need help removing totaldperformance/tradeadexchange virus [Solved]

Not a lot showing really but we’ll clean up a bit and run another scan which will hopefully clear it up.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1973459036-702736670-631739545-1000\…\Run: [AdobeBridge] => [X]
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll No File
BHO: No Name -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} ->  No File
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll No File
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

===================================================

Download zoek.exe to your Desktop:
Important: Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.
 

• on Windows Vista, 7, and 8, right-click Zoek.exe and select: Run as Administrator
• give it a few seconds to appear
• copy/paste the entire script inside the codebox below into the input field of Zoek:
  

  createsrpoint;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns
  

• close any open programs.
• click the Run script button, and wait. It takes a few minutes to run.
• when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
• if a reboot is needed, the log will be opened after the reboot.

Can you tell me how your computer is now.

Satchfan

Hopefully it has gone but we'll run a couple more scans to be sure and if they are OK I'll send instructions to tidy up.

Download Malwarebytes-Anti-Malware

Click here.

• double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7 users, please right-click and select “Run as Administrator”)
• select the “Scan” tab at the top
• there are three scan types; choose Threat Scan, then click on Scan
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or  Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:
  

  
  o    scan archives
  o    scan for potentially unsafe applications
  o    enable Anti-Stealth technology

  
  Note: Do not check Remove found threats
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
  

  Note - if ESET doesn't find any threats, no report will be created.
   

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found,
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    Click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.
 

Logs to include with the next post:

Mbam.txt
Eset result

Can you tell me if there are any outstanding problems.

Satchfan

And of course, it's still not gone. I clicked, and suddenly there it was.

so I got sony vegas pro way before the tradeadexchange thing started, and I'd rather not remove it unless absolutely necessary, just like cs6. The rest of that stuff though, go for it.

And of course, it's still not gone. I clicked, and suddenly there it was.

Do you mean tradeadexchange?
 

I got sony vegas pro way before the tradeadexchange thing started, and I'd rather not remove it unless absolutely necessary, just like cs6.

Your choice, but we don't condone the use of pirated software so if it is still on your system the next time you need help then you might have to remove it first. I have not included Sony vegas pro in the fix – that’s your choice to remove it or not.


Let's get rid of what Eset found.

Please copy all text in the code box below and paste it into Notepad:
 

@echo off
del /f /s /q "C:\Program Files (x86)\NCH Software\VideoPad\videopad.exe”
del /f /s /q "C:\Program Files (x86)\NCH Software\VideoPad\videopadsetup_v3.89"
del /f /s /q "C:\Users\User\AppData\Roaming\uTorrent\updates\3.4.1_31227.exe"
del /f /s /q "C:\Users\User\Downloads\DJ2540_188.exe"
del /f /s /q "C:\Users\User\Downloads\FreeVideoCallRecorder.exe"
del /f /s /q "C:\Users\User\Downloads\ScreenRecorderFree.exe"
del /f /s /q "C:\Users\User\Downloads\vpsetup.exe"
del /f /s /q "H:\uTorrent.exe"
del /f /s /q "H:\Downloads\Downloads.rar"
del %0

• save the Notepad file to your desktop and name it delfiles.bat
• save type as "All Files"
• on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).

Please let me know the current situation.

Satchfan

I did that, but tradeadexchange is still popping up on me. Any thing else to try before removing cs6 and sony vegas pro?

Let’s see if we can find it.

Please download SystemLook from one of the links below and save it to your Desktop.

SystemLook (32-bit)
SystemLook (64-bit)

• double-click SystemLook.exe to run it.
• copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:
  
  

  :folderfind
  *tradeadexchange*
  :filefind
  *tradeadexchange*
  :regfind
  tradeadexchange
  
  

• click the Look button to start the scan.
• when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

Hi Sapphire

It has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you are having problems and still need help.

Thanks

Satchfan
 

Yes, I am still having trouble. Sorry, got really busy with work and other things and lost track of how many days had passed.

SystemLook didn't find anything.

Sorry, got really busy with work and other things and lost track of how many days had passed.

 

Not a problem as long as you let me know you're busy but still around.

Is tradeadexchange the only problem remaining and if so, is this with all browsers or only Chrome?

Yeah, it's just tradeadexchange that's the problem now. I use chrome the majority of the time, but so far it hasn't happened when I use my other browsers.

I think the best way to deal with this is to re-install Chrome, (beats me why anybody uses it as we have so much trouble getting rid of its rubbish).


Uninstall/Reinstall Google Chrome

First save all your bookmarks/favourites.

• open Chrome, click on the 3 bars in the top right hand corner, select Bookmarks and then Bookmarks Manager
• click on Organise and then select Export Bookmarks to HTML file, then choose Desktop to save it
• again, click on the three bars in the top right hand corner and select Settings
• in the list of Settings under “Sign in” click on Disconnect your Google Account – (if “Disconnect your Google Account” is not there, you will have to sign in using your Chrome username and password first to make it visible)
• in the text of the next window click on “Google Dashboard” then, at the “Chrome sync” screen, click on Stop and Clear at the bottom
• a box will open and ask for confirmation, click on OK (wait for this to complete before doing the next step)
• when confirmation appears close that page and then click on Disconnect account
• shut Google Chrome, click on Start > Control Panel > Programs and Features (or Add/Remove Programs in XP) and uninstall Google Chrome. Select Everything for removal if asked.

Reboot the system and then reinstall Google Chrome from here

Repeat the process to reinstate your bookmarks by going to Bookmarks > Bookmarks Manager > Organise and select Import Bookmarks.

Satchfan