is this a virus? unwanted ad program?

olias

I've disabled and removed that add on and it appears to have been the culprit, thanks. I'll update if any further problems, otherwise thankyou again.

I've deleted those last two posts, as I'm not sure if there is anything on them that I don't really want remaining on a public forum - not least they give away my real name...

Olias

waddler_8

No problem.

Uninstall Yontoo.

There are what look like leftovers from a previous infection if you want me to remove them?

[2011/11/05 11:51:01 | 000,000,312 | ---- | C] () -- C:\ProgramData\~1kAlMiG2Kb7FzP
[2011/11/05 11:51:01 | 000,000,216 | ---- | C] () -- C:\ProgramData\~1kAlMiG2Kb7FzPr
[2011/11/05 11:50:38 | 000,000,464 | ---- | C] () -- C:\ProgramData\1kAlMiG2Kb7FzP
[2011/11/05 09:43:49 | 000,000,304 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011/11/05 09:43:49 | 000,000,208 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011/11/05 09:43:45 | 000,000,448 | ---- | C] () -- C:\ProgramData\6DSS92c31Apgjk
[2011/06/06 09:51:38 | 000,010,014 | -HS- | C] () -- C:\Users\jason\AppData\Local\fng62ln35c0eawwgu17g61o070
[2011/06/06 09:51:38 | 000,010,014 | -HS- | C] () -- C:\ProgramData\fng62ln35c0eawwgu17g61o070


[2011/05/02 00:01:22 | 000,010,300 | -HS- | C] () -- C:\Users\jason\AppData\Local\jd0304a8d3q3q1q3u
[2011/05/02 00:01:22 | 000,010,300 | -HS- | C] () -- C:\ProgramData\jd0304a8d3q3q1q3u
[2011/03/30 13:52:15 | 000,012,682 | -HS- | C] () -- C:\Users\jason\AppData\Local\r0t835ni0n1t18aj4n071sa4s7m
[2011/03/30 13:52:15 | 000,012,682 | -HS- | C] () -- C:\ProgramData\r0t835ni0n1t18aj4n071sa4s7m

waddler_8

olias wrote: »

I've deleted those last two posts, as I'm not sure if there is anything on them that I don't really want remaining on a public forum - not least they give away my real name...

There's no Personally Identifiable Information (PII) in them.

olias

waddler_8 wrote: »

No problem.

Uninstall Yontoo.

There are what look like leftovers from a previous infection if you want me to remove them?

[2011/11/05 11:51:01 | 000,000,312 | ---- | C] () -- C:\ProgramData\~1kAlMiG2Kb7FzP
[2011/11/05 11:51:01 | 000,000,216 | ---- | C] () -- C:\ProgramData\~1kAlMiG2Kb7FzPr
[2011/11/05 11:50:38 | 000,000,464 | ---- | C] () -- C:\ProgramData\1kAlMiG2Kb7FzP
[2011/11/05 09:43:49 | 000,000,304 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011/11/05 09:43:49 | 000,000,208 | ---- | C] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011/11/05 09:43:45 | 000,000,448 | ---- | C] () -- C:\ProgramData\6DSS92c31Apgjk
[2011/06/06 09:51:38 | 000,010,014 | -HS- | C] () -- C:\Users\jason\AppData\Local\fng62ln35c0eawwgu17g61o070
[2011/06/06 09:51:38 | 000,010,014 | -HS- | C] () -- C:\ProgramData\fng62ln35c0eawwgu17g61o070


[2011/05/02 00:01:22 | 000,010,300 | -HS- | C] () -- C:\Users\jason\AppData\Local\jd0304a8d3q3q1q3u
[2011/05/02 00:01:22 | 000,010,300 | -HS- | C] () -- C:\ProgramData\jd0304a8d3q3q1q3u
[2011/03/30 13:52:15 | 000,012,682 | -HS- | C] () -- C:\Users\jason\AppData\Local\r0t835ni0n1t18aj4n071sa4s7m
[2011/03/30 13:52:15 | 000,012,682 | -HS- | C] () -- C:\ProgramData\r0t835ni0n1t18aj4n071sa4s7m

Silly question, but whats the easiest way to do that? Thanks.

Olias

waddler_8

• Double-click OTL.exe to start the program.
• Allow the UAC prompt
• Copy and Paste all the following code into the textbox. Do not include the word Code

  :processes
  killallprocesses
  
  :services
  ydqebyaw
  xdqxtwfy
  xcwsxkpq
  wpydogil
  vgddeofi
  ugxsasqg
  ufbnysnl
  tavncwvk
  srstrevp
  shnenvga
  scdrgpzy
  sahydxve
  rwqpkbda
  rhpmbklv
  rglddgbd
  rcwkyqqo
  qhueulxv
  qglmbpzs
  pzhehkgb
  puygarfm
  pnbmqqvo
  plwnhtri
  pcdytpei
  ozodmgri
  ozizxogg
  okkkmfbz
  oildpfpr
  ogulofuo
  oednmsty
  obuwkfil
  noopwlvv
  nnwjuqcw
  ncqcpsdr
  msarkocj
  mlllnnuh
  miitnebv
  mbuwuxrb
  loumstvt
  lgprkkye
  lbomdwcd
  kihnbgnd
  jslatlct
  jrwbqrbi
  jhdeqayu
  jethpequ
  iwfqruce
  iukblidm
  itfqwwjy
  iigclfli
  hnkdrhnd
  gzqmntje
  gauwyaad
  fyouwqke
  fuzumfki
  fspkxphc
  fpzkempk
  fpswounf
  foadhrib
  fmzfodii
  fmgrzeaw
  fkpdmfoo
  eysyaqme
  exuijwun
  elbgefuk
  dpqcmkij
  dhiyqsce
  dhdutcqv
  cxlmeoan
  csnmqsyi
  ccbowpos
  ccapaoob
  bsckbqqq
  bkqlnkvt
  bjnnjugb
  alcjwdny
  aavsxowg
  
  :Files
  C:\ProgramData\~1kAlMiG2Kb7FzP
  C:\ProgramData\~1kAlMiG2Kb7FzPr
  C:\ProgramData\1kAlMiG2Kb7FzP
  C:\ProgramData\~6DSS92c31Apgjk
  C:\ProgramData\~6DSS92c31Apgjkr
  C:\ProgramData\6DSS92c31Apgjk
  C:\Users\jason\AppData\Local\fng62ln35c0eawwgu17g61o070
  C:\ProgramData\fng62ln35c0eawwgu17g61o070
  C:\Users\jason\AppData\Local\jd0304a8d3q3q1q3u
  C:\ProgramData\jd0304a8d3q3q1q3u
  C:\Users\jason\AppData\Local\r0t835ni0n1t18aj4n071sa4s7m
  C:\ProgramData\r0t835ni0n1t18aj4n071sa4s7m
  
  :commands
  [CREATERESTOREPOINT]
  [REBOOT]
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Click OK & allow it to do so if asked.
• The report should appear in Notepad after the reboot.
• Copy and Paste that report in your next reply.