What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Flash Player redirect virus/Webpage not available (connection timed o

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

Hugh, first let me apologize for the confusion in this thread.  I have been removing Malware on this forum for close to 13 years and its one of the best on the internet. TB-Psychoic is no longer with us on this forum  as a helper so I will be assisting you 

 

Your last FRST scan shows that you removed the cracked software, please understand that this is your computer and I cant tell you what do to do, I can just advise, but almost 100% of cracked software is infected, do the math, why does some one want to crack office and give it to you for free  :smack:

 

I can see by your last FRST log that a lot or all of it has been removed, you still have a file running as a service to bypass Microsoft Office but we can deal with that later, lets do this

 

 
-AdwCleaner-by Xplode
 
Click on this link to download : ADWCleaner TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers
 
 
Do not click on any links in the top Advertisment.
 
[external image: AdwCleaner4.201_zpsxrbk2llq.jpg]
 
  •  
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
 
 
===============================================================================
 
 
 
[external image: thisisujrt.gif] Please download Junkware Removal Tool TO YOUR DESKTOP
  •  
  • Download the one from Bleeping Computer
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
 
 
 
 
===============================================================================
 
Download Malwarebytes' Anti-Malware  TO YOUR DESKTOP
 
  •  
  • Windows XP : Double click on the icon to run it.
  • Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
 
 
[external image: 0841859c-1a35-4dbd-b41a-e720629e3e22_zps]
 
  •  
  • On the Dashboard click on Update Now
  • Go to the Setting Tab
  • Under Setting go to Detection and Protection
  • Under PUP and PUM make sure both are set to show Treat Detections as Malware
  • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  • Then on the Dashboard click on Scan
  • Make sure to select THREAT SCAN
  • Then click on Scan
  • When the scan is finished and the log pops up…select Copy to Clipboard
  • Please paste the log back into this thread for review
  • Exit Malwarebytes
 
Post #17

Oh wow,i just want my computer cleaned  :banana:

I got most of the software from my cousin who brings it via CD's,i don't even know if they're pirated or not :P

 

Before i do anything funky,how do i save something to my desktop?

Post #19

Dont knock yourself out trying to save that file to your desktop if your unable to , if need be after you download it we can move it, go ahead and download and run the scans

Post #20
Adwcleaner log:
 
 
# AdwCleaner v5.003 - Logfile created 26/08/2015 at 01:12:33
# Updated 20/08/2015 by Xplode
# Database : 2015-08-25.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x86)
# Username : User - USER-PC
# Running from : C:\Users\User\Downloads\AdwCleaner.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
 
***** [ Files ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
[-] Key Deleted : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec
[-] Key Deleted : HKCU\Software\Conduit
 
***** [ Web browsers ] *****
 
 
*************************
 
:: Proxy settings cleared
:: Winsock settings cleared
 
########## EOF - C:\AdwCleaner\AdwCleaner[C7].txt - [711 bytes] ##########
 
 
 
 
 
 
 
 
 
 
 
 
 
Here's the JRT log:
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.7 (08.18.2015:1)
OS: Windows 7 Ultimate x86
Ran by [removed] on sri 26.08.2015 at  1:26:11,69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Tasks
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
 
 
~~~ Chrome
 
 
[C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
 
[C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
 
[C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
 
[C:\Users\User\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on sri 26.08.2015 at  1:27:24,75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
 
 
 
 
 
Malwarebytes anti-malware log:
 
 
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 26.8.2015
Scan Time: 1:33
Logfile: fh.txt
Administrator: Yes
 
Version: 2.1.8.1057
Malware Database: v2015.08.25.07
Rootkit Database: v2015.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: User
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 300055
Time Elapsed: 10 min, 34 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Deep Rootkit Scan: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 0
(No malicious items detected)
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)
Post #22

Right now everything is fine,and it has been for like 10 days but i'm concerned because 2 months ago i had the virus,tried to remove it,it disappeared and after like 2-3 weeks it came back.

I didn't clean anything but it disappeared.Maybe if the programs Psychotic told me to download cleaned it?

Before discovering this site i snooped around the appData files and deleted whatever seemed suspicious that was new,but that worked for a couple of minutes,then the redirect came back.

Then i posted on here and in the meantime of posting things the virus just disappeared.

Post #23

Hugh, lets run a free online virus scanner, I have seen this run in an hour or so and some systems it may take longer so lets do it when you have time, it may pick up something we missed

 

As far as appData files, unless you know exactly what they are I would leave them alone, you dont want to delete a file thats legit and needed by windows to run

 

 
ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan
 
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
 
 
  •  
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
  • Click the [external image: esetOnline.png] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    •  
  • Click on [external image: esetSmartInstall.png] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: esetSmartInstallDesktopIcon.png] icon on your desktop.
 
  • Check [external image: esetAcceptTerms.png]
  • Click the [external image: esetStart.png] button.
  • Accept any security warnings from your browser.
  • Check [external image: esetScanArchives.png]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: esetListThreats.png]
  • Push [external image: esetExport.png], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: esetBack.png] button.
  • Push [external image: esetFinish.png]
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.
Post #24

Here it is:

 

C:\AdwCleaner\Quarantine\C\Program Files\DAEMON Tools Toolbar\uninst.exe.vir a variant of Win32/Adware.Toolbar.Shopper.AE application cleaned by deleting - quarantined
 
Hmmm,i wonder what the problem is?  :scratch:
Post #26

Right now everything is fine,but at the time of posting this i got redirected to a fake adobe flash player update site,i.e. when visiting anything starting with youtube.com or facebook.com i got redirected.On certain sites it didn't redirect,like this one.

While trying to solve it through this site it just disappeared,but i'm worried because it disappeared before and then came back,i didn't download or install anything in the meantime.

I also found a folder full of porn pictures (LOL) i think it downloaded .

Before posting on this site i tried cleaning it myself with free trials of hitman pro and such programs,but it kept randomly coming back.

Then i tried deleting some files out of AppData (i looked up what each one does) and that only solved the problem temporarily or it stopped redirecting me from certain sites.

In short: the virus disappeared without me cleaning it.

Post #27

When you fool around downloading anything with the torrents your just leaving your self wide open to getting infected, not all but the greater percentage of files and programs downloaded via the torrents are infected, you never know, its like playing Russian Roulette malware and viruswise, I would not allow anyone in my family to use that on anyone of my systems.

 

Lets do this, I will leave this thread open for you for maybe 3 days or so, post back and let me know if the problem came back. If the thread is closed just send me a PM and I will reopen it for you and we can dig deeper if need be

 

Double click on AdwCleaner.exe to run the tool again.
  •  
  • Click on the Uninstall button.
  • Click Yes when asked are you sure you want to uninstall.
  • Both AdwCleaner.exe, its folder and all logs will be removed.
 
 
 
==========================================================
 
 
Please download DelFix and save the file to your Desktop.
 
[external image: DelFix_zps139e2ea1.jpg]
 
  •  
  • Windows XP Double Click DelFix.exe to run the program. 
  • Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR 
  • Checkmark " Remove Disinfection Tools"
  • Click the Run button
 
 
This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI