Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 21

Thread: Malware or Spybot Issue

  1. #11
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
    To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

    start
    CreateRestorePoint:
    CloseProcesses:
    HKLM-x32\...\Run: [] => [X]
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\pdf.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll => No File
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll => No File
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll => No File
    CHR Plugin: (Java(TM) Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
    U3 idsvc; no ImagePath
    S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
    U3 wpcsvc; no ImagePath
    2016-03-01 12:49 - 2014-09-10 20:01 - 00003804 _____ C:\WINDOWS\System32\Tasks\AutoKMS
    Task: {025E3B95-A6D2-4C85-BD24-71C170E5A887} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-09-10] ()
    C:\ProgramData\DP45977C.lfl
    C:\Users\Kym\AppData\Local\Temp\sqlite3.dll
    Task: {F27906F8-C2D3-459A-A01E-D551D7DB510D} - \{780C0A47-0B7D-7E7E-0B11-780C0D7E1109} -> No File <==== ATTENTION
    EmptyTemp:
    Hosts:
    End
    Open FRST/FRST64 and press the > Fix < button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

    ~~~~~~~~~~~~~~~

    Instructions on how to backup your Favourites/Bookmarks and other data can be found below.

    Proceed with the reset once done.

    ~~~~~~~~~~~~~~~~~~~

    Please remove any usb or external drives from the computer before you run this scan!


    Please download RogueKiller and save it to your desktop.

    You can check here if you're not sure if your computer is 32-bit or 64-bit
    • Download RogueKiller to your desktop.

    • Quit all running programs.
    • For Windows XP, double-click to start.
    • For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.[/*]
    • Read and accept the EULA (End User Licene Agreement)
    • Click Scan to scan the system.
    • When the scan completes Close the program > Don't Fix anything!
    • Don't run any other options, they're not all bad!!
    • Post back the report which should be located on your desktop.


    ~~~~~~~~~`

    What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
    Most reliable and thorough.
    The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
    This scanner can take quite a bit of time to run, depending of course how full your computer is.



    Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

    ESET Online Scan
    Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.
    • Please download ESET Online Scan and save the file to your Desktop.
    • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
    • Double-click esetsmartinstaller_enu.exe to run the programme.
    • Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
    • Agree to the Terms of Use once more and click Start. Allow components to download.
    • Place a checkmark next to Enable detection of potentially unwanted applications.
    • Click Advanced settings. Place a checkmark next to:
      • Scan archives
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth technology

    • Ensure Remove found threats is unchecked.
    • Click Start.
    • Wait for the scan to finish. Please be patient as this can take some time.
    • Upon completion, click . If no threats were found, skip the next two bullet points.
    • Click and save the file to your Desktop, naming it something such as "MyEsetScan".
    • Push the Back button.
    • Place a checkmark next to and click .
    • Re-enable your anti-virus software.
    • Copy the contents of the log and paste in your next reply.


    Please post:
    Fixlog.txt
    RogueKiller.txt
    ESET Online Scan.txt
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  2. #12
    Junior Member
    Join Date
    Feb 2016
    Posts
    11

    Default Image not loading

    In this last part you said, "Place a checkmark next to ? and click ?" the two images aren't loading or no longer exist. Would you be able to let me know another way?

  3. #13
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Place a checkmark next to Uninstall the application on close, and click Finish.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  4. #14
    Junior Member
    Join Date
    Feb 2016
    Posts
    11

    Default Fixlog, RogueKiller, ESET Online Scan

    Fix result of Farbar Recovery Scan Tool (x64) Version:27-02-2016
    Ran by Kym (2016-03-02 17:35:11) Run:3
    Running from C:\Users\Kym\Desktop
    Loaded Profiles: Kym (Available Profiles: Kym)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    start
    CreateRestorePoint:
    CloseProcesses:
    HKLM-x32\...\Run: [] => [X]
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\pdf.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll => No File
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll => No File
    CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll => No File
    CHR Plugin: (Java(TM) Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
    U3 idsvc; no ImagePath
    S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
    U3 wpcsvc; no ImagePath
    2016-03-01 12:49 - 2014-09-10 20:01 - 00003804 _____ C:\WINDOWS\System32\Tasks\AutoKMS
    Task: {025E3B95-A6D2-4C85-BD24-71C170E5A887} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe [2014-09-10] ()
    C:\ProgramData\DP45977C.lfl
    C:\Users\Kym\AppData\Local\Temp\sqlite3.dll
    Task: {F27906F8-C2D3-459A-A01E-D551D7DB510D} - \{780C0A47-0B7D-7E7E-0B11-780C0D7E1109} -> No File <==== ATTENTION
    EmptyTemp:
    Hosts:
    End
    *****************

    Restore point was successfully created.
    Processes closed successfully.
    HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value not found.
    HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully
    HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
    HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
    C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\ppGoogleNaClPluginChrome.dll => not found.
    C:\Program Files (x86)\Google\Chrome\Application\48.0.2564.116\pdf.dll => not found.
    C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll => not found.
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll => not found.
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll => not found.
    C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => not found.
    idsvc => service not found.
    wfpcapture => service not found.
    wpcsvc => service not found.
    "C:\WINDOWS\System32\Tasks\AutoKMS" => not found.
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{025E3B95-A6D2-4C85-BD24-71C170E5A887} => key not found.
    C:\WINDOWS\System32\Tasks\AutoKMS => not found.
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS => key not found.
    "C:\ProgramData\DP45977C.lfl" => not found.
    "C:\Users\Kym\AppData\Local\Temp\sqlite3.dll" => not found.
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F27906F8-C2D3-459A-A01E-D551D7DB510D} => key not found.
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{780C0A47-0B7D-7E7E-0B11-780C0D7E1109} => key not found.
    C:\Windows\System32\Drivers\etc\hosts => moved successfully
    Hosts restored successfully.
    EmptyTemp: => 240.5 MB temporary data Removed.


    The system needed a reboot.

    ==== End of Fixlog 17:35:14 ====

    RogueKiller V11.0.14.0 [Feb 29 2016] (Free) by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/software/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 10 (10.0.10240) 64 bits version
    Started in : Normal mode
    User : Kym [Administrator]
    Started from : C:\Users\Kym\Desktop\RogueKiller.exe
    Mode : Scan -- Date : 03/02/2016 18:10:45

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 1 ¤¤¤
    [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Partner -> Found

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 0 ¤¤¤

    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x0]) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD10EZRX-00A8LB0 SCSI Disk Device +++++
    --- User ---
    [MBR] c609e88a3e3a1eba81f6bd58da21a012
    [BSP] 6de4e5b287547337ca290f55453cdbb2 : Windows Vista/7/8|VT.Unknown MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953766 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive1: Samsung SSD 840 EVO 120G SCSI Disk Device +++++
    --- User ---
    [MBR] 2414a722e2d20553db2407084ca6f557
    [BSP] 5514a66c0c60dbc0c336179378e42b92 : Windows Vista/7/8|VT.Unknown MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 114371 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK

    +++++ PhysicalDrive2: Generic- Multi-Card USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    C:\AdwCleaner\Quarantine\C\ProgramData\3c355888\4543324a.dll.vir a variant of Win32/Adware.Adposhel.A application
    C:\FRST\Quarantine\C\Users\Kym\AppData\Local\Temp\ICReinstall_setup.exe.xBAD a variant of Win32/InstallCore.AFF.gen potentially unwanted application
    C:\Users\Kym\AppData\Roaming\uTorrent\updates\3.4.1_30925.exe a variant of Win32/AdkDLLWrapper.A potentially unwanted application
    C:\WINDOWS\AutoKMS\AutoKMS.exe a variant of MSIL/HackKMS.H potentially unsafe application

  5. #15
    Junior Member
    Join Date
    Feb 2016
    Posts
    11

    Default Fixed?

    Hi Juliet,

    I just tried to open twitch.tv which was being massively spammed by ads before, and its working perfectly now. Im not sure if everything is fixed? Or if its only temporary.

    I wont download any addons for chrome yet, il wait for your advice.

    Thanks.

  6. #16
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    This last fix should fix any left overs, glad to hear things are good.


    Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
    To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

    start
    CreateRestorePoint:
    CloseProcesses:
    C:\Users\Kym\AppData\Roaming\uTorrent\updates\3.4.1_30925.exe
    C:\WINDOWS\AutoKMS\AutoKMS.exe
    EmptyTemp:
    End
    Open FRST/FRST64 and press the > Fix < button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  7. #17
    Junior Member
    Join Date
    Feb 2016
    Posts
    11

    Default Thank You So Much!!!!!!!!!!!!!!!!!!!!!

    Fix result of Farbar Recovery Scan Tool (x64) Version:02-03-2016
    Ran by Kym (2016-03-03 14:21:44) Run:4
    Running from C:\Users\Kym\Desktop
    Loaded Profiles: Kym (Available Profiles: Kym)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    start
    CreateRestorePoint:
    CloseProcesses:
    C:\Users\Kym\AppData\Roaming\uTorrent\updates\3.4.1_30925.exe
    C:\WINDOWS\AutoKMS\AutoKMS.exe
    EmptyTemp:
    End
    *****************

    Restore point was successfully created.
    Processes closed successfully.
    C:\Users\Kym\AppData\Roaming\uTorrent\updates\3.4.1_30925.exe => moved successfully
    C:\WINDOWS\AutoKMS\AutoKMS.exe => moved successfully
    EmptyTemp: => 360 MB temporary data Removed.


    The system needed a reboot.

    ==== End of Fixlog 14:21:51 ====

  8. #18
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    DelFix
    • Please download DelFix or from Here and save the file to your Desktop.
    • Double-click DelFix.exe to run the programme.
    • Place a checkmark next to the following items:
    • Remove disinfection tools
    • Click the Run button.
    • -- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).


    ~~~~~~~~~~~~~~~~~~~~`


    The following programmes come highly recommended in the security community.
    • AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
    • CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
    • Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
    • Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
    • NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
    • Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
    • Secuina PSI will scan your computer for vulnerable softwarethat is outdated, and automatically find the latest update for you.
    • SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
    • Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.




    Want to help others? Join the ClassRoom and learn how.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  9. #19
    Junior Member
    Join Date
    Feb 2016
    Posts
    11

    Default Juliet

    Once again, thank you so much! I really do appreciate the time and effort you put into helping a complete stranger.

  10. #20
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    We're glad to help, safe surfing
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •