&nbsp; . . . . . . . : 1112.3 days (2010-05-06 16:44:34)&nbsp; &nbsp; &nbsp; Entropy&nbsp; . . . . . : 6.5&nbsp; &nbsp; &nbsp; SHA-256&nbsp; . . . . . : 0411AB18ECB0D3D6292EABB89B4C8E41112B3E0BE272B087555C2CB8CB0BFC28&nbsp; &nbsp; &nbsp; Product&nbsp; . . . . . : ALOT&nbsp; &nbsp; &nbsp; Publisher&nbsp; . . . . : ALOT Inc.&nbsp; &nbsp; &nbsp; Description&nbsp; . . . : ALOT&nbsp; &nbsp; &nbsp; Version&nbsp; . . . . . : 1.0.4.0&nbsp; &nbsp; &nbsp; Copyright&nbsp; . . . . : Copyright (C) 2009&nbsp; &nbsp; &nbsp; RSA Key Size . . . : 1024&nbsp; &nbsp; &nbsp; Authenticode . . . : Blacklisted&nbsp; &nbsp; &nbsp; Fuzzy&nbsp; . . . . . . : 100.0&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; Program is code signed with a known fraudulent certificate.Malware remnants ____________________________________________________________&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Explorer Bars\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{DB38E21A-0133-419d-92AD-ECDFD5244D6D} (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{EB620C54-E229-4942-87CE-E717109FC8C6} (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB620C54-E229-4942-87CE-E717109FC8C6}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\ShoppingReport2\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EB620C54-E229-4942-87CE-E717109FC8C6}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\ShoppingReport2\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1007\Software\ShoppingReport2\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar)&nbsp;&nbsp; HKU\S-1-5-21-2052111302-1965331169-725345543-1009\Software\ShoppingReport2\ (Adware.Hotbar)Cookies _____________________________________________________________________&nbsp;&nbsp; F:\Documents and Settings\Graham\Cookies\2KGR2IFW.txt&nbsp;&nbsp; F:\Documents and Settings\Graham\Cookies\MWKGNZD9.txt&nbsp;&nbsp; F:\Documents and Settings\Graham\Cookies\O2DLONTY.txt[/code]</blockquote>

[QUOTE="Vitesse, post: 122252, member: 8287"] Apologies for long gap. Ran HitMan and forgot to save the file (was sort of expecting it to do it automatically after all the others so ran again and saved the one here. The original one had 98 items - think 94 were tracking. Two were not removed and are in the second file here with yellow markers. Two had red markers and were deleted (hope that makes sense). Have tried to do Kaspersky but had to abort until I could have time to run (and not leave computer on unattended) as it seems to be about 10 hours (had to cancel it after 5 hours). So running today - now. HitMan is as below as file type? is not allowed to be posted as attachment? (yellow marked items are the ones listed as suspicious below) [code] HitmanPro 3.7.3.194 www.hitmanpro.com Computer name . . . . : HOME-PC Windows . . . . . . . : 5.1.3.2600.X86/1 User name . . . . . . : HOME-PC\Graham License . . . . . . . : Trial (30 days left) Scan date . . . . . . : 2013-05-22 23:48:59 Scan mode . . . . . . : Normal Scan duration . . . . : 36m 6s Disk access mode . . : Direct disk access (SRB) Cloud . . . . . . . . : Internet Reboot . . . . . . . : No Threats . . . . . . . : 15 Traces . . . . . . . : 20 Objects scanned . . . : 914,516 Files scanned . . . . : 96,759 Remnants scanned . . : 218,136 files / 599,621 keys Suspicious files ____________________________________________________________ F:\Documents and Settings\Tracy\Local Settings\Temp\nsb6.tmp\installhelper.dll Size . . . . . . . : 130,840 bytes Age . . . . . . . : 1112.3 days (2010-05-06 16:46:46) Entropy . . . . . : 6.5 SHA-256 . . . . . : 0411AB18ECB0D3D6292EABB89B4C8E41112B3E0BE272B087555C2CB8CB0BFC28 Product . . . . . : ALOT Publisher . . . . : ALOT Inc. Description . . . : ALOT Version . . . . . : 1.0.4.0 Copyright . . . . : Copyright (C) 2009 RSA Key Size . . . : 1024 Authenticode . . . : Blacklisted Fuzzy . . . . . . : 100.0 Program is code signed with a known fraudulent certificate. F:\Documents and Settings\Tracy\Local Settings\Temp\nsn3.tmp\installhelper.dll Size . . . . . . . : 130,840 bytes Age . . . . . . . : 1112.3 days (2010-05-06 16:44:34) Entropy . . . . . : 6.5 SHA-256 . . . . . : 0411AB18ECB0D3D6292EABB89B4C8E41112B3E0BE272B087555C2CB8CB0BFC28 Product . . . . . : ALOT Publisher . . . . : ALOT Inc. Description . . . : ALOT Version . . . . . : 1.0.4.0 Copyright . . . . : Copyright (C) 2009 RSA Key Size . . . : 1024 Authenticode . . . : Blacklisted Fuzzy . . . . . . : 100.0 Program is code signed with a known fraudulent certificate. Malware remnants ____________________________________________________________ HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Explorer Bars\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{DB38E21A-0133-419d-92AD-ECDFD5244D6D} (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{EB620C54-E229-4942-87CE-E717109FC8C6} (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{EB620C54-E229-4942-87CE-E717109FC8C6}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1005\Software\ShoppingReport2\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{EB620C54-E229-4942-87CE-E717109FC8C6}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1006\Software\ShoppingReport2\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1007\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1007\Software\ShoppingReport2\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1009\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{258C9770-1713-4021-8D7E-1F184A2BD754}\ (Adware.Hotbar) HKU\S-1-5-21-2052111302-1965331169-725345543-1009\Software\ShoppingReport2\ (Adware.Hotbar) Cookies _____________________________________________________________________ F:\Documents and Settings\Graham\Cookies\2KGR2IFW.txt F:\Documents and Settings\Graham\Cookies\MWKGNZD9.txt F:\Documents and Settings\Graham\Cookies\O2DLONTY.txt [/code] [/QUOTE]

Verification