Malware from a torrent

Re

Download Toolbar-S&D (Team IDN) to your Desktop.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

When scanning, disconnect your internet connection.

* Start the installation of the program by executing the downloaded file.
* Double-click now on the Toolbar-S&D shortcut.
* Select your desired language by typing the corresponding letter and validating with the Enter key.
* Now choose option 1. Wait until the search is complete.
* Post the generated report. (C:\TB.txt)


@+
--
We’ve all been beginners at something at some point.
But knowledge is the reward for diligence.

Re

Let's try this:
Download Malwarebytes anti-malware here
http://www.malwarebytes.org/mbam.php

* Install it (make sure to choose "French"; do not change the installation settings) and update it.

(NB: If you are missing "COMCTL32.OCX" during installation, download it here: https://www.malekal.com/tutorial-aboutbuster/

* Go through the tutorial to familiarize yourself with the program:

https://forum.pcastuces.com/sujet.asp?f=31&s=3

(that said, it is very easy to use).

Restart Malwarebytes by strictly following these instructions:

! Disconnect and close all running applications!

* Launch Malwarebytes.

Perform a "Complete" scan.

--> Let the program work (and do nothing else with the PC during the scan).
--> At the end, click on "results."
--> Check that all infected items are checked, then click on "delete."

Note: If you need to restart your PC to finish the cleaning, do it!


Post the saved report after deleting the infected items (in the "report/log" tab of Malwarebytes, the most recent one)

@+
--
We have all been beginners at something at some point.
But knowledge is the reward of diligence.

Hello

1)Download Toolbar-S&D (Team IDN) to your Desktop.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cpVobGk5bHnxrhQ4yaoEUDJvOYNnEGyYjgqHZz5GqZLfutR3fMFPlsC3-CGIilfupPAguYATNyua3csodN_frdMK8sSzUpit10Yac-QJCOkMqJKkbdKcP6ySs8trWPgoNVIq4TGGWCe6o0txXQv-ZueJF9vZzw3RXsGwFYIqN2lvF2LPdQzS8mE1d5kWOVOz6EMzQuE5-lClSJM869uq3oc7-t7yg%3D%3D&attredirects=3

During the scan, disconnect your internet.

* Start the installation of the program by running the downloaded file.
* Now double-click on the Toolbar-S&D shortcut.
* Select the desired language by typing the letter of your choice and validating with the Enter key.
* Now choose option 1. Wait until the search is complete.
* Post the generated report. (C:\TB.txt)


2)What is the name of this torrent?

@+
--
We have all been beginners at something at one time.
But knowledge is the reward of diligence.

Re

1) Restart Toolbar-S&D by double-clicking (or right-clicking under Vista) on the shortcut. Type "2" then confirm by pressing "Enter".

! Do not close the window during the deletion!

A report will be generated, post its content here.

NOTE: If your Desktop does not reappear, press Ctrl+Alt+Del simultaneously to open the Task Manager.
Go to the "Processes" tab. Click on File in the top left corner and choose "Run..."
Type explorer then confirm.

2) Download OAD http://sosvirus.changelog.fr/OAD.exe
- Save it to your desktop

Double click on the OAD to launch it

- file name to search type or copy and paste: “[Torrentsworld.net] - Scale Bustin Babes 35.Torrent”
- Search type: select option 6 then confirm [enter]

OAD will now search for the file. Let it work until it is done.
The search report will automatically display as soon as it is finished.

- Copy and paste this report into your next post.

Important note: Depending on the size of the hard drives, this search may take several minutes. Be patient


Please post the reports as you go, thank you

@+

--
We have all been beginners at something at one point.
But knowledge is the reward of diligence.

Re

The exact name is d:\T‚l‚oads\Downloads or d:\Telechargements\Downloads or even with accents on the e

Thank you
--
We have all been a beginner at something one day.
But knowledge is the reward for diligence.

Hello

Download OTMoveIt3 (by Old_Timer) to your Desktop.

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

! Disconnect and close all your running applications!

Double-click on "OTMoveIt" to open the program.
Then copy what is in bold below:

:Services


:Reg
:files
d:\Downloads\Downloads\[Torrentsworld.net] - Scale Bustin Babes 35.torrent
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

and paste it in the left frame of OTMoveIt3:
Paste Instructions for Items to be Moved.
(do not touch anything else!)

-> click on MoveIt! to start the deletion.
-> let the tool work ...

(Note: your desktop will disappear and then reappear, this is normal.)

-> Once finished, a small window will open: click on " Yes " .

Your PC will restart by itself ...

-->Post the content of the report located in the folder "C:\_OTMoveIt\MovedFiles"


@+
--
We've all been beginners at something at one point.
But knowledge is the reward of diligence.

Hello

Please run an antivirus scan and post the report here, thanks

Is the media player working?

See you later
--
We have all been beginners at something at some point.
But knowledge is the reward for diligence.

Hello

Use this to post it.

To send it to me, click on this link:

http://www.cijoint.fr/

Click on Browse and find the file: Nom_complet_du_fichier
Click on Open.

Click on "Click here to upload the file."

A link in this format:

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

will be added to the page.

Copy this link into your response.

See you later
--
We have all been beginners at something at one point.
But knowledge is the reward for diligence.

Re

For your PC verification if you don't mind, do this:

1- Download and install the HijackThis software:

https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
or here http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
or here https://www.clubic.com/telecharger-fiche17891-hijackthis.html

--> Click on the setup to start the installation: follow the prompts and do not change the installation settings.
At the end of the installation, the program will start automatically: close it by clicking on the red cross.
In the end, you should have a shortcut on your desktop and also a path like:
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

(Do not run this program for now and proceed to the next step...)


2- Download Random's System Information Tool (RSIT) from random/random and save the executable on your Desktop.

-> http://images.malwareremoval.com/random/RSIT.exe

! Disconnect and close all your running applications!

Double-click on "RSIT.exe" to launch it.

Right-click under VISTA (run as…)

-> A first window opens with the title: "Disclaimer of warranty".

* In front of the option "List files/folders created ..." , choose: 2 months

* then click on "Continue" to start the scan...


-> let the scan run and do not touch the PC...


When the scan is complete, two text files will open (probably with Notepad).

Post the content of "log.txt" (the one that appears on the screen), as well as "info.txt" (which you will see in the taskbar), for analysis and wait for further instructions...

Important: post one report, then the other in the next response...
If you try to post both at the same time, it may be too long for the forum...
(And if "log.txt" alone doesn’t work either, do it in two parts... thank you...)

(Note: the reports will also be saved in this folder -> C:\rsit)

@+
--
We have all been beginners at something one day.
But knowledge is the reward of diligence.

Re

Download ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Rename it to save it on your desktop as asdehi (just to prevent the infection from blocking it)
-> Double click on combofix.exe.
-> Press the 1 key (Yes) to start the scan.
-> When the scan is complete, a report will appear. Copy/paste this report into your next response.

NOTE: The report is also located here: C:\Combofix.txt

Before using ComboFix:

-> Disconnect from the Internet and close all open program windows.

-> Temporarily disable the real-time protection of your Antivirus and Anti-spyware, only during the use of ComboFix, as they can greatly interfere with the searching and cleaning procedure of the tool.

Once done, double-click on Combofix.exe on your desktop.

- Say yes to the warning message, so that the program can start analyzing the PC.

-Warning: During this step, do not use the PC and do not open any programs. Risk of freezing the computer

- At the end of the scan, it is possible that ComboFix will need to restart the PC to finalize the disinfection/search, let it do so.

- A report will then open in Notepad; this report file Combofix.txt is automatically saved and stored at C:\Combofix.txt)

-> Reactivate the real-time protection of your Antivirus and Anti-spyware before reconnecting to the internet.

-> Return to the forum, and copy and paste the entire content of C:\Combofix.txt into your next message.

/!\ Do not touch anything until the scan is complete. /!\: risk of freezing the computer (complete crash)


::If ComboFix detects something and asks to restart, you accept

@+

--
We've all been beginners at something at one point.
But knowledge is the reward for diligence.

Hello

Yes, you need to download the recovery console; it can be useful in case of a crash of your PC.

Installation tutorial here:
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

See you later
--
We have all been beginners at something at one time.
But knowledge is the reward for diligence.

Re

Ok; check if you have a report here: C:\Combofix.txt.

Please repost an RSIT, thanks
--
We have all been beginners at something one day.
But knowledge is the reward of diligence.

Re

Let's start from the beginning.

1) Purge the restore like this:
http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924

This removes all traces of the various infections, and will allow for a possible restoration without infections.

2) Download ToolsCleaner to remove unnecessary disinfection software

---> Download ToolsCleaner to your Desktop.
https://www.commentcamarche.net/telecharger/
* Double-click on ToolsCleaner2.exe to launch it.
* Click on Scan and let the scan run.
* Click on Remove to finalize.
* You can, if you wish, use the Optional Options.
* Click on Exit to get the report.
* Post the report (TCleaner.txt) which can be found at the root of your hard drive (C:\).



3) Download [https://www.commentcamarche.net/telecharger/ 168 ccleaner Ccleaner]

. Save it to the desktop
. Double-click or right-click "run as" on the file to start the installation
. In the installation window, choose French for the language and OK
. Click on [b] next /b
. Read the license and [b] accept /b
. Click on [b] next /b
. Here, check only [b] create a shortcut on the desktop /b and then [b] automatically check for Ccleaner updates /b
. Click on [b] install /b
. Click on [b] close /b
. Double-click on the Ccleaner icon to open it
. Once opened, click on [b] options /b and then [b] advanced /b
. Uncheck [b] erase only files, from the windows temp folder older than 48 hours /b
. Click on [b] cleaner /b
. Click on [b] windows /b in the advanced column
. Check the first box [b] old data from the prefetch /b only this one, which gives you the box old data from prefetch and the advanced box that got checked automatically but only this one
. Click on [b] analyze /b; once the analysis is finished
. Click on [b] run the cleaning /b and on the confirmation request [b] OK /b you will need to repeat this once it is finished verify by clicking again on analyze to make sure there's nothing left
. Now click on [b] registry /b and then on [b] find errors /b
. Leave everything checked and click on [b] fix selected errors /b
. It will ask you to save [b] YES /b
. Give it a name so you can find it and save
. Click on fix all selected errors and on the confirmation request OK
. It deletes and closes; you verify by relaunching find errors
. Go back to options and recheck the box erase only files, from the windows temp folder older than 48 hours and on cleaner, windows under advanced you uncheck the first box old data from prefetch
. You can close Ccleaner.

Tutorial: [url]https://jesses.pagesperso-orange.fr/Docs/Logiciels/CCleaner.htm/url


Please post the ToolsCleaner report to me, thank you
--
We have all been beginners at something at one point.
But knowledge is the reward of diligence.