PC health kit

[sahh]

Would like help PC Health Kit.

 

[TwinHeadedEagle]

Hi,


Follow this topic and attach requested reports --> http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/

 

[sahh]

Hi,


Follow this topic and attach requested reports --> http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/

 

[sahh]

I am attempting to get these reports to you:
Activeris AntiMalware
Scan DateThursday, April 03, 2014
Database Version1741
Total Items Found59
Objects Scanned :312052
Time Elapsed :00:27:05
NameFound Items
Infection Nametrojan.dropper
CategoryTrojan
Threat LevelSevere
Action PerformedNoActionTaken
Items Found1
Found AreaFileSystem
Details
File Namec:\users\hogan\desktop\frst64.exe
MD50
Signature14935240541988435118
Md5hash: 6655936e40c43120145a11547734f01f
Infection Nametrojan-downloader.banload
CategoryTrojan-Downloader
Threat LevelSevere
Action PerformedNoActionTaken
Items Found18
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range10
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range10
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range10
:range
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range15
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range15
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range15
:range
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range2
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range2
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range2
:range
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range5
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range5
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range5
:range
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range6
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range6
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range6
:range
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range7
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range7
*
Found AreaRegistry
Details
Registry Keyhkey_users
.default\software\microsoft\windows\currentversion\internet settings\zonemap\ranges\range7
:range
Infection Nameroguesecurityprogram.anti-spyware-plus-2006
CategoryRogue Antispyware Program
Threat LevelSevere
Action PerformedNoActionTaken
Items Found15
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\010402.com
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\010402.com
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\971searchbox.com\www
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\971searchbox.com\www
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\971searchbox.com
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\971searchbox.com
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\allforadult.com
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\allforadult.com
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\fuviseni
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\fuviseni
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\hetefow
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\hetefow
*
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\medopena
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\microsoft\windows\currentversion\internet settings\zonemap\domains\angelfire.com\medopena
*
Infection Namemalware.agent
CategoryGeneric Malware
Threat LevelHigh
Action PerformedNoActionTaken
Items Found3
Found AreaFileSystem
Details
File Namec:\users\hogan\appdata\local\sysaver\uninst.exe
MD53876455218949777792
Signature0
Md5hash: 786577003dfc6c9069d07bc7886f8649
Found AreaFileSystem
Details
File NameC:\Users\hogan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SySaver\Uninstall.lnk
MD53876455218949777792
Signature0
Md5hash: 786577003dfc6c9069d07bc7886f8649
Found AreaFileSystem
Details
File Namec:\users\hogan\appdata\local\sysaver\temp.dat
MD50
Signature17119157286476802429
Md5hash: 5287a37540c90004b1b96fc26d9a76d5
Infection Namemalware.gen
CategoryGeneric Malware
Threat LevelHigh
Action PerformedNoActionTaken
Items Found2
Found AreaFileSystem
Details
File Namec:\users\hogan\downloads\mypublishersetup-usd-en-us-costco0605(1).exe
MD50
Signature11830472442702456746
Md5hash: 01c753b27b8a4c8071feb3c80a8c2295
Found AreaFileSystem
Details
File Namec:\users\hogan\downloads\mypublishersetup-usd-en-us-costco0605.exe
MD50
Signature11830472442702456746
Md5hash: 01c753b27b8a4c8071feb3c80a8c2295
Infection Namepup.optional
CategoryPotentially Unwanted Application
Threat LevelHigh
Action PerformedNoActionTaken
Items Found18
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\smartbar
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\smartbar
publisher
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\smartbar
downloadprovider
Found AreaRegistry
Details
Registry Keyhkey_current_user
software\smartbar
uu
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
enablefiletracing
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
enableconsoletracing
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
filetracingmask
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
consoletracingmask
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
maxfilesize
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasapi32
filedirectory
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
enablefiletracing
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
enableconsoletracing
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
filetracingmask
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
consoletracingmask
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
maxfilesize
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\microsoft\tracing\snapdo_rasmancs
filedirectory
Infection Nameadware-toolbar.iwon-copilot
CategoryToolbar-BHO
Threat LevelMedium
Action PerformedNoActionTaken
Items Found1
Found AreaRegistry
Details
Registry Keyhkey_local_machine
software\funwebproducts
Infection NameRestricted Settings
CategorySecurity Disabler
Threat LevelMedium
Action PerformedNoActionTaken
Items Found1
Found AreaWindowsSettings
Details
Registry Keyhkey_local_machine
software\clients\startmenuinternet\iexplore.exe\shell\open\command
© Copyright Activeris Software 2012

 

[sahh]

there is one more. Thanks so much for your help.

 

[TwinHeadedEagle]

First, go to Control Panel and uninstall following:
- Adobe Reader X
- Highlightly
- HiDef Media Player 1.1.12
- Java 7 Update 45
- LPT System Updater Service
- Snap.Do
- Snap.Do Engine

Latest version of Java and Adobe Reader available here --> http://www.java.com/en/ and here http://get.adobe.com/uk/reader/
Make sure to uncheck optional offers.

***** NEXT *****​

Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Open FRST, and click Fix. Attach me that report after it is finished.

***** NEXT *****​

1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!

- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

 

[sahh]

Sorry, how I figured out to reply to post. I started a new conversation which I know is against the rules.
So I uninstalled all programs using either control panel or revouninstall. I even ran force uninstall to double check. All went fine except when I open any web browser the snapdo search engine appears and the questions about wanting me to fix issues. So I know they are still on my computer. I had attempted to uninstall those yesterday . The titles do not appear in programs or in the revouninstall window.

The other question is, you had said to reinstall Java and Adobe reader after uninstalling the other version. Is this mandatory or can I do it later.

Again so thankful for your help. SAHH

 

[TwinHeadedEagle]

Remove everything except Java and Adobe Reader. You will deal with them later.

Then follow other steps...

 

[sahh]

Well as I said above, I removed everything including Java and Adobe but Snap Do is still on my computer? I am inferring I need to proceed anyway. See above. Is that's correct? Many thanks for your time.

 

[TwinHeadedEagle]

OK, but if you want to remove it, please follow my instructions.

 

[sahh]

I am very carefully following your directions. But you are not answering the question so I will continue to your next step.u question was: Snap do and snap do engine were uninstalled but still show up in web browser. Do I proceed to combo fix?

 

[TwinHeadedEagle]

I am very carefully following your directions. But you are not answering the question so I will continue to your next step.u question was: Snap do and snap do engine were uninstalled but still show up in web browser. Do I proceed to combo fix?

Here is the answer, sometimes there are still leftovers even if you uninstall them through control panel. -->

OK, but if you want to remove it, please follow my instructions.

 

[sahh]

And Revoinstall?

 

[sahh]

I did it with REvoUNinstsll

 

[TwinHeadedEagle]

I know, but I am trying to explain you that Adware is very stubborn and even if you uninstall it with Revo, some settings will still be there...

That is why I gave you advanced tools to remove all remnants.

 

[sahh]

Bad news. I downloaded fix and opened FRST but it said it couldn't open, did not have permission or upright pathways so I uninstalled and tried to download again and now I think I have more unwanted programs. Very discouraged

 

[TwinHeadedEagle]

Try Run as Administrator if it happens again, try to make a ScreenShot.

 

[sahh]

no luck. Screen shot

 

[TwinHeadedEagle]

Can you try to disable your antivirus and to run FRST again.

 

[sahh]

disabled firewall and virus protector, same dialog box popped up when trying to run FRST.