claro wont go away....redirecting ....locked files on computer

[cleantheworld]

http://forum.avast.com/Smileys/default/sad.gif
files all over the place on my computer....sent locked ones to recycle bin and programme files all over the place.....cant get rid of claro

[mchain]

hi cleantheworld,

AdwCleaner got rid of a lot of the web add-on c**p.

You did not include the log for aswMBR.exe, could you please attach that?  Need to see if you possibly have a rootkit installed as well.

[cleantheworld]

see attachment....computer hard drive seems to have been divided with recycle bin in different section and wondering what is in the removable disk section?

thanks

[mchain]

Thank you for that.

A malware expert has been notified.  As he likely lives in a different time zone than you, please be patient.

You have now provided the logs he needs to begin his analysis; when he enters your thread, he will prepare a cleansing routine just for you and your system, and no other.

It will be a bit before he arrives, but less than 24 hours.

[essexboy]

Hi you also have McAfee running on your system, I would recommend that you uninstall it

Also for Chrome you will need to manually change the search engine from Claro there

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
IE - HKU\S-1-5-21-2810083453-1765977715-965898646-1001\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.claro-search.com/?affID=110824&tt=4412_8&babsrc=HP_ss&mntrId=e65d041300000000000074de2b76794f
IE - HKU\S-1-5-21-2810083453-1765977715-965898646-1001\..\SearchScopes\{C0137735-94BA-425E-90CF-DC6B43DC6A70}: "URL" = http://www.claro-search.com/?q={searchTerms}&affID=110824&tt=4412_8&babsrc=SP_ss&mntrId=e65d041300000000000074de2b76794f
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{dfefbe51-ca52-484b-adf0-6b158b05262d}: C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\FirefoxExtension
O3 - HKLM\..\Toolbar: (no name) - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O20 - AppInit_DLLs: (c:\progra~3\browse~1\24897~1.175\{61d8b~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.dll ()
[2012/11/04 23:10:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Search Results Toolbar
[2012/11/02 21:43:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[cleantheworld]

black screen at the moment

[cleantheworld]

trying to reboot but went to welcome before turning to a black screen?

[cleantheworld]

the mouse works

[essexboy]

What is the current status of the system ?

[cleantheworld]

not sure whether a reboot will work as it went black at welcome?

[cleantheworld]

can open in safe mode but can't access internet

[mchain]

Are you able to select "Safe Mode with networking"?  Try that.

[cleantheworld]

rebooted from disk.....was running in safe mode as well but I hadn't allowed networking.  Still looks like a lot of interesting things happening on my computer

[cleantheworld]

more reports......

[essexboy]

OK this is weird as all I removed were BHO's

First you will need to uninstall McAfee
From the control panel uninstall McAfee
Then download and run this tool http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Then reboot to normal windows and let me know the result