Had a few PUPS and adware, removed them but might have more...

[Numnizzle]

So as the subject states, I've had some PUPS and adware on my machine, the girlfriend was downloading things and installed something with Savings App and the wonderful Spigot lol.

 

I've used just about all of the programs before in years past and I'm familiar with MB but recently I've been getting a LOT of ip blocking on MB lately, I've done a bit of digging and found that the majority of ips are Egyptian. Was wondering if someone could check through and see if I missed anything.

 

Thanks!

-Numnizzle

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 

• Double click on AdwCleaner.exe to run the tool.
  
• Vista/Windows 7/8 users right-click and select Run As Administrator
  
• Click on the Scan button.
  
• AdwCleaner will begin...be patient as the scan may take some time to complete.
  
• When it's done you'll see: Pending: Uncheck any elements you don't want removed.
  
• Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  
• Look over the log especially under Files/Folders for any program you want to save.
  
• If there's a program you want to save, just uncheck it from AdwCleaner.
  
• If you're not sure, post the log for review.
  
• If you're ready to clean it all up.....click the Clean button.
  
• After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  
• Copy and paste the contents of that logfile in your next reply.
  
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  
• Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  
• To restore an item that has been deleted (if necessary):
  
• Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
  

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

[Numnizzle]

I've attempted to copy + paste even the first log and I get a message on the forums saying my post was too large. Not sure if it's ok or not but I've attached all of them.

Addition.txt

FRST.txt

AdwCleanerS2.txt

[kevinf80]

Download CKScanner from here: http://downloads.malwareremoval.com/CKScanner.exe

 

Important - Save it to your desktop.

 

Doubleclick CKScanner.exe (Right click and "Run as administrator" in Vista/Win7/8).

Give permission if necessary, and click Search For Files.

After a very short time, when the cursor hourglass disappears, click Save List To File.

A message box will verify the file saved. Please run the program once only.

Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

[Numnizzle]

ok so I tried to download and save to desktop, ok good. I go to run it and it says that it cannot find it and to make sure I typed the name correctly. even though it's right on my desktop in front of me

[Numnizzle]

Nvmd, sorry I guess Norton was blocking it, I temp disabled it and it's working now

[Numnizzle]

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad

c:\windows\autokms\autokms.exe

c:\windows\system32\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\autokms.exe.log

c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\clr_v4.0_32\usagelogs\autokms.exe.log

scanner sequence 3.ZZ.11.CLAPPZ

 ----- EOF ----- 

[Numnizzle]

I apologize if I can edit posts but I don't see of a way. I did a bit of research because I thought I've heard of autokms before. I understand it's crack for Microsoft Office? I have no idea how or even why that would be on my system considering I work retail and I get legit free copies of just about every piece of MS software. I have Office installed from a retail access download, so I wouldn't need that.... weird 

[kevinf80]

You have failed to post the full log from CKScanner, many entries are missing. AutoKMS is also used to Crack Windows Operating Systems not only MS Office.

 

As you have AutoKMS on your system and fail to post the FULL log from CKScanner help ceases, feel free to contact a moderator...

[Maurice Naggar]

@Numnizzle

Please see here: http://forums.malwarebytes.org/index.php?showtopic=97700