[Resolved] Broni I need you...long time no see ;-)

[Broni]

I'm not sure what you're doing.
You're supposed to run Uninstall Cleaner to remove dead OpenCandy listing.

[dam1120]

I told you what I was doing step by step. I got to this box what should I do all it offers is delete and so on am I in the wrong place? I also told you this was a kind of work around to get here since I was getting the error messages and it wouldn't let me go past due to the messages. Here it is again.

I right clicked open and got the error message unsafe exe http://prntscr.com/28lg59
but I still clicked yes to open it and these error messgaes came back up?

http://prntscr.com/28ea2g - I clicked on reinstall using recommended settings got this http://prntscr.com/28eaa1

This makes no sense as you can see the .dll file is in the unzip folder yet the error message says missing? http://prntscr.com/28ll4q

then I got to here http://prntscr.com/28ovb1 I am stuck now as to what to do? I scrolled down the list no open candy to remove? Could it be gone?

[Broni]

Possibly.

Since this is a very long topic update me on current issues if any.

[dam1120]

ok seems they were removed from IE tool bar and add remove programs all that we wanted gone. I do see some programs I am not familiar with such as XM Asia Pacific Pte Ltd and Wild Tangent.

This http://prntscr.com/28qwyp http://prntscr.com/28qx4h

Also the problem with Windows live mail. I removed my name and person I sent to last month http://prntscr.com/28qyq6 the message in all my mails are gone even the sent mails. The address to and from are there but the message poof?"


I found something it wont leave add ons in IE. http://prntscr.com/28rxby

[Broni]

I simply have no time to go through a list of your installed programs.
Nothing malicious there so if you want to pursue that matter you can create new topic in Windows forum.

Same goes for Windows mail.
It's not malware related.

As for IE if you don't have any visible toolbar or other issue leave those alone.

[dam1120]

ok ty but could one of the programs you had me download and install of caused the live mail to have a problem? also do I uninstall the programs you had me install and use?
Thank you for your time and help.

[Broni]

I doubt any of my programs caused any Windows mail issues.

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/

14. Please, let me know, how your computer is doing.

[dam1120]

All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Test
->Temp folder emptied: 22060481 bytes
->Temporary Internet Files folder emptied: 57726723 bytes
->Java cache emptied: 19897593 bytes
->FireFox cache emptied: 305996553 bytes
->Google Chrome cache emptied: 242966637 bytes
->Flash cache emptied: 4240 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12058 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
RecycleBin emptied: 9043476 bytes

Total Files Cleaned = 627.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Test
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Public

User: Test
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.69.0 log created on 12042013_230016

Files\Folders moved on Reboot...
File\Folder C:\Users\Test\AppData\Local\Temp\CVHLauncher(201312041313001C98).log not found!
C:\Users\Test\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Test\AppData\Local\Temp\~DF1ECAA1A6E8400DEB.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DF5D0788F4AFF393F3.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DF603CD0011883E692.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DF641BDA1F467923B9.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DF7280D39B699951FB.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DFA94901D5B539C61F.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DFC41B0168F1C0B12A.TMP not found!
File\Folder C:\Users\Test\AppData\Local\Temp\~DFE2AEA18BFA96C54F.TMP not found!
C:\Users\Test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\N366MR0B\36OULDR7.htm moved successfully.
C:\Users\Test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\4A72F430-B40C-4D36-A068-CE33ADA5ADF9.dat moved successfully.
C:\Users\Test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
File move failed. C:\Users\Test\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

[dam1120]

Okay did all these . Now did you find any trojans, rootkits or bootkits in my system so I know to change passwords and such? Again thank you for the time you took to help me out.

[Broni]

No. Your passwords are safe.

[dam1120]

Thank you and good night I can rest easy now that you saved my baby

[Broni]

Way to go!!
Good luck and stay safe