pixelmathtag infection [Solved]

The easiest way would be for you to move FRST to the desktop.

Currently it is located at C:\Users\Karen\Downloads

When using explorer, you probably have a window on the left where the download folder is probably about the third item in the list.  Click on downloads to open the folder and find FRST64.exe.  Right click on it and select cut.  Then click on desktop, probably the second item in the list, and past FRST there by right clicking in the right window and selecting paste.

The put fixlist.txt on your desktop also.

Your way much easier!  Had to hard start again - firefox and google not responding.  Running better not great.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04
Ran by [removed] at 2015-04-16 21:35:42 Run:1
Running from C:\Users\[removed]\Downloads
[removed] Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
HKLM-x32\…\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-388596950-1715359082-2369245363-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll [2012-12-12] (Catalina Marketing Corporation)
CHR Plugin: (CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll (Catalina Marketing Corporation)
EmptyTemp:
end
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-388596950-1715359082-2369245363-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll not found.
EmptyTemp: => Removed 40.6 MB temporary data.


The system needed a reboot.

==== End of Fixlog 21:35:47 ====

Hmmm…

Let's get an online scan.

[external image: GzlsbnV.png] ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet while your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the program. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points. 
• Click [external image: esetExport.png] and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to [external image: xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png] and click [external image: SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.

So far 2 threats found - timer is moving but files scanned and target are no moving.  Posting from another computer.

Never mind it just moved 2 more files scanned.  Sorry!

C:\Backed Up Tower 1\Desktop\malware\Process.exe    Win32/PrcView potentially unsafe application
C:\Backed Up Tower 2\Desktop\malware\Process.exe    Win32/PrcView potentially unsafe application
C:\Users\Karen\Desktop\Microsoft Word, etc\Avery Wizard 4.01 - US 20111209.exe    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Users\Karen\Downloads\ccsetup409(1).exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup409.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup413.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup416.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup417.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup418.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup419(1).exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup419.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup500.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup502.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Karen\Downloads\ccsetup503.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application

Nothing there to worry about.

Can you please try to describe for me, your current symptoms with as much detail as possible?

I'm headed to bed so it will be several hours before you hear from me again.

No problem - I've been staying up also.

Forgive me if I do not use the correct terms. I do not have the freeze screen issue at this time when I open any programs or browsers.(I would have to use a hard shut down - press and hold off button.) 

For the last day computer has slowed and not been responsive to closing programs, a cloudy white haze comes over the screen and the blue circle is there instead of an arrow. 

The tower had a steady yellow light (not at this time) usually it blinks as a program loads.  When a browser opens the 'signatures' at the bottom left were 'pixelmathtag' 'pixel2368' or 'everesttech.net' plus others. 

During this time computer very slow to load internet page and a secondary page would open but not to the sites listed - 'pixelmathtag' 'pixel2368' or 'everesttech.net'

I am worried since this is the Quickens computer and my son just did his tax return on it.  I know it would be a good idea to change passwords.

Thank you again for your help.  It does seem faster and I can get to the files I need for this trip.  While away I will shut down and disconnect cable.

If you are too busy I will post when I am back if there is still an issue.

Kindest Regards,

Fiveone5

Checking email on problem computer - IE and Firefox 'not responding' if I try to open another tab.  Will not close when I try.  I an shutting down and cathcing some sleep.  This is frustrating for a novice  - I turn the key and go as my husband says!!

Good morning,

When I shut down last night - computer froze - white fog over page - steady yellow light on tower. Did a hard shut down for the night.

This morning I clicked on Firefox same issue as described previous post.Issue connecting with internet - pixelmathtag than adadvisor.net - Firefox not responding.

Hard shut down but Firefox asked if I wanted to restore session did that for your site and no issue at this time. No sites running in bottom left while page loaded.

I don't know if this is the information that will be useful.  Let me know if you need other.

Thank you!

Every piece of information is a clue… if I can just figure out what they add up to.  I don't understand the cloudy white haze  or white fog reference.  I'm still thinking about it.

Let's try resetting your browsers.

Instructions on how to backup your Favorites/Bookmarks and other data can be found below.

• [external image: xehzOq95.png.pagespeed.ic.1o1xpAkZbO.png]Backup Internet Explorer Favorites
• [external image: xQlf57ne.png.pagespeed.ic.SnwgqhVB9v.jpg]Backup Firefox Bookmarks
• [external image: U5NwUGc.png]Backup Chrome Bookmarks
• [external image: MMFS6Lg.png]Backup Opera Bookmarks (scroll down)
   

Proceed with the reset once done.

• [external image: xehzOq95.png.pagespeed.ic.1o1xpAkZbO.png]Internet Explorer: How to reset Internet Explorer settings
• [external image: xQlf57ne.png.pagespeed.ic.SnwgqhVB9v.jpg]Firefox: Reset Firefox
• [external image: U5NwUGc.png]Chrome: Chrome - Reset browser settings
• [external image: MMFS6Lg.png]Opera: How to perform a clean reinstall of Opera

OK… a little information.

The white fog or haze is apparently a "new" feature to Windows 7.  It appears when resources are  all (or mostly) being used.  It is supposed to tell you that you are going to need to wait for whatever operation is currently working to finish before you can do something additional/new.  The yellow light is telling you that your hard drive is working.

So… together, this tells us that when you get the haze, your computer is working hard, and the yellow light means that information is being written to the hard drive.

Is there a chance that this phenomenon started Wednesday morning?  I'm only talking about the white haze - not the pixelmathtag.  If so, that could mean that your computer is trying to install the updates that Microsoft pushed out on Tuesday night… and hasn't completed their installation.

Was able to backup Firefox bookmarks to flash drive.

IE states it is not accessiable folder has small white box with black arrow. Notice several files in computer have same issue - Application Data, Cookies, Local Settings, My Documents, NetHood, PrintHood, Recent, SendTo, StartMenu, Templates.

Not sure about the start of the problem - sorry - this week a blur. May have been Tuesday.

I have no problem right now after the hard shut down - I opened Firefox with the link (white window asking if I want to restore session).  If I open up new browser then it's slow to load and freezes.

Updates were done - did not get message that the install was incomplete.

I've left the computer with the haze and yellow light - I figured it was maxing out.  Got worried when it was 10 + minutes and still there.  That's when I thought I had a major issue.

Let's try thouroughly checking system files, and resetting various permissions.

Please download Tweaking.com's Windows Repair tool:

When you start the tool, you will see instructions for each step.  Go ahead and work your way through them.  Don't bother with the last tab called "tweaks".  Those are basically ads for other programs.  When you are done, please post the repair log.