Virus? [Solved]

Hello exhaster and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Run Farbar Recovery Scan Tool

HijackThis is not used on the newer systems as it doesn't give clear results so we'll run a different scan.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called FRST.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Logs to include with next post:

FRST.txt
Addition.txt
checkup.txt

Thanks

Satchfan
 

 
Hi Jay; thanks for the logs.

You have a lot of adware on your computer which we can deal with but first, although the Farbar log showed Windows Defender as not running, your other log showed that it was.

You cannot have 2 antiviruses running so please make sure that it is disabled, (we can decide which you want to use once your computer is clean):

• open Windows Defender by clicking Start and in the search box, type Defender
• in the list of results, click Windows Defender
• click Tools and then click Options
• click Administrator, then clear the Use this program check box
• click Save. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

========================

I notice you have run ComboFix which is not recommended. Apart from the fact that it is not designed for Windows 8.1, ComboFix is a VERY powerful tool that can reduce a computer to a useless piece of metal without expert guidance.

While you may see ComboFix being used quite often without incident, the tool should NEVER be run unsupervised on this or any other computer, (as stated in the Disclaimer that is first displayed by ComboFix when you run the tool)

========================

OK, let's clean up.

Please uninstall the following programs:

Amazon Browser App
BrowserSafeguard with RocketTab


Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below.

HKLM-x32\…\Run: [BrowserSafeguard] => "C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe"
HKLM-x32\…\Run: [] => [X]
HKLM-x32\…\Run: [fst_us_92] => [X]
HKLM-x32\…\Run: [t4pc_en_4] => [X]
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57264;https=127.0.0.1:57264
SearchScopes: HKU\S-1-5-21-1437081656-3968728444-3903356693-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.condui…rchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-1437081656-3968728444-3903356693-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.condui…rchTerms}&SSPV=
2013-08-19 19:05 - 2013-08-19 19:05 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-08-19 19:00 - 2013-08-19 19:01 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-08-19 19:02 - 2013-08-19 19:03 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-08-19 19:00 - 2013-08-19 19:00 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-08-19 19:03 - 2013-08-19 19:04 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
Amazon Browser App (HKLM-x32\…\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon) <==== ATTENTION
BrowserSafeguard with RocketTab (HKLM-x32\…\Browsersafeguard) (Version:  - Browsersafeguard) <==== ATTENTION
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe
C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

When you’ve done all that, please run FRST again and send the new log.

Logs to include with next post:

Fixlog.txt
AdwCleaner log
New FRST.txt

Thanks

Satchfan

Hm, that found nothing so let's see what an online scan shows up.

Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or  Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:
  

  
  o    scan archives
  o    scan for potentially unsafe applications
  o    enable Anti-Stealth technology

  
  Note: Do not check Remove found threats
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  

  
  Note - if ESET doesn't find any threats, no report will be created.
   

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    Click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.
 

Thanks

Satchfan

Here it is:

That result is a "false-positive".

How is the computer now?

I logged in today and there was a message about unable to connect to SmartAudio. Not sure what that is or means

That is not a malware issue but have you tried uninstalling the Audio driver and reinstalling it?

To uninstall it open Device Manager:

• swipe in from the right edge of the screen, then tap Search, (If you're using a mouse, point to the bottom-right corner of the screen, move the mouse pointer up, then click Search)
• Type Device Manager in the search box and then click Device Manager
• click on the symbol next to “Sound”, right click on Conexant and then on uninstall
• click OK.

Then, go here and download and install the latest driver.

Let me know if that helps.
 

Hi exhaster

It has been several days since I sent my last set of instructions. Please let me know if you are having problems. 

If I don't hear from you within 24 hours I'll assume that all is still OK and close the topic.

Thanks

Satchfan