This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Key Mouse Genie Removal

49 min read

This thread's last reply is from June 12, 2011, 10:59 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

askey127
June 12, 2011, 2:24 PM UTC
mgauss,
A lot of studying the last five years.. It's a challenge.
------------------------------------------------------------
Backup Your Registry with ERUNT:
  • Download erunt.zip to your Desktop from here:
    http://aumha.org/downloads/erunt.zip
  • Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to your Desktop. It will create a new folder.
  • Inside the new folder, if you have XP, double click ERUNT.exe. In Vista or Win7, right click ERUNT.exe and choose "Run as administrator"
  • OK all the prompts to back up your registry to the default location.
Note: If you ever need to restore your registry later, you would go to the default backup folder and start ERDNT.exe
(The default backup folder is C:\Windows\ERDNT\ and the backups are saved according to date stamp)
----------------------------------------------
Perform a Custom Scan or Fix with OTL
Run OTL (Right click and choose "Run as administrator" in Vista/Win7)
  • Under the Custom Scans/Fixes box at the bottom, paste in the following lines from the Code Box:

    
:processes
    
killallprocesses
    

    
:Files
    
C:\Documents and Settings\Brian Gauss\Recent\Key Mouse Genie.lnk
    
C:\Program Files\Key Mouse Genie
    

    
:Reg
    
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
    
"url2"=-
    

    
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
    
"002"=-
    

    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Digital River\SoftwarePassport\Vsisoftware.com\Key Mouse Genie]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #10]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #2]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #3]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #4]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #5]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #7]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #8]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #9]
    

    
[HKEY_USERS\S-1-5-21-3512505422-203031270-4841105-1005\Software\Microsoft\Internet Explorer\TypedURLs]
    
"url2"=-
    

    
[HKEY_USERS\S-1-5-21-3512505422-203031270-4841105-1005\Software\Microsoft\Search Assistant\ACMru\5603]
    
"002"=-
    

    
:Commands
    
[EMPTYTEMP]
    
[CREATERESTOREPOINT]
    
[Reboot]
  • Then click the Run Fix button at the top.
  • Let the program run unhindered and reboot the PC when it is done.
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.


Then let's see if we got rid of the Genie.
askey127
mgauss
June 12, 2011, 3:34 PM UTC
I'm impressed. I don't know if we are where we want to be but I'm impressed anyway.
What do you do in real life?




All processes killed
========== PROCESSES ==========
========== FILES ==========
C:\Documents and Settings\Brian Gauss\Recent\Key Mouse Genie.lnk moved successfully.
C:\Program Files\Key Mouse Genie folder moved successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\\url2 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603\\002 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Digital River\SoftwarePassport\Vsisoftware.com\Key Mouse Genie\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #10\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #2\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #3\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #4\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #5\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #7\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #8\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #9\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3512505422-203031270-4841105-1005\Software\Microsoft\Internet Explorer\TypedURLs\\url2 not found.
Registry value HKEY_USERS\S-1-5-21-3512505422-203031270-4841105-1005\Software\Microsoft\Search Assistant\ACMru\5603\\002 not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Brian Gauss
->Temp folder emptied: 1255017548 bytes
->Temporary Internet Files folder emptied: 115658045 bytes
->Java cache emptied: 1438883123 bytes
->FireFox cache emptied: 134046688 bytes
->Flash cache emptied: 1030244 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 41661 bytes

User: LocalService
->Temp folder emptied: 1063880 bytes
->Temporary Internet Files folder emptied: 86215 bytes
->Flash cache emptied: 300 bytes

User: Marilyn Gauss
->Temp folder emptied: 245343803 bytes
->Temporary Internet Files folder emptied: 278586941 bytes
->Java cache emptied: 134101253 bytes
->FireFox cache emptied: 86537007 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 43959 bytes

User: Michael Gauss
->Temp folder emptied: 5287912 bytes
->Temporary Internet Files folder emptied: 14182165 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 109143233 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 744956 bytes

User: NetworkService
->Temp folder emptied: 1985240 bytes
->Temporary Internet Files folder emptied: 237210374 bytes
->Flash cache emptied: 405 bytes

User: Samantha Gauss
->Temp folder emptied: 6624435 bytes
->Temporary Internet Files folder emptied: 237876824 bytes
->Java cache emptied: 955298 bytes
->FireFox cache emptied: 50302694 bytes
->Flash cache emptied: 3396 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 84660 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 734554 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 198007101 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
RecycleBin emptied: 4034635544 bytes

Total Files Cleaned = 8,190.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.24.0 log created on 06122011_110419

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\CAG9EZ81.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367023&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\CAJPU3Q2.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354290977&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\CAO7YZ61.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354301289&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\CAP1L82M.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354290570&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\rowse%2Fchampain&kw_type=broad&kw=champain&num_radlinks=5&max_radlink_len=27®ion=def&cc=100&flash=9&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\Type=click&FlightID=100462&AdID=139594&TargetID=16970&Segments=1119,2276,2399,2471,2743,2872,2960,3030,3285,3800,4008,6298,8463,8796,9496,9779,9784,9853,10372,12090,1228[2] not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\Type=click&FlightID=123434&AdID=166120&TargetID=1435&Segments=730,2259,2720,2743,3030,3285,3800,5388,5880,6089,7215,7603,8463,8796,9496,9779,9781,9853,10088,10381,11418,[1] not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\Type=click&FlightID=123435&AdID=166121&TargetID=1434&Segments=730,2274,2472,2607,2719,2743,3030,3285,4898,8463,8796,9496,9779,9781,9853,10381,12638,13760,14036,14121,141[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\KH6N8H27\Type=click&FlightID=123439&AdID=166123&TargetID=28041&Segments=730,2743,3030,3285,8463,8796,9496,9779,9781,9853,10381,13760,14173,14401,14402,14734,14735,14736,14757,147[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CA57I940.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354301398&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CA89MJ4H.com%2Fbrowse%2Fchampain&lmt=1179354370&dt=1179354379711&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CA8DUF2D.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354300102&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CAEQUIXV.com%2Fbrowse%2Fchampain&lmt=1179354370&dt=1179354380477&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CAG7GTWJ.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367289&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CALMI9G6.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354289977&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\CAMP59NM.com%2Fbrowse%2Fchampain&lmt=1179354370&dt=1179354377398&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\Type=click&FlightID=123434&AdID=166120&TargetID=1435&Segments=730,2259,2720,2743,3030,3285,3800,5388,5880,6089,7215,7603,8463,8796,9496,9779,9781,9853,10088,10381,11418,[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\K1MZ092V\Type=click&FlightID=36200&AdID=49888&TargetID=913&Segments=730,2259,2401,2725,2743,2813,3030,3285,3800,4960,5516,5854,5880,6298,6520,6582,7428,7429,7431,7652,7769,7823,7[1] not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CA2DYBEP.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367789&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CA2GH22L.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354290664&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CACFGBOX.com%2Fbrowse%2Fchampain&lmt=1179354370&dt=1179354380570&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CACQ4DL6.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354291070&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CAJDQO78.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367398&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CAJNUE29.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354301977&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\CAOXYROX.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354301086&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\rowse%2Fchampain&kw_type=broad&kw=champain&num_radlinks=5&max_radlink_len=27®ion=def&cc=100&flash=9&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\Type=click&FlightID=123434&AdID=166120&TargetID=1435&Segments=730,2259,2401,2720,2743,3030,3285,3800,5388,5880,6089,6298,7215,8352,8463,8796,9496,9779,9781,9853,10088,10[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\Type=click&FlightID=123435&AdID=166121&TargetID=1434&Segments=730,2274,2472,2607,2719,2743,3030,3285,4898,8463,8796,9496,9779,9781,9853,10381,12638,12720,13760,14036,141[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\GTIZC5IN\Type=click&FlightID=123439&AdID=166123&TargetID=28041&Segments=730,2743,3030,3285,8463,8796,9496,9779,9781,9853,10381,13760,14173,14401,14402,14734,14735,14736,14757,147[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\%3Dnavclient%26ie%3DUTF-8%26rls%3DGGIH%2CGGIH%3A2007-02%2CGGIH%3Aen%26q%3Dserver%2Bside&cc=506&flash=9&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=32&u_java=true not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CA85WDSL.com%2Fbrowse%2Fchampain&lmt=1179354370&dt=1179354378117&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CAEIQBV0.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354288945&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CAIPEA75.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367492&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CAIXS1A3.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354366398&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CASHYZ05.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354301477&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CATDQYSL.com%2Fbrowse%2Fchampain&ref=&lmt=1179354359&dt=1179354367883&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=37&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CAUDCITH.com%2Fbrowse%2Fchampain&ref=&lmt=1179354281&dt=1179354290477&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=35&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\CAZAD57Z.com%2Fbrowse%2Fchampain&lmt=1179354289&dt=1179354302070&cc=100&u_h=864&u_w=1152&u_ah=834&u_aw=1152&u_cd=32&u_tz=-240&u_his=36&u_java=true&u_nplug=0&u_nmime=0 not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=123435&AdID=166121&TargetID=1434&Segments=730,2274,2472,2607,2719,2743,3030,3285,4898,6298,8463,8796,9496,9779,9781,9853,10381,12284,12720,13760,1385[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=123439&AdID=166123&TargetID=28041&Segments=730,2743,3030,3285,6298,8463,8796,9496,9779,9781,9853,10381,13760,14173,14401,14402,14734,14735,14736,1475[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=123439&AdID=166123&TargetID=28041&Segments=730,2743,3030,3285,8463,8796,9496,9779,9781,9853,10381,13760,14173,14401,14402,14734,14735,14736,14757,147[1] not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=36200&AdID=49888&TargetID=913&Segments=730,2259,2401,2725,2743,2813,3030,3285,3800,4960,5516,5854,5880,6298,6520,6582,7428,7429,7431,7652,7769,7823,7[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=38677&AdID=49897&TargetID=913&Segments=730,2259,2725,2743,2813,3030,3285,3800,4960,5516,5854,5880,6520,6582,7652,7769,7854,8462,8463,8525,8598,8613,8[1].htm not found!
File\Folder C:\Documents and Settings\Brian Gauss\Local Settings\Temp\Temporary Internet Files\Content.IE5\5OOX8WII\Type=click&FlightID=39557&AdID=50697&TargetID=7579&Segments=1753,2246,2616,2743,3285,4008,4960,5427,5516,6298,6520,6582,6589,7039,7356,7525,7769,7854,8239,8462,8463,8598[1].htm not found!

Registry entries deleted on Reboot...
askey127
June 12, 2011, 4:48 PM UTC
mgauss,
Retired Electrical Engineer. You can click the MVP thing in my signature.

Looks good. I think you have done well.
I'll bet the Genie is not to be found. I don't think we missed any.

--------------------------------------------------------
Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 10.0 are vulnerable.
Go HERE and click on AdbeRdr1001_en_US.exe to download the latest version of Adobe Acrobat Reader.
Save this file to your desktop and run it to install the latest version of Adobe Reader.

After the new Reader is installed, Open Adobe Reader X. (Right click and Run as administrator in Vista/Win7)
OK the license.
Click on Edit and select Preferences.
On the Left, click on the Javascript category and Uncheck Enable Acrobat Javascript.
Click on the Security (Enhanced) category and Uncheck Automatically trust sites from my Win OS security zones.
Click on the Trust Manager category and Uncheck Allow opening of non-PDF file attachments with external applications.
Click the OK button
When it finishes, you can remove the Installer from your desktop.

You should be good to go,
askey127
mgauss
June 12, 2011, 5:06 PM UTC
I really appreciate it. I would like to donate to the website (or you), how do I do that?

Question: I thought there was an Adobe X compatibility problem with the latest version of firefox and so I went back to the earlier version of Firefox. Do you know if that has been resolved?

In the meantime I will do as you noted above.

Another question: I assume Zonealarm and AVG are gone forever, do I have firewall protection through Avira?

Yet another: I would like to scan and send you my work computer for your evaluation. I would hope it doesn't have the kind of messes this one does. Accessibility to me only and not the kids might help a bit (at least we will know where the blame is).
askey127
June 12, 2011, 6:14 PM UTC
Some notes on your comments:
We don't, by policy, do business computers. Too many possible entanglements. Some countries have incredible legal requirements on any found infections in business machines.
I don't know of any Firefox/Adobe resolutions, but having the new Reader X is the most important issue.
I have no problem on my systems (XP and Win7x64) with Firefox 4.01 and Adobe Reader X together. Usually, any problems are related to what was installed first.

If you want a 3rd party firewall, I would suggest Online Armor. It doesn't have ZA's warts, bugs, or any crummy toolbars.
If you don't want Avira's once-a-day nag screen, you can get its paid version (excellent and cheap), or Uninstall it and get Microsoft Security Essentials.

Good Luck.
mgauss
June 12, 2011, 6:28 PM UTC
I'm self-employed (a certified financial planner), my work computer is not at any large or even small business, it's just me and a bunch of other CFPs in an office suite. I would love for you to take a look at it.

Don't I need a firewall? You didn't sound to concerned about my not having one.

I'm assuming I can donate to the site via credit card from this computer without risk of that trojan that was removed?
askey127
June 12, 2011, 7:22 PM UTC
If you are behind a modern NAT router, the third party firewall doesn't buy too much.
For something like a mobile, traveling laptop, a third party firewall is much more useful and important.

We would be pleased if you could donate. It's here: http://www.malwareremoval.com/donations.php
Your card should work fine.

You do need to keep an eye on the card account, in case of an earlier password robbery, etc.
Just be fanatical about nobody using a P2P file sharing program, EVER, for anything.
And.. be careful what you click on.
mgauss
June 12, 2011, 7:38 PM UTC
Donation made. Thank you again very much for your time and help.

Michael Gauss
askey127
June 12, 2011, 10:59 PM UTC