Infected [Closed]

Thanks for the logs.

I won't reply tonight as I have to get up for work early but try to get back in the morning.

Uninstall programs

Uninstall these programs if present:

PriceMinus
qone8 uninstaller
Popcorn Time

• click Start, Control Panel, Programs and Features
• click on quickpick and then on Uninstall. Repeat this for Popcorn Time.

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

(Company) C:\Program Files (x86)\Popcorn Time\Updater.exe
Startup: C:\Users\Oz Domer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\j6bIXtKRz.lnk [2015-07-03]
ShortcutTarget: j6bIXtKRz.lnk -> C:\Users\Oz Domer\AppData\Roaming\uSILlzCwXBSr\aQ1Vb72t.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKLM\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.goo…ice/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - https://clients2.goo…ice/update2/crx
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U4 vsserv; No ImagePath
S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X]
2015-07-03 17:37 - 2015-07-03 17:37 - 00000010 _____ C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache
2015-07-03 17:35 - 2015-07-03 17:35 - 00376926 _____ C:\Users\Oz Domer\AppData\Local\census.cache
2015-07-03 17:35 - 2015-07-03 17:35 - 00164929 _____ C:\Users\Oz Domer\AppData\Local\ars.cache
2015-06-17 16:42 - 2015-06-17 16:43 - 00000000 ____D C:\Users\Oz Domer\AppData\Local\PAYDAY 2
2015-07-06 00:24 - 2015-05-30 12:24 - 00000348 _____ C:\Windows\Tasks\Bidaily Synchronize Task[973b].job
2015-07-03 12:32 - 2015-05-30 13:07 - 00000000 ____D C:\Program Files (x86)\IObit
Task: {43024FC3-F7DB-4327-A1B9-075AE662C7A7} - System32\Tasks\Uninstaller_SkipUac_Oz_Domer => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Task: {69BA8751-80A7-4021-B0F2-10E7DF08EB24} - System32\Tasks\Bidaily Synchronize Task[973b] => c:\programdata\{861300b5-b777-7434-8613-300b5b7702d6}\2015.crack.rar.exe [2014-05-30] () <==== ATTENTION
Task: C:\Windows\Tasks\Bidaily Synchronize Task[973b].job => c:\programdata\{861300b5-b777-7434-8613-300b5b7702d6}\2015.crack.rar.exe <==== ATTENTION
FirewallRules: [{E4721311-5C5C-478C-A9CC-9DB41C84885D}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeUpdater.exe
FirewallRules: [{F8B45DE3-F4E1-4E1C-95E7-BBC839885F2C}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeUpdater.exe
FirewallRules: [TCP Query User{55C8E9A3-9BA8-47F3-ACA6-23A30CFE5254}C:\users\oz domer\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\oz domer\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [UDP Query User{EF90A6B3-22FE-4225-9217-FAA458C2AD11}C:\users\oz domer\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\oz domer\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [{D488212D-CD8E-482E-AA77-0E86672A9E47}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{F372E6E8-7C73-42D2-B904-608E08031BEF}] => (Allow) C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe
FirewallRules: [{83FAE7DC-1262-467B-8660-867CE1DC1AA8}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [{29710093-31B5-4BD2-9274-81016D2B3372}] => (Allow) C:\Program Files (x86)\Popcorn Time\Updater.exe
FirewallRules: [TCP Query User{795BCECD-98C2-443D-8E4C-420B9A2EC949}C:\program files (x86)\popcorn time\chromecast\node.exe] => (Block) C:\program files (x86)\popcorn time\chromecast\node.exe
FirewallRules: [UDP Query User{0D01FB29-B245-4ADE-8D39-3862447245B9}C:\program files (x86)\popcorn time\chromecast\node.exe] => (Block) C:\program files (x86)\popcorn time\chromecast\node.exe
C:\Users\Oz Domer\AppData\Local\sponge.last.runtime.cache
C:\Users\Oz Domer\AppData\Local\census.cache
C:\Users\Oz Domer\AppData\Local\ars.cache
C:\Program Files (x86)\IObit
C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
c:\programdata\{861300b5-b777-7434-8613-300b5b7702d6}
C:\Program Files (x86)\Popcorn Time
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

================================================
 

• Please download MGADiag by clicking here and save it to your desktop
• double click the [external image: diagicon.png] icon on your desktop
• push [external image: continue.png]
• push [external image: copy.png]
• go to Start -> Run and type in "Notepad"
• go to Edit -> Paste in notepad
• Copy and paste that log here.

================================================

Run CKScanner

Download CKScanner by askey127 from here & save it to your Desktop.

• double-click CKScanner.exe then click Search For Files
• when the cursor hourglass disappears, click Save List To File
• a message box will verify the file saved
• double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.

Logs to include in your next poat:

Fixlog.txt
MGDiag log
CKFiles.txt

Satchfan

Fixlog.txt:

Boot Mode: Normal

It appears that your version of Windows is not genuine, which you may or may not be aware of.

This forum, as all the other top malware removal forums, will NOT help anyone we suspect of having obtained their software illegally.

Should you replace it with a genuine version of Windows we’ll be pleased to help with any future problems.

Satchfan

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.htmland start a new topic