Cannot delete Registry entry

[parhamjl]

After trying to recover from severe malware infection, I ran Spybot S&D. It removed several Registry entries but one it could not. I tried manually but it could not be removed. It is located at Hkey-users\S-1-5-21-200258984-2800820833-1255355968\Software\DataMngr. It has subdirectories "Files", "List" and 'Toolbar". Toolbar is the only one that is not null. It shows the Flag is REG-DWORD 0x00000000 (0). Spybot calls it a Delta.Toolbar entry. How do I remove this entry, or is it safe to leave it as is?

 

[VistaKing]

AdwCleaner

Click here AdwCleaner

:ar: Click on Download Now button

:ar: Save to the Desktop

:ar: Right-click on AdwCleaner.exe and choose

:ar: Click on Delete and confirm the prompt.

:ar: Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt


To Remove AdwCleaner program from your PC

:ar: Right click on adwcleaner.exe choose Run as administrator to run the tool.

:ar: Click on Uninstall, then confirm with yes to remove this utility from your computer.

 

[parhamjl]

I have included the AdwCleaner file. My system is Windows Ultimate 64 bit, and AdwCleaner cautions that it might not run correctly, but it seem to do OK.

 

[VistaKing]

Remove Delta Toolbar (Removal Guide)

Take a look at the link above to remove the delta toolbar off your browsers

 

[parhamjl]

Delta Toolbar

Thanks! I don't see any signs of Delta Toolbar on my computer as I went through the Delta Toolbar removal guide.

 

[VistaKing]

Did you check the browsers extensions and add-ons ?

 

[parhamjl]

Delta Toolbar browser extensions and add-ons

I did check those. No trace of the malware.

 

[VistaKing]

Click here DDS

:ar: Click on Download Now button

:ar: When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

:ar: Double click the DDS icon on the Desktop then click the Run button to run the tool.

:ar: Place a check next to attact.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

:ar: Save two logs onto your desktop and upload them with your reply

 

[VistaKing]

Run the app below

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

 

[VistaKing]

Also

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

How To Upload a File:
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[parhamjl]

Here are the DDS logs.

 

[VistaKing]

Can you run the tool that is on post #10

 

[parhamjl]

I had ran a Malwarebytes scan earlier in my recovery from malware. It initially found several problems. For good measure, I updated Malwarebytes and ran a full scan again. It found no problems.

 

[parhamjl]

Farbar

I only ran the scan. I did not do the 'Fix'. Was I supposed to?

 

[VistaKing]

Open notepad. Inside notepad paste the highlighted items below


start
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
HKCU\...\Run: [Akamai NetSession Interface] - "C:\Users\Lynn\AppData\Local\Akamai\netsession_win.exe" [x]
HKLM-x32\...\Run: [Search Protection] - C:\ProgramData\Search Protection\SearchProtection.exe [x]
HKLM-x32\...\Run: [Ad-Aware Antivirus] - "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run [x]
HKU\Guest\...\Run: [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [x]
HKU\Guest\...\Run: [Advanced SystemCare 4] - "C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCTray.exe" [x]
HKU\Guest\...\Run: [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [x]
HKU\Guest\...\Run: [Advanced SystemCare 4] - "C:\Program Files (x86)\IObit\Advanced SystemCare 4\ASCTray.exe" [x]
HKU\Guest\...\Run: [Rohos] - C:\Program Files (x86)\Rohos\agent.exe [x]
HKU\Guest\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [x]
HKU\HomeGroupUser$\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB [x]
AppInit_DLLs: C:\PROGRA~2\KEYCRY~1\KEYCRY~4.DLL [85304 2013-03-07] (Zemana Ltd.)
AppInit_DLLs-x32: c:\progra~2\keycry~1\keycry~3.dll [78136 2013-03-07] (Zemana Ltd.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Constant Guard.lnk
ShortcutTarget: Constant Guard.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)
URLSearchHook: (No Name) - {90eee664-34b1-422a-a782-779af65cdf6d} - No File
URLSearchHook: (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File
HKCU SearchScopes: DefaultScope {C3512387-1998-4F6E-82DE-C56CE250D840} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN39910817921345487&UM=2
SearchScopes: HKCU - {664AFAC7-3060-4BE2-99CF-E087B70885FD} URL = http://search.conduit.com/Results.aspx?ctid=CT3300019&SearchSource=45&UM=2&q={searchTerms}
SearchScopes: HKCU - {C131D0FB-A80A-4E7B-9B86-68180C285C78} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=01E815E4-0A5B-4FD8-8014-E458FFFC4725&apn_sauid=A7BFF1FA-EF47-4100-9CDD-60E652CB7B2E
SearchScopes: HKCU - {C3512387-1998-4F6E-82DE-C56CE250D840} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN39910817921345487&UM=2
BHO-x32: Virtual Account Numbers Helper - {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files (x86)\Virtual Account Numbers\CitiVANHelper.dll (Orbiscom Ltd. All rights reserved.)
BHO-x32: Constant Guard Protection Suite - {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.506.2\NativeBHO.dll (WhiteSky)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.3.1.22\coIEPlg.dll (Symantec Corporation
Toolbar: HKLM-x32 - Virtual Account Numbers - {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files (x86)\Virtual Account Numbers\CitiVANToolbar.dll (Orbiscom Ltd. All rights reserved.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
URLSearchHook: (No Name) - {90eee664-34b1-422a-a782-779af65cdf6d} - No File
URLSearchHook: (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
S2 RapportMgmtService; "C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe" [x]
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [x]
C:\Users\Lynn Standard Accoun\AppData\Roaming\ID Vault
C:\ID Vault
C:\Users\Lynn\AppData\Roaming\ID Vault
C:\ProgramData\Syscon
C:\Users\Lynn\GoToAssistDownloadHelper.exe
C:\Users\Lynn\sxstrace.exe
end


Click on File choose Save As
Choose the Desktop on the left hand side.
In the File Name: input fixlist.txt
In the Save as type: choose All Types on the drop down menu
Click on the [Save] button

Open FRST64.exe and click on the [FIX] button . Once its complete it will create a new log called Fixlog.txt . Upload the Fixlog.txt with your reply .

 

[parhamjl]

Here is the Fixlog.txt

 

[VistaKing]

Once you're done with that. Run the tool below

RogueKiller for 32bit <==== Download Link
RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

Log should be on the Desktop or the C:\ Drive

 

[parhamjl]

Here is the RKreport. It also put a RK_Quarantine subdirectory on my desktop.

 

[VistaKing]

Rerun RogueKiller click on Delete button then click on Fix Proxy and Fix Host button

 

[parhamjl]

I somehow managed to generate two RKreport files, apparently while trying to click on the greyed out 'Fix Proxy'. Both are included here.