Jump to content


Photo
- - - - -

(PUP.Optional.Bandoo)


  • This topic is locked This topic is locked
29 replies to this topic

#21 iut044

iut044

    New Member

  • Members
  • Pip
  • 19 posts

Posted 09 August 2013 - 06:03 PM

did a quick scan

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/10/2013 at 00:02 AM

Application Version : 5.6.1020

Core Rules Database Version : 10678
Trace Rules Database Version: 8490

Scan type       : Quick Scan
Total Scan Time : 00:03:50

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 724
Memory threats detected   : 0
Registry items scanned    : 59724
Registry threats detected : 0
File items scanned        : 11701
File threats detected     : 55

Adware.Tracking Cookie
    .imrworldwide.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .imrworldwide.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .c.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .c.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .c.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .c.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .doubleclick.net [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .h.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .h.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .h.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .h.atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    accounts.google.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    vlc-media-player.en.softonic.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    vlc-media-player.en.softonic.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    vlc-media-player.en.softonic.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    vlc-media-player.en.softonic.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    www.googleadservices.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .advertising.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .doubleclick.net [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\TZZDOOBH.txt [ /serving-sys.com ]
    .advertising.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .advertising.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .advertising.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\KUDOD04Y.txt [ /advertising.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\WTBMN82Z.txt [ /ads.undertone.com ]
    .invitemedia.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\V0R7N7T1.txt [ /media6degrees.com ]
    .media6degrees.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .media6degrees.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    .media6degrees.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\505O87JB.txt [ /ad.yieldmanager.com ]
    .lucidmedia.com [ C:\USERS\IUT044\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8QJSQNKL.DEFAULT-1376005866982\COOKIES.SQLITE ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\77SAFDEY.txt [ /h.atdmt.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\ARIYYQY5.txt [ /invitemedia.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\U38MPY78.txt [ /tribalfusion.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\E3XPC1GO.txt [ /atdmt.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\3EAUQKDN.txt [ /revsci.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\NGYFRHBC.txt [ /adviva.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\KAMXSU9A.txt [ /doubleclick.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\1X1YWMYK.txt [ /adform.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\52T8FKPG.txt [ /imrworldwide.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\M0C2GTRG.txt [ /specificclick.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\SPOCCWPF.txt [ /findlaw.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\R253S6U9.txt [ /ads.p161.net ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\S853IACU.txt [ /ru4.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\WKAS7773.txt [ /lucidmedia.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\PJBCMT3X.txt [ /casalemedia.com ]
    C:\Users\iut044\AppData\Roaming\Microsoft\Windows\Cookies\O8Q3HRSS.txt [ /track.adform.net ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
    .atdmt.com [ C:\USERS\IUT044\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
    .doubleclick.net [ C:\USERS\IUT044\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
 



#22 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,160 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 09 August 2013 - 06:09 PM

One more scan and we'll see how it is.....

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Advanced settings and select the following:

  • Scan potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology

Click Start
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

MrC


Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#23 iut044

iut044

    New Member

  • Members
  • Pip
  • 19 posts

Posted 09 August 2013 - 08:13 PM

the only log that I  can find is this which did not seem right right

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
 



#24 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,160 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 09 August 2013 - 08:19 PM

Did you notice if it found anything??

C:\Program Files\ESET\EsetOnlineScanner\log.txt


MrC


Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#25 iut044

iut044

    New Member

  • Members
  • Pip
  • 19 posts

Posted 10 August 2013 - 05:26 AM

You can check with the image the only log is the one that I posted before . I remember that it found  somethings related about ask toolbar and something hiddenstart for  for dell datasafe .



#26 iut044

iut044

    New Member

  • Members
  • Pip
  • 19 posts

Posted 10 August 2013 - 05:28 AM

sorry I forgot to attach the image

Attached Files

  • Attached File  eset.jpg   69.11KB   0 downloads


#27 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,160 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 10 August 2013 - 06:35 AM

OK......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get "Unsupported operating system. Aborting now", just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC

Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#28 iut044

iut044

    New Member

  • Members
  • Pip
  • 19 posts

Posted 10 August 2013 - 06:40 AM

 Results of screen317's Security Check version 0.99.72  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
avast! Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Adobe Reader XI  
 Mozilla Firefox (23.0)
 Google Chrome 28.0.1500.72  
 Google Chrome 28.0.1500.95  
````````Process Check: objlist.exe by Laurent````````  
 Comodo Firewall cmdagent.exe
 Comodo Firewall cfp.exe
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 



#29 MrCharlie

MrCharlie

    Forum Deity

  • Experts
  • PipPipPipPipPipPip
  • 28,160 posts
  • Gender:Male
  • Location:So. Plainfield, New Jersey, USA

Posted 10 August 2013 - 06:45 AM

Well the system is clean as I can get it, if you have any more problems with it, just follow the procedure here as we did before (just download fresh copies of the programs):

http://forums.malwar...130705&p=713020

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:


----------------------------------

Looks Good.....just get Chrome:

Google Chrome 28.0.1500.72 <-----OLD
Google Chrome 28.0.1500.95 <-----OK

You have old versions of Google Chrome on the system.
Please download and run OldChromeRemover.
@Windows Vista/Windows 7-8 users must use “Run As Administrator.”

-------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again. (may be down right now)
Cached version:
http://webcache.goog...n&ct=clnk&gl=us

Good Luck and Thanks for using the forum, MrC

Malware Removal Expert


Posted Image


I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.

Posted Image Thanks MrC & crew

#30 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 11 August 2013 - 09:03 AM

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users