This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

how to remove persistent malware Yieldmaster Revsci etc

158 min read

This thread's last reply is from June 30, 2012, 10:09 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

maxi
June 26, 2012, 10:32 AM UTC
Hi mutepail :)

I think you should look at all files and folders on your desktop, Any thing you dont recognise or want I would advise you to delete. The less you have the better, as you will notice unwanted changes easier.

Step 1
SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind 
    
*ilivid*
    

    
:folderfind 
    
*ilivid*
    

    
:regfind 
    
ilivid
    

    
:contents
    
C:\Users\Liberty\Desktop\~$search 9.8.rtf
    
C:\Windows\ϛ~
    

    
:dir
    
C:\Users\Liberty\Desktop\Desktop

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note
: The log can also be found on your Desktop entitled SystemLook.txt

Step 2
ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
  • First please Disable any Antivirus you have active, as shown in This topic.
  • Note: Don't forget to re-enable it after the scan.
  • Next hold down Control then click on the following link to open a new window to ESET online scannner
  • Select the option YES, I accept the Terms of Use then click on Start.
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on Start.
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on Finish.
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.


In your next reply please include:
The systemlook logfile.
The eset log.
How your computer is running now ?

Regards maxi :)
mutepail
June 26, 2012, 6:06 PM UTC
hi Maxi
Here is the log from step one

SystemLook 30.07.11 by jpshortstuff
Log created at 18:54 on 26/06/2012 by Liberty
Administrator - Elevation successful

========== filefind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid\ilivid.exe --a---- 2033152 bytes [21:32 18/01/2012] [14:20 05/08/2011] A485B5376A7BD86E17DA042A64EE3E86

========== folderfind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid d------ [21:32 18/01/2012]
C:\_OTL\MovedFiles\06252012_203613\C_Users\Liberty\AppData\Local\Ilivid Player d------ [20:04 25/10/2011]

========== regfind ==========

Searching for "ilivid"
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid]

========== contents ==========

C:\Users\Liberty\Desktop\~$search 9.8.rtf - Opened succesfully.

LibertyLiberty32]ÐT-´rø]0÷…à ì¨û]ö[‚u`pX  è¨û]1G
u€pX

C:\Windows\ϛ~ - Opened succesfully.

[KeyList]
Count=0


========== dir ==========

C:\Users\Liberty\Desktop\Desktop - Parameters: "(none)"

---Files---
2 Live Crew - Banned In The U.S.A. - YouTube.m4v --a---- 26133990 bytes [21:37 22/01/2012] [21:41 22/01/2012]
2 Live Crew - Banned In The U.S.A. - YouTube.mp3 --a---- 4330529 bytes [21:41 22/01/2012] [21:41 22/01/2012]
2 Live Crew - Do Wah Diddy - YouTube.m4v --a---- 15613879 bytes [21:41 22/01/2012] [21:43 22/01/2012]
2 Live Crew - Do Wah Diddy - YouTube.mp3 --a---- 3885820 bytes [21:43 22/01/2012] [21:43 22/01/2012]
2 Live Crew - Me So Horny (Uncensored) - YouTube.m4v --a---- 53823510 bytes [21:28 22/01/2012] [21:37 22/01/2012]
2 Live Crew - Me So Horny (Uncensored) - YouTube.mp3 --a---- 4606800 bytes [21:37 22/01/2012] [21:37 22/01/2012]
2Pac - Dear Mama.m4v --a---- 18007385 bytes [23:14 21/02/2012] [23:16 21/02/2012]
2Pac - Dear Mama.mp3 --a---- 4449674 bytes [23:16 21/02/2012] [23:16 21/02/2012]
702-STEELO - YouTube.m4v --a---- 9669891 bytes [00:31 23/01/2012] [00:34 23/01/2012]
702-STEELO - YouTube.mp3 --a---- 4198872 bytes [00:34 23/01/2012] [00:34 23/01/2012]
702-WHERE MY GIRLS AT - YouTube.m4v --a---- 8584243 bytes [00:34 23/01/2012] [00:36 23/01/2012]
702-WHERE MY GIRLS AT - YouTube.mp3 --a---- 3821873 bytes [00:36 23/01/2012] [00:36 23/01/2012]
Alphaville - Forever Young (with lyrics) - YouTube.m4v --a---- 9023334 bytes [18:32 22/01/2012] [18:33 22/01/2012]
Alphaville - Forever Young (with lyrics) - YouTube.mp3 --a---- 3754163 bytes [18:33 22/01/2012] [18:33 22/01/2012]
Andy Brown - Tozarire.wmv - YouTube.m4v --a---- 58431432 bytes [02:00 09/01/2012] [02:05 09/01/2012]
Andy Brown - Tozarire.wmv - YouTube.mp3 --a---- 6116051 bytes [02:05 09/01/2012] [02:06 09/01/2012]
Cheryl 'Pepsii' Riley - Thanks For My Child - YouTube.m4v --a---- 51599368 bytes [22:58 21/02/2012] [23:05 21/02/2012]
Cheryl 'Pepsii' Riley - Thanks For My Child - YouTube.mp3 --a---- 4402418 bytes [23:05 21/02/2012] [23:05 21/02/2012]
Cutest Father Daughter Song Ever! - YouTube.m4v --a---- 20041985 bytes [21:06 21/02/2012] [21:10 21/02/2012]
Cutest Father Daughter Song Ever! - YouTube.mp3 --a---- 3827306 bytes [21:10 21/02/2012] [21:10 21/02/2012]
Fyfe Dangerfield - She's Always A Woman (Full Song) - YouTube.m4v --a---- 30022754 bytes [00:12 22/02/2012] [00:15 22/02/2012]
Fyfe Dangerfield - She's Always A Woman (Full Song) - YouTube.mp3 --a---- 3187829 bytes [00:15 22/02/2012] [00:15 22/02/2012]
Leonard Zhakata - Nzombe Huru -- Batai Mazwi.wmv - YouTube.m4v --a---- 55620059 bytes [02:37 09/01/2012] [02:48 09/01/2012]
Leonard Zhakata - Nzombe Huru -- Batai Mazwi.wmv - YouTube.mp3 --a---- 10907117 bytes [02:48 09/01/2012] [02:48 09/01/2012]
Leonard Zhakata-Gomba Remarara - YouTube.m4v --a---- 60491336 bytes [02:48 09/01/2012] [03:00 09/01/2012]
Leonard Zhakata-Gomba Remarara - YouTube.mp3 --a---- 12096629 bytes [03:00 09/01/2012] [03:01 09/01/2012]
Leonard Zhakata-Nhamodzenyika - YouTube.m4v --a---- 53162555 bytes [02:27 09/01/2012] [02:37 09/01/2012]
Leonard Zhakata-Nhamodzenyika - YouTube.mp3 --a---- 10347887 bytes [02:37 09/01/2012] [02:37 09/01/2012]
Mase - Welcome Back Best Quality (2004) - YouTube.m4v --a---- 44267165 bytes [21:22 22/01/2012] [21:28 22/01/2012]
Mase - Welcome Back Best Quality (2004) - YouTube.mp3 --a---- 3804318 bytes [21:28 22/01/2012] [21:28 22/01/2012]
Mase feat. Total - Tell Me What You Want - YouTube.m4v --a---- 19771287 bytes [21:19 22/01/2012] [21:22 22/01/2012]
Mase feat. Total - Tell Me What You Want - YouTube.mp3 --a---- 4845873 bytes [21:22 22/01/2012] [21:22 22/01/2012]
MECHANIC MANYERUKE MAKOROKOTO - YouTube.m4v --a---- 30412155 bytes [00:20 22/02/2012] [00:25 22/02/2012]
MECHANIC MANYERUKE MAKOROKOTO - YouTube.mp3 --a---- 4969171 bytes [00:25 22/02/2012] [00:25 22/02/2012]
Michelle Gayle - Sweetness - Official Music Video HQ - YouTube.m4v --a---- 14305305 bytes [00:36 23/01/2012] [00:37 23/01/2012]
Michelle Gayle - Sweetness - Official Music Video HQ - YouTube.mp3 --a---- 3537242 bytes [00:37 23/01/2012] [00:37 23/01/2012]
Ndivumbamirewo - Marshal Munhumwe - The Four Brothers - YouTube.m4v --a---- 80017373 bytes [02:06 09/01/2012] [02:14 09/01/2012]
Ndivumbamirewo - Marshal Munhumwe - The Four Brothers - YouTube.mp3 --a---- 10226679 bytes [02:14 09/01/2012] [02:15 09/01/2012]
Paul Matavire - January Disease.wmv - YouTube.m4v --a---- 44256651 bytes [01:54 09/01/2012] [02:00 09/01/2012]
Paul Matavire - January Disease.wmv - YouTube.mp3 --a---- 6803594 bytes [02:00 09/01/2012] [02:00 09/01/2012]
Peter Cetera - Daddy's Girl - YouTube.m4v --a---- 41684547 bytes [21:24 21/02/2012] [21:28 21/02/2012]
Peter Cetera - Daddy's Girl - YouTube.mp3 --a---- 3690216 bytes [21:28 21/02/2012] [21:28 21/02/2012]
T'pau - China in your hand - YouTube.m4v --a---- 16030644 bytes [00:37 23/01/2012] [00:40 23/01/2012]
T'pau - China in your hand - YouTube.mp3 --a---- 3913824 bytes [00:40 23/01/2012] [00:41 23/01/2012]
The Four Brothers - Rugare. - YouTube.m4v --a---- 69324786 bytes [02:22 09/01/2012] [02:27 09/01/2012]
The Four Brothers - Rugare. - YouTube.mp3 --a---- 5673432 bytes [02:27 09/01/2012] [02:27 09/01/2012]
The Four Brothers - Vimbayi - YouTube.m4v --a---- 95624517 bytes [02:15 09/01/2012] [02:22 09/01/2012]
The Four Brothers - Vimbayi - YouTube.mp3 --a---- 7850163 bytes [02:22 09/01/2012] [02:22 09/01/2012]
Windows Media Player.lnk --a---- 782 bytes [10:38 11/08/2011] [13:15 08/11/2009]
Zimbabwe Cha Cha Cha Kings - Vimbiso.wmv - YouTube.m4v --a---- 52906223 bytes [01:49 09/01/2012] [01:54 09/01/2012]
Zimbabwe Cha Cha Cha Kings - Vimbiso.wmv - YouTube.mp3 --a---- 5222036 bytes [01:54 09/01/2012] [01:54 09/01/2012]

---Folders---
Nokia d------ [10:38 11/08/2011]
Unused Desktop Shortcuts d------ [10:38 11/08/2011]

-= EOF =-

Many thanks

Liberty
mutepail
June 26, 2012, 8:44 PM UTC
Hi Maxi

here is the log from step 2

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=42e8ba0b6b50724388a393869a0a1fa5
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-06-26 06:43:30
# local_time=2012-06-26 07:43:30 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 686438 686438 0 0
# compatibility_mode=1024 16777215 100 0 260483 260483 0 0
# compatibility_mode=5893 16776574 100 94 21495769 93200889 0 0
# compatibility_mode=8192 67108863 100 0 188 188 0 0
# scanned=34232
# found=0
# cleaned=0
# scan_time=1712
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=42e8ba0b6b50724388a393869a0a1fa5
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-06-26 08:35:51
# local_time=2012-06-26 09:35:51 (+0000, GMT Daylight Time)
# country="United Kingdom"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 688221 688221 0 0
# compatibility_mode=1024 16777215 100 0 262266 262266 0 0
# compatibility_mode=5893 16776574 100 94 21497552 93202672 0 0
# compatibility_mode=8192 67108863 100 0 1971 1971 0 0
# scanned=206997
# found=1
# cleaned=0
# scan_time=6670
E:\Program Files\FoxTabFlvPlayer\FLVPlayer.exe a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I
maxi
June 27, 2012, 5:37 PM UTC
Hi mutepail :) Nearly there :)

Step 1
Run OTL Script

We need to run an OTL Fix

  • Right click on OTL.exe and select "Run As Administrator" to run it.
  • Copy and Paste the following code into the textbox. Do not include the word Code

    
:reg
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid]
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32]
    
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid]
    

    
:files
    
ipconfig /flushdns /c
    
E:\Program Files\FoxTabFlvPlayer\FLVPlayer.exe 
    

    
:commands
    
[emptytemp]
    
[createrestorepoint]
  • Then click the Run Fix button at the top.
  • Click .
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.


Step 2
Systemlook

We need to run Systemlook again like you did before, but this time enter the contents of the code box below (Do not enter the word code)
:filefind 

*ilivid*

*trolltech*



:folderfind 

*ilivid*

*trolltech*



:regfind 

ilivid

trolltech


Step 3
Set Your Computer to Show All Files/Folders.

  • Click Start.
  • Open Computer.
  • Press the ALT key.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.


Step 4
Upload File/Files for testing

Please go to Virustotal or jotti.org

Copy/paste this file and path into the white box at the top:
C:\Users\Liberty\Desktop\~$search 9.8.rtf
C:\Windows\ϛ~

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the permalink (web address) in your next response.
Example of web address :


In your next reply please include:
The latest OTL logfile.
The Systemlook logfile.
The links to Virustotal.
How your computer is running now ?

Regards maxi :)
mutepail
June 27, 2012, 8:22 PM UTC
Hi Maxi
Here is the latest OTL log
All processes killed
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iLividSetupV1.exe\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\C:\Program Files\iLivid\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Plugin Cache 4.7.false\C:\Program Files\iLivid\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Liberty\Downloads\cmd.bat deleted successfully.
C:\Users\Liberty\Downloads\cmd.txt deleted successfully.
E:\Program Files\FoxTabFlvPlayer\FLVPlayer.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Liberty
->Temp folder emptied: 44144787 bytes
->Temporary Internet Files folder emptied: 26530351 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 1916 bytes

User: NeroMediaHomeUser.4.Liberty-PC
->Temp folder emptied: 28696 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19914434 bytes
RecycleBin emptied: 2032 bytes

Total Files Cleaned = 86.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.52.0 log created on 06272012_202731

Files\Folders moved on Reboot...
C:\Users\Liberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\NeroMediaHomeUser.4.Liberty-PC\AppData\Local\Temp\etilqs_i8X51xBh7OCkSfIIWIlD moved successfully.
C:\Users\NeroMediaHomeUser.4.Liberty-PC\AppData\Local\Temp\etilqs_i8X51xBh7OCkSfIIWIlD-journal moved successfully.

Registry entries deleted on Reboot...


step 3
SystemLook 30.07.11 by jpshortstuff
Log created at 20:43 on 27/06/2012 by Liberty
Administrator - Elevation successful

========== filefind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid\ilivid.exe --a---- 2033152 bytes [21:32 18/01/2012] [14:20 05/08/2011] A485B5376A7BD86E17DA042A64EE3E86

Searching for "*trolltech*"
No files found.

========== folderfind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid d------ [21:32 18/01/2012]
C:\_OTL\MovedFiles\06252012_203613\C_Users\Liberty\AppData\Local\Ilivid Player d------ [20:04 25/10/2011]

Searching for "*trolltech*"
No folders found.

========== regfind ==========

Searching for "ilivid"
No data found.

Searching for "trolltech"
[HKEY_CURRENT_USER\Software\Trolltech]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]

-= EOF =-
step 4
virus total
~$search 9.8.rtf

https://www.virustotal.com/file/d9ec3e1 ... 1340826751

C:\Windows\ϛ~

https://www.virustotal.com/file/4dd8aaa ... 340827271/



Jotti
~$search 9.8.rtf

http://virusscan.jotti.org/en/scanresult/d7d220708091204dda48fdbdc4337af1753b9ad9

C:\Windows\ϛ~
http://virusscan.jotti.org/en/scanresult/41e22e351459cb9d6177156ae8c0fcaa1afdd93e/989df8fb01174f20c39d1c15472ccf6da2c4147c

The computer is fast but AVG still flashes to say'found tracking cookie'.

Many thanks

Mutepail
mutepail
June 27, 2012, 8:27 PM UTC
Hi Maxi

I had forgotten to attach the systemlook file.

SystemLook 30.07.11 by jpshortstuff
Log created at 20:43 on 27/06/2012 by Liberty
Administrator - Elevation successful

========== filefind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid\ilivid.exe --a---- 2033152 bytes [21:32 18/01/2012] [14:20 05/08/2011] A485B5376A7BD86E17DA042A64EE3E86

Searching for "*trolltech*"
No files found.

========== folderfind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid d------ [21:32 18/01/2012]
C:\_OTL\MovedFiles\06252012_203613\C_Users\Liberty\AppData\Local\Ilivid Player d------ [20:04 25/10/2011]

Searching for "*trolltech*"
No folders found.

========== regfind ==========

Searching for "ilivid"
No data found.

Searching for "trolltech"
[HKEY_CURRENT_USER\Software\Trolltech]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
[HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
[HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]

-= EOF =-
maxi
June 28, 2012, 4:01 PM UTC
Hi mutepail :)

Step 1
Run OTL Script

We need to run an OTL Fix

  • Right click on OTL.exe and select "Run As Administrator" to run it.
  • Copy and Paste the following code into the textbox. Do not include the word Code

    
:reg
    
[-HKEY_CURRENT_USER\Software\Trolltech]
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
    
[-HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:]
    
[-HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:]
    

    
:files
    
ipconfig /flushdns /c
    

    
:commands
    
[emptytemp]
    
[createrestorepoint] 
    
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click .
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.


Step 2
Systemlook

We need to run Systemlook again like you did before using the below code.
:filefind 

*ilivid*

*trolltech*



:folderfind 

*ilivid*

*trolltech*



:regfind 

ilivid

trolltech


Step 3
Security Check

  • Please download Security Check by screen317 from one of the links below:
    • Link 1
    • Link 2
  • Save it to your Desktop.
  • Right click SecurityCheck.exe And select " Run as administrator " , then follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt
  • Please post the contents of that document.


In your next reply please include:

The OTL logfile.
The systemlook logfile.
The security check logfile.


Regards maxi :)
mutepail
June 28, 2012, 8:46 PM UTC
Hi Max
step 1
All processes killed
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Trolltech\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:\ not found.
Registry key HKEY_CURRENT_USER\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QSqlDriverFactoryInterface:\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.5\com.trolltech.Qt.QTextCodecFactoryInterface:\ not found.
Registry key HKEY_USERS\S-1-5-21-2636723537-2607932590-1398714872-1000\Software\Trolltech\OrganizationDefaults\Qt Factory Cache 4.7\com.trolltech.Qt.QImageIOHandlerFactoryInterface:\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Liberty\Downloads\cmd.bat deleted successfully.
C:\Users\Liberty\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Liberty
->Temp folder emptied: 190769 bytes
->Temporary Internet Files folder emptied: 4478941 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 841 bytes

User: NeroMediaHomeUser.4.Liberty-PC
->Temp folder emptied: 21528 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6332991 bytes
RecycleBin emptied: 12805880 bytes

Total Files Cleaned = 23.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.52.0 log created on 06282012_204932

Files\Folders moved on Reboot...
C:\Users\Liberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
C:\Users\Liberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VXPGQQFW\uk_yahoo_com[1].htm moved successfully.
C:\Users\NeroMediaHomeUser.4.Liberty-PC\AppData\Local\Temp\etilqs_sYGmfo5IbTemB1LvmmPR moved successfully.
C:\Users\NeroMediaHomeUser.4.Liberty-PC\AppData\Local\Temp\etilqs_sYGmfo5IbTemB1LvmmPR-journal moved successfully.

Registry entries deleted on Reboot...

step 2
SystemLook 30.07.11 by jpshortstuff
Log created at 21:32 on 28/06/2012 by Liberty
Administrator - Elevation successful

========== filefind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid\ilivid.exe --a---- 2033152 bytes [21:32 18/01/2012] [14:20 05/08/2011] A485B5376A7BD86E17DA042A64EE3E86

Searching for "*trolltech*"
No files found.

========== folderfind ==========

Searching for "*ilivid*"
C:\_OTL\MovedFiles\06252012_203613\C_Program Files\iLivid d------ [21:32 18/01/2012]
C:\_OTL\MovedFiles\06252012_203613\C_Users\Liberty\AppData\Local\Ilivid Player d------ [20:04 25/10/2011]

Searching for "*trolltech*"
No folders found.

========== regfind ==========

Searching for "ilivid"
No data found.

Searching for "trolltech"
No data found.

-= EOF =-

step 3
Results of screen317's Security Check version 0.99.42
Windows 7 Service Pack 1 x86 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
AVG Internet Security 2012
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Reader X (10.1.2)
Google Chrome 12.0.742.100
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

Many thanks
Mutepail
maxi
June 29, 2012, 4:04 PM UTC
Hi mutepail :) Your logs appear to free of malware :) There are just one or two things to look at and I have provided some advice below on how to stay clean.

The tracking cookies that AVG are detecting are not a threat to your security and you can even stop AVG from detecting them. There is plenty info if you follow the link below
http://www.avg.com/ww-en/faq.num-2334#num-2334

I notice that the UAC(User Acess Control) is disabled on your machine. I would recommend you enable this for your safety. You can learn how from the link below.
http://support.microsoft.com/kb/975787 (I would recommend the default settings)




Java SE Runtime Environment (JRE).

Please download from HERE

  • Find Java SE 7u5.
  • Click the Download JRE button to the right.
  • Choose the correct Platform and Multi-language. Next, check the box that says I agree to the Java SE Runtime Environment 6 License Agreement.
  • Click the Continue button.
  • Click on the filename under Windows Offline Installation and save it to your desktop.
  • Close all active windows.
  • Install the program.


Clean up with OTL

  • right click and select "run as administrator" to start the program. This will remove all the tools we used to clean your pc.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CleanUp! button
  • Say Yes to the prompt and then allow the program to reboot your computer.


You can now remove any tools left on your desktop.



Create a new, clean System Restore point which you can use in case of future system problems:
  • Press Start >> All Programs >> Accessories >>System Tools >> System Restore
  • Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
  • Now remove old, infected System Restore points:
  • Next click Start >> Run and type cleanmgr in the box and press OK
  • Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
  • Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
  • Press OK and Yes to confirm


Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Malwarebytes' Anti-Malware
You already hav this installed. I would recommend you update and run a quick scan once a week.




Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety



Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean!
mutepail
June 29, 2012, 11:03 PM UTC
thanks a million Maxi
Cypher
June 30, 2012, 10:09 AM UTC
As your problems appear to have been resolved,