Jump to content

Recommended Posts

Mr.c here are the infected files they were not removed but are infected from the ESET scan :

 

 C:\AdwCleaner\Quarantine\C\ProgramData\safe asave\51f29b987ca3b.dll.vir a variant of Win32/Adware.MultiPlug.I application

C:\AdwCleaner\Quarantine\C\Users\saviraaj\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcciighfihnilbkkehkbogclibokkaig\1\51f29b987c7df2.53375384.js.vir Win32/Adware.MultiPlug.H application
Link to post
Share on other sites

Why do you say they weren't removed?
 

C:\AdwCleaner\Quarantine\C\ProgramData\safe asave\51f29b987ca3b.dll.vir a variant of Win32/Adware.MultiPlug.I application
C:\AdwCleaner\Quarantine\C\Users\saviraaj\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcciighfihnilbkkehkbogclibokkaig\1\51f29b987c7df2.53375384.js.vir Win32/Adware.MultiPlug.H application

 

 

 

The .vir extension means they're in quarantine.

MrC

Link to post
Share on other sites

LOG: 

 

C:\AdwCleaner\Quarantine\C\ProgramData\safe asave\51f29b987ca3b.dll.vir a variant of Win32/Adware.MultiPlug.I application cleaned by deleting - quarantined
C:\AdwCleaner\Quarantine\C\Users\saviraaj\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcciighfihnilbkkehkbogclibokkaig\1\51f29b987c7df2.53375384.js.vir Win32/Adware.MultiPlug.H application cleaned by deleting - quarantined
C:\Users\saviraaj\AppData\Local\iexplorer\Browsers Monitor\iexplorer_monitor.exe Win32/Toolbar.Alnaddy.B application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Downloaded TZ\Windows 7 Loader + Activator v2.0.6 Reloaded - DAZ [Team Rjaa]\Windows 7 Activator\Windows Loader.exe Win32/HackTool.WinActivator.I application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Hexxit\Minecraft (1).exe multiple threats cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Hexxit\Minecraft.exe multiple threats cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\AAPR.rar.exe Win32/InstalleRex.J application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\avs media player (1).exe MSIL/Solimba.H application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\avs media player.exe MSIL/Solimba.H application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\cbsidlm-tr1_11-iWisoft_Free_Flash_SWF_Downloader-ORG-10912725.exe Win32/DownloadAdmin.G application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\cbsidlm-tr1_13-Uberstrike_HD-SEO-75738854.exe Win32/DownloadAdmin.G application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\CheatEngine62.exe multiple threats cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\DAEMONToolsUltra110-0103.exe Win32/OpenCandy application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\SetupImgBurn_2.5.7.0.exe a variant of Win32/Bundled.Toolbar.Ask application cleaned by deleting - quarantined
C:\Users\saviraaj\Downloads\Setups\SoftonicDownloader_for_kaspersky-anti-virus-remover.exe Win32/SoftonicDownloader.E application cleaned by deleting - quarantined
 
 
 
Mr.c    alnaddy is still my home page but when i check my internet options and chrome's home page it is google.
 
BUt besides that no pop-ups, no highlited word ad
Link to post
Share on other sites

Great..........

 

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites

Here is the log Mr.c :

 

 

 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
AVG AntiVirus Free Edition 2013   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 McAfee SiteAdvisor    
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Java 7 Update 25  
 Adobe Flash Player 11.8.800.168  
 Adobe Reader XI  
 Google Chrome 29.0.1547.62  
 Google Chrome 29.0.1547.66  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 AVG avgwdsvc.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 0% 
````````````````````End of Log`````````````````````` 
Link to post
Share on other sites

Looks Good, just update your Java

Java 7 Update 25 <----please update, should be Update 40

Go to control panel > Java > Update Tab > Update Now
Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here
Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

----------------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used FRST:
Download the fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
That will delete the quarantine folder created by FRST.

-----------------------------

Please download OTC to your desktop.
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.