Virus also recording me from my video lens..Help ?

[RainerRocks]

A while ago I used Veetle to watch MMA . I have since deleted it because it screwed with my laptop .

So I uninstalled it but I still see it showing up in these reports.

I want it removed but don't know how to because it doesn't show up any longer
in my programs because I deleted it.

It's a shady program and I should have known better.

Thanks a million.

PS: I used the program to delete the McAfee kernels . Which program should I run to make sure that monster is gone once and for all.

[true indian]

Malwarebytes seems to have done the job nicely there and now lets wait for essexboy to give the green signal 

[RainerRocks]

Malwarebytes seems to have done the job nicely there and now lets wait for essexboy to give the green signal 

Ok true indian

PS: I been racking my brains out trying to figure out where this virus came from and it can only be 2 places .

Was viewing youtube and video wouldn't play (some did and some didn't) and link showed up
on youtube video window saying I needed to install Adobe -Flash
even tho I had it installed.

So I figured I needed to update and did. Since that my PC was acting strange.

[magna86]

Hi,

@RainerRocks
Hello and welcome to avast!

• I will be working on your Malware issues this may or may not solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• If you don't know or understand something, please don't hesitate to ask.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, delete files, edit the registry, etc...)
• Please DO NOT run any other tools or scans whilst I am helping you.
  
• It is important that you reply to this thread. Do not start a new topic.
• Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
• Absence of symptoms does not mean that everything is clear.

-----------------------------------------------------



> Attach here MBAM.txt log

----------------

Re-run OTL.exe.

• Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
  
  

Code: [Select]


:OTL
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://startpage.com/
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{18092453-1A5D-443C-99D3-CDAD419B1A83}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15004&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=PW&apn_dtid=YYYYYYYYUS&apn_uid=25667EC4-F38C-4D22-8931-AE82B09C0138&apn_sauid=18DDCC39-9B0A-4A9A-B732-C3C7953AB74A
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{7990EA36-AFD2-41C8-AFA3-A5C8589C8E70}: "URL" = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=&language=english&prfh=font_sizeEEEmediumN1Nrecent_results_filterEEE1N1Nlanguage_uiEEEenglishN1Ndisable_open_in_new_windowEEE1N1NlanguageEEEenglishN1NsslEEE1N1Nnum_of_resultsEEE10N1Npicture_privacyEEEonN1NsuggestionsEEE1N1N
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{A3EEDFD0-1629-40A9-AF54-2BC65D448E14}: "URL" = http://www.pricestalker.net/ProductSearch.aspx?keyword={searchTerms}
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{AEFEFC1F-EFD2-48A7-92E4-B5C96F2DCAD3}: "URL" = http://addons.alltheinternet.com/texis/open/search?q={searchTerms}
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{BB7753FB-F0CE-418A-9849-F249F082026C}: "URL" = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

:files
C:\ProgramData\6063536.reg
C:\ProgramData\6063536.bat
C:\ProgramData\6063536.pad
C:\install.exe
ipconfig /flushdns /c
netsh int ip reset c:\resetlog.txt /c
ipconfig /release /c
ipconfig /renew /c

:commands
[CREATERESTOREPOINT]
[emptytemp]



• Then click the Run Fix button at the top.
  
• Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.
----------------------------



> Go here and read&run

RogueKiller. Attach here all RK reports.

http://forum.avast.com/index.php?topic=53253.0

---------------


Multiple Antivirus Programs

You are running more than 1 Antivirus program!


AV: AVAST Software
AV: McAfee, Inc.
AV: Lavasoft Ad-Aware.



Running - more than one - antivirus program is not recommended because:[list=1]

• They can conflict with each other.
• Report the other antivirus software as malicious.
• Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
• Can cause your computer to become unstable...run slowly and even, in rare cases, BSOD crash...etc

I strongly suggest you uninstall one of them.  Which one, is your decision.


Then go to this webpage:
http://singularlabs.com/uninstallers/security-software/

Download &run antivirus removal tool to remove leftovers.

------------------


> Re-run OTL , just click on RunScan and attach here fresh OTL.txt log

[true indian]

http://news.softpedia.com/news/Fake-Adobe-Flash-Player-Websites-Distribute-Ransomlock-Ransomware-333127.shtml

You should know the only legit flash player site is adobe.com anything else is faked!! 

[Pondus]

PS: I been racking my brains out trying to figure out where this virus came from and it can only be 2 places .

they also come with fake java updates

anyway we should leave you and magna86 do do the work now.   

[RainerRocks]

Magna

First off I want to say THANK YOU ..YOU GUYS ROCK !

1- Should I run malware first then OTL.exe. ?

PS: I deleted Adaware..didn't think it was considered a virus program..anyway it's gone. I lso checked
http://singularlabs.com/uninstallers/security-software/
to see if it was listed to get rid of anything left over but Lavasoft (adaware) isn't listed so hopefully it's gone. Was a good program I must say.

I'm keepin Avast for sure and Malware which is also good.

[true indian]

Rainrockets,first off go with magna's fixes and you should be fine no need to run anything else now apart from what magna says 

Instead of Ad-Aware which is now old and outdated I recommend Malwarebytes which free with amazing database to update and do weekly scans and Pro version is worth running beside your AV 

[RainerRocks]

Rainrockets,first off go with magna's fixes and you should be fine no need to run anything else now apart from what magna says 

Instead of Ad-Aware which is now old and outdated I recommend Malwarebytes which free with amazing database to update and do weekly scans and Pro version is worth running beside your AV 

Yes I will but I thought magna said to run malware first before doing OTL..see his post.

Thanks

[magna86]

Hi, 
I understand that you have been run MalwareBytes before my post, so I just wrote to attach here mbam.txt log just to see what has been done.

If I misread, please skip mbam step ( attaching log ) and go to the OTL Fix step ; RogueKiller ; AV step... At the end, attach here fresh OTL.txt log to see current situation.

[RainerRocks]

Hi, 
I understand that you have been run MalwareBytes before my post, so I just wrote to attach here mbam.txt log just to see what has been done.

If I misread, please skip mbam step ( attaching log ) and go to the OTL Fix step ; RogueKiller ; AV step... At the end, attach here fresh OTL.txt log to see current situation.

That's OK..anyway I started malware again so it's running as I type.

I will follow everything in order.

After malware OTL is next.

Thanks so much !

[RainerRocks]

OK here is malware report (quick scan) and will report back with OTL next.

PS: I'm now up 28hrs straight since 5am NY EST and now almost 9am the next day..uh !

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.03.13.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
RainerRocks :: RAINERROCKS-PC [administrator]

3/13/2013 8:25:10 AM
mbam-log-2013-03-13 (08-25-10).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 353713
Time elapsed: 9 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[RainerRocks]

Problem...

I opened OTL and pasted the stuff as advise and hit Fix.

Well a DOS window popped up and nothing happened. The curser was blinking
and doing nothing.

The noticed the program OTL was saying "Not Responding " on the top .

Everything just sat still and PC froze.

I was able to hit restart toget out of it.

So was that DOS screen suppose to pop up or what ?

Thanks.

PS: Waiting to know if I should try it again.

True Indian..I can't respond to your PM. I since uninstalled flash player so now every youtube video is saying to install it.

But I was searching for " Ozone Generators" at the time so maybe you can find it.

[RainerRocks]

Magna see above post in case you missed it.

So PC started back up and I tried again.

A DOS screen popped up for sec and was gone just as fast.

Then the PC didn't seem to be doing anything then windows popped up with a screen that said "A critical error has occured and windows will shut down in a minute"

PC shut down and upon rebooting ask me if it was ok to allowed OTL and I said yes.

Then the report popped up..see attachement. I don't know if it's the full report because the PC was only up for a minute before it shut down.

[RainerRocks]

Ok..just in case see last 2 posts before this in case you missed them.

I ran OTL for a 3rd time and it seem to go smoothly.

Only thing I don't like is it changed my homepage and got rid of my search engine.
It made google my homepage and bing for default search engine. I use to use BING but no  more..I didn't delete it from system tho.

I do have google mail but that's also going soon and now some how it'smy homepage..not good.




I used "StartPage" which is very good for search engine and home page.. No tracking .


See attachement for latest OTL file.