VIRUS WHICH STOPS UPDATES [Solved]

Hi again scan run and log attached. Having a wee issue with windows defender. Each time I switch on my PC it's off. When I go in to switch it on sometimes it lets me and sometimes it doesn't and tells me to reboot. Should I switch on the Comodo defender again and just leave the Windows one off? As always many thanks Amanda

Hello, Amanda.

It appears that you may have forgotten to attach your OTL log. Please try sending it again.

Windows Defender

Windows Defender will not turn/stay on if there is a 3rd party antivirus (Comodo) turned on, the reason being that Comodo has its own defender. Confirm if Comodo Defense+ is turned on. If so, and you prefer to use Comodo D+, there is no need to worry about Windows Defender. If Comodo D+ is disabled, go ahead and activate it.

Let me know if you are having further issues with your spyware program.

Hi sorry…not sure what happened to the log but have attached again. Have also switched back on Comodo defender thanks Amanda

Hello, Amanda.

Thank you for the OTL log. This log is clean.

Malware can sometimes resurface during the cleaning process. To ensure that it has not, please run DDS again and send me a fresh log.

Hi run the scan and attached the 2 logs from DDS (hopefully) LOL. Thing seem to running quite well just now. thanks again Amanda

Hello, Amanda.

Thank you for the DDS log. There are just a few items left to clear. Please do the following:

1. Remove Toolbars/Application from Programs

There are a couple of toolbars installed on your system that should be removed: HopSurf Toolbar, and Skype Toolbar. These toolbars are valid and most likely were installed along with your software programs. Multiple toolbars, however, can affect your internet browsing speed, clutter your browser window, cause browser hangs, and use up system resources and bandwidth.

We also need to remove QuickShare. QuickShare is a coupon pop-up advertisement application.

Please remove these items via your Control Panel > Programs and Features > Uninstall a program.

2. Uninstall Toolbars/Applications from Browsers

If the following appear in any of your browsers (HopSurf Toolbar, Skype Toolbar and QuickShare), do the following:

For Internet Explorer:

• Open Internet Explorer.
• Click Tools > Manage Add-ons.
• In the Manage Add-ons window, under Add-on Types (found on left side) highlight Toolbars and Extensions.
• Under the Show: drop-down menu (found on left side) make sure All add-ons is selected.
• Highlight the extension (HopSurf, Skype, QuickShare) you wish to remove, and select Disable.
• The Disable add-on window may pop up to warn you that related services and add-ons will also be disabled. Click Disable.
• Click Close to exit the Manage Add-ons window.

For Firefox:

• Open Firefox.
• Click Tools > Add-ons.
• In the Add-ons window, under Add-on Types select Extensions.
• Click to highlight the extension (HopSurf, Skype, QuickShare) you wish to remove and select Disable. If you want to delete an extension entirely, click Remove.
• The Disable add-on window may pop up to warn you that related services and add-ons will also be disabled. Click Disable.
• Exit the Add-ons Manager window, and restart Firefox to complete the process.

For Google Chrome

• Open Google Chrome.
• Click the wrench icon at the top right of the browser window.
• Click Tools > Select Extensions to open the Options tab.
• Uncheck Enabled to disable the extension (HopSurf, Skype, QuickShare), or click Remove to delete it completely.

3. Reset Your Home Page and Default Search Engine

Removing the toolbars may have changed your browser settings (homepage, default search engines). If so, please follow the instructions found HERE.

Please let me know if you have successfully deleted these applications, and then we can go ahead with our final housekeeping tasks.

Hi having some problems with the latest lot of instructions. Can't find anything in programs called Skype toolbar. There is Skype web features and Skype 5.10 but no toolbar. Not sure if any of these relate to the toolbar. Can't remove Quickshare. Have tried numerous times. It goes through the process to uninstall but it does not remove the program.Not even after a reboot. None of the extensions were on Chrome (which is my main internet) Managed to disable Hopsurf, Quickshare and Skype add on for internet explorer Managed to disable Hopsurf on firefox Can you suggest anything else to help remove Quickshare from programs? thanks Amanda

Hello, Amanda.

Skype toolbar is disabled through your browser extensions which you have already done. QuickShare can be very persistent and difficult to remove. Let's try the following uninstaller program which will also remove any registry entries associated with QuickShare.

Revo Uninstaller

Please download Revo Uninstaller Freeware Portable from HERE. (found at the bottom of the page)

• Double click the installation file on the desktop to run the installer.
• Let it install to the default location.
• Double click the new Revo Uninstaller Icon on the desktop to start the program. You will now see a list of installed programs that Revo Uninstaller can remove.
• Locate the program you are uninstalling: QuickShare
• Right click the Icon, then choose Uninstall.
• Click Yes to the warning and choose the Uninstall Mode.
• Choose the Advanced option, and then click Next.
• This will launch the program's built in uninstaller – follow any prompts. Be patient as it can take several minutes.
• Once the uninstaller is done, click Next.
• Revo Uninstaller will now scan for leftover information. Be patient as it can take several minutes.
• Once this scan is done, click Next.
• You will then be presented of the leftover entries found by Revo Uninstaller.
• Look at ALL of the entries to ensure they relate to the uninstall. These should appear in bold print.
• Click Select All if every entry is related to the uninstall, or check only the entries that are related > Click Delete to remove the entries.
• Click Next.
• If there are any program file folders left over, you will be presented with a list to be removed.
• Again, look at ALL of the entries to ensure they are related to the uninstall.
• Click Select All if every entry is related to the uninstall, or check only the entries that are related. > Click Delete to remove the entries.
• Click Finish to go back to the uninstall list.
• Close the program.

Hi there followed your instructions and Quickshare is now gone - Have been on the internet and no longer have the pop up adverts for all types of dodgy things. Thank you. Quite enjoying getting this all cleaned up. What's next? Many thanks Amanda

Hello, Amanda.

Good job removing QuickShare. Your issues now appear to be resolved and your system is clean. Let's move into our final phase with some important housekeeping tasks. I have also included some recommendations to help keep your computer healthy and safe.

1. CLEANUP

Please work through the following steps to ensure that unnecessary programs and files have been removed and your system is up-to-date.

CleanUp with OTL

• Double-click OTL.exe to run it. (Vista users, please right click on OTL.exe and select "Run as an Administrator.")
• Close all other programs apart from OTL as this step will require a reboot.
• On the OTL main screen, click on the CleanUp! button.
• Click Yes to begin the Cleanup process, and then allow the program to reboot your computer.
• After the reboot, delete any tools we used from your desktop.

Uninstall AdwCleaner

• Double click on AdwCleaner.exe to run the tool again.
• Click on the Uninstall button.
• Click Yes when asked are you sure you want to uninstall. AdwCleaner.exe, its folder and all logs will be removed.

Tool Removal

You no longer need the following tools. Please delete these and any logs from your machine: DDS, aswMBR, Security Check, JRT, and ESET. You can keep Malwarebytes and Revo Uninstaller for future use if you choose.

Temp File Cleaner (TFC)

Please download TFC to your desktop.

• Close any open windows.
• Double click theTFC icon to run the program.
• TFC will close all open programs itself in order to run.
• Click the Start button to begin the process.
• AllowTFC to run uninterrupted.
• The program should not take long to finish.
• Once complete, it should automatically reboot your machine.
• If your computer does not automatically reboot, manually reboot to ensure a complete clean.

You can keep TFC for future use if you choose.

2. RESTORE POINTS

Create New System Restore Point

• Click Start > Right-click My Computer > Click Properties.
• In left pane, click System Protection.

Note: If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

• Click System Protection tab, and then click Create.
• In the System protection dialogue box, type a description, and then click [b}Create.

Delete Old Restore Points

• Click Start > All Programs > Accessories > System Tools > Disk Cleanup and then click OK.
• Click the More Options tab.
• In the System Restore and Shadow Copies tab, click Clean Up.

3. UPDATES

Adobe Reader

You are presently running Adobe Reader 9 (Version 9.5.5). To improve the functionality and security of your software, please update to Adobe Reader 11 (Version 11.0.03) HERE. Updates safeguard your system against malicious attacks through PDF files.

Adobe Flash

You are presently running the most current version of Adobe Flash 11 (Version 11.8.800.94). Always ensure you keep up with the latest version by checking HERE. Updates ensure that your software works properly and may include changes to security or new product functionality.

Adobe Shockwave Player

You are presently running Adobe Shockwave Player 11 (Version 11.6). Please update to Adobe Shockwave Player 12 (Version 12.0.3.133) HERE. This update addresses a vulnerability that prevents a malicious code from running on infected systems.

4. BROWSER SECURITY

Browser Updates

Running older versions of a browser pose serious security vulnerabilities. Updates increase the stability, security, speed, and functionality of your web browsers. Check for and download the latest version of your browser:

Internet Explorer: HERE
Mozilla Firefox: HERE
Google Chrome: HERE

Turn On Automatic Updates

You can stay up to date with the latest critical and security updates by using Automatic Updates. To turn on Automatic Updates:

• Click Start > click Control Panel > Click Windows Update.
• In the left pane, click Change Settings.

• Under Important Updates, click the down arrow and select Install updates automatically (recommended).
• Under Recommended Updates, check Give me updates the same way I receive Important Updates.
• Under Who can install updates, check Allow all users to install updates on this computer.

• Click OK to apply the changes. (Note: If Windows prompts you to confirm these changes, allow it.)
• Close the window.

Turn On Safe Browsing Features

For Internet Explorer: Activate SmartScreen Filter

• Open Internet Explorer.
• Click Tools > SmartScreen Filter > Turn on SmartScreen Filter.

For Mozilla Firefox: 1. Block Attack Sites and Web Forgeries

• Open Firefox.
• Click Tools > Options.
• Click the Security tab and check mark the following:

• Warn me when sites try to install add-ons
• Block reported attack sites
• Block reported web forgeries.

2. AdBlock Plus

To remove online advertising and block all known malware domains, download AdBlock Plus from HERE.

For Google Chrome: Enable Phishing and Malware Protection

• Open Google Chrome.
• Click the Customize and control icon (wrench or 3 bars) located at the top right corner of the browser.
• Click Settings > Show advanced settings > Under the Hood.
• In the Privacy section, check mark Enable phishing and malware protection.
• Restart Google Chrome to activate new settings.

5. RECOMMENDATIONS: ENHANCE YOUR SYSTEM SECURITY

If you are looking to add even more security features to protect your system, the following applications may be of interest to you.

For Internet Explorer: SpywareBlaster

If Internet Explorer is your default browser, download SpywareBlaster from HERE. SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.

For Firefox: No-Script

If Firefox is your default browser, download No-Script from HERE. No Script prevents malicious scripts from being executed on your system.

For All Browsers: Web of Trust

To avoid untrustworthy sites while browsing, download Web of Trust (WOT) from HERE. WOT is compatible with all browsers and informs you which websites you can trust by displaying coloured rating symbols next to search results: Green (good), Yellow (caution), Red (dangerous).

Secunia Online Software Inspector (OSI)

To prevent malware from exploiting vulnerabilities due to outdated software, scan your system with OSI HERE.http://secunia.com/vulnerability_scanning/online/. OSI searches your operating system and software for insecure versions and missing security updates.

6. RECOMMENDED READING

To help you maintain a clean, safe, and healthy system, the following informative articles may be of interest to you:

How to Prevent Malware by Miekiemoes HERE
So How Did I Get Infected In the First Place? By Tony Klein HERE
Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams HERE
Help! My computer is Slow – How to improve system performance after malware removal by Miekiemoes HERE
Create Strong Passwords by Microsoft HERE
PC Safety and Security – What do I need to do? by Glaswegian HERE

Please respond to this thread one last time so that we can mark the problem solved and close this topic.

Wishing you always a safe browsing experience.
~fbfbfb

Hi there ran through and actioned everything you listed. Will also look at the pages you advised I should read. Everything seems to be working well and the laptop is speeding along. Thank you so much for all your help. It is very much appreciated thanks again Amanda

You are very welcome, Amanda. Glad we could help. It was a pleasure working with you. All the best, ~fbfbfb

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.