This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Redirecting to wrong sites, Slow browsing, and ads in bottom left and

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi Aaron T ;)

AdwCleaner

  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

=============================== Next =======================================


Please run the following:

Please download Malwarebytes Anti-Rootkit and save it to your desktop.
  • Be sure to print out and follow the instructions provided on that same page for performing a scan.
  • Caution: This is a beta version so also read the disclaimer and back up all your data before using.
  • When the scan completes, click on the Cleanup button to remove any threats found and reboot the computer if prompted to do so.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • If there are problems with Internet access, Windows Update, Windows Firewall or other system issues, run the fixdamage tool located in the folder Malwarebytes Anti-Rootkit was run from and reboot your computer.
  • Two files (mbar-log-YYYY-MM-DD, system-log.txt) will be created and saved within that same folder.
  • Copy and paste the contents of these two log files in your next reply.
Note: Further documentation can be found in the ReadMe.rtf file which is located in the Malwarebytes Anti-Rootkit folder.


On your next reply please post :
  • AdwCleaner log
  • MBAR report

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
okay… here is the ADWcleaner log: # AdwCleaner v2.009 - Logfile created 11/25/2012 at 10:15:19 # Updated 24/11/2012 by Xplode # Operating system : Windows 7 Professional Service Pack 1 (64 bits) # User : Aaron M. Tabuchi - LOGOSOSMOSIS # Boot Mode : Normal # Running from : C:\Users\Aaron M. Tabuchi\Desktop\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml File Deleted : C:\Users\Public\Desktop\eBay.lnk Folder Deleted : C:\Program Files (x86)\AVG Secure Search Folder Deleted : C:\Program Files (x86)\Yontoo Folder Deleted : C:\ProgramData\AVG Secure Search Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\Users\Aaron M. Tabuchi\AppData\Local\AVG Secure Search Folder Deleted : C:\Users\Aaron M. Tabuchi\AppData\LocalLow\AVG Secure Search Folder Deleted : C:\Users\Aaron M. Tabuchi\AppData\LocalLow\Conduit ***** [Registry] ***** Key Deleted : HKCU\Software\AVG Secure Search Key Deleted : HKCU\Software\Conduit Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B} Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] ***** [Internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v16.0.2 (en-US) Profile name : default File : C:\Users\Aaron M. Tabuchi\AppData\Roaming\Mozilla\Firefox\Profiles\guk1gr71.default\prefs.js [OK] File is clean. ************************* AdwCleaner[S1].txt - [3681 octets] - [25/11/2012 10:15:19] ########## EOF - C:\AdwCleaner[S1].txt - [3741 octets] ##########
please help… I downloaded the MalwareBytes anti-root kit and tried to restart my computer. It was unable to restart and has not been able to boot up since. Obviously, i can't get to the log to post it. I do recall that the Malware Bytes anti-root kit found several "forged registry sectors:" or something like that. When i restart, or boot up the computer, the windows logo appears and then a bluescreen with text flashes very quickly and the computer shuts down. i tried to repair bootup and that did not work. i tried to restore to a restore point and that did not work. If you could please help me. I appreciate your help this far. - Aaron T.
Hi Aaron T ;)

Try the following :)

How to start your computer by using the Last Known Good Configuration feature

  • Start your computer.
  • When you see the "Please select the operating system to start" message, press the F8 key.
  • When the Windows Advanced Options menu appears, use the ARROW keys to select Last Known Good Configuration (your most recent settings that worked), and then press ENTER.
  • If you are running other operating systems on your computer, use the ARROW keys to select Microsoft Windows 7, and then press ENTER.

If should, last Known Good Configuration not work;

Please do the following:

Download the appropriate version for your system of the Farbar Recovery Scan Tool and save it to a flash drive.


Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
On the System Recovery Options menu you will get the following options:Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.

[*]When the tool opens click Yes to the disclaimer.

[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there

[*]Press Scan button.

[*]type exit and reboot the computer normally

[*]FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.

Since i backed up all of my files, and since this is a fairly new computer, I went ahead and did the Vaio recovery which reformatted everything and was supposed to put the machine back into it's factory condition. it took about an hour and a half. i am guessing this is the closest i can come to a clean reinstall since there was no Windows disc provided with my computer. It looks like it wiped out everything including all software installed after i purchased the system. i even had to re-register and all that. Having said that, how do you think i should proceed? After this reformatting and reinstall of windows, is it possible that the system could still be affected? What would you recommend doing from here? Thank you.
Hi Aaron T ;)

Since i backed up all of my files, and since this is a fairly new computer, I went ahead and did the Vaio recovery which reformatted everything and was supposed to put the machine back into it's factory condition. it took about an hour and a half. i am guessing this is the closest i can come to a clean reinstall since there was no Windows disc provided with my computer.

Very good!!

It looks like it wiped out everything including all software installed after i purchased the system. i even had to re-register and all that.

Of course! This is normal

Having said that, how do you think i should proceed? After this reformatting and reinstall of windows, is it possible that the system could still be affected? What would you recommend doing from here?

It isn't likely that anything survived the reformat, MBAR likely cleaned what was on the machine. The type of malware that was on your machine infects the MBR and likely left a custom BCD code which was why the machine was unbootable, this code would have shown up in FRST.
So you should be ok now that you have reformatted.
The best think to do is practice safe surfing habits, stay away from torrents and peer to peer, cracks, keygens and be careful of what links you click on and what programs you download and you should be fine.

Below I will give you some advice that will help you avoid future to infect your machine

Follow this step

MOST IMPORTANT: You Need to Update Windows and IE to get all the Latest Security Patches to protect your computer from the malware that is around on the internet.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free


5.SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?
Thank you very much for your help!!! I will be going through all of your recommendations and materials in detail. It looks like the TonyKlein link is broken. fyi While this may be covered in the materials, after all this i am willing to look into a paid anti-malware anti virus if necessary ( in addition to the 3rd party firewall that you recommended). is there a paid or free anti-malware ( similar to AVG ) that you would recommend? I have considered eset but i was wondering what your suggestion might be. Thanks again for all of you help. It is very impressive that this is a free service. - Aaron Tabuchi
Hi Aaron T ;)

Thank you very much for your help!!!

I will be going through all of your recommendations and materials in detail.


It looks like the TonyKlein link is broken. fyi

This is very strange, the link works perfectly.
Try this; http://www.geekstogo.com/how-did-i-get-inf…he-first-place/

While this may be covered in the materials, after all this i am willing to look into a paid anti-malware anti virus if necessary ( in addition to the 3rd party firewall that you recommended). is there a paid or free anti-malware ( similar to AVG ) that you would recommend? I have considered eset but i was wondering what your suggestion might be.

I always recommend Microsoft Security essentials

I think it's the best of the free products around

http://www.microsoft.com/security_essentials/

Thanks again for all of you help. It is very impressive that this is a free service.

Thank you for your appreciation :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI