Expect my PC is infected.

[Timewarp]

A few weeks ago, my pc started to act bizarre setting changed randomly, slowed to a crawl.

I run Malwarebytes Anti-Malware (premium) 2.02.1012 and it had quarrentined programs in the past, but not recently. Now it seems to be erratic.

 

I couldn't paste the file contents here, so they are attached.

 

Thanks for your help in advance.

Addition.txt

FRST.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Run Malwarebytes as follows:

 

• 
  

On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may see this message box.
'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.

 

Post log:

 

• 
  

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Kevin

 

 

 

fixlist.txt

[Timewarp]

FIXLOG.TXT attached.  Malwarebytes' scan running now

Fixlog.txt

[Timewarp]

malwarebytes log attached.  no infections found. did not have to restart.

 

Adwcleaner running

MALWAREBYTES LOG.txt

[kevinf80]

That is the wrong log from Malwarbytes, you post "protection log" we need to see the "scan log"

[Timewarp]

Sorry, but I did not see any other log with today's date.  It would be in the same location, yes?

Since it did not find any issues, would it still have produced the protection log?

 

Also, adwcleaner ran as you described through the point of reboot.  At that point, when the desktop loaded, I did not get a text file. I got a system message saying "the process has stopped responding, with a yes and no buttons.  My mouse was unresponsive as well. I hit the enter button and the desktop went blank and reloaded.

 

Should I proceed to jrt.exe? or ?   awaiting instructions

[kevinf80]

Malwarebytes always produces a log from a scan even when no malware/infection is found, all logs are saved to the same folder. Not sure why the scan you ran did not produce a log....

 

Regarding JRT, yes please proceed and run the tool...

[Timewarp]

Attached is the JRT log.   It still seems slow, esp at start up. takes a long time to load the desktop and the icons flash a lot.

 

The last scan log in Malwarebytes is dated 7/19, which seems strange.  Do you think I should reinstall Malwarebytes?

JRT.txt

[kevinf80]

Yes please re-install malwarebytes use the following link to for a clean removal:  MBAM Clean Removal Process 2x

 

Follow the relevant steps and ensure to run mbam-clean tool after UNinstalling Malwarebytes.

 

When reinstalling the program please try the latest version from here:

 

http://www.malwarebytes.org/mwb-download/

 

Right click and choose "Run as administrator" to open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link

Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

 

Let me see that log, also give an update on any remaining issues or concerns....

 

Kevin

[Timewarp]

Well, I uninstalled , ran the clean removal, and reinstalled. rebooting between.  I'm not sure.  I had to reboot twice to get my desktop to load.

and when I opened malwarebytes, it had my license. I did not expect that.  While I am tempted to repeat this process, I did run a scan and got a log - attached.   Still no detections.

 

What you think? 

MALWAREBYTE SCAN LOG.txt

[kevinf80]

How does your system respond, are there any remaining issues or concerns?

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• 
  

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats"  is UNticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 

• 
  

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 

• 
  

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply.

 

Kevin....

[Timewarp]

Here are the results of the ESET program.  I am glad you warned me to be patient.

ESET SCAN LOG.txt

[kevinf80]

Uninstall ZoneAlarm Toolbar unfortunately it does have the unwanted extra "Conduit" as can be seen from ESET log, use the following uninstaller:

 

Download GeekUninstaller from here: http://www.geekuninstaller.com/download (Choose free version) Save Geek.zip to your Desktop. (Visit the Home page at that link for necessary information)

 

Extract Geek Uninstaller and save to your Desktop. There is no need to install, the executable is portable and can also be run from a USB if required.

 

Run the tool, the main GUI will populate with installed programs list,

 

Left click on ZoneAlarm LTD Toolbar to highlight that entry.

 

Select Action from the Menu bar, then Uninstall from there follow the prompts.

 

If Uninstall fails open the "Action" menu one more time and use "Force Removal" option..

 

Next,

 

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe  

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

• Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Files :Files
  
  

  :FilesC:\Users\BOB\Downloads\ccsetup411.exe    C:\Users\BOB\Downloads\ccsetup413.exe    C:\Users\BOB\Downloads\PDFCreator-1_7_2_setup.exe    C:\Users\BOB\Downloads\ZASPSetupWeb_131_211_000.exeC:\Users\BOB_THE_ADMIN\Downloads\ccsetup414.exe    C:\Users\BOB_THE_ADMIN\Downloads\ZASPSetup_120_104_000.exe    D:\My Downloads\ccsetup406.exe    D:\My Downloads\CuteWriter.exe    D:\My Downloads\ZASPSetupWeb_110_780_000.exe    D:\My Downloads\ZASPSetup_110_000_054.exe:Commands[EmptyTemp]

• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM
  

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

 

Let me see the log from OTM,  also let me know if there are there any remaining issues or concerns with your system...

 

Kevin

[Timewarp]

Attached file from otm   things are looking better

07242014_061609.log

[kevinf80]

Thanks for the log, did you uninstall ZA toolbar? i`m just curious... Continue and run the following:

 

Next,

 

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

 

Upgrading Java:

 

Go to http://java.com/en/ and click on "Do I have Java"

It will check your current version and then offer to update to the latest version

Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

 

***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them. <<-- Very Important

 

Next,

 

Download "Delfix by Xplode" and save it to your desktop.

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

• 
  

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

 

if there are any remaining logs from tools we have used, either delete or drag/drop to the recycle bin, empty bi when complete...

 

Kevin......

[Timewarp]

Yes, I did uninstall the ZA toolbar.   proceeding with your instructions

[kevinf80]

Thanks for the update....

[Timewarp]

Completed. 

 

Thank you so much for your help. I really appreciated your prompt responses and clear, precise and complete directions.

 

Is there anything in what you found that would be useful for me to know? I'm open to learning.

 

Bob

[kevinf80]

Hello Bob

 

Thank you for the update and kind words. there was not a great deal wrong with your system, adware and browser hijacker, but nothing malicious per se.

 

Read the following link to fully understand PC security and best practices, you may find it very informative and useful....

 

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

 

Take care and surf safe, it was a pleasure with you....

 

Kevin....

[Timewarp]

Thanks I'll review the link -

 

You have no idea how reassuring it is to know that there are folks like you out here that have the knowledge and willingness to help.

 

thanks again

[kevinf80]

You`re very welcome....

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!