CleanerPro and PC Mechanic [Solved]

Hi Svinlesha,
 

The computer seems to be running just fine – better in fact, than it has in a while.

That's good to here.

 

=========================

Do you want to keep Pirates and Stormfall?

 

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt
 

Start
CloseProcesses:
C:\Users\Tim\AppData\Local\Vosteran
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
C:\Program Files (x86)\Cleaner Pro
EmptyTemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.

Download the version suitable to your computer.

• 32 bit System:
  • Link 1 - 32 bit
  • Link 2 - 32 bit
• 64 bit System:
  • Link 1 - 64 bit
  • Link 2 - 64 bit

• Right click SystemLook.exe and select "Run as Administrator" to run it.
• Copy the content of the following code-box into the main text-field:
  

  :folderfind
  *GoodGameEmpire*
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

=========================

In your next post please provide the following:

• Fixlog.txt
• SystemLook.txt

Hi OCD!!!

 

We would like to remove Pirates and Stormfall, please.

 

Fixlog text:

 

Hi Svinlesha,
 

By the way, my son and I will be away for the weekend and won't be able to reply until Sonday at the earliest, and probably Monday.

Thank you for letting me know. I hope you guys have/had a nice weekend.

=========================

[external image: bullseye_zpse9eaf36e.gif] FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt
 

Start
CloseProcesses:
2015-01-24 17:36 - 2015-01-24 17:36 - 00003602 _____ () C:\Windows\System32\Tasks\Pirates WW1
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Pirates946
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pirates
2015-01-24 17:35 - 2015-01-29 17:23 - 00000000 ____D () C:\Users\Tim\AppData\Local\Pirates
Task: {0954B156-7016-4593-9693-815C917DFE34} - System32\Tasks\Pirates WW1 => Chrome.exe –kiosk http://plarium.com/p…blisherID=0_1_2
2015-01-24 17:34 - 2015-01-29 17:25 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\StormFall
2015-01-24 17:34 - 2015-01-24 17:34 - 00003664 _____ () C:\Windows\System32\Tasks\StormFall TW1
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormFall
2015-01-24 17:34 - 2015-01-24 17:34 - 00000000 ____D () C:\Users\Tim\AppData\Local\StormFall
Task: {A575C369-FF15-421C-88C4-9F5D2FDA273C} - System32\Tasks\StormFall TW1 => Chrome.exe –app=http://plarium.com/p…blisherID=1_1_2 –app-window-size=1440,900 
C:\Program Files (x86)\PC Speed Up
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\GGEmpire441
2015-01-24 17:36 - 2015-01-24 17:36 - 00000000 ____D () C:\Users\Tim\AppData\Local\GGEmpire
C:\Users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GoodGameEmpire
EmptyTemp:
End

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Reboot & Test

In your next post please provide the following:

• Fixlog.txt
• How is the computer running?

Hey OCD!

 

Here's the fixlog text:

 

Hi Svinlesha,
 

Are we getting close?

I think we are just about done. A few scans just to be sure, then some clean-up and we'll get you on your way.

[external image: bullseye_zpse9eaf36e.gif] Security Check

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Right click SecurityCheck.exe, select "Run as Administrator" and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run Farbar Recovery Scan Tool it should be on your desktop.

• • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

• checkup.txt
• new FRST
• Any remaining issues?

Hi Svinlesha,

[external image: bullseye_zpse9eaf36e.gif] Uninstall via Programs and Features

Click Start > Control Panel > Programs and Features. Locate and select the following that are present on the list and click the Remove button:

• Java 7 Update 67
• Adobe Flash Player 11.9.900.117

=========================

[external image: bullseye_zpse9eaf36e.gif] Adobe Flash Player:

Go to http://get.adobe.com/flashplayer/?no_ab=1

• Remove the check mark from the box "Install Google Drive"
• Click the Download button, and follow the onscreen directions to complete the installation.

Please note, depending on your settings, you may have to temporarily disable your antivirus software for the Adobe Reader update.

=========================

Last(?) remaining issue: while we were doing this a pop up appeared from malewarebytes saying that it had located vosteran, a PUP (potentially unwanted program).

 

Please re-run MBAM, but this time do not remove the found threats. Locate the log and post in your next reply.

=========================

[external image: bullseye_zpse9eaf36e.gif] Re-run SystemLook

• Right click SystemLook.exe and select "Run as Administrator" to run it.
• Copy the content of the following code-box into the main text-field:
  

  :filefind
  *Cleaner Pro*   
  
  :folderfind
  *Cleaner Pro*   
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

=========================

In your next post please provide the following:

• MBAM.txt
• SystemLook.txt

Hej OCD!

 

Hope all is well with you and yours.  Here are the requested logs.

 

MBAM:

 

Hi Svinlesha,

Your log appears to be clean.

All the Pro Cleaner items are safely located in quarantine folders so they pose no threat.

We have a few items to take care of before we get to the All Clean Speech.

= = = = = = = = = = = = = = = = = = = =

[external image: bullseye_zpse9eaf36e.gif] Remove Disinfection Tools

• Download Delfix
• Tick the following boxes:
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  [external image: Delfix_zpsbce6c60b.gif]
• Click Run
• Any other tools and files found can simply be deleted or uninstall via the Control Panel.

= = = = = = = = = = = = = = = = = = = =


With the above items taken care of let's move on to the All Clean part of the process.

The following procedures are recommendations for helping to keep your system running smoothly. If you are currently satisfied with how your system is running some or all of these may not pertain to you. Implement what you need.

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate windows and frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

• NoScript
• AdBlockPlus

Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

Free Anti-Virus

• Avast Free Antivirus
• Avira Free Antivirus 2013
• PC Tools AntiVirus Free
• Ad-Aware Free Antivirus +

Free Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here.

• Online Armor Free
• Agnitum Outpost Firewall Free
• Comodo Firewall

= = = = = = = = = = = = = = = = = = = =

Be prepared for CryptoLocker:

Cryptolocker Ransomware: What You Need To Know
CryptoLocker Ransomware Information Guide and FAQ

to help protect your computer in the future I recommend that you get the following free program:

CryptoPrevent install this program to lock down and prevent crypto-ransomeware

[external image: CryptoPrevent_zps7ddc3ebd.jpg]

= = = = = = = = = = = = = = = = = = = =

COMPUTER SECURITY - a short guide to staying safer online

= = = = = = = = = = = = = = = = = = = =

WOT Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.

• Green should be good to go
• Yellow for caution
• Red to stop

= = = = = = = = = = = = = = = = = = = =

P2P may be a great way to get lots of stuffs, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.

• FBI Cyber Education Letter
• USAToday
• infoworld

= = = = = = = = = = = = = = = = = = = =

Make sure you keep your Windows OS current.

• Windows XP:
  Microsoft will no longer offer support for Windows XP beginning on April 8, 2014
  If you are running Windows XP, please take the time to read the information provided at these links.
  • Windows XP - The Elephant In The Room
  • Windows XP - The end of the road
• Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems.
• Window 8 Open Windows Update by swiping in from the right edge of the screen (or, if you're using a mouse, pointing to the lower-right corner of the screen and moving the mouse pointer up), tapping or clicking Settings, tapping or clicking Change PC settings, and then tapping or clicking Update and recovery.

Without these you are leaving the back door open.

= = = = = = = = = = = = = = = = = = = =

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

= = = = = = = = = = = = = = = = = = = =

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

hello ocd thank you so much! the computer is running really good and me and my dad just want to say thank you so much  

 

Isaac

 

 

 

 

Hej OCD,

 

You've been fantastic, thanks again for all the help and support.  I'll be sure to drop some cash into the tip jar.

 

Take care!

 

Tim

Hello Isaac,

You are quite welcome. You and your Dad have been great through the entire process. Just remember going forward to be careful what you download and install on your computer. When in doubt, ask your Dad.

@Tim,
I'm glad I was able to help, and thank you for the kind words. I think by having Isaac follow along through the process will serve him well going forward.

If you have no other questions, I will go ahead and close the topic.

Thank you (Isaac & Tim), you have been a pleasure to work with.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.