disk-err-windows-error-failure1.warnning8541.com (has infected my brow

Good evening,

My 5 year old son was on my laptop a couple of days ago. Since then I have had major problems, especially while surfing the internet. There are pop-ups galore, and every time you click on a link it takes you to a dodgy website. For example. often it takes you to the website I put in the topic title - disk-err-windows-error-failure1.warnning8541.com. (yes, there is a double in warning). Often the popups/adverts say 'powered by helper king.' Many normal websites seem to have extra hyperlinks in them, taking you to more dodgy websites.

Like I said, it's mostly affected my internet browsers but I do sometimes get pop-ups at other times too, for example when I first switch the laptop on it says 'Computer running slow? For Tech/PC support call free now. Available 24/7 020 3150 0993.' And when I googled the phone number it said it was a scam number showing up on computers infected with malware.

Any help would be most greatly appreciated. Thanks.

Ps - I am running windows 8.1 and am using an Asus laptop.

Hello percylovely and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested


Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/Seven, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• when the pre-scan is finished, click on Scan
• click on Report and copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

If the program is blocked, continue to try it several times. If it still doesn’t work, (it could happen), rename it to winlogon.exe.

Please post the contents of the RKreport.txt in your next reply.

Satchfan

Many thanks Satchfan. Here is the report.

Note: Please run these in the order given in the instructions.

===================================================

Run RogueKiller

IMPORTANT: Do not reboot your computer if at all possible otherwise the malware will reactivate and you will have to run RogueKiller again

• close all programs
• double-click RogueKiller.exe - Windows 7/8: right-click the program and select Run as Administrator'
• after it has completed it's prescan, click on Scan
• click on the click on the “Registry” tab
• make sure the following entries there are checked:
  

  
  [Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | CitrixReceiver : "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"  -> Found
  [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc) -> Found
  [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Found
  [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc) -> Found
  [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : [removed] [removed] [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)]  -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : [removed] [removed] [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)]  -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9A9B8C4B-F61B-4E13-873A-CD83E0935EDF} | DhcpNameServer : [removed] [removed] [UNITED STATES (US)][UNITED STATES (US)]  -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{A8A87052-14A7-4556-BC21-0CDE0D8A7BA8} | DhcpNameServer : [removed] [removed] [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)]  -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9A9B8C4B-F61B-4E13-873A-CD83E0935EDF} | DhcpNameServer : [removed] [removed] [UNITED STATES (US)][UNITED STATES (US)]  -> Found
  [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{A8A87052-14A7-4556-BC21-0CDE0D8A7BA8} | DhcpNameServer : [removed] [removed] [UNITED KINGDOM (GB)][UNITED KINGDOM (GB)]  -> Found
   

• click on the click on the “Tasks” tab and place a checkmark next to these:
  

  
  [Suspicious.Path] lmjDGKOyCsURIri9.job – C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9.exe (–c=xeU2oeYeSu95ajwSLmhqchs42bN96c3uZinFVYL25M9rZvusJRQ6UZUUJEUDYv3myFh23yg+q9ITZUCycEJBc2jDNsbwfytx8WdbQ0w1FRmK/zZ7/uVeprXgs6zN6G0Lm1QlXR9WrJy1U3QsDt+PqSjXCbRnkv1jAdyHTsTxUZQoNm8dCZgY671MOQH/Rv7uT7gEF6OyITq1+tkiwZ3vNKHFMyp9e/sD6R8ds/p+p8y6Fe6KoyYid1pJCyyFP9jHRqqCagkj5BoMAEh/kVVZsz/iQzicPCeCvRllvFQhJHLjlZomt0rgq2bzwEhuL9WXpXmfwB9XifA8BpSC35LZYw==) -> Found
  [Suspicious.Path] \\lmjDGKOyCsURIri9 – C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9.exe (–c=xeU2oeYeSu95ajwSLmhqchs42bN96c3uZinFVYL25M9rZvusJRQ6UZUUJEUDYv3myFh23yg+q9ITZUCycEJBc2jDNsbwfytx8WdbQ0w1FRmK/zZ7/uVeprXgs6zN6G0Lm1QlXR9WrJy1U3QsDt+PqSjXCbRnkv1jAdyHTsTxUZQoNm8dCZgY671MOQH/Rv7uT7gEF6OyITq1+tkiwZ3vNKHFMyp9e/sD6R8ds/p+p8y6Fe6KoyYid1pJCyyFP9jHRqqCagkj5BoMAEh/kVVZsz/iQzicPCeCvRllvFQhJHLjlZomt0rgq2bzwEhuL9WXpXmfwB9XifA8BpSC35LZYw==) -> Found
   

• then press the Delete button and post the log it produces.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called FRST.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Logs to include with next post:

Rogue Killer log
AdwCleaner[S0].txt
FRST.txt
Addition.txt

Thanks

Satchfan

Thanks so much for your prompt response. Here is the report after the first deletion (I didn't delete the 4 at the bottom of the Registry list marked PUM.DesktopIcons as you didn't mention those).

Those dealt with quite a lot of issues but there’s still a lot to clear up.

We may have to uninstall/reinstall Chrome because some of these extensions prove difficult to remove but we’ll see how it goes.

================================================

It’s a good idea to move Farbar Recovery Scan Tool to your desktop otherwise future fixes may not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below.
 

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF Extension: amptrakeepacom - C:\Users\Jon Longstaff\AppData\Roaming\Mozilla\Firefox\Profiles\r9eprrg6.default\Extensions\[removed] [2015-04-02]
FF Extension: helper king - C:\Users\Jon Longstaff\AppData\Roaming\Mozilla\Firefox\Profiles\r9eprrg6.default\Extensions\[removed] [2015-04-02]
CHR Extension: (afmdpmddiokpdknaeofdnlclbpgehhce) - C:\Users\Jon Longstaff\AppData\Local\Google\Chrome\User Data\Default\Extensions\afmdpmddiokpdknaeofdnlclbpgehhce [2015-04-02]
CHR Extension: (helper king) - C:\Users\Jon Longstaff\AppData\Local\Google\Chrome\User Data\Default\Extensions\obbfamljbihbcghcciagdafdpbgcmkne [2015-04-02]
2015-04-03 14:49 - 2015-04-03 14:49 - 01224704 _____ () C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9.exe
2015-04-02 20:01 - 2015-04-08 00:17 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-04-02 18:32 - 2015-04-08 00:17 - 00001344 _____ () C:\WINDOWS\Tasks\helper_king_notification_service.job
2015-04-02 18:32 - 2015-04-08 00:17 - 00000706 _____ () C:\WINDOWS\Tasks\helper_king_updating_service.job
2015-04-02 18:32 - 2015-04-02 18:32 - 00004348 _____ () C:\WINDOWS\System32\Tasks\helper_king_notification_service
2015-04-02 18:32 - 2015-04-02 18:32 - 00003710 _____ () C:\WINDOWS\System32\Tasks\helper_king_updating_service
2015-04-02 18:32 - 2015-04-02 18:32 - 00000000 ____D () C:\Program Files (x86)\helper king
2015-03-31 09:14 - 2015-03-31 09:14 - 00004387 _____ () C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9
2015-04-08 00:18 - 2014-07-27 22:55 - 00000000 ____D () C:\ProgramData\boost_interprocess
Task: {E4C87B33-AC33-49D1-8114-0AD0A44BDE2C} - System32\Tasks\helper_king_notification_service => C:\Program Files (x86)\helper king\helper_king_notification_service.exe [2015-04-02] (FileProperties_CompanyName)
Task: {FE4890A7-FE2F-4262-8F26-D45EF8C1BA74} - System32\Tasks\helper_king_updating_service => C:\Program Files (x86)\helper king\helper_king_updating_service.exe [2015-04-02] ()
Task: C:\WINDOWS\Tasks\helper_king_notification_service.job => C:\Program Files (x86)\helper king\helper_king_notification_service.exeç/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='helper king' /appid='73143' /srcid='2913' /bic='a349e4509200fe4904a4957db6ee803a' /verifier='e3531c6314a5d606ff9f1c118520e95b' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif
Task: C:\WINDOWS\Tasks\helper_king_updating_service.job => C:\Program Files (x86)\helper king\helper_king_updating_service.exe¬ /campid=2913 /verid=1 /url=http:/cdn.buildomserv.com/txt/@CAMPID@/@VER@/file.txt /appid=73143 /taskname=helper_king_updating_service /funurl=http:/stats.buildomserv.com
C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9.exe
C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
C:\WINDOWS\Tasks\helper_king_notification_service.job
C:\WINDOWS\Tasks\helper_king_updating_service.job
C:\WINDOWS\System32\Tasks\helper_king_notification_service
C:\WINDOWS\System32\Tasks\helper_king_updating_service
C:\Program Files (x86)\helper king
C:\Users\Jon Longstaff\AppData\Roaming\lmjDGKOyCsURIri9
C:\ProgramData\boost_interprocess
EmpyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scan” tab, select Threat Scan, then click Scan.
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

When all that is complete, please run FRST again and send the new log.

Logs to include with the next post:

Fixlog.txt
Mbam.txt
New FRST.txt

Can you tell me if there are any outstanding problems.

Satchfan

Here is the fixlog report.

Daily protection log: (I'm assuming this is the one you want. There is also a scanning history log but I can't copy and paste it.

Please post the Malwarebytes log.

Open Malwarebytes, click on History > Application Logs. Open the last scan by double-clicking on it. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select "Copy to clipboard"; that copies the full log to the windows clipboard, so in your reply, right click in the text field and select "Paste", (or press Ctrl+V).

Here it is. Apologies. Couldn't see the export and copy to clipboard buttons as they were hidden behind the task bar.