MPC Safe Navigation hijaclk [Solved]

Well done.

Let’s run an online scan to be sure nothing is left and if that’s clear I’ll send instructions to tidy up.


Run ESET Online Scan

Note: This may take a long time so please be patient.

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use Internet Explorer, FireFox or Chrome for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan

• click the Run Eset online Scanner button
• for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  

  
  o    click on esetinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  o    double click on the Eset installer icon on your desktop.
   

• check Yes, I accept the Terms of Use
• click the Start button
• accept any security warnings from your browser
• check Enable detection of potentially unwanted applications
• click Advanced settings and select the following:
  

  
  o    scan archives
  o    scan for potentially unsafe applications
  o    enable Anti-Stealth technology

  
  Note: Do not check Remove found threats
   

• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• when the scan completes, push List of found threats
• push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  

  
  Note - if ESET doesn't find any threats, no report will be created.
   

• push the back button.
• push Finish

When the scan is complete:

If no threats were found:

o    put a checkmark in "Uninstall application on close"
o    close program
o    report to me that nothing was found.
 

If threats were found:

o    click on "list of threats found"
o    click on "export to text file" and save it as ESET results and save to the desktop
o    click on back
o    put a checkmark in "Uninstall application on close"
o    click on finish
o    close program
o    copy and paste the report here
 

Thanks

Satchfan

I ran the scan twice and both times it froze when it was almost done…It did detect 63 problems but never got to the log part.

What went wrong?

Did you disable your antivirus before scanning?

Please look and see if a log was produced: it will be located here:

C:\Program Files\EsetOnlineScanner\log.txt.

So I ran the scan a few times and It kept crashing in roughly the same place so I scanned the computer in 2 sections. First I scanned the folder where it was crashing and it ran without any threats found, then I ran it with the one folder excluded and it ran to completion and here is the report, Maybe it was just too big or something timed out?

Thanks again for all your help!

Here is what popped up there was no folder for Eset in either program files or program files (x86)

C:\Users\Lauren Wagner\.frostwire5\updates\frostwire-6.1.5.windows.coc.premium.exe    a variant of Win32/OpenCandy.A potentially unsafe application    
C:\Users\Lauren Wagner\.frostwire5\updates\frostwire-setup.exe    a variant of Win32/InstallCore.ACZ potentially unwanted application    
C:\Users\Lauren Wagner\AppData\Local\Setup Wizard\b24245e4-b61c-4e24-9f97-013cdfc25175\driverscanner.exe    a variant of Win32/UniBlue.F potentially unwanted application    
C:\Users\Lauren Wagner\Desktop\rcsetup152.exe    Win32/Bundled.Toolbar.Google.D potentially unsafe application    
C:\Windows\Installer\MSI2DE7.tmp    a variant of Win32/Bundled.Toolbar.Ask.F potentially unsafe application    
C:\zoek_backup\C_Users_Lauren Wagner_AppData_Local_dsisetup1433302242.exe.vir    Win32/Adware.DsiLoad.A application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\AdbWinApi.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\AdbWinUsbApi.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\AdcManager.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\AndriodServer.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\BrowserPlugIn.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\CeBase.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Cleaner.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\CrashReport.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Database.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\isafechlp.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\LogReport.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\LpcManager.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MainFrame.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Monitor.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPC.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCAutoClean.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCBS.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCNews.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCProtectService.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MpcSafeDll.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MpcSafeDll64.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCSecurity.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCSetting.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCTray.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\MPCTray64.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\msvcm90.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Report.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\SafeNavi.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\SafeNavi64.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\SafeProtect.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\SetupFrame.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Support.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\TrayFrame.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Uninstall.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\UninstallFrame.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\UninstDelete.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Update.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\UpdateHost.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Upgrade.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Utility.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Web.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\WinService.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\xadb.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\XBus.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\XProcessBus.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\XSkin.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Drivers\MPCBase_32.sys    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Drivers\MPCKpt.sys    Win64/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Drivers\MPCKpt_vista_32.sys    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Drivers\MPCKpt_vista_64.sys    Win64/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Drivers\MPCKpt_xp_32.sys    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Exe\ADC_qd00000.exe    a variant of Win32/MPCCleaner.A potentially unwanted application    
C:\zoek_backup\C_PROGRA~2_MPC Cleaner\Microsoft.VC90.CRT\msvcm90.dll    a variant of Win32/MPCCleaner.A potentially unwanted application    
 

Well done on getting the scan done.Let’s clear up what was found by the scan.

Please copy all text in the code box below and paste it into Notepad:
 

@echo off
del /f /s /q "C:\Users\Lauren Wagner\.frostwire5\updates\frostwire-6.1.5.windows.coc.premium.exe”
del /f /s /q “C:\Users\Lauren Wagner\.frostwire5\updates\frostwire-setup.exe”
del /f /s /q "C:\Users\Lauren Wagner\AppData\Local\Setup Wizard\b24245e4-b61c-4e24-9f97-013cdfc25175\driverscanner.exe”
del /f /s /q "C:\Users\Lauren Wagner\Desktop\rcsetup152.exe”
del /f /s /q "C:\Windows\Installer\MSI2DE7.tmp”
del %0

• save the Notepad file to your desktop and name it delfiles.bat
• save type as "All Files"
• on your desktop, double-click on delfiles.bat to run it, (a black CMD window will flash, then disappear - this is normal).

The files/folders, if found, will have been deleted and the "delfile.bat" file will also be deleted.

The rest of the Online scan is only reporting backups created during the course of fixes can't cause any harm and will be removed when we tidy up.

Can you tell me how things are now and if there are any remaining problems.

Thanks

Things seem to be running fine now. IE Explorer is working as well. But I looked at the file locations and the files are still there, they did not get deleted? I manually deleted the files mentioned with the exception of the "C:\Windows\Installer\MSI2DE7.tmp”  as I could not find it. There wasn't even a Windows\Installer directory.

Those that were shown up by Eset and not removed will be dealt with now.

Well done; your computer appears to be clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall Combofix

Follow these steps to uninstall Combofix

• click START then RUN
• now type Combofix /uninstall in the runbox and click OK.

Note the space between the X and the /, it needs to be there.

🖼Click to load external image (CFuninstall.jpg)

• please follow the prompts to uninstall Combofix.
• once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.

===================================================

Uninstall AdwCleaner

• double click on adwcleaner.exe to run the tool
• click on Uninstall
• confirm with Yes.

===================================================

Download & run Delfix

• download Delfix from here to remove many of the tools we've used during the cleaning process.
• ensure “Remove disinfection tools” is checked.

Also place a checkmark next to:

o    Create registry backup
o    Purge system restore

• click the Run button.

You can delete all other logs and programs we’ve used that are on your desktop. Just click on them and press Delete.

===================================================

Update installed programs

Your version of Java is out-of-date and need to be removed and updated.

Having the latest updates and removing old versions ensures there are no security vulnerabilities in your system.

• click Start, Control Panel, Programs and Features.
• click on the following program and then on Uninstall:

Java 8 Update 25

If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

NEXT

Install the latest version of Java:

Java

NOTE – when you install Java, before clicking on Install, be sure to Uncheck “Install the Ask Toolbar and make Ask my default search provider”

🖼Click to load external image (Java.gif)

Even though I just had you get the latest version of Java, there is a vulnerability with regards to Java and web browsers. Therefore, we recommend to disable java in web browsers.

More information can be found here.

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

======================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

======================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

======================

Download WOT

Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

green if it's safe
yellow for caution
red for unsafe
 

You can download the WOT add-on for Firefox, Chrome, Internet Explorer, Opera, and Safari browsers. It does not slow down your browsing experience, it is easy to use and free. Just click “Download” and you are ready to go!

======================

MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

A couple of links with information here and here which can answer any questions you might have about installing/using it.

======================

Unchecky

Be careful when downloading free software. Many free programs come bundled with adware, many of which cause redirects/popups and verge on being malware. There is a program that automatically “unckecks” the boxes you may not notice when downloading programs.

Download and install Unchecky .

===================================================

I also recommend that you read the following:

Best Practices for Safe Computing - Prevention of Malware Infection by miekiemoes

Simple and easy ways to keep your computer safe and secure on the Internet  by Lawrence Abrams

I will keep this open for 24 hours in case you have any problems, after which I’ll close the topic.

Safe computing

Satchfan

Thanks for all of your help and helping people keep their computers clean!

You're welcome.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.