This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

PC laptop infected with Malware

101 min read

This thread's last reply is from January 7, 2015, 3:22 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

So, seems there's still a few items that need removing, nothing serious, but they do need taking care of.

  • Click Start
  • Type notepad.exe in the search programs and files box and click Enter.
  • A blank Notepad page should open.
    • Copy/Paste the contents of the code box below into Notepad (don't include Code: Select all).

C:\Documents and Settings\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Documents and Settings\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Documents and Settings\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe
C:\Documents and Settings\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe
C:\Documents and Settings\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe
C:\Program Files (x86)\Music Editor Free\ConduitInstaller.exe
C:\ProgramData\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe
C:\Users\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe
C:\Users\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe
EmptyTemp:

    • Save it to the same folder/directory that FRST.exe is in, naming it as fixlist.txt


NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

  • Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
    • Press the Fix button once and wait.
    • FRST will process fixlist.txt
    • When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
    • Please post me the log, and let me know if you're having any problems with your computer.
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-01-2015 03
Ran by [removed] at 2015-01-04 19:36:35 Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Documents and Settings\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Documents and Settings\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Documents and Settings\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe
C:\Documents and Settings\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe
C:\Documents and Settings\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe
C:\Program Files (x86)\Music Editor Free\ConduitInstaller.exe
C:\ProgramData\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll
C:\Users\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe
C:\Users\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe
C:\Users\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe
EmptyTemp:
*****************

C:\Documents and Settings\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll => Moved successfully.
"C:\Documents and Settings\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll" => File/Directory not found.
C:\Documents and Settings\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe => Moved successfully.
C:\Documents and Settings\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe => Moved successfully.
C:\Documents and Settings\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe => Moved successfully.
C:\Program Files (x86)\Music Editor Free\ConduitInstaller.exe => Moved successfully.
"C:\ProgramData\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll" => File/Directory not found.
"C:\Users\All Users\Application Data\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll" => File/Directory not found.
"C:\Users\All Users\InstallMate\{96F12AFC-7901-4F73-AD98-31234D12080A}\Custom.dll" => File/Directory not found.
"C:\Users\Fatima Trapaga\Downloads\cbsidlm-tr1_8-Data_Doctor_Recovery_Pen_Drive-ORG2-10700114.exe" => File/Directory not found.
"C:\Users\Fatima Trapaga\Downloads\jZipSetup-r100-w-bf.exe" => File/Directory not found.
"C:\Users\Fatima Trapaga\Downloads\SoftonicDownloader_for_stanza-desktop.exe" => File/Directory not found.
EmptyTemp: => Removed 72.1 MB temporary data.


The system needed a reboot.

==== End of Fixlog 19:36:43 ====
.... and let me know if you're having any problems with your computer.


So .... how's your computer running now ????
Hi,

Sorry it took a while - I have been at work. It seems to be running fine now. Is there anything else i should do? Can you reccomend a good antivirus/spayware? Avast does not seem to be cutting it...

Sincerely,

Fats
No problem, I wasn't going anywhere. ;) :D

We've just got to remove the programs that we've been using to clean your machine, and clear out your System restore points, to remove any malware that might have got "backed up" when your computer created RPs during your infection, then we're finished.

The following tool will do both ....

  • Please download delfix and save it to your desktop.
  • Right-click on delfix.exe and select " Run as administrator " to run it.
  • Check all the boxes then click on Run.
  • Once it has finished, a notepad file named DelFix.txt will open. Post the contents of this notepad in your next reply.
  • The log can also be located at the root of the system drive, C:\DelFix.txt.


As far as protecting your computer goes ....

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection. For most people it's not that their AV isn't "cutting it", it's that they have unrealistic expectations of what an AV program can actually do. Improving your security is usually more a case of improving your browsing habits rather than improving the programs that you're using to protect you.

Here you go. Do I delete all the other stuff you had me download now?

# DelFix v10.8 - Logfile created 07/01/2015 at 22:19:40
# Updated 29/07/2014 by Xplode
# Username : Fatima Trapaga - FATIMA-HP
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\Fatima Trapaga\Desktop\FRST-OlderVersion
Deleted : C:\Users\Fatima Trapaga\Desktop\adwcleaner_4.106.exe
Deleted : C:\Users\Fatima Trapaga\Desktop\dds.com
Deleted : C:\Users\Fatima Trapaga\Desktop\dds.scr
Deleted : C:\Users\Fatima Trapaga\Desktop\esetsmartinstaller_enu.exe
Deleted : C:\Users\Fatima Trapaga\Desktop\Fixlog.txt
Deleted : C:\Users\Fatima Trapaga\Desktop\FRST64.exe
Deleted : C:\Users\Fatima Trapaga\Desktop\Rkill.txt
Deleted : HKLM\SOFTWARE\AdwCleaner

~ Creating registry backup ... OK

~ Cleaning system restore ...


New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########
Do I delete all the other stuff you had me download now?


You should find it's all been deleted by delfix, all you should need to do now is delete delfix.

As your problems now appear to have been resolved,