Needing help removing a Virus! PGCC-MARKET-ADV. [Closed]

Some years ago i downloaded a program and my Google Chrome seems to became infected by some source of Virus which makes pages to load with advertisement. This is very stressfull specially when im working. "pgcc.market-adsvisor.net" Its the page which loads and after some spanish advertisement .

Im totally new to this forum but hope somebody can help me!

Hi

It has been a couple of days since I replied to your request for help with your computer problems.

Please let me know if you are having problems and still need help.

Thanks

Satchfan

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.htmland start a new topic

Has i posted before, some years ago i downloaded a program and my Google Chrome seems to became infected by some source of Virus which makes pages to load with advertisement. This is very stressfull specially when im working. "pgcc.market-adsvisor.net" Its the page which loads and after some spanish advertisement .

I'll follow the recomendations @Satchfan gave me for now.

ps: Sorry about the late reply, i didnt have much free time this week 'coz of university. Eitherway ill process as you told me @Satchafn

This topic has been re-opened at the request of the user.

I'll wait for the logs but in future please let me know if your reply will be delayed, as I too am busy.

Satchfan

P2P - I see you have P2P software, (uTorrent ), installed on your machine.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

You have some nasty stuff on your computer and it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

Please see this topic for more information:

P2P File Sharing Risks.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Download/run Rkill:

Please download Rkill from one of the following links and save to your Desktop:

Please download Rkill from one of the following links and save to your Desktop:

Link One
Link Two
Link Three
Link Four

• on Windows XP double-click on the Rkill desktop icon to run the tool
• on Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
• a black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully
• if not, delete the file, then download and use the one provided in Link 2
• if it does not work, repeat the process and attempt to use one of the remaining links until the tool runs
• if the tool does not run from any of the links provided, please let me know
• do not reboot the computer or you will need to run the application again
• please leave Rkill on the Desktop until otherwise advised.

Note: If your security software warns about Rkill, please ignore and allow the download to continue.

================================================

Uninstall programs

Please uninstall these programs:

360 Total Security
pgcchelper

• click Start, Control Panel, Programs and Features
• click on 360 Total Security and then Uninstall
• repeat this for pgcchelper.

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:

• start Malwarebytes-Anti-Malware and update it, (“Update” tab}
• once it is updated, click on “Scan” tab, select Threat Scan, then click Scan.
• when the scan is complete, if no malicious items are found you can close the program
• if malicious items are found be sure that everything is checked and click Quarantine
• when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• copy and paste the contents of that report in your next reply and exit MBAM.

NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

When you’ve done the above, please run FRST again and make sure there is a checkmark next to "Addition.txt" before you hit “Scan”.

Logs to include with the next post:

Mbam.txt
New Frst.txt
New Addition.txt

Satchfan

Unnistaled: uTorrent, 360 Total Security and pgcchelper

According to you last log, uTorrent is still installed.


There is evidence that there was illegal software on your system, (AutoKMS), and, if this had not been deleted, helping you would be in direct breach of forum rules. However, as it appears that it has been deleted we’ll carry on.


You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: F - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: G - G:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {2091109a-ec9b-11e2-81bf-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {209110a1-ec9b-11e2-81bf-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {3354c7d3-b65f-11e1-85c4-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {3354c7da-b65f-11e1-85c4-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {555db868-c42c-11e1-986e-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {555db87a-c42c-11e1-986e-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {6d39009a-89cd-11e3-81a6-e89a8f044043} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {7dff1801-042d-11e3-99f7-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {7ee67c48-ab5d-11e1-9c37-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {814e09fc-06a0-11e3-bfb8-e89a8f044043} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {839edb36-bef0-11e1-a7f6-e89a8f044043} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d65fc-be0d-11e1-a6d5-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d660c-be0d-11e1-a6d5-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d660f-be0d-11e1-a6d5-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d661e-be0d-11e1-a6d5-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d6634-be0d-11e1-a6d5-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d6647-be0d-11e1-a6d5-001e101f6c04} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {870d6654-be0d-11e1-a6d5-001e101f6c04} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {98b68ef4-8cf3-11e4-a1d6-e89a8f044043} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b1170f08-b665-11e1-aaae-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b128d9d0-79a3-11e1-ad2b-e89a8f044043} - G:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b128d9d7-79a3-11e1-ad2b-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b4e4fd6e-06b5-11e3-bc4e-e89a8f044043} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b75cbd4f-4c49-11e2-845e-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b75cbd60-4c49-11e2-845e-001e101f859f} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b75cbd95-4c49-11e2-845e-001e101f859f} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {b75cbda6-4c49-11e2-845e-001e101f859f} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {c905ad93-7dc4-11e1-9435-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {c905ada5-7dc4-11e1-9435-e89a8f044043} - G:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {d1598edb-052f-11e3-9b91-e89a8f044043} - F:\AutoRun.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {e5eb2800-7dd1-11e1-ba79-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {f61ffaa6-b6cc-11e1-8026-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {f61ffaa9-b6cc-11e1-8026-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {f61ffaab-b6cc-11e1-8026-e89a8f044043} - F:\StartVMCLite.exe
HKU\S-1-5-21-2217298813-2927578935-920386982-1000\…\MountPoints2: {fed48f45-b0e5-11e1-bdfc-e89a8f044043} - F:\StartVMCLite.exe
AppInit_DLLs-x32: c:\windows\jaksta\ac\x86\jaudcap.dll => No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {F11F3195-DB15-4386-AC80-13C6FE576B53} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKLM-x32 -> {6F601FA8-C974-4DA2-BE97-D0382BB0B5AD} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
BHO: AllCHeApPrice -> {A26C1ADD-E1BD-E1E3-22F8-2342C59EF108} -> C:\ProgramData\AllCHeApPrice\ALdqClzjI.x64.dll => No File
BHO: GreAatsaveR -> {F8F6BED2-3F26-FA29-32C4-4F4312546BF4} -> C:\Program Files (x86)\GreAatsaveR\WAcF.x64.dll => No File
BHO-x32: No Name -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [No File]
FF Extension: No Name - C:\Program Files (x86)\360\Total Security\safemon\webprotection_firefox [not found]
FF Extension: SNT - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\yb2m6y23.default\Extensions\[removed] [2014-01-21] [not signed]
CHR Extension: (Proteção de Internet do 360) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\glcimepnljoholdmjchkloafkggfoijh [2015-11-09]
S3 Tosrfcom; no ImagePath
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [X]
2015-12-01 21:59 - 2015-12-01 21:59 - 00000000 ____D C:\Users\Toshiba\AppData\Local\Nico Mak Computing
2015-11-09 14:47 - 2015-11-09 14:48 - 29489272 _____ C:\Users\Toshiba\Downloads\360TSE_Setup_7.2.0.1021.exe
2015-12-04 04:35 - 2015-07-24 17:12 - 00000000 ____D C:\Program Files (x86)\360
2015-12-04 03:02 - 2012-11-22 09:51 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\uTorrent
2015-12-01 05:46 - 2015-10-19 11:21 - 00000000 __SHD C:\ProgramData\360Quarant
2015-12-01 05:46 - 2015-10-19 11:21 - 00000000 __SHD C:\$360Section
Task: {9346C268-CD96-4219-8C67-49FBCEAB905C} - \Advanced System Protector -> No File <==== ATTENTION
Task: {9B3310F2-D7F4-46F4-A512-0DCD5104F759} - \SomotoUpdateCheckerAutoStart -> No File <==== ATTENTION
Task: {E6FAC7B6-2217-4DDE-AFBE-7173CCF1C606} - \AutoKMS -> No File <==== ATTENTION
FirewallRules: [TCP Query User{38F6D9A2-CE4C-46B2-A499-08113283FB65}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{37CCD958-FF84-4CC6-8232-E2E9ED329674}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{95AB5361-25DB-4309-A133-A04AAF97A500}C:\users\toshiba\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\toshiba\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{D95D58B6-1C05-42A0-9D16-60BE980B2CC2}C:\users\toshiba\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\toshiba\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{0A980D26-E7A6-4AB3-95A0-42F0C2889334}C:\windows\kmsemulator.exe] => (Allow) C:\windows\kmsemulator.exe
FirewallRules: [UDP Query User{2D19EB68-9D96-44F3-B62E-8378FBADD90D}C:\windows\kmsemulator.exe] => (Allow) C:\windows\kmsemulator.exe
FirewallRules: [{2F249B5F-838D-4E2C-851A-87B11B5E65F0}] => (Allow) C:\Users\Toshiba\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{01D02FD0-5539-4CFE-A53B-731C88D880C2}] => (Allow) C:\Users\Toshiba\AppData\Local\iLivid\iLivid.exe
FirewallRules: [{0953B0C3-891E-4B6C-A354-1043B9A09CCF}] => (Allow) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
FirewallRules: [{D8FE5899-54B4-4D87-9197-DB63F890B9B8}] => (Allow) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
FirewallRules: [{A79857CB-DC6C-48E9-8C9F-7D0826AF659E}] => (Allow) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
FirewallRules: [{D6F4E693-D20B-417C-AA5F-CE518A4A2D20}] => (Allow) C:\Program Files\360\360 Internet Security\safemon\360Tray.exe
FirewallRules: [{73A5BCB0-0F35-48F5-83B6-D728B899E017}] => (Allow) C:\Program Files\360\360 Internet Security\UpTip.exe
FirewallRules: [{D94AC79C-2BAE-4084-8452-B286D758DAEC}] => (Allow) C:\Program Files\360\360 Internet Security\UpTip.exe
FirewallRules: [{82B04690-14F7-41A9-BDD3-B6B04B0D6640}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
FirewallRules: [{2D18A4BA-DBDE-4B8B-BF06-C8B10AD9A84F}] => (Allow) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
C:\Users\Toshiba\AppData\Roaming\0AZ2B6673Windows.bat
C:\Users\Toshiba\AppData\Roaming\33KM2IMTW2Windows.bat
C:\Users\Toshiba\AppData\Roaming\9ZTCUM5SCSVACLhehe.exe
C:\Users\Toshiba\AppData\Roaming\bitlord_log.txt
C:\Users\Toshiba\AppData\Roaming\L1QHUAXhehe.exe
C:\Users\Toshiba\AppData\Roaming\ZFKOXZ6DODAWindows.bat
C:\Users\Toshiba\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Toshiba\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Toshiba\AppData\Local\Temp\jre-8u60-windows-au.exe
C:\Users\Toshiba\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\Toshiba\AppData\Local\Temp\Quarantine.exe
C:\Users\Toshiba\AppData\Local\Temp\rnsetup0.exe
C:\Users\Toshiba\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Toshiba\AppData\Local\Temp\stubhelper.dll
C:\Users\Toshiba\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Toshiba\AppData\Local\Temp\{3CC7CDA1-51B3-4D59-87CF-EF76109A212C}-42.0.2311.90_41.0.2272.118_chrome_updater.exe
C:\Users\Toshiba\AppData\Local\Temp\{5B312002-9617-46A7-8B31-53337E079C2C}-41.0.2272.89_40.0.2214.115_chrome_updater.exe
C:\Users\Toshiba\AppData\Local\Temp\{694DE23C-2511-4F9C-841F-19C0054DC42A}-40.0.2214.115_chrome_installer.exe
C:\Users\Toshiba\AppData\Local\Temp\{8BDA707E-0BEA-46F0-8339-C016E4EA3C5F}-39.0.2171.95_chrome_installer.exe
C:\Users\Toshiba\AppData\Local\Temp\{903CA3B2-3591-4D28-A8A2-E774059B7BD3}-40.0.2214.115_chrome_installer.exe
C:\Users\Toshiba\AppData\Local\Temp\{E4D00499-5580-4A1B-85D1-50CB0D137A40}-42.0.2311.90_41.0.2272.118_chrome_updater.exe
C:\Program Files (x86)\uTorrent\uTorrent.exe
C:\windows\kmsemulator.exe
C:\Users\Toshiba\AppData\Local\iLivid
C:\Program Files\360
EmptyTemp:
CMD: ipconfig /flushdns

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log (Fixlog.txt); please post it to your reply.

Logs to include with next post:

Fixlog.txt

Can you tell me if there are any remaining problems.

Thanks

Satchfan

Well done on following the instructions so well.

Let’s run an online scan to be sure nothing is left and if that’s clear I’ll send instructions to tidy up.


Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or  Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Run Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:
  

  
  o    scan archives
  o    scan for potentially unsafe applications
  o    enable Anti-Stealth technology

  
  Note: Do not check Remove found threats
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  

  
  Note - if ESET doesn't find any threats, no report will be created.
   

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found.
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here.
 

Thanks

Satchfan

 

Hi

It has been several days since I asked you to run an Eset scan.

Please let me know the result and we can then tidy up

Thanks