13 replies to this topic

[DanaF]

I get a Norton Anitivirus box that reports adware being present.  However, I find this suspect.  It's been awhile since I've visited you guys with my personal computer anyway so I figured I'd like you guys take a look.

 

As always, thanks for the help!

 

 

Attached Files

•  dds.txt   23.76KB   180 downloads
•  attach.txt   12.16KB   234 downloads

[OCD]

Hi DanaF,

There isn't much showing in the logs you provided, please run these additional scans.

 

Also, kindly copy & paste the logs directly into the reply window.

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Copy and Paste logs directly into the reply window. DO NOT attach the logs unless specifically instructed to do so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Please stay with this topic until I let you know that your system appears to be "All Clear"

Important: All tools MUST be run from the Desktop.

=========================

Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

aswMBR

Download aswMBR.exe and save it to your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When asked if you want to download Avast's virus definitions please select Yes.
• Click Scan
• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

=========================
AdwCleaner

Download AdwCleaner to your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Run AdwCleaner and select Delete
• Once done it will ask to reboot, allow the reboot
• On reboot a log will be produced, please attach the content of the log to your next reply

=========================

Junkware Removal Tool

Download Junkware Removal Tool to your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Shut down your protection software now to avoid potential conflicts.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

=========================

In your next post please provide the following:

• checkup.txt
• aswMBR.txt
• attach MBR.zip
• AdwCleaner[S0].txt
• JRT.txt

[DanaF]

Ok, not sure what's going on here, but I'm not being allowed to paste into the reply window.  I've used the paste icons above, as well as ctrl+v, and neither is working.  Am I missing something simple?

[OCD]

Hi DanaF,
 

Ok, not sure what's going on here, but I'm not being allowed to paste into the reply window.  I've used the paste icons above, as well as ctrl+v, and neither is working.  Am I missing something simple?

 
If you run into problems being able to paste logs into the reply window, please click the toggle switch in the menu and retry. The menu will be greyed out when you can paste into the window.

[DanaF]

Here are the scan results for Security Check:

Results of screen317's Security Check version 0.99.86
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Security Suite
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
JavaFX 2.1.1
Java™ 7 Update 5
Java 2 Runtime Environment, SE v1.4.1_02
Java version out of Date!
Adobe Flash Player 11.4.402.265 Flash Player out of Date!
Adobe Reader XI
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3%
````````````````````End of Log``````````````````````

Here are the scan results of aswMBR:

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-07-21 19:52:37
-----------------------------
19:52:37.924 OS Version: Windows x64 6.1.7601 Service Pack 1
19:52:37.924 Number of processors: 4 586 0xF0B
19:52:37.924 ComputerName: DANA-PC UserName: Dana
19:52:39.812 Initialize success
19:52:40.077 VM: initialized successfully
19:52:40.108 VM: Intel CPU supported
19:52:43.925 VM: supported disk I/O storport.sys
19:53:12.301 AVAST engine defs: 14072001
19:53:18.744 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
19:53:18.744 Disk 0 Vendor: WDC_WD32 12.0 Size: 305244MB BusType: 3
19:53:18.744 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1
19:53:18.744 Disk 1 Vendor: Maxtor_6 BANC Size: 95611MB BusType: 3
19:53:18.744 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000081
19:53:18.760 Disk 2 Vendor: SEAGATE_ 0002 Size: 35003MB BusType: 1
19:53:18.760 Disk 3 (boot) \Device\Harddisk3\DR3 -> \Device\00000082
19:53:18.760 Disk 3 Vendor: FUJITSU_ 0104 Size: 140272MB BusType: 1
19:53:18.838 VM: Disk 3 MBR read successfully
19:53:18.838 Disk 3 MBR scan
19:53:18.853 Disk 3 Windows VISTA default MBR code
19:53:18.853 Disk 3 Partition 1 80 (A) 07 HPFS/NTFS NTFS 140270 MB offset 63
19:53:18.869 Disk 3 default boot code
19:53:18.900 Disk 3 scanning C:\Windows\system32\drivers
19:53:28.276 Service scanning
19:53:30.382 Service BHDrvx64 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140703.001\BHDrvx64.sys **LOCKED** 5
19:53:35.296 Service IDSVia64 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140718.001\IDSvia64.sys **LOCKED** 5
19:53:37.760 Service NAVENG C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140721.009\ENG64.SYS **LOCKED** 5
19:53:37.901 Service NAVEX15 C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140721.009\EX64.SYS **LOCKED** 5
19:53:49.757 Modules scanning
19:53:49.757 Disk 3 trace - called modules:
19:53:49.772 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll adpu320.sys
19:53:49.788 1 nt!IofCallDriver -> \Device\Harddisk3\DR3[0xfffffa8005340060]
19:53:49.788 3 CLASSPNP.SYS[fffff880019b743f] -> nt!IofCallDriver -> \Device\00000082[0xfffffa80050c4060]
19:53:50.599 AVAST engine scan C:\Windows
19:53:51.785 AVAST engine scan C:\Windows\system32
19:56:44.430 AVAST engine scan C:\Windows\system32\drivers
19:56:55.241 AVAST engine scan C:\Users\Dana
20:18:08.244 AVAST engine scan C:\ProgramData
20:20:52.574 Scan finished successfully
20:21:23.572 Disk 3 MBR has been saved successfully to "C:\Users\Dana\Desktop\MBR.dat"
20:21:23.572 The log file has been saved successfully to "C:\Users\Dana\Desktop\aswMBR.txt"

Here are the scan results of AdwCleaner:


# AdwCleaner v3.216 - Report created 21/07/2014 at 20:25:31
# Updated 17/07/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Dana - DANA-PC
# Running from : C:\Users\Dana\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Uniblue
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
Folder Deleted : C:\Program Files (x86)\Uniblue
Folder Deleted : C:\Users\Dana\AppData\Local\eSupport.com
Folder Deleted : C:\Users\Dana\AppData\Roaming\Uniblue
Folder Deleted : C:\Users\Dana\Documents\Updater
File Deleted : C:\Windows\Tasks\driverscanner.job
File Deleted : C:\Windows\System32\Tasks\driverscanner

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DriverScanner]
Key Deleted : HKLM\SOFTWARE\Classes\driverscanner
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [updaterz.exe]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17207


*************************

AdwCleaner[R0].txt - [2949 octets] - [21/07/2014 20:24:14]
AdwCleaner[S0].txt - [2479 octets] - [21/07/2014 20:25:31]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2539 octets] ##########

Here are the scan results for JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by Dana on Mon 07/21/2014 at 20:32:39.41
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Dana\appdata\local\{8B017DDE-7B84-4FE2-BA8F-2388EB8D6717}
Successfully deleted: [Empty Folder] C:\Users\Dana\appdata\local\{F0EFA827-299E-4C96-B23E-D4C1A3A0F54C}
Successfully deleted: [Empty Folder] C:\Users\Dana\appdata\local\{F83EB0B7-658E-4AD0-BD8D-085026FC40C5}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 07/21/2014 at 20:43:36.92
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

Attached Files

•  MBR.zip   543bytes   141 downloads

[OCD]

Hi DanaF,

Malwarebytes' Anti-Malware

Download Malwarebytes' Anti-Malware (save it to your desktop).

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• Select Scan tab.
  
• Select type of scan to perform:
  
  • Threat Scan < --- Select this type of scan
  • Custom Scan
  • Hyper Scan
• Next click the Scan button.
• When the scan is complete, if no malicious items are found you can close the program.
• If malicious items are found be sure that everything is checked, and click Quarantine .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

=========================

ESET Online Scanner

*Note:

• It is recommended to disable on-board antivirus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
• Please don't go surfing while your resident protection is disabled!
• Once the scan is finished remember to re-enable your antivirus along with your anti-spyware programs.

** You need to run your browser with Administrator Rights, to do so right click your browsers short cut and select "Run as Administrator".

= = = = = = = = = = = = = = = = = = = =

Go here to run ESET Online Scanner

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your Antivirus software. You can usually do this with its Notification Tray icon near the clock
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
• Click Scan.
• Wait for the scan to finish.
• When the scan completes, click List of found threats
• click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
• Include the contents of this report in your next reply
  
  Note - when ESET doesn't find any threats, no report will be created.
• Push the back button.
• Push Finish
• Re-enable your Antivirus software.

=========================

In your next post please provide the following:

• MBAM log
• ESET's log.txt
• How's the computer running, any symptoms?

[DanaF]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 7/21/2014
Scan Time: 10:37:21 PM
Logfile: mal.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.21.09
Rootkit Database: v2014.07.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Dana

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 317578
Time Elapsed: 10 min, 33 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

ESET produced no results as it found no threats.

So far, I haven't seen a pop-up. If I do, I will report back.

Here's a link on the net showing the exact pop-up I got. http://community.nor...A4611B?v=mpbl-1

Many others seem to agree that this is not Norton!

[OCD]

Hi DanaF,

Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Java™ 7 Update 5
• Adobe Flash Player 11.4.402.265

=========================

Update Java

• Get the current version of Java (Version 7 Update 60) by going to http://java.com/en/d...d/installed.jsp
• Select the Verify Java Version button and follow the onscreen instructions to update if necessary.

=========================

Adobe Flash Player:

Go to http://get.adobe.com...player/?no_ab=1

• Remove the check mark from the box "Install Google Drive"
• Click the Download button, and follow the onscreen directions to complete the installation.

Please note, depending on your settings, you may have to temporarily disable your antivirus software for the Adobe Reader update.

=========================

Disk Defragmenter in Windows 7

Click on the Start button, and type in "disk defragmenter" in the search window at the bottom.
"Disk Defragmenter" should appear at the top of the search results, click to open.

(a window similar to the one below will open)



Locate your primary hard drive (usually C:), and select it.



Next select the Defragment Disk button. Monitor the progress if you choose.



Close when the defrag process has been completed.

= = = = = = = = = =

You can also Schedule the Disk Defragmenter to run on a predetermined schedule.

From the main Disk Defragmenter window



Select the Configure / Schedule button



Select a date and time that best suits your needs.
Close when finished.

=========================

In your next post please provide the following:

• How is the computer running?
• Any new symptoms?

[DanaF]

Ok, I was able to remove both and install Acrobat. When I click the "I Agree" button to install Java, I get "Internet Explorer has stopped working". I choose "close program" and IE reports:

Internet Explorer has closed this webpage to help protect your computer



A malfunctioning or malicious add-on has caused Internet Explorer to close this webpage.

[OCD]

Hi DanaF,

Please try again by visiting here >> http://java.com/en/d...windows_xpi.jsp
You should be downloading Java Version 7 Update 65 (filesize: 897 KB)

Then continue on with the remainder of the previous steps.

[DanaF]

Ok, I was able to download it using your new link. Thanks.

My computer is currently scheduled to defrag once a week. In fact, it will do so tonight I believe.

I also found that the Norton prompt was not bogus. I did some digging in the program itself and found the adware entries. While I wasn't able to resolve them in the pop-up, I was able to resolve the issue in the program itself.

I'll let this thing run for a few days and let you know if that did get rid of the pop-up.

Glad to see that my computer is remaining pretty clean.

Thanks for your help!

[OCD]

Hi DanaF,

 

Sounds good.    I will leave the thread open until I hear back from you. Please be sure to come back as we have some final clean up steps that should be taken before I let you go for good.

[OCD]

Hi DanaF,

How is the computer performing?

[OCD]

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatth...ed_t106388.html and start a new topic