danzelcool Posted January 28, 2014 ID:783464 Share Posted January 28, 2014 i need help removing this pup i tried everything to get rid of but it just wont go away Link to post Share on other sites More sharing options...
MrCharlie Posted January 28, 2014 ID:783731 Share Posted January 28, 2014 Welcome to the forum, please start HERE Post back the 2 logs here.....DDS.txt and Attach.txt (DDS won't run on W8) (please don't put logs in code or quotes and use the default font) (Please don't forget to run the RogueKiller scan below) General P2P/Piracy Warning: 1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided. 2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy. Failure to remove such software will result in your topic being closed and no further assistance being provided. <====><====><====><====><====><====><====><====> Next................ Please download and run RogueKiller 32 bit to your desktop. RogueKiller<---use this one for 64 bit systems Which system am I using? Quit all running programs. For Windows XP, double-click to start. For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run. Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything! Don't run any other options, they're not all bad!!!!!!! Post back the report which should be located on your desktop. (please don't put logs in code or quotes and use the default font) MrC Note: Please read all of my instructions completely including these. Make sure system restore is turned on and running, please create a new restore point Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive <+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you. <+>The removal of malware isn't instantaneous, please be patient. <+>When we are done, I'll give to instructions on how to cleanup all the tools and logs <+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. ------->Your topic will be closed if you haven't replied within 3 days!<-------- (If I don't respond within 24 hours, please send me a PM) Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:783780 Share Posted January 29, 2014 RogueKiller V8.8.4 _x64_ [Jan 27 2014] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.adlice.com/forum/Website : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.com Operating System : Windows 8.1 (6.3.9200 ) 64 bits versionStarted in : Normal modeUser : danze_000 [Admin rights]Mode : Scan -- Date : 01/28/2014 19:04:28| ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 7 ¤¤¤[RUN][sUSP PATH] HKUS\S-1-5-21-995039667-2013647595-1445239047-1006\[...]\Run : Twoo ("C:\Users\Gary\AppData\Roaming\Massive Media\Twoo.exe" [7]) -> FOUND[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorUser (0) -> FOUND[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorUser (0) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 3 ¤¤¤[V2][sUSP PATH] OFFICE2013ACT : C:\ProgramData\Microsoft\Windows\OFFICEICON.vbs [-] -> FOUND[V2][sUSP PATH] Lenovo-32000 : C:\ProgramData\Lenovo-32000.vbs [-] -> FOUND[V2][sUSP PATH] Lenovo-32065 : C:\ProgramData\Lenovo-32065.vbs [-] -> FOUND ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Browser Addons : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts 54.204.28.26 imfpmncmbojnbdhnogcegojocabhpbnh ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST1000DM003-1CH162 +++++--- User ---[MBR] 8469fdca6c59788645af3273b9f89caf[bSP] 70328627a41e3fbb29ac5f3caa1876aa : Empty MBR CodePartition table:0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 MoUser = LL1 ... OK!User = LL2 ... OK! Finished : << RKreport[0]_S_01282014_190428.txt >> Link to post Share on other sites More sharing options...
MrCharlie Posted January 29, 2014 ID:783799 Share Posted January 29, 2014 Please read the instructions again, I need to you to run DDS and post the DDS.txt and Attach.txt logs. MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:783802 Share Posted January 29, 2014 how do i run dds Link to post Share on other sites More sharing options...
MrCharlie Posted January 29, 2014 ID:783808 Share Posted January 29, 2014 I'm sorry, you have W8, please do this instead: Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?) Please make sure you click download buttons that look similar to this, not "sponsored ad links": Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.If the logs are large, you can attach them: To attach a log: Bottom right corner of this page. New window that comes up. MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:783809 Share Posted January 29, 2014 how do i save it to a folder it wont open Link to post Share on other sites More sharing options...
MrCharlie Posted January 29, 2014 ID:783994 Share Posted January 29, 2014 Save it to your desktop, MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:784028 Share Posted January 29, 2014 it still wont open it says this app cant run on your pc Link to post Share on other sites More sharing options...
MrCharlie Posted January 29, 2014 ID:784041 Share Posted January 29, 2014 I don't see why it won't run, are you using the correct version for your operating system? I've used it many times with W8. Below is a link to a direct download for the 64bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Make sure you right click and choose Run as administrator when you try to run it. If it refuses to run, can you take a screen shot of the error message and attach it. Let me know....MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:784071 Share Posted January 29, 2014 i took a screenshot but it wont let me attach it Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:784075 Share Posted January 29, 2014 this what happens Link to post Share on other sites More sharing options...
MrCharlie Posted January 29, 2014 ID:784107 Share Posted January 29, 2014 Do me a favor, try the 32 bit version. MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 29, 2014 Author ID:784255 Share Posted January 29, 2014 here i got itAddition.txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784314 Share Posted January 30, 2014 I need to see the FRST.txt MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 30, 2014 Author ID:784316 Share Posted January 30, 2014 here it is FRST_29-01-2014_18-10-34.txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784338 Share Posted January 30, 2014 This is in your host file, not sure what to do about it:54.204.28.26 imfpmncmbojnbdhnogcegojocabhpbnh-----------------------Download the attached fixlist.txt to the same folder as FRST.Run FRST.exe and click Fix only once and waitThe tool will create a log (Fixlog.txt) in the folder, please post it to your reply.Then......rebootLet me know how it is, MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 30, 2014 Author ID:784448 Share Posted January 30, 2014 How do I save the fixitlist to frst Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784542 Share Posted January 30, 2014 It looks like you have FRST here-----> C:\FRSTSo download the fixlist.txt and then copy and paste it into C:\MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 30, 2014 Author ID:784573 Share Posted January 30, 2014 here it is Fixlog.txt Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784576 Share Posted January 30, 2014 How is it?? MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 30, 2014 Author ID:784580 Share Posted January 30, 2014 i don't get the pop up anymore Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784584 Share Posted January 30, 2014 Good....do you think you can follow this procedure to restore the original host file: http://support.microsoft.com/kb/972034 MrC Link to post Share on other sites More sharing options...
danzelcool Posted January 30, 2014 Author ID:784587 Share Posted January 30, 2014 did i do it right Link to post Share on other sites More sharing options...
MrCharlie Posted January 30, 2014 ID:784609 Share Posted January 30, 2014 An easy way to check is run another scan with RogueKiller and post the new log, MrC Link to post Share on other sites More sharing options...
Recommended Posts