[pystryker]

Looking good, now let's check for rootkits, since aswMBR crashed on you earlier.


Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  
• Put a checkmark beside loaded modules.
  
  
• A reboot will be needed to apply the changes. Do it.
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
• Then click on Change parameters in TDSSKiller.
• Check all boxes then click OK.
• Click the Start Scan button.
  
  
• The scan should take no longer than 2 minutes.
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

[Advertisements]

IT says "page error" when i click the TDSSkiller link

[Jeremy N Jacqulin McMurray]

IT says "page error" when i click the TDSSkiller link

[pystryker]

Try this link and see if it brings up the page properly.

http://support.kaspe...viruses/utility

[Jeremy N Jacqulin McMurray]

"The page isn't redirecting properly"

[pystryker]

Ok, that's a new one on me. Try a different browser and let's see if that will work.

[Jeremy N Jacqulin McMurray]

Saying page can't be displayed on a different browser

[pystryker]

Ok, let's try a different approach and tool then.


Please download Malwarebytes AntiRootkit and save it to your desktop.

Full instructions how to use MBAR
Please note: This is a beta version so please be sure to read the disclaimer and note of it.

• Unzip/unrar MBAR in a folder to your Desktop and MBAM shall run ...

• Click on Next > then on Update button to download fresh definitions.


• When database updates click Next

• In the following window ensure "Targets" scan for Drivers; Sectors; System are ticked. Then select "Scan button"


• If an infection/s are found ensure "Create Restore Point" is checked, then select the "Cleanup Button" to remove threats.
Or if you are sure any entries should not be kept, just untick them. A list of infected files will be listed.


• The Clean up procedure will be Scheduled for process.
• When complete pop-up will show you. Select the Yes button and the system should re-boot to complete the cleaning process.

>> Please attach the two following logs from the mbar folder:

system-log.txt
and
mbar-log-year-month-day (hour-minute-second).txt.

[Jeremy N Jacqulin McMurray]

It said no malware found

[pystryker]

Very well, let's run a scan for remnants and check for out of date programs.

Please disable your antivirus for the duration of my instructions. Don't forget to re-enable them after you have completed the steps.


Step 1: Scan with Malwarebytes


Please download Malwarebytes Anti-Malware to your desktop
Install the progamme and select update
Once it has updated select Settings > Detection and Protection
Tick Scan for rootkits



Go back to the Dashboard and select Scan Now



If threats are detected, click the Apply Actions button, MBAM will ask for a reboot.





On completion of the scan (or after the reboot) select View Detailed Log
Select Export > Select text file and save to the desktop



Step 2: Scan with ESET Online Scanner


Please note: You can use Internet Explorer or Firefox for this step. Either browser used will have to be ran in admin mode.

Right click on either the Internet Explorer icon or the Firefox icon in the Start Menu or Quick Launch Bar on the Task bar and select Run as Administrator from the menu.

If you use Firefox, you will be prompted to download esetsmartinstaller_enu.exe. Please do so, then double click it to install it.

Please click on this link and then click the ESET Online Scanner bar ---->

• Select the option YES, I accept the Terms of Use then click on Start
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked.
• Make sure that the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
• Scan for potentially unwanted applications
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology
• Now click on Start
• The virus signature database will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically. The scan may take several hours.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• Now click on Finish
• Use notepad to open the logfile located at C:\Program Files(x86)\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Step 3: SecurityCheck Scan


Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Things I need to see in your next post:

• ESET Scan Log
• MBAM Log
• SecurityCheck Log

[Jeremy N Jacqulin McMurray]

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK

 

 

 

I can't figure out where the log is for malware bytes, it didn't open one after it scanned

 

 

 

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Java™ 6 Update 20  
 Java version out of Date!
 Adobe Flash Player 13.0.0.214  
 Mozilla Firefox (29.0.1)
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 

[Jeremy N Jacqulin McMurray]

<?xml version="1.0" encoding="UTF-16"?>

<mbam-log>

<header><date>2014/05/26 22:16:26 -0500</date><logfile>mbam-log-2014-05-26 (22-16-23).xml</logfile><isadmin>yes</isadmin></header>

<engine><version>2.00.2.1012</version><malware-database>v2014.05.27.03</malware-database><rootkit-database>v2014.05.21.01</rootkit-database><license>free</license><file-protection>disabled</file-protection><web-protection>disabled</web-protection><self-protection>disabled</self-protection></engine><system><osversion>Windows 7 Service Pack 1</osversion><arch>x64</arch><username>Pebbles</username><filesys>NTFS</filesys></system><summary><type>threat</type><result>completed</result><objects>274203</objects> <time>894</time><processes>0</processes><modules>0</modules><keys>4</keys><values>3</values><datas>0</datas><folders>3</folders><files>8</files><sectors>0</sectors></summary><options><memory>enabled</memory><startup>enabled</startup><filesystem>enabled</filesystem><archives>enabled</archives><rootkits>enabled</rootkits><deeprootkit>disabled</deeprootkit><heuristics>enabled</heuristics><pup>enabled</pup><pum>enabled</pum></options><items><key><path>HKU\S-1-5-21-1161006839-941228008-44157736-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF190686-9E72-403C-B99D-682ABDB63C5B}</path><vendor>PUP.Optional.TopArcadeHits.A</vendor><action>success</action><hash>46c9e66ea9d275c166b7b6aeba48659b</hash></key><key><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}</path><vendor>PUP.Optional.Adpeak</vendor><action>success</action><hash>d23de56f502bef47ec8aa3240ef545bb</hash></key><key><path>HKLM\SOFTWARE\WOW6432NODE\WOW6432NODE\Adpeak, Inc.</path><vendor>PUP.Optional.Adpeak</vendor><action>success</action><hash>32dd97bd2a51280e69997657d0338f71</hash></key><key><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Scorpion Saver</path><vendor>PUP.Optional.Adpeak</vendor><action>success</action><hash>050a14408fecc0767d1ff6b1c939c937</hash></key><value><path>HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}</path><valuename/><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata/><hash>23ec8bc9c4b7270fe19ecb662bd7c23e</hash></value><value><path>HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS</path><valuename>{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}</valuename><vendor>PUP.Optional.SweetPacks</vendor><action>success</action><valuedata>C:\Program Files\Updater By SweetPacks\Firefox</valuedata><hash>23ec8bc9c4b7270fe19ecb662bd7c23e</hash></value><value><path>HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}</path><valuename>DisplayName</valuename><vendor>PUP.Optional.Adpeak</vendor><action>success</action><valuedata>Level Quality Watcher</valuedata><hash>d23de56f502bef47ec8aa3240ef545bb</hash></value><folder><path>C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn</path><vendor>PUP.Optional.DealPly.A</vendor><action>success</action><hash>df3070e4eb908aac479df87fca38c937</hash></folder><folder><path>C:\Users\Pebbles\AppData\Local\GreatArcadeHits</path><vendor>PUP.Optional.GreatArcadeHits.A</vendor><action>success</action><hash>967996bee398c076f31f94e454aecc34</hash></folder><folder><path>C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\oclgomenfkljhfkfflghppidonpkljjg</path><vendor>PUP.Optional.ScorpionSaver</vendor><action>success</action><hash>9b745df786f5b086761d96e244be35cb</hash></folder><file><path>C:\ProgramData\ReadOnlyInstaller.msi</path><vendor>PUP.Optional.WeCare.A</vendor><action>success</action><hash>a06fd084ec8f42f43e97cb53e719ac54</hash></file><file><path>C:\temp\scorpionsaver.exe</path><vendor>PUP.Optional.ScorpionSaver</vendor><action>success</action><hash>080783d12f4cb28496e18f97d82c12ee</hash></file><file><path>C:\temp\ScorpionSaver.msi</path><vendor>PUP.Optional.Adpeak</vendor><action>success</action><hash>0609e66e07746cca75ddda100cf737c9</hash></file><file><path>C:\Windows\Installer\MSI6852.tmp</path><vendor>PUP.Optional.SmartBar</vendor><action>success</action><hash>20ef173d592289adaf69b47a986853ad</hash></file><file><path>C:\Windows\Installer\258f6a7f.msi</path><vendor>PUP.Optional.Adpeak</vendor><action>success</action><hash>fe111a3a4e2d0234a766eb00e221c63a</hash></file><file><path>C:\Windows\Installer\258f6a80.msi</path><vendor>PUP.Optional.SmartBar.A</vendor><action>success</action><hash>c24d3f15c4b739fde1f868bf629eaa56</hash></file><file><path>C:\Users\Pebbles\AppData\Local\GreatArcadeHits\gahff.xpi</path><vendor>PUP.Optional.GreatArcadeHits.A</vendor><action>success</action><hash>967996bee398c076f31f94e454aecc34</hash></file><file><path>C:\Users\Pebbles\AppData\Local\GreatArcadeHits\GAHUninstaller.exe</path><vendor>PUP.Optional.GreatArcadeHits.A</vendor><action>success</action><hash>967996bee398c076f31f94e454aecc34</hash></file></items>

 

</mbam-log>

[Jeremy N Jacqulin McMurray]

<?xml version="1.0" encoding="UTF-8"?>

<logs><record toVersion="2014.5.21.1" name="Rootkit Database" last_modified_tag="cb0bcf34-d074-47c5-9cfa-aa5734bceb2c" fromVersion="2014.2.20.1" systemname="PEBBLES-PC" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-26T22:14:59.298120-05:00" LoggingEventType="1" severity="debug"/><record toVersion="2014.5.27.3" name="Malware Database" last_modified_tag="b5b030bc-96c6-419d-85c0-3777bcd96420" fromVersion="2014.3.4.9" systemname="PEBBLES-PC" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-26T22:15:41.254179-05:00" LoggingEventType="1" severity="debug"/>

</logs>

[Jeremy N Jacqulin McMurray]

Well, I searched my PC for the logs, I hope thats what you need.

[pystryker]

Hi

Open MBAM and click on the History button at the top. When the menu opens, click on Application Logs and then there should be the one log from the scan you ran.

Put a check mark in the box and then click on View, then Export and select Text.file

When the window opens, give it the name MBAM and select the Desktop at the location to save it at. Click Save and it will tell you your file has been successfully exported.

Locate the file on your desktop and use notepad to open it, and please post it.

[Jeremy N Jacqulin McMurray]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/26/2014
Scan Time: 10:16:26 PM
Logfile: fff.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.05.27.03
Rootkit Database: v2014.05.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Pebbles

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 274203
Time Elapsed: 14 min, 54 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.TopArcadeHits.A, HKU\S-1-5-21-1161006839-941228008-44157736-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF190686-9E72-403C-B99D-682ABDB63C5B}, Quarantined, [46c9e66ea9d275c166b7b6aeba48659b],
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}, Quarantined, [d23de56f502bef47ec8aa3240ef545bb],
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\WOW6432NODE\Adpeak, Inc., Quarantined, [32dd97bd2a51280e69997657d0338f71],
PUP.Optional.Adpeak, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Scorpion Saver, Quarantined, [050a14408fecc0767d1ff6b1c939c937],

Registry Values: 3
PUP.Optional.SweetPacks, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}, Quarantined, [23ec8bc9c4b7270fe19ecb662bd7c23e],
PUP.Optional.SweetPacks, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}, C:\Program Files\Updater By SweetPacks\Firefox, Quarantined, [23ec8bc9c4b7270fe19ecb662bd7c23e]
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}|DisplayName, Level Quality Watcher, Quarantined, [d23de56f502bef47ec8aa3240ef545bb]

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.DealPly.A, C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn, Quarantined, [df3070e4eb908aac479df87fca38c937],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits, Quarantined, [967996bee398c076f31f94e454aecc34],
PUP.Optional.ScorpionSaver, C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\oclgomenfkljhfkfflghppidonpkljjg, Quarantined, [9b745df786f5b086761d96e244be35cb],

Files: 8
PUP.Optional.WeCare.A, C:\ProgramData\ReadOnlyInstaller.msi, Quarantined, [a06fd084ec8f42f43e97cb53e719ac54],
PUP.Optional.ScorpionSaver, C:\temp\scorpionsaver.exe, Quarantined, [080783d12f4cb28496e18f97d82c12ee],
PUP.Optional.Adpeak, C:\temp\ScorpionSaver.msi, Quarantined, [0609e66e07746cca75ddda100cf737c9],
PUP.Optional.SmartBar, C:\Windows\Installer\MSI6852.tmp, Quarantined, [20ef173d592289adaf69b47a986853ad],
PUP.Optional.Adpeak, C:\Windows\Installer\258f6a7f.msi, Quarantined, [fe111a3a4e2d0234a766eb00e221c63a],
PUP.Optional.SmartBar.A, C:\Windows\Installer\258f6a80.msi, Quarantined, [c24d3f15c4b739fde1f868bf629eaa56],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits\gahff.xpi, Quarantined, [967996bee398c076f31f94e454aecc34],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits\GAHUninstaller.exe, Quarantined, [967996bee398c076f31f94e454aecc34],

Physical Sectors: 0
(No malicious items detected)


(end)

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/26/2014
Scan Time: 10:16:26 PM
Logfile: ddddd.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.05.27.03
Rootkit Database: v2014.05.21.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Pebbles

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 274203
Time Elapsed: 14 min, 54 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.TopArcadeHits.A, HKU\S-1-5-21-1161006839-941228008-44157736-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{CF190686-9E72-403C-B99D-682ABDB63C5B}, Quarantined, [46c9e66ea9d275c166b7b6aeba48659b],
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}, Quarantined, [d23de56f502bef47ec8aa3240ef545bb],
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\WOW6432NODE\Adpeak, Inc., Quarantined, [32dd97bd2a51280e69997657d0338f71],
PUP.Optional.Adpeak, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Scorpion Saver, Quarantined, [050a14408fecc0767d1ff6b1c939c937],

Registry Values: 3
PUP.Optional.SweetPacks, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}, Quarantined, [23ec8bc9c4b7270fe19ecb662bd7c23e],
PUP.Optional.SweetPacks, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}, C:\Program Files\Updater By SweetPacks\Firefox, Quarantined, [23ec8bc9c4b7270fe19ecb662bd7c23e]
PUP.Optional.Adpeak, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{19DC5AB8-0792-4875-8F1B-896C5A9CE6AE}|DisplayName, Level Quality Watcher, Quarantined, [d23de56f502bef47ec8aa3240ef545bb]

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.DealPly.A, C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojcgaoafcmbadjkfdippkdddgkeaipbn, Quarantined, [df3070e4eb908aac479df87fca38c937],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits, Quarantined, [967996bee398c076f31f94e454aecc34],
PUP.Optional.ScorpionSaver, C:\Users\Pebbles\AppData\Local\Google\Chrome\User Data\Default\Extensions\oclgomenfkljhfkfflghppidonpkljjg, Quarantined, [9b745df786f5b086761d96e244be35cb],

Files: 8
PUP.Optional.WeCare.A, C:\ProgramData\ReadOnlyInstaller.msi, Quarantined, [a06fd084ec8f42f43e97cb53e719ac54],
PUP.Optional.ScorpionSaver, C:\temp\scorpionsaver.exe, Quarantined, [080783d12f4cb28496e18f97d82c12ee],
PUP.Optional.Adpeak, C:\temp\ScorpionSaver.msi, Quarantined, [0609e66e07746cca75ddda100cf737c9],
PUP.Optional.SmartBar, C:\Windows\Installer\MSI6852.tmp, Quarantined, [20ef173d592289adaf69b47a986853ad],
PUP.Optional.Adpeak, C:\Windows\Installer\258f6a7f.msi, Quarantined, [fe111a3a4e2d0234a766eb00e221c63a],
PUP.Optional.SmartBar.A, C:\Windows\Installer\258f6a80.msi, Quarantined, [c24d3f15c4b739fde1f868bf629eaa56],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits\gahff.xpi, Quarantined, [967996bee398c076f31f94e454aecc34],
PUP.Optional.GreatArcadeHits.A, C:\Users\Pebbles\AppData\Local\GreatArcadeHits\GAHUninstaller.exe, Quarantined, [967996bee398c076f31f94e454aecc34],

Physical Sectors: 0
(No malicious items detected)


(end)