Audio ads

[Roaglaan]

My wife had a problem on her laptop with audio playing with no open programs that sound like ads, I followed instruction found in this thread

 

http://forums.malwarebytes.org/index.php?showtopic=130066&hl=%2Baudio#entry708772

 

Here is the log from step 2:

 

When I try to run mbar I get an error message: The dependency service or group failed to start. I will try to restart the laptop and try again.

 

Thank you in advance for any assistance.

 

-Roag

RKreport0_S_07302013_224839.txt

[AdvancedSetup]

Hello and

Please do the following.

Please download RKill from here

There are three buttons to choose from with different names on them, select the first one and save it to your desktop.

• Double-click on the Rkill desktop icon to run the tool if using Windows XP.
• If using Vista, Win 7, or Win 8 then right-click over it and choose "Run As administrator"
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
• If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
• If the tool does not run from any of the links provided, please let me know.

 

 

Then run RogueKiller again but do not quit it, leave it running.

Then run the following.


Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[Roaglaan]

Thank you for helping, here are the log files.

Addition.txt

FRST.txt

Rkill.txt

[AdvancedSetup]

Please uninstall McAfee Security Scan Plus from the Control Panel, Add/Remove
Also uninstall ALL versions of Java
 
Then run the following.
 
Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

[Roaglaan]

Here is the fixlog.

 

Fixlog.txt

[AdvancedSetup]

That looks good.  Please run the following.

STEP 01

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 02

Please download AdwCleaner by Xplode to your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• If prompted by the User Account Control click Yes to allow it to run.
• Under Actions click on the Delete button.
• Click OK on all prompts.
• You will be prompted to restart your computer. A text file will open after the restart.
• Please post the entire contents of that logfile to your next reply.
• You can find the logfile at C:\AdwCleaner[s1].txt where the number in brackets indicates how often it was run.

STEP 03

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.
 

 

[Roaglaan]

Here are the logs.

JRT.txt

Result.txt

AdwCleanerS1.txt

[AdvancedSetup]

Great, that looks good too.  More of those pesky items have been removed.

Please start MBAM and check for updates and do a Quick Scan and post back that log.

 

Next, download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

 

 

Then let me know how the computer is running and if you're still seeing any issues or not.

[Roaglaan]

Security Check finished but a notepad document did not open, I'll post the MBAM log.

 

The only issue now is Micro Trend Titanium service wont start, but that is a different forum.

protection-log-2013-08-01.txt

[AdvancedSetup]

That is a protection log which shows that you are still having IP blocks, unless this log is before you ran the other fixes.

 

Please reboot the computer again and then browse just a couple of sites after the reboot and then open MBAM and go to the Logs tab and open and send me the latest PROTECTION log that should have a date/time after you rebooted the computer.   Want to see if any IP blocks are still going on or not.

[Roaglaan]

I don't know if it means anything but I restarted and had to do a hard reset.

protection-log-2013-08-02.txt

[AdvancedSetup]

Well that's not good as you already got an IP block.  Could potentially be normal from an ad but let's run some other tools to make sure.

 

Please download the following scanner from Kaspersky and save it to your computer: TDSSkiller

Then watch the following video on how to use the tool and make sure to temporarily disable your security applications before running TDSSkiller.

PC Winvids - How to run Kaspersky TDSSKiller

If any infection is found please make sure to choose SKIP and post back the log in case of a False Positive detection.

Once the tool has completed scanning make sure to re-enable your other security applications.
 

[Roaglaan]

The ads are back, here is the log.

tdsskiller log.txt

[AdvancedSetup]

Please go ahead and create a new System Restore and then run TDSSKiller again and this time tell it to cure this:  Rootkit.Boot.Harbinger.a

 

Then post back the new log from TDSSKiller.

 

[Roaglaan]

Here is the log.

tdsskiller log.txt

[AdvancedSetup]

Great, please open MBAM and verify the current Protection log date and time (write it down)

 

Then reboot the computer one more time and then open MBAM and go to the Logs tab again and open the new current one after the reboot and post that one back please.

 

Then run the following

 

Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files
  

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.
 

[Roaglaan]

Here are the logs.

protection-log-2013-08-02.txt

Result.txt

[AdvancedSetup]

Doesn't look like we're out of the woods just yet.

 

 

Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.
  

 

[Roaglaan]

Here is the log.

ComboFix.txt

[AdvancedSetup]

Great that was able to remove some more for us.  Sort of like peeling an onion to get to the center of it all.

 

Now that those have run well let's have you run this again.

 

Please download AdwCleaner by Xplode to your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• If prompted by the User Account Control click Yes to allow it to run.
• Under Actions click on the Delete button.
• Click OK on all prompts.
• You will be prompted to restart your computer. A text file will open after the restart.
• Please post the entire contents of that logfile to your next reply.
• You can find the logfile at C:\AdwCleaner[s1].txt where the number in brackets indicates how often it was run.

 
 
 
Then run this
 
Next, download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

 

Thanks

[Roaglaan]

Here are the logs, I cant find the checkup.txt, should I run security check again?

AdwCleanerS2.txt

[AdvancedSetup]

Yes, please run security check again and also let me know how the computer is running now and if you're still experiencing any malware related issues or not.

 

Next, download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

 

[Roaglaan]

Here is the log. The only issue right now is internet explorer is not working properly, if I type an address into the address bar it will not load and if I pick from the favorites list it will not load either.

checkup.txt

[AdvancedSetup]

Please open Internet Explorer and go to Tools/Internet Options/Advanced and click on the Reset button.  Then quit Internet Explorer, then restart Internet Explorer.

Then see if it will function now or not and let me know.

[Roaglaan]

That did it, thank you.