fbstatic-a.akamaihd.net [Closed]

I cleared the browser cache. Did not reset the browser settings because of password etc. loss until I know I must do this.

After I posted my first board message, I used the tools provided by WTT to obtain the logs for your review. This instantly eliminated the fbstatic-a.akamaihd.net visible scrolling bar from the bottom left corner of the Facebook log in page. I was able to log into Facebook with no further issue and my system has been running much faster since.

Here are log results. I am so thankful to have your help with this issue. Please help me rid my system from anything you deem threatening.

Hello again Nala.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner
• when it has finished, select Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Download and run Junkware Removal Tool

[external image: thisisujrt.gif] Please download Junkware Removal Tool to your desktop.

• shut down your protection software now to avoid potential conflicts.
• run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator"
• the tool will open and start scanning your system
• please be patient as this can take a while to complete depending on your system's specifications
• on completion, a log (JRT.txt) is saved to your desktop and will automatically open
• post the contents of JRT.txt into your next message.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

• save it to your Desktop
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

When you’ve done the above, please run FRST again and send the new log

Logs to include with next post:

AdwCleaner log
JRT.txt
Checkup.txt
Frst.txt

Thanks

Satchfan

That cleaned up a lot but unfortunately one or more of the identified infections is known to use a backdoor trojan known as ZeroAccess, a particularly nasty rootkit infection.

This allows hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of its backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS.

Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

These infections can possibly be cleaned, but it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting both system partitions and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, If you decide to go through with the cleanup, please proceed with the following steps:

================================================

Run Farbar Recovery Scan Tool

Farbar Recovery Scan Tool is in your Downloads folder. It’s a good idea to move it to your desktop otherwise future fixes may not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.


Open notepad (Start >All Programs > Accessories > Notepad). Please copy the entire contents of the code box below and paste it into Notepad.

URLSearchHook: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 - (No Name) - {f4c28532-b9d0-4950-a2df-e83f9929242b} - C:\Program Files\MyFunCards_5m\bar\1.bin\5mSrcAs.dll No File
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://www.bing.com/…rc=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {d48efd2d-1c0c-4d68-bbc3-2f219c756723} URL =
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {E22D2942-636A-4FAB-AE76-63F24DDBECC1} URL =
SearchScopes: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> {F3F92588-AF51-4B46-9EA9-CCD5DE246D63} URL =
Toolbar: HKLM - No Name - {210f1b36-3b7f-41a4-b5da-3eb87f5a56c2} -  No File
Toolbar: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-1766275910-2450894708-632072239-1000 -> No Name - {25E2E5C9-C43C-4EE8-B23E-4383915F2BCE} -  No File
FF HKLM\…\Firefox\Extensions: [5mffxtbr@MyFunCards_5m.com] - C:\Program Files\MyFunCards_5m\bar\1.bin
FF HKU\S-1-5-21-1766275910-2450894708-632072239-1000\…\Firefox\Extensions: [{07433EEA-AEA0-461F-AB9F-35D67476BA7E}] - C:\Users\Janelle\AppData\Local\{07433EEA-AEA0-461F-AB9F-35D67476BA7E}
FF Extension: XULRunner - C:\Users\Janelle\AppData\Local\{07433EEA-AEA0-461F-AB9F-35D67476BA7E} [2011-03-12]
U3 Winsock; no ImagePath
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 Lavasoft Kernexplorer; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
2015-08-04 20:09 - 2015-08-04 20:10 - 05831179 _____ (Piriform Ltd) C:\Users\Janelle\Downloads\9AA6.tmp
2015-07-31 17:27 - 2015-07-31 17:27 - 00000000 ____D C:\Users\Janelle\AppData\Local\Skype
2011-03-12 05:10 - 2011-05-10 01:08 - 0001034 _____ () C:\Users\Janelle\AppData\Local\Mdebukijaduxoxu.dat
2011-03-12 05:10 - 2011-05-10 01:08 - 0000000 _____ () C:\Users\Janelle\AppData\Local\Mwuda.bin
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
C:\Users\Janelle\AppData\Local\{07433EEA-AEA0-461F-AB9F-35D67476BA7E}
C:\Users\Janelle\AppData\Local\{07433EEA-AEA0-461F-AB9F-35D67476BA7E} [2011-03-12]
C:\Users\Janelle\Downloads\9AA6.tmp
C:\Users\Janelle\AppData\Local\Skype
C:\Users\Janelle\AppData\Local\{ef8a5bbf-5833-eadd-22ca-66c158232ebe}
C:\Users\Janelle\AppData\Local\Google\Desktop\Install
C:\Program Files\Google\Desktop\Install
C:\Program Files\MyFunCards
C:\Users\Janelle\AppData\Local\{07433EEA-AEA0-461F-AB9F-35D67476BA7E}
C:\Program Files\Lavasoft\Ad-Aware
EmptyTemp:

NOTE: this script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

================================================

Please run these in the order requested.

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan
  • only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
  • then click Continue > Reboot now
• copy and paste the log in your next reply.
  • A copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.  

Link 1
Link 2

**Note:  It MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.

• when finished, it will produce a report for you.  
• please post the C:\ComboFix.txt in your next post.

Please also remember to include (Fixlog.txt) and the TDSSKiller log

Thanks

Satchfan