Virus also recording me from my video lens..Help ?

[magna86]

Ok,  for some reason OTL has failed to run cmd in fixprogress.

Re-run OTL Fix again (RunFix button) but use this script:

Code: [Select]

:processes
killallprocesses

:OTL
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://startpage.com/
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{18092453-1A5D-443C-99D3-CDAD419B1A83}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15004&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=PW&apn_dtid=YYYYYYYYUS&apn_uid=25667EC4-F38C-4D22-8931-AE82B09C0138&apn_sauid=18DDCC39-9B0A-4A9A-B732-C3C7953AB74A
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{7990EA36-AFD2-41C8-AFA3-A5C8589C8E70}: "URL" = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=&language=english&prfh=font_sizeEEEmediumN1Nrecent_results_filterEEE1N1Nlanguage_uiEEEenglishN1Ndisable_open_in_new_windowEEE1N1NlanguageEEEenglishN1NsslEEE1N1Nnum_of_resultsEEE10N1Npicture_privacyEEEonN1NsuggestionsEEE1N1N
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{A3EEDFD0-1629-40A9-AF54-2BC65D448E14}: "URL" = http://www.pricestalker.net/ProductSearch.aspx?keyword={searchTerms}
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{AEFEFC1F-EFD2-48A7-92E4-B5C96F2DCAD3}: "URL" = http://addons.alltheinternet.com/texis/open/search?q={searchTerms}
IE - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\SearchScopes\{BB7753FB-F0CE-418A-9849-F249F082026C}: "URL" = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1918482796-3435808618-3437081748-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

:files
C:\ProgramData\6063536.reg
C:\ProgramData\6063536.bat
C:\ProgramData\6063536.pad
C:\install.exe

:commands
[CREATERESTOREPOINT]
[emptytemp]



[magna86]

Ok, just don't panic. 

Re-run above script (just in case ) and attach log.
Then be free to continue with other steps. Don't worry, your computer will be just fine. 

[essexboy]

error.. My apologies. Wrong thread 

[RainerRocks]

I'm confused now..I thought the 3rd try of OTL was good but I guess not.

Now I'm not sure which one to run now..the one magna has up now or essex?

Help ?

Ok..Before seeing these last 2 posts I ran rouge Killer and did the 3 steps..here's the files attached.

PS: Let me know what which OTL I should run again..Magna or essex..thanks so much !

[RainerRocks]

Ok I tried essex OTL and pasted the file and hit fix.

It didn't do anything that I could see then that windows window came up and said" Windows need to close due to critical error in one minute"

Well my pc shut down .

Upon rebooting OTL file showed up but I'm not sure it's the full file because it must have ran way less than a minute.

Anyway here it is..

[RainerRocks]

Ok am i screwed..i ran essex file on OTL ..what now ?

[RainerRocks]

Ok MY pc has been taken over by freaking google which I despise.

When opening IE my start page goes to "Acer" which is my computer maker then FN google takes over and redirects it to googles homepage and plus it added tons of tool bars and now Bing is my default search engine.

My original home page was "Startpage" and "startpage" was my search engine.

HELP

[essexboy]

No that fix would have no affect

[Kafeine]

((deleted))
OT.

[magna86]

@RainerRocks
I told you not to panic!

Follow "Multiple Antivirus Programs" steps. Then re-run OTL, click on RunScan and attach here fresh OTL.txt log.

[RainerRocks]

adwcleaner file

[RainerRocks]

malware scan

[RainerRocks]

OTL Fix scan

[magna86]

Well, this is another story ...  Your OTL log looks much, much better. 
See, I told you that everything will be fine.

------------------------------

Now I want to run one powerful tool for further / deeper check system.




> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

• Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  
• In the window that opens on the top right corner, click Settings.
  
• In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
  
  
• Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.


----------------

PS: Please, don't worry and don't panic, just disable your AntiVirus real-time protection & run Combofix.

If CF pop-up some message, just click Yes, Ok. Allow ComboFix to scan your system alone. Don't tuch your computer and CF will reboot your system.
When CF finish his work, it will Pop-up log. Attach here that log. If some error occurs druing the CF scan, try to ignore it and write down here and we will solve the problem.

[RainerRocks]

Here's the aswMBR scan before I move on to the combo scan.

Thanks