Bad infection [Solved]

Pop-ups, redirects, questionable sites trying to get me to download, underlined words.  Bleh.

 

I have Malwarebytes and AVG installed, but this still got past them.  Pretty sure one of the kids downloaded something they shouldn't have.

 

I tried to follow instructions and download the two programs suggested, but every time I tried to run the aswMBR program (5 times) it shuts my computer down or freezes it.  So, no files to give you from it.  Below is the Farbar files.

 

Thank you!

 

Hello Clstlg67 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested


There are a few strange entries in your logs but I’d like another couple of scans before dealing with them.

Run Zoek

Please temporarily disable your AV program.

Download zoek.exe to your Desktop:

Important: Disable your AntiVirus and AntiSpyware programs, so they do not interfere with the running of Zoek.exe. You can find instructions how to disable your security applications here.
 

• on Windows Vista, 7, 8 and 10, right-click Zoek.exe and select: Run as Administrator
• give it a few seconds to appear
• copy/paste the entire script inside the codebox below into the input field of Zoek:
  
  

  autoclean;
  emptyalltemp;
  emptyclsid;
  FFdefaults;
  iedefaults;
  chrdefaults;
  

 

• close any open programs.
• click the Run script button, and wait. It takes a few minutes to run.
• when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\
• if a reboot is needed, the log will be opened after the reboot.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan
• when it has finished, leave everything that was found checked, (ticked), then click on Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

Logs to include with next post:

zoek-results.log
AdwCleaner log

Thanks

Satchfan

 

I tried to run Zoek.  I started the scan at 10:32 this morning and it stalled.  As of 5:15 this afternoon, this is all that has happened.

 

Zoek.exe v5.0.0.1 Updated 27-09-2015
Tool run by Goodwin on Fri 03/31/2017 at 10:31:50.14.
Microsoft Windows 10 Home 10.0.14393  x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\Goodwin\Downloads\zoek(1).exe [Scan all users]   [Quick Scan]

===== Runcheck 10:32:40.03 =====

— Create Environment Variables 10:32:41.44
— Create System Restore Point 10:33:05.02
— Checking Input 10:33:55.77
— Recently Created 10:34:24.97
— StartUp Information 10:39:56.05
 

 

When I try to close the window, it just pops open again.  When I try to run it again–it says it is already running.  I tried to uninstall it, but it doesn't show up in my list of installed programs.
 

What is going on here?

OK…I tried it one more time and it worked.  **whew**
 
Logs are attached below.
 
Thank you.

Those got rid of some junk so let’s see what we have left now.

Run Farbar Recovery Scan Tool

 

Please run FRST again and make sure there is a checkmark next to "Addition.txt" before you hit ‘Scan’.

Logs to include with next post:

New Frst.txt
New Addition.txt

Thanks

Satchfan

Here you go.

Sorry for the delay but unfortunately I don't seem to be getting your replies - I'll look into it.

 

I'll look at your logs as soon as I can but won't be replying tonight, (It's 11pm GMT), and I'm busy tomorrow with family stuff but will get back as soon as I can.

 

Nina

Just managed to post this before I leave for a few hours.

 

 

There seems to be some confusion here about the security you have/had on your computer.

A quick glance at your logs shows that you have uninstalled AVG and have attempted to install some form of Norton: yet AVG still seems to be present.

If you want my help, I need you to do as I asked in my first post:

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I appreciate that you are anxious about getting this sorted out but, please make no further changes to your computer other than the directions I give to you.


Run Security Check

Download Security Check by screen317 from here.

• save it to your Desktop.
• double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• a Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

NOTE: If you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED!, try rebooting the system and then run SecurityCheck again.

Satchfan

I didn't do either.

I disabled AVG as requested for an earlier scan and didn't install anything other than what you have requested.

I did discover that we had McAfee on our computer (not sure when that happened…I didn't do it) and I disabled it as well when it was requested that I turn off or disable our AV.

???

I now need another new FRST scan after seeing the results of that log so please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit ‘Scan’.

Logs to include with next post:

Newest Frst.txt
Newest Addition.txt

Thanks

Satchfan

Done

Thanks

 

Same problem with our timing.

 

I'll have a look in the morning and send a reply as soon as I can.

Uninstall programs

Uninstall the following program:

BrowseForTheCause

 

===================================================

Run Norton Removal Tool

Please download and run this to remove remnants of Norton from your system.

===================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate Farbar Recovery Scan Tool
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

===================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM-x32\…\Run: [] => [X]
AutoConfigURL: [S-1-5-21-2247873678-407546785-3609120540-1001] => hxxp://noblok.org/wpad.dat?0b54e5a13011a1047af4c22b9f9501b226794952
ManualProxies: 0hxxp://noblok.org/wpad.dat?0b54e5a13011a1047af4c22b9f9501b226794952
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\.DEFAULT -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL =
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2247873678-407546785-3609120540-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll No File
FF Plugin HKU\S-1-5-21-2247873678-407546785-3609120540-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Goodwin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [No File]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\672336500.js [2017-03-23] <==== ATTENTION (Points to *.cfg file)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\672336500.cfg [2017-03-23] <==== ATTENTION
AVG Zen (Version: 1.113.1 - AVG Technologies) Hidden
Task: {0B742177-1988-4B83-AC86-A4C57BC54E6D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {0C99A53C-70D5-415A-8A17-9882292909E3} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {166FF7A1-C5CB-45A8-8F19-ACCDD45948A8} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {1A88DBA7-BD6D-4750-A0B5-5D474FBFEC0F} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {2A791789-F189-425B-BC21-0C9C430B2D01} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {2B097C45-09F4-4960-A797-01AA3E912864} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {4D215ECB-DA01-40DF-A220-E3602D7914F4} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {633F38EF-D95E-4D02-9B4B-998EDE80E999} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {64B6E592-E458-44F8-80D9-EA1A6F1895EF} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {715943B0-FF19-4EC1-B2D8-BE104D7600A6} - \WinZipBackGroundToolsTask -> No File <==== ATTENTION
Task: {874CA347-F92F-438D-A247-FD8F40BEC2DA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {889BC5A3-44B3-4188-A753-1272811BF6E6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {A9B94A90-EA26-47C9-BED7-8F772F563EDB} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {B623141E-B389-410E-A74A-2C04A70C17A4} - \WinZip Update Notifier -> No File <==== ATTENTION
Task: {BE6DD5D7-B8EF-4E1C-9E7E-43A47E66A504} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CDA25000-C0B5-4DEE-9EC7-5D84DE2457AD} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {E43761F9-C6B2-43C6-8984-567D667E30CB} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
FirewallRules: [{963D6C07-A7D6-4BF6-922F-ECF0D853056E}] => (Allow) C:\Program Files (x86)\iWin Games\WebUpdater.exe
FirewallRules: [{424CE373-0B54-4D85-8F29-FD76FCC0F8E5}] => (Allow) C:\Program Files (x86)\iWin Games\WebUpdater.exe
FirewallRules: [{DC1DEB77-97F2-428D-9AE9-AAF935864070}] => (Allow) C:\Program Files (x86)\iWin Games\iWinGames.exe
FirewallRules: [{E69F1964-40CB-4E7C-8FEE-FCDDCD60437A}] => (Allow) C:\Program Files (x86)\iWin Games\iWinGames.exe
C:\Program Files (x86)\iWin Games\WebUpdater.exe
CMD: ipconfig /flushdns
RemoveProxy:
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Run Malwarebytes Anti-Malware

Please download Malwarebytes Anti-Malware to your desktop.

• double-click mbam-setup- mb3-setup-consumer-3.0.4.exe and follow the prompts to install the program
• at the end, be sure a checkmark is placed next to the following
  • Launch Malwarebytes Anti-Malware
  • a 14 day trial of the Premium features is pre-selected: deselect this if you don’t want it, (it won’t diminish the scanning and removal capabilities of the program).
• click Finish.
• on the Dashboard, click Update Now
• after the update completes, click the Scan Now' button.
• if an update is available, clicking the Update Now button will update it
• a Threat Scan will begin.
• when the scan is complete, if malware has been detected, click Apply Actions to allow MBAM to clean what was found
• when the prompt to restart the computer appears, click Yes.
• after the restart once you are back at your desktop, open MBAM once more
• click on the “History” tab, the “Application Logs”
• double-click on the scan log which shows the date and time of the scan just performed.
• click Copy to Clipboard
• please paste the contents of the clipboard into your reply.

Logs to include with the next post:

Fixlog.txt
Mbam.txt

Can you tell me if there are any outstanding problems.

Satchfan

 

I tried to uninstall the BrowseFortheCause and it gave me an error window.

 

When I right click on Farbar, there is no cut option.

 

Sorry…will try again when I get home from work tonight.

OK:  keep me posted and we'll take it from there.