Jump to content

Snapdo.com

lethal1

By lethal1
in Resolved Malware Removal Logs

 Share

Recommended Posts

lethal1

lethal1

Posted
Posted

HI,

 

I have read the guides and the self help and done a search on the above topic and find no reference to it.,

 

This appears to affect mainly chrome and obviously blocks access to the known AV and download sites.

 

Has anyone got a suggestion regarding how to rid ones PC of it?

 

I believe I got it from downloading one of two peices of software from cnet.download.com...so much for their guarantee of virus & malware free downloads!

 

Appreciate any advise

 

regards lethal1

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum, please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

Hi MrC, thanks for your advises.

 

I have done as you asked to this point, and look forward to your advises...

 

Further the notification I have set up may be being compromised by my username being an old (5 yrs +) email address...as i didnt get a notification from your inital post...

 

I have asked for advise on this as well (changing the email associated with the username...which also needs to change), in the interim i will re check this thread perioodically

 

regards

 

lethal1

 

 

dds.zip

RKreport0_S_08202013_112022.txt

attach.zip

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please uninstall these from your add/remove programs:
Facemoods Toolbar
flybuys Toolbar
Glarysoft Toolbar

Then..........

Please download AdwCleaner from here and save it on your Desktop.
 

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

  • Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  • Now click on the Search tab.
  • Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:
Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.
If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.




Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.


MrC

Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

Hi again MrC,

 

Thanks for the update and advise.

 

I have removed the toolbars specified from add/remove (though I note from the log file below glarysoft toolbar remains in part).

 

I have attached the *.txt log file, as requested.

 

In regard to the folders I can see nothing that I would find an issue with if we removed it, apart from tunewiki.

 

I dont use Antivir webguard, nor regard the ask toolbar as much more than spam....some disagree.

The same goes for avg secure search.

 

Thanks agin for your advise to date and look forward to the next,..

 

regards

 

Lethal1

 

AdwCleanerR1.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

We can't pick and choose with this AdwCleaner, is tunewiki something you can reinstall when we're done??

If so......

Lots of adware found....lets clear it out.....

  • Please re-run AdwCleaner
  • Click on Delete button.
  • Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......

thisisujrt.gif Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Last.........

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

Hi MrC,

 

Logs and other files now attached after following your advises/directions above (thanks).

 

Only notable issue was the errors that displayed whlist running JRT, though my lack of familarity with this software oculd be the issue.

 

I have re-checked what was triggering the appearance of snapdo (in chrome) and this no longer occurs, however i dont beliveve chrome is acting as it should (not saving home page for example)

 

thanks again and look forward to hearing from you, after you have had a chance to examine the attached.

 

regards

Lethal1

mbam-log-2013-08-21 (00-11-10).txt

JRT1.txt

AdwCleanerS1.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

For Chrome...........

First make sure you have the latest version of Chrome:

Open up Chrome > Click on the 3 bars in the upper right hand corner

Click on About Google Chrome

If there's an update available it will automatically update

Next:

Go to Tools > Clear Browser Data

Put a check next to all of these:

  • Clear browsing history
  • Clear download history
  • Empty the cache
Click "Clear Browsing Data"

-------------------------------

Next:

Click the Chrome menu on the browser toolbar.

Select Settings.

In the "Search" section, click Manage search engines.

Check if (Default) is displayed next to your preferred search engine. If not, mouse over it and click Make default.

Mouse over any other suspicious search engine entries that are not familiar and click X to remove them.

-------------------------------------

Click the Chrome menu .

Select Settings.

In the "On startup" section, select Open a specific page or set of pages.

Click Set pages. (in blue to the right)

Remove any unfamiliar pages.

-----------------------

Click the Chrome menu .

Select Settings.

In the "Appearance" section, if the "Show Home button" checkbox is selected, see if the page listed below is the home page you’d like to use.

If the page isn't the home page you'd like to use, click Change and select your preferred page.

-------------------------

Carefully check for any odd extensions or plugins: (it's a good idea to disable them all and see if you're still redirected and then add each one back until you find the culprit)

Type the following into the address box and hit Enter:

chrome:plugins

Do the same for:

chrome:extensions

Let me know.....MrC

Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

Hi MrC,

 

Thanks for the advises...done the above.

 

Interesting that snapdo.com was still listed as the default search, and there was no pre-selection for the home button.

Could have thought that all interations would have been removed by earlier steps...?

 

I have removed/addressed these issues.

 

I will continue normal use as a test, and come back with update in 24 hours.

 

BTW, were there any notable issues on the prior logs supplied?

 

Finally, have noted that when staring up the pc, only my account (an admin account) is now displayed as an option (that is...for an account to login too).

Previously all four were listed, including 'guest'.

Do you know if this is a win 7 update or has something changed this?

 

regards

 

Lethal1

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

I found this on hiding user accounts, so maybe reversing it may work:

you can do this through secpol.msc

1. Klick Start->Run->secpol.msc

2. Navigate to Local policies -> Security settings

3. Find the entry "Interactive Logon: Hide last user..." and set it to activated.

4. Reboot the machine

MrC

Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

thanks, will do.

 

I will come back to you regarding any re-emergence in next 48 hours.

 

In the interim, what would you suggest I do with all the log files and new apps on the desktop, that have been used in this issue to date...I would consider some of the anti-spyware apps are worth archiving/keeping?

 

regards

 

Lethal1

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

I'll give you instructions on deleting all the tools and logs when we're done.

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites
lethal1

lethal1

Posted
  • Author
Posted

HI MrC,

 

The details from securitycheck.exe follow:

 

Results of screen317's Security Check version 0.99.72  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Disabled!  
Norton Internet Security   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300  
 SlimCleaner     
 Java 7 Update 25  
 Adobe Flash Player 11.8.800.94  
 Adobe Reader XI  
 Mozilla Firefox (23.0.1)
 Mozilla Thunderbird (17.0.7)
 Google Chrome 28.0.1500.95  
 Google Chrome 29.0.1547.57  
 Google Chrome Plugins...  
````````Process Check: objlist.exe by Laurent````````  
 Norton ccSvcHst.exe
 WinPatrol winpatrol.exe
 BillP Studios WinPatrol WinPatrol.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

 

Seperately, It appears I am still having some issues with Google Chrome. Whhilst the home page button brings up the nominated home page...on opening, I get a blank google type screen/tab showing the google store icon only...I would have hoped for the nominated homepage...I will review your chrome instructions with the aim of addressing this...

 

Let me know where you think we should go next after reading the log results.

 

thanks again

 

lethal1

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.