Virus on Pc [Closed]

Hello everyone so I recently got a Russian virus called Искать в Интернетe. I tried using Malwarebytes and it found a few things but my computer is still much slower and I get pop ups in my browser. It didn't change my search engine or anything, not yet at least. It added like 3 other programs that I was able to just uninstall but i'm not sure if they're gone. After I did that on a custom scan and found out it didn't work, I downloaded HitMan Pro but that didn't work either. After that I decided to download Norton but I could not install it. It gave me an error tying to install it. It then told me to download Norton Power Eraser and it didn't let me install either, I got error right after it didn't work.

Norton Power Eraser Error: 0x80070005,n44,n66

Anyways if anybody could please help uninstall this please let me know much love <3

The virus is not gone because it is still opening new tabs.

It is still opening new tabs.

Is this happening in all browsers or just Chrome?

Please also post the Addition.txt log that was produced whe you ran FRST.

I won't reply again tonight as it's 11:15pm here, (GMT), but will get back as soon as I've had a chance to look at your logs.

Well I only have chrome and it opens a random tab maybe every 10 minutes but my antivirus blocks it.

Thanks.

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKU\S-1-5-21-1618345455-87854707-2869981398-1001\…\Run: [mailruhomesearch] => "C:\Users\oweez\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe" –pr_deferred
GroupPolicy: Restriction <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
S3 VMnetAdapter; \SystemRoot\system32\DRIVERS\vmnetadapter.sys [X]
2017-02-19 12:50 - 2017-02-19 12:51 - 164634056 _____ (Symantec Corporation) C:\Users\oweez\Downloads\NS-ESD-Def-22.8.1.14-EN.exe
2017-02-19 12:27 - 2017-02-19 12:27 - 03423928 _____ (Symantec Corporation) C:\Users\oweez\Downloads\NPE (1).exe
2017-02-19 12:25 - 2017-02-19 12:49 - 00000000 ____D C:\Users\oweez\AppData\Local\NPE
2017-02-19 12:25 - 2017-02-19 12:25 - 03423928 _____ (Symantec Corporation) C:\Users\oweez\Downloads\NPE.exe
2017-02-19 12:09 - 2017-02-19 13:10 - 00000000 ____D C:\Program Files (x86)\NortonInstaller
2017-02-19 12:09 - 2017-02-19 12:22 - 00000000 ____D C:\ProgramData\NortonInstaller
2017-02-19 12:08 - 2017-02-19 12:49 - 00000000 ____D C:\ProgramData\Norton
2017-02-19 12:08 - 2017-02-19 12:08 - 01100576 _____ (Symantec Corporation) C:\Users\oweez\Downloads\NSDeluxeDownloader.exe
2017-02-19 12:08 - 2017-02-19 12:08 - 00001307 _____ C:\Users\oweez\Desktop\Norton Installation Files.lnk
2017-02-19 12:08 - 2017-02-19 12:08 - 00000000 ____D C:\Users\Public\Downloads\Norton
2017-02-19 03:11 - 2017-02-19 03:11 - 00003764 _____ C:\WINDOWS\System32\Tasks\httpnewscrensbonsorgylodem
CustomCLSID: HKU\S-1-5-21-1618345455-87854707-2869981398-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-65D58E9596C6}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
Task: {348FC1C0-2194-4D5C-B1E7-E0AEDB1A4AB4} - \AutoPico Daily Restart -> No File <==== ATTENTION
Task: {9CA5762C-812A-408E-81BE-D56714D71478} - System32\Tasks\httpnewscrensbonsorgylodem => Chrome.exe hxxp://newscrensbons.org/ylodem
C:\Users\oweez\AppData\Local\Mail.Ru
C:Windows\System32\Tasks\httpnewscrensbonsorgylodem
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run CKScanner

Download CKScanner by askey127 from here & save it to your Desktop.

• double-click CKScanner.exe then click Search For Files
• when the cursor hourglass disappears, click Save List To File
• a message box will verify the file saved
• double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply.

Logs to include with next post:

Fixlog.txt
CKFiles.txt

Thanks

Satchfan

Hi oWeezy

It has been several days since I replied to your request for help with your computer problems.

Please let me know if you are having problems and still need help.

Thanks

Satchfan

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.htmland start a new topic