Jump to content

Welcome to Geeks to Go
Geeks to Go Welcome
Create Account Login to Account
Photo

Removal instructions for Dotdo FastInternet

- - - - -
Started by Metallica , Mar 02 2016 07:07 AM

  • Please log in to reply
No replies to this topic

#1
Metallica
Posted 02 March 2016 - 07:07 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Content is republished with permission from Malwarebytes.

What is Dotdo FastInternet?

The Malwarebytes research team has determined that Dotdo FastInternet is adware. These adware applications display advertisements not originating from the sites you are browsing.
This one uses a very obnoxious proxy hijack to accomplish that.

How do I know if my computer is affected by Dotdo FastInternet?

You may see this added to the properties of your Chrome shortcuts:

shortcut.png

and these greyed out proxy options in Chrome and Internet Explorer:

Chrome.png

proxy.png

You may also find this entry in your list of installed software:

warning4.png

How did Dotdo FastInternet get on my computer?

Adware applications use different methods for distributing themselves. This particular one was bundled with other software.

How do I remove Dotdo FastInternet?

Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted program.
This proxy hijacker however blocks access to every official downloadlocation for Malwarebytes software.
If you do not have Malwarebytes Anti-Malware installed and you are having trouble downloading it due to this infection, here is what you need to do:
  • Find the file C:\a\hho.txt
  • Rightclick that file and choose Edit
  • Remove all the text from that file and replace it with dotap.dotdo.net
  • Then click File > Save
  • Once you have done this you should be able to reach www.malwarebytes.org/mwb-download/
  • On that site scroll down to the Download button
  • Please download Malwarebytes Anti-Malware to your desktop.
  • Double-click mbam-setup-version.exe and follow the prompts to install the program.
  • At the end, be sure a check-mark is placed next to the following:
    • Enable free trial of Malwarebytes Anti-Malware Premium
    • Launch Malwarebytes Anti-Malware
  • Then click Finish.
  • If an update is found, you will be prompted to download and install the latest version.
  • Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
  • When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
  • Reboot your computer if prompted.
Is there anything else I need to do to get rid of Dotdo FastInternet?
  • No, Malwarebytes' Anti-Malware removes Dotdo FastInternet completely.
  • In some cases this PUP creates some scheduled tasks. You can read here how to check for and, if necessary, remove Scheduled Tasks.
How would the full version of Malwarebytes Anti-Malware help protect me?

We hope our application and this guide have helped you eradicate this adware application.

As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Dotdo FastInternet adware. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.

protection1.png


and it blocks the connections this adware tries to make.

protection2.png


Technical details for experts

You may see these signs in FRST logs:
 () C:\a\internetport3.exe
 () C:\a\wincheckfe.exe
 () C:\a\wcheckf.exe
 () C:\a\winonit.exe
 () C:\a\getcap.exe
 HKLM\...\Run: [cutoauto] => C:\a\wincheckfe.exe [54806 2014-11-10] ()
 HKLM\...\Run: [interpee] => C:\a\internetport3.exe [10752 2015-03-18] ()
 HKLM-x32\...\Run: [cutoauto] => C:\a\wincheckfe.exe [54806 2014-11-10] ()
 HKLM-x32\...\Run: [interpee] => C:\a\internetport3.exe [10752 2015-03-18] ()
 HKCU\...\Run: [rutoauto] => 55198178.bat
 HKCU\...\Run: [dutoauto] => C:\a\wincheckfe.exe [54806 2014-11-10] ()
 HKCU\...\Run: [interpee] => C:\a\internetport3.exe [10752 2015-03-18] ()
 Startup: C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\intr.lnk [2016-03-02]
 ShortcutTarget: intr.lnk -> C:\a\49359444.bat ()
 HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 1 <======= ATTENTION (Restriction - ProxySettings)
 ProxyEnable: [HKLM] => Proxy is enabled.
 ProxyEnable: [HKLM-x32] => Proxy is enabled.
 ProxyServer: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
 ProxyServer: [HKLM-x32] => http=127.0.0.1:8877;https=127.0.0.1:8877
 AutoConfigURL: [HKLM] => http=127.0.0.1:8877;https=127.0.0.1:8877
 ProxyEnable: [S-1-5-21-1350903546-318028887-1286703239-1003] => Proxy is enabled.
 ProxyServer: [S-1-5-21-1350903546-318028887-1286703239-1003] => http=127.0.0.1:8877;https=127.0.0.1:8877
 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
 HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
 FF user.js: detected! => C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\user.js [2016-03-02]
 C:\Users\{username}\Desktop\Google Chrome.lnk
 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
 C:\Users\{username}\AppData\Local\yuntnani
 C:\a
 C:\Program Files (x86)\FastInternet
 C:\Users\Public\Desktop\Google Chrome.lnk

FastInternet (HKLM\...\FastIn) (Version:  - Dotdo)
C:\Users\{username}\AppData\Local\Temp\nsq72C3.tmp\System.dll
FirewallRules: [{29546615-7973-4000-83D3-A1BEF1481E2A}] => (Allow) C:\a\internetport3.exe
FirewallRules: [{DCC315BA-74B1-42C1-B7BA-E0B88F475B12}] => (Allow) C:\a\internetport3.exe
FirewallRules: [{3A2C8D29-6D20-4187-B80C-996FFC4B3D0C}] => (Allow) C:\a\getcap.exe
FirewallRules: [{B816BD0A-CE52-490D-9007-1C7A8274E849}] => (Allow) C:\a\getcap.exe
FirewallRules: [{00399994-9DB9-4B76-A91E-5023384E1710}] => (Allow) C:\a\wincheckfe.exe
FirewallRules: [{28087A57-F6E0-46D9-9D8C-C87AB72BFE48}] => (Allow) C:\a\wincheckfe.exe
FirewallRules: [{D258FFE7-67C8-4751-BE7E-85E27ABB79C4}] => (Allow) C:\a\winonit.exe
FirewallRules: [{08F487BD-A93A-424B-A698-94D1A69E314F}] => (Allow) C:\a\winonit.exe
FirewallRules: [{0A4EB1C8-4AEF-4C04-96EE-230C2B46305C}] => (Allow) C:\a\wcheckf.exe
FirewallRules: [{36A74AA3-6E53-4ED8-AD45-DBD24A827C5F}] => (Allow) C:\a\wcheckf.exe
FirewallRules: [{35F0EBCF-CF0F-4959-BDAC-CB77E583F6F2}] => (Allow) C:\a\vchk.exe
FirewallRules: [{BE3388BB-92EC-4B38-B09A-4686FE70B1F7}] => (Allow) C:\a\vchk.exe
FirewallRules: [{9FBC8041-6006-4B47-A4DE-59A588DBA5D5}] => (Allow) C:\a\wLdKLx2g6HErgUhQ6wJi.exe
FirewallRules: [{1BE9A65A-D1A4-4AE8-B626-C49BA42649A0}] => (Allow) C:\a\wLdKLx2g6HErgUhQ6wJi.exe

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --proxy-server=http=127.0.0.1:8877
ShortcutWithArgument: C:\Users\{username}\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --proxy-server=http=127.0.0.1:8877
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --proxy-server=http=127.0.0.1:8877
ShortcutWithArgument: C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --proxy-server=http=127.0.0.1:8877
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --proxy-server=http=127.0.0.1:8877
Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\a
       Adds the file 41r3zwGKNm.exe"="3/1/2016 6:55 PM, 827881 bytes, A
       Adds the file 49359444.bat"="3/2/2016 12:57 PM, 147 bytes, A
       Adds the file 7za.exe"="11/18/2010 5:27 PM, 587776 bytes, A
       Adds the file ayyyyy.txt"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file FiddlerCore.dll"="11/13/2013 9:56 PM, 358912 bytes, A
       Adds the file getcap.exe"="3/16/2015 3:18 PM, 353386 bytes, A
       Adds the file hho.txt"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file install.txt"="3/2/2016 12:57 PM, 1 bytes, A
       Adds the file internetport3.exe"="3/18/2015 4:55 AM, 10752 bytes, A
       Adds the file logff.txt"="3/2/2016 12:57 PM, 0 bytes, A
       Adds the file loogg1.txt"="3/2/2016 12:57 PM, 0 bytes, A
       Adds the file loogg2.txt"="3/2/2016 12:58 PM, 456 bytes, A
       Adds the file ukey.ini"="3/2/2016 12:57 PM, 27 bytes, A
       Adds the file uniquewLdKLx2g6HErgUhQ6wJi.ini"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file uur.txt"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file vchk.txt"="3/20/2015 9:13 PM, 900 bytes, A
       Adds the file ver.ini"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file vv.txt"="3/2/2016 12:57 PM, 7933 bytes, A
       Adds the file wcheckf.exe"="4/9/2015 2:44 PM, 54308 bytes, A
       Adds the file wincheckfe.exe"="11/10/2014 12:33 AM, 54806 bytes, A
       Adds the file winonit.exe"="3/18/2015 4:17 AM, 53942 bytes, A
       Adds the file wLdKLx2g6HErgUhQ6wJi.exe"="3/2/2016 12:57 PM, 7933 bytes, A
    Adds the folder C:\Program Files (x86)\FastInternet
       Adds the file app.exe"="12/30/2014 2:19 PM, 34053 bytes, A
       Adds the file dotuninstall.exe"="12/30/2014 2:36 PM, 34181 bytes, A
    Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
       Adds the file Google Chrome.lnk"="3/2/2016 12:59 PM, 2172 bytes, A
    Adds the folder C:\Users\{username}\AppData\Local\yuntnani
       Adds the file vchk.exe = 3/2/2016 8:36 AM, 56752 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
       Alters the file Google Chrome.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
       Alters the file Google Chrome.lnk
    In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
       Adds the file intr.lnk"="3/2/2016 12:57 PM, 647 bytes, A
    In the existing folder C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default
       Adds the file user.js"="3/2/2016 12:57 PM, 35 bytes, A
    In the existing folder C:\Users\Public\Desktop
       Alters the file Google Chrome.lnk
    In the existing folder C:\Windows\SysWOW64
       Adds the file 55198178.bat"="4/16/2015 2:23 PM, 19 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
       "ProxyEnable"="REG_DWORD", 1
       "ProxyOverride"="REG_SZ", "<-loopback>"
       "ProxyServer"="REG_SZ", "http=127.0.0.1:8877;https=127.0.0.1:8877"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
       "cutoauto"="REG_SZ", "C:\a\wincheckfe.exe"
       "interpee"="REG_SZ", "C:\a\internetport3.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastIn]
       "DisplayName"="REG_SZ", "FastInternet"
       "Publisher"="REG_SZ", "Dotdo"
       "UninstallString"="REG_SZ", "C:\Program Files (x86)\FastInternet\dotuninstall.exe"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel]
       "Proxy"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings]
       "ProxySettingsPerUser"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
       "DisableAntiSpyware"="REG_DWORD", 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings]
       "ProxyEnable"="REG_DWORD", 1
       "ProxyOverride"="REG_SZ", "<-loopback>"
       "ProxyServer"="REG_SZ", "http=127.0.0.1:8877;https=127.0.0.1:8877"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
       "cutoauto"="REG_SZ", "C:\a\wincheckfe.exe"
       "interpee"="REG_SZ", "C:\a\internetport3.exe"
Malwarebytes Anti-Malware log:
Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/2/2016
Scan Time: 1:10 PM
Logfile: mbamDotdoProxyHijacker.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.03.02.03
Rootkit Database: v2016.02.27.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {username}

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 368108
Time Elapsed: 5 min, 42 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 7
Trojan.Agent, C:\a\wincheckfe.exe, 2560, Delete-on-Reboot, [15e6760c9aff51e5f9581e4a50b202fe]
PUP.Optional.DotDo, C:\a\getcap.exe, 2732, Delete-on-Reboot, [4eade39f693040f63d632dd39d657d83]
PUP.Optional.Clicker.ChrPRST, C:\a\internetport3.exe, 4068, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, C:\a\wcheckf.exe, 4076, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, C:\a\wincheckfe.exe, 2560, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, C:\a\winonit.exe, 3448, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.ProxyHijacker, C:\Users\{username}\AppData\Local\yuntnani\vchk.exe, 3532, Delete-on-Reboot, [7a81d0b20495191d711a4cb8887bb14f]

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FastIn, Quarantined, [29d286fccdcc9f97baefea1a0df607f9], 

Registry Values: 14
Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cutoauto, C:\a\wincheckfe.exe, Quarantined, [15e6760c9aff51e5f9581e4a50b202fe]
Trojan.Agent, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cutoauto, C:\a\wincheckfe.exe, Quarantined, [15e6760c9aff51e5f9581e4a50b202fe]
Trojan.Agent, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|dutoauto, C:\a\wincheckfe.exe, Quarantined, [15e6760c9aff51e5f9581e4a50b202fe]
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|interpee, C:\a\internetport3.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|interpee, C:\a\internetport3.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|interpee, C:\a\internetport3.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cutoauto, C:\a\wincheckfe.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|cutoauto, C:\a\wincheckfe.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUP.Optional.Clicker.ChrPRST, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|dutoauto, C:\a\wincheckfe.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5]
PUM.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:8877;https=127.0.0.1:8877, Quarantined, [34c7d6acabeec86e9827c83cb54ef907]
PUP.Optional.Clicker.ChrPRST, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FASTIN|Publisher, Dotdo, Quarantined, [f803354d801995a13d6fea1a37ccad53]
PUM.Optional.ProxyHijacker, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:8877;https=127.0.0.1:8877, Quarantined, [af4c542ecfcac472605fbb49b84b5ea2]
PUM.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:8877;https=127.0.0.1:8877, Quarantined, [ad4ef38f03968caa5d6114f05ba82bd5]
PUP.Optional.MultiPlug.PrxySvrRST, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|rutoauto, 55198178.bat, Quarantined, [06f583fffa9f80b65747da8fba4a06fa]

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.Clicker.ChrPRST, C:\Program Files (x86)\FastInternet, Delete-on-Reboot, [29d286fccdcc9f97baefea1a0df607f9], 
PUP.Optional.Clicker.ChrPRST, C:\a, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.ProxyHijacker, C:\Users\{username}\AppData\Local\yuntnani, Delete-on-Reboot, [7a81d0b20495191d711a4cb8887bb14f], 

Files: 30
Trojan.Agent, C:\a\wincheckfe.exe, Delete-on-Reboot, [15e6760c9aff51e5f9581e4a50b202fe], 
PUP.Optional.DotDo, C:\a\getcap.exe, Delete-on-Reboot, [4eade39f693040f63d632dd39d657d83], 
PUP.Optional.DotDo, C:\Users\{username}\Desktop\lkqimotph0.exe, Quarantined, [f10a5e24fc9dc274b9e78a7625dd7987], 
PUP.Optional.DotDo, C:\Program Files (x86)\FastInternet\app.exe, Quarantined, [55a6d6acadec44f21985857b31d1ba46], 
PUP.Optional.Clicker.ChrPRST, C:\Program Files (x86)\FastInternet\dotuninstall.exe, Quarantined, [29d286fccdcc9f97baefea1a0df607f9], 
PUP.Optional.Clicker.ChrPRST, C:\a\7za.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\41r3zwGKNm.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\49359444.bat, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\ayyyyy.txt, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\FiddlerCore.dll, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\hho.txt, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\install.txt, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\internetport3.exe, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\logff.txt, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\loogg1.txt, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\loogg2.txt, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\ukey.ini, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\uniquewLdKLx2g6HErgUhQ6wJi.ini, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\uur.txt, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\vchk.txt, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\ver.ini, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\vv.txt, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\wcheckf.exe, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\wincheckfe.exe, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\winonit.exe, Delete-on-Reboot, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.Clicker.ChrPRST, C:\a\wLdKLx2g6HErgUhQ6wJi.exe, Quarantined, [7388f78be0b9bb7b377308fcfc074bb5], 
PUP.Optional.MultiPlug.PrxySvrRST, C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\intr.lnk, Quarantined, [41ba2b573f5a40f6445093d65da7df21], 
PUP.Optional.MultiPlug.PrxySvrRST, C:\Windows\SysWOW64\55198178.bat, Quarantined, [06f583fffa9f80b65747da8fba4a06fa], 
PUP.Optional.ProxyHijacker, C:\Users\{username}\AppData\Local\yuntnani\vchk.exe, Delete-on-Reboot, [7a81d0b20495191d711a4cb8887bb14f], 

Physical Sectors: 0
(No malicious items detected)


(end)
As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.
  • 0

Advertisements

Back to Malware Removal Guides and Tutorials


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Malware Removal Guides and Tutorials

As Featured On:

featured
Malware Removal How to Guides Windows 7 System Building Download Files Register welcome

Never used a forum? Learn how.