Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by [removed] at 2015-03-11 09:32:06 Run:2
Running from C:\Users\[removed]\Desktop
[removed]
Boot Mode: Normal
==============================================
Processes closed successfully.
HKU\Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]S-1-5-21-992209882-4053709944-3239361273-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]AdobeBridge => Value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} => Key not found.
HKCR\Wow6432Node\CLSID\{EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} => Key not found.
HKCR\CLSID\{EFE522B3-7ABD-49CB-A5C3-A2AFBBA83B9D} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Value not found.
HKCR\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => Key not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{71AAABE5-1F0F-11D7-BD6F-004854603DCE} => Value not found.
HKCR\CLSID\{71AAABE5-1F0F-11D7-BD6F-004854603DCE} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\phegaokedjdajgnfphbnpkcfdgjbidko => Key not found.
EagleX64 => Service not found.
Lbd => Service not found.
SBRE => Service not found.
WinRing0_1_2_0 => Service not found.
"C:\Windows\B83FC356B7C0441F8A4DD71E088E7974.TMP" => File/Directory not found.
"C:\Users\Skunkarific Customer\Documents\My CamStudio Temp Files" => File/Directory not found.
"C:\Windows\msdownld.tmp" => File/Directory not found.
"C:\Users\Skunkarific Customer\AppData\Local\Temptmp7912.png" => File/Directory not found.
"C:\Users\Skunkarific Customer\AppData\Local\Temptmp8A15.png" => File/Directory not found.
"C:\Users\Skunkarific Customer\AppData\Local\Temp\MSNF560.exeC:\Users\Skunkarific Customer\AppData\Local\Temp\Quarantine.exe" => File/Directory not found.
"C:\Users\Skunkarific Customer\AppData\Local\Temp\sqlite3.dll" => File/Directory not found.
"C:\Users\Skunkarific Customer\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File" => File/Directory not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208} => Key not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1} => Key not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8} => Key not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9} => Key not found.
HKU\S-1-5-21-992209882-4053709944-3239361273-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F79A9AD-D6C1-410F-B444-A4ACD783E9FC} => Key not found.
C:\Windows\System32\Tasks\{39EFCB2E-95B2-4B8F-B823-79106277CE6C} not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{39EFCB2E-95B2-4B8F-B823-79106277CE6C} => Key not found.
"C:\Users\SKUNKA~1\AppData\Local\Temp -c" => File/Directory not found.
"C:\Users\SKUNKA~1\AppData\Local\Temp\PanoramicMountains.deskthemepack" => File/Directory not found.
"C:\ProgramData\TEMP" => ":5C321E34" ADS not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 869.1 MB temporary data.
The system needed a reboot.
==== End of Fixlog 09:33:54 ====
I performed the reset on Chrome. I visited several web-pages and so far there is no sign of the pop-up ads or redirects. I looked in Control Panel/Programs and there was no listing for the Roll Around program. Although, I checked previously and it was never listed in there. But, it appears we were successful. Crossing fingers that we got it completely and that it doesn't resurface.
Thank you so much for your help. Is there anything else I need to do or any recommendations you have? Also, is this a relatively new virus. I'm confused why Avast didn't catch it and prevent this from happening? Is there anything out there that's better than Avast (I've been using it for years and it usually does a good job).
And….now the @!!@$%&^ bug is back. Everything was fine until just a minute ago, it started with the pop-up ads again and the redirect. I'm ready to wipe the hard drive and start over, unless you want to give it another go?
Very glad to hear that the Roll Around Ads have been removed. I don't know how long this adware has been around as new malware surfaces relentlessly. Avast is a good product, but realize that there is no one particular security program that will stop everything, regardless if it is free or paid for. As computer users, we need to be diligent at all times and do whatever we can to keep malware away.
We need to perform a final bit of housekeeping. I am also including a list of recommendations to help you maintain a clean and secure system.
1. REMOVAL OF DISINFECTION TOOLS
Please run the following application to ensure that all removal tools used during your system's disinfection are deleted.
Download Delfix from HERE and save it to your desktop.
Tick the following boxes:
Remove disinfection tools
Create registry backup
Purge system restore
[external image: Delfix.png]
Click Run. > When finished, a report will open listing the tools that have been deleted.
Any remaining tools, logs, files or folders remaining on your desktop can be removed manually.
Malwarebytes Anti-Malware (MBAM)
You may wish to keep MBAM. Perform weekly updates and scans to maintain system security. If you choose to delete this programme, remove it from your Control Panel.
2. UPDATES
Remember to update regularly. Updates contain important changes to improve the performance, stability and security of programs that run on your system. Many web exploits search for outdated software with security flaws resulting in compromised personal files (banking and credit card information, ID data, passwords…) and cause other major issues.
Windows Updates
You can stay up to date with the latest critical and security updates by using Automatic Updates. To turn on Automatic Updates for Windows 7, click HERE.
Java
You are presently running Java 8 Update 31. Please update this software to Java 8 Update 40. Always keep Java updated to ensure that your applications continue to run safely and efficiently. Updates are available HERE.
Adobe Reader
You are presently running Adobe Reader 11.0.10. This is up-to-date. Always keep this software updated to improve the funtionaility and security of your software. Updates to Adobe Reader safeguard your system against malicious attacks through PDF files.
Adobe Flash
You are presently running Adobe Flash 16.0.0.305. This is up-to-date. Always keep this software updated – Flash-based attacks are still among the most popular ways to infect PCs.
3. BROWSER SECURITY
Enable Firewall
Ensure your firewall is enabled to protect your computer against malicious internet traffic. To enable the Firewall in Windows 7, click HERE.
Browser Updates
Running older versions of a browser pose serious security vulnerabilities. Updates increase the stability, security, speed, and functionality of your web browsers. Download the latest version of your browser:
Internet Explorer:HERE. Firefox:HERE. Google Chrome:HERE.
Turn On Safe Browsing Features
For Internet Explorer, activate SmartScreen Filter.
• Open Internet Explorer.
• Click Tools > SmartScreen Filter > Turn on SmartScreen Filter.
For Mozilla Firefox: 1. Block Attack Sites and Web Forgeries
• Open Firefox.
• Click Tools > Options.
• Click the Security tab and check mark the following:
• Warn me when sites try to install add-ons
• Block reported attack sites
• Block reported web forgeries.
2. AdBlock Plus
To remove online advertising and block all known malware domains, download AdBlock Plus from HERE.
For Google Chrome: Enable Phishing and Malware Protection
• Open Google Chrome.
• Click the Customize and control icon (wrench or 3 bars) located at the top right corner of the browser.
• Click Settings > Show advanced settings > Under the Hood.
• In the Privacy section, check mark Enable phishing and malware protection.
• Restart.
4. RECOMMENDED READING
To help you maintain a clean, safe, and healthy system, the following informative articles may be of interest to you:
PC Safety and Security – What do I need to do? by Glaswegian HERE. How to Prevent Malware by Miekiemoes HERE. So How Did I Get Infected In the First Place? By Tony Klein HERE. Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams HERE. Create Strong Passwords by Microsoft HERE.
Rbarnhart1, thank you for using Whatthetech support and working patiently through all the procedures. Please respond to this thread one last time so we can mark it resolved.
I posted a message after the one you responded to. My computer is still infected with the virus. It was dormant for about 2 hours and then came back. Not sure if you still want me to remove tools. Or if we should try something new? Or if I should just wipe my drive and start over?
I guess we celebrated a bit too early. Let's hold off on removing the tools. Are Roll Around Ads still visible in Chrome, and if you also use other browsers, are they visible there as well?
They seem to only be in Chrome. I'm using Internet Explorer right now and I haven't had the problem here. Whenever I use Chrome and go to regular webpage, I will get 3 ads at the bottom of the page (one of which is a video/audio ad that starts playing automatically). Also, sometimes I'll click a link and it will give me redirect to a new tab that says "No Data".
In fact, when this virus came back yesterday, I tried to go to the WhatTheTech forum while I was still in Chrome. Every time I clicked the Log In link, it kept redirecting me to spoofed websites for "Virus removal".
This one is quite interesting. I've only seen one or two that were worse.
Please work through the following options to remove Roll Around Ads. If Option 1 does not resolve the issue, then move on to Option 2. Let me know if you were successful removing the virus.
Option 1: Scan with Software Removal Tool for Chrome
The Software Removal Tool scans your computer for programs known to cause problems with Chrome, and then offers to remove them for you.
Review the Terms of Service and Privacy Policy > Click Accept > Install.
The Software Removal Tool will download to your computer.
Open the Software Removal Tool. It will immediately start searching your computer for suspicious programs.
A message will tell you how many programs were found, if any.
Click Remove suspicious programs. Wait until you see the message Removal complete. Some open applications may be closed in the process.
Click Continue to quit the tool. If your computer needs to reboot, the button will say Restart.
Chrome will automatically reopen, asking you to reset your browser settings. Click Reset.
Note: To discourage attackers from changing the names of their programs, the Software Removal Tool does not reveall the names of the suspicious programs it finds. You'll only see the number of programs detected.
Option 2: Uninstall and Reinstall Chrome
Uninstall Chrome from your Control Panel. Before uninstalling, ensure you have saved any bookmarks and passwords you wish to keep. Use another browser to reinstall Chrome > visit the Chrome website HERE.
Well….okay. I tried the first thing. It came back with nothing found. So, I uninstalled Chrome and reinstalled. Once again, the ads are not popping up. But, I'm skeptical that it's gone. After everything else we've tried…just uninstalling chrome sounds like too simple of a fix. But, I will continue to use chrome and see if anything happens. Should we consider it fixed at the moment? Or wait for awhile and see what happens?
Let's wait and see what happens. I will keep your thread open for the next few of days. Let me know if the virus reappears. Roll Around Ads is tricky to remove, but we can try several other options.
Sounds good. So far, everything is okay. I was even able to login here with Chrome without getting spoof website popups, so crossing fingers. I'll post back and let you know.
Thanks for the reminder…I almost forgot to check back. The virus seems to be gone. Uninstalling and reinstalling Chrome seemed to be a good move. Somewhat unrelated to the virus, I also discovered that the heat-sink and fan had a ton of dust in there and I cleaned that out. Between the two things, the computer seems to be running better.
I also took your advice and uninstalled a bunch of stuff i wasn't using. I've got a few that I'm not using but plan to soon. Crossing fingers that the virus isn't just hibernating somewhere. I appreciate your help on this. I wasn't looking forward to reloading the OS.
