Problems with laptop even after factory reset due to virus [Closed]

Hi! I really appreciate all the expert help I can get regarding my laptop issue. Thank you in advance!

Two weeks ago I noticed oyodomo's weird pop ups and never thought much of it until I found it weird ten days after the infection that I got pop ups even though I had adblock installed. I looked it up online and found out that it was a virus so I factory reset (no disc) my laptop, which is an hp pavilion.

After resetting, I downloaded symantecs and malwarebytes and ran full scans on both. They didn't pick up on anything. I also tried manually removing some files as I read on this website: http://guides.yoosecurity.com/how-to-remov…o-com-redirect/

"Step 4: The next step is to remove Oyodomo.com redirect virus from the files related to the following one inside the local disk C area or Registry editor:
%AllUsersProfile%\{random.exe\
And in the end you will have to prompt your registry section and delete the following pathways there:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\random
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\random
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |Regedit32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\”S"

Now my symantecs randomly pops up with two messages:

"NY kernel system has changed" and "host process for windows tasks has changed"

Thank you!

Hello techderp2 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download one of these to your desktop:

for a 32-bt system download this version.
for 64-bit use this one

.

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.
Please post the contents of the RKreport.txt in your next reply.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner and select Delete
• when it has finished it will ask to reboot - allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run OTL

• download OTL to your desktop.
• double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• click Scan all users.
• under Custom Scan paste this in

  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  services.exe
  /md5stop
  %systemroot%\*. /rp /s
  DRIVES
  CREATERESTOREPOINT

• click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
• when the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• you may need two posts to fit them both in.

Logs to include with next post:

RKreport.txt
AdwCleaner log
OTL.txt
Extras.txt

Thanks

Satchfan

Thank you for your reply. I am currently very busy with schoolwork and will run these scans on the weekend. Please do not close this thread until then. Thank you so much!!

Thanks for letting me know. As long as I'm kept informed I'll keep the topic open. Good luck with your school work - that's very important.

I ran into several problems with the scans. First, I simply can't download adwcleaner onto my laptop because symantec recognizes adwcleaner as a virus. Second, the OTL and Extra logs are over 140 pages in a word document…. I tried to post it but I'm guessing the forum won't let me post that much. Is the reason why the OTL and Extra logs are overly long because I can't get the adwcleaner? If so how can I download it safely and get the OTL and Extra logs to you? Thank you!!

I downloaded symantecs

I don't understand what you mean by "symantecs".

You said you had run a scan with Microsoft Security Essentials, (MSE). If you have that installed then you should not have downloaded and run another antivirus with MSE still protecting your computer.

Let's get these things done slowly and try one at a time.


Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7: right-click the program and select Run as Administrator'
• after it has completed it's prescan click on the “Registry” tab
• make sure this entry there is checked, then click on Delete:

[SUSP PATH] setup.exe – C:\Windows\Temp\CR_AB213.tmp\setup.exe [7] -> KILLED [TermProc]

Please include the Delete log in your next post.

Next

Let’s try running AdwCleaner in safe mode:

How to start Windows in Safe Mode - Windows 7

Let me know how that goes.

Satchfan

So far so good - although I'm unsure about the AdwCleaner log - it looked too clean.

Try the following in normal mode but if that doesn't work, try again in safe mode.

Run aswMBR

• download aswMBR.exe to your desktop.
• double click the aswMBR.exe to run it
• if asked, accept the AVAST virus definition download
• click the "Scan" button to start scan
• on completion of the scan click Save log, save it to your desktop and post in your next reply

Now try to run OTL again.

Thanks

Satchfan