Malware infections?

Says "No Fix text provided. Then ,. something like load it, but there is nothing to load.
Shall I click the CleanUp button?

Hi Dorothy,

Says "No Fix text provided

When you copy the code please do not include the words Code: select all

I receive message: " No Fix has been provided. Click to load it from a file or cancel"
I clicked but no file to load it from.
Sorry....
Shall I try the "CleanUp" tab???

Hi Dorothy,

Shall I try the "CleanUp" tab???

No, that is for later once we are finished.

Just to confirm, you copied the following

:Commands

[CREATERESTOREPOINT]



:processes

killallprocesses

:otl

O2 - BHO: (Define) - {B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE} - C:\Users\Cassidy\AppData\Local\DefineExt\temp.dat ()

:commands

[EMPTYTEMP]

[EMPTYFLASH]

[EMPTYJAVA]

[RESETHOSTS]

[REBOOT]

Then pasted into the Custom Scans/Fixes box before clicking Run Fix?

I'm going to try this post again...sorry if you've gotten it three times...looks like it posted, but didn't, I think.
Anyway, OTL says there is no Fix to run...says to click and load fix, but there is no such thing that I can find when I click.
Shall I try CleanUp instead?

Thanks so much.

Testing. Unable to post here this afternoon.

OK, let me try the fix thing again. I just now see your post. Thanks

Hi Dorothy,

Let's try a different way of running the fix in OTL

Please download the attached file and save it to your desktop


Custom OTL Script:

• Double-click OTL.exe to start the program.
• Now double click anywhere inside the Custom Scans/Fixes box.
• At the prompt Click Ok to load a custom scan from a file or Cancel to cancel.
• Click the Ok button and navigate to the file Scan.txt which should be on your Desktop.
• Select Scan.txt and click Open. Text will now appear in the Custom Scans/Fixes box.
• Now click the red Run Fix button.
• Let the program run unhindered.
• If OTL asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.

Note: The logfile can also be located C: >> _OTL >> MovedFiles >> DD/DD/DD TT/TT.txt <-- denotes date/time log created.

Feel like an idiot--I apparently didn't paste that in, but now did and OTL custom fix was run. I'm very sorry. With no print spool loading, I have been unable to print the instructions. No excuse. This file resulted after Fix and reboot:
All processes killed
========== COMMANDS ==========
Restore point Set: OTL Restore Point
========== PROCESSES ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B78F92C8-DEB3-11E2-9A0A-FB64281D6ADE}\ not found.
File C:\Users\Cassidy\AppData\Local\DefineExt\temp.dat not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Cassidy
->Temp folder emptied: 317816232 bytes
->Temporary Internet Files folder emptied: 577988571 bytes
->Java cache emptied: 462026 bytes
->FireFox cache emptied: 442405937 bytes
->Google Chrome cache emptied: 444031613 bytes
->Flash cache emptied: 32753 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 125511121 bytes
->Temporary Internet Files folder emptied: 8342693 bytes
->FireFox cache emptied: 88194357 bytes
->Flash cache emptied: 961 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1060030300 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36584 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42321377 bytes
RecycleBin emptied: 307430013 bytes

Total Files Cleaned = 3,256.00 mb


[EMPTYFLASH]

User: All Users

User: Cassidy
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: DefaultAppPool

User: Guest
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Cassidy
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: DefaultAppPool

User: Guest

User: Public

Total Java Files Cleaned = 0.00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.69.0 log created on 10202013_175200

Files\Folders moved on Reboot...
C:\Users\Cassidy\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Cassidy\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
File move failed. C:\Windows\SysWow64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Hi Dorothy,

I apparently didn't paste that in

No problem, it's done now.

The Bad report from Malwarebytes refers to Potentially Unwanted Programs, you should let Malwarebytes remove them unless you have reason to keep them.

The problem with the wireless printer may be unrelated to any malware issues.

Have the Ads and surveys stopped now?

Well, after reboot, have been testing. I received one redirect associated with TidyNetwork.com, but then no more on multiple site visits.
Print spool still not loading, apparently.
I still have some pop-ups on start up for JUcheck , iYogiSupport, and SSBkgupdate, the latter of which has been there forever. Not sure if these are any problem, just annoying.
I'll reinstall printer (AGAIN) and see if that helps. Also, will just continue use here and report tomorrow.
Thanks SO MUCH for this help.
Was there anything else to send you???

Indeed the wireless may be unrelated but have tried everything. Understood. Will run the Malwarebytes and removal now.

Hi Dorothy,

I received one redirect

There should be none so we need to look a little further.

TDSSKiller - Rootkit Removal Tool
Please download the TDSSKiller.exe by Kaspersky... save it to your Desktop. <-Important!!!

1. Double-click on TDSSKiller.exe to run the tool. Vista - W7 users: Right-click and select "Run As Administrator".
   If TDSSKiller does not run... rename it. Right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. ektfhtw.com).
   If you don't see file extensions, please see: How to change the file extension.
2. Click the Start Scan button. Do not use the computer during the scan!
3. Click Change parameters
4. Under Additional Options CHECK Verify file digital signatures
5. IMPORTANT: Ensure Detect TDLFS file system remains UNCHECKED.
6. Click OK if changes were made.
7. Click Start scan and allow it to scan for Malicious objects.
   
   
   • If Malicious objects are detected, the default action will be Cure, ensure SKIP is selected... then click Continue
   • If suspicious objects are detected, the default action will be Skip, ensure Skip is selected... then click Continue
   • If Unsigned files are detected, the default action will be Skip, ensure Skip is selected... then click Continue
   
   DO NOT change the default actions, other than CURE to SKIP.
8. You may be asked to reboot the computer to complete the process. Click on Reboot Now and allow the computer to reboot.
9. A log will be created on your root drive (usually C:) drive. The log will have a name like Name.Version_Date_Time_log.txt.
   for example, C:\TDSSKiller.2.4.1.2_20.04.2010_15.31.43_log.txt.
10. If no reboot is required, click on Report. A log file should appear.
11. Please post the contents of the log file in your next reply

Ran the TDSS Killer. It will not allow me to "copy" the report, but it indicated at the end of scan and on the report itself that there were Zero items detected. Is there any other helpful info that can be gleaned from the TDSS report? Thank you!!!

Hi Dorothy,

Update Java Runtime

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 7 Update 45.

• Download the latest version of Java Runtime Environment (JRE) 7 Here
• Scroll down to where it says "Java SE 7u45"
• Click the blue Download JRE button to the right
• Select the Windows platform from the dropdown menu
• Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX License Agreement". Click on Continue.The page will refresh
• Click on the link to download Windows Offline Installation & save the file to your desktop
• Close any programs you may have running - especially your web browser
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) ) in the name
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions
• Reboot your computer once all Java components are removed
• Then from your desktop double-click on jre-7u45-windows-i586.exe to install the newest version

Next

Please uninstall Java Auto Updater

Also, unless you have need for it please uninstall iYogi Support Dock

Now please run a new scan with OTL and post only the OTL.txt file.