Immunizing portable HDD

gabe22,

Have you considered using UsbFix 2015 v7.946
Download > Download UsbFix - MajorGeeks
Save to the Desktop.

Next, please, temporarily disable your antivirus software so it does not interfere with the running of USBFix.

Now, right-click the downloaded USBFix file and select: Run as Administrator
At the main console of USBFix, press: Research

As requested, connect your external data sources to your PC (USB keys, external drives, etc…), turn any on if powered, but, do not open any of the connected devices.
Once ready, click: OK

When the scan is over, a report opens on the Desktop. It is also found at C:\UsbFix\Log\UsbFix...

Please post the USBFix [Research] report in your reply.

gabe22 said:

Also just asking whats the reason for adding geoPlugin to geolocate your visitors and geoplugin.net in host file? are they bad urls(as in maybe urls with infected files .. thats connected to some software running on my system maybe)

According to Trend Micro that worm communicates with those domains.

   Note

Other Details
This worm accesses the following URL(s) to get the affected system's location:

• http://www.geoplugin.net/json.gp

Re: USBFix - that's the one that screwed up my registry yesterday. It auto deleted entries as soon as it was launched. Managed to fix it. If you ask me - I'd say backup reg first and use the "research option"

If it's ben scanning that long an no threats shown as detected you can probably skip it.

Re: USBFIX

You just have to be careful when you run it to choose the "Research" button rather than let it auto clean anything.

I know that it's slow but it is a thorough scan. When it's finished you can actually ignore the browser window that opens and look at the results in the program window and decide what you need to remove. Was at work earlier. Will keep an eye on this thread later this evening. As for any suggestions by Cottonball or Jacee - they're pretty much the malware removal experts here and know far more about it than I do. (Plus decent fixes for problems that may remain after malware removal)

I would like to see a UVK scan report if possible as it may contain some useful info.

If you want to run the suggested USBFix then don't make the same mistake that I did. Just plug in your drives and choose the "research" button. Then you get a log of what was found and it doesn't remove anything that way. You can upload the log of "Found" items.

What it removed on my when I launched it - custom registry entries that I suppose it detected as non-standard! Had to replace them.

Code:

[HKEY_USERS\S-1-5-21-165181766-1597162493-719806621-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"DisallowRun"=dword:00000001

[HKEY_USERS\S-1-5-21-165181766-1597162493-719806621-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun]
"1"="SecurityScan_Release.exe"
"2"="apn stub.exe"
"3"="AdobeUpdater.exe"
"4"="CLUpdater.exe"
"5"="AdobeUpdater.dll"
"6"="AdobeUpdaterApp.dll"
"7"="mconduitinstaller.exe"
"8"="ieLogic.exe"
"9"="ExPromo.exe"
"10"="PhyDMACC.dll"
"11"="rkinstall.exe"
"12"="ocsetuphlp.dll"

and

Code:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apn stub.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Ask Toolbar1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\askbarsetup.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Ask Toolbar2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\babylon.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Babylon 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\babylonagent.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Babylon 2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\babylonTC.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Babylon 3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\babylontoolbarsrv.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Babylon Serv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmng.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Cltmng"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Conduit_AppsToolbarHelper.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Conduit"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieLogic.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:OpenCandy2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mconduitinstaller.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Conduit"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe]
"Debugger"="\"C:\\Program Files\\EmEditor\\EmEditor.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OCSetupHlp.dll]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:OpenCandy 3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Offercast2802_DEMOTB_.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Ask Toolbar Installer"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Toolbar1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search_SpinToolbarHelper.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Toolbar2"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Search_SpinToolbarHelper1.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Toolbar3"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityScan_Release.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:McAfee Scan"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinloadToolbarHelper1.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:Toolbar4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmsoemon.exe]
"Debugger"="\"C:\\Program Files (x86)\\Smart-X\\AppLocker\\AppLocker.exe\" /locked:MyWebSearch"

Re: Your question on cooling fans. Don't know much about it. For my old laptop I had a cooling stand for ventilation underneath. For my current laptop - it started running hot with no sign of data intensive tasks running. I took it apart and cleaned inside and around the vent and the fan. That helped for a while. Eventually I just replaced the fan and it's fine. When I did used to run data intensive apps I used a process manager that can throttle user defined processes and include or exclude any process to keep things a little cooler.