Jump to content

Need malware removal help!


Recommended Posts

I recently downloaded media player and got an unwanted program called fast clean pro that downloaded itself on my computer. Now it has taken over, exiting out of websites, constantly freezing my computer. I have the pro version of malwarebytes but it refuses to open. I read a post in the forum and tried to redownload the free version but it froze my computer and then refused to open to. I downloaded the farbar recovery scan tool that was listed in the next step and got the text files but I don't know where to go from there...please help!!!

 

Link to post
Share on other sites

  • Replies 86
  • Created
  • Last Reply

Top Posters In This Topic

Minion%20Welcome.jpg

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat :)

Before we start please note the following:

  • Analysis and research take some time, also sometimes real life gets in the way, please be patient.
  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Paste the logs in your posts, attachments make my work harder and more complicated.
  • Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight! :)

warning.gif Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

I downloaded the farbar recovery scan tool that was listed in the next step and got the text files but I don't know where to go from there...

Please post them here in your next reply :)

Link to post
Share on other sites

ok it won't let me paste the text in here at all. I tried to click more reply options and attach it as a file unfortunately it kept telling me page could not be displayed and then internet explorer froze up completely and I had to close it out and start over. What now?

Link to post
Share on other sites

Hi :)

No worries, if you are unable to post them, you may attach instead. It makes my work harder, but not impossible :)

Now let's kick some butts :ph34r:



remove%20outdated.jpg Uninstall some programs

We need to uninstall some programs.

  • Press the WindowsKey.png + R on your keyboard at the same time. Type appwiz.cpl and click OK.
  • Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

  • Coupon Printer for Windows
  • Perk Prize Panel
  • ShopAtHome.com Helper
  • Windows Media Player Packages

After completing uninstalls, please manually reboot your machine!



JRTbythisisu.png Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on JRTbythisisu.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Follow the prompts and let this process run uninterrupted.
  • This scan can take a while, depending on your System specs.
  • Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.
Do not forget to re-enable your previously switched off protection software!
Please also manually reboot your machine after this procedure.



adwcleaner_new.png Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

  • Right-click on adwcleaner_new.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Follow the prompts and click Scan.
  • When finished, please click Clean.
  • Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.



FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    > XP users click run after receipt of Windows Security Warning - Open File.
    > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

Link to post
Share on other sites

JRT starts up and says creating a registry back up but then says "the system cannot find the path specified" four times in a row. Then says checking startup and checking modules, stays like that for several minutes then closes out. Leaves not text file or anything

Link to post
Share on other sites

:blink: I feel a little dumb after that comment.....                        this is the log it gave me, Still won't let me copy and paste.

No need to feel like this. I told you - ask if unsure :)

And if necessary I can deal with attachments.

 

Was uninstallation succesful?

 

Please post me also fresh FRST& Addition logfiles.

Link to post
Share on other sites

No, I opened adwcleaner and clicked uninstall several times. The box opened asking if I was sure I wanted to uninstall, I clicked yes, but it is still on my desk top. Also, do you have a link where I can get the farbar again? I guess I must have accidentally uninstalled it or something, it's no longer there.

Link to post
Share on other sites

I was asking about this:
 

remove%20outdated.jpg Uninstall some programs

We need to uninstall some programs.

  • Press the WindowsKey.png + R on your keyboard at the same time. Type appwiz.cpl and click OK.
  • Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time
The list of programs to uninstall:
  • Coupon Printer for Windows
  • Perk Prize Panel
  • ShopAtHome.com Helper
  • Windows Media Player Packages
After completing uninstalls, please manually reboot your machine!

 

 

 

 

Leave AdwCleaner.

 

 

Here's the instruction for FRST:

 

FRST.gif Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.
There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    > XP users click run after receipt of Windows Security Warning - Open File.
    > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
  • When the tool opens click Yes to disclaimer.
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content in your next reply.

 

Link to post
Share on other sites

FRST.gif Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Press the WindowsKey.png + R on your keyboard at the same time. Type Notepad and click OK.

  • Copy the entire content of the codebox below and paste into the Notepad document:

    startHKU\S-1-5-21-1367087300-1485594865-1163891642-1001\...\Run: [ShopAtHomeWatcher] => C:\Users\Cody & LaGina\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exeHKU\S-1-5-21-1367087300-1485594865-1163891642-1001\...\Run: [ShopAtHomeUpdater] => C:\Users\Cody & LaGina\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exeC:\Users\Cody & LaGina\AppData\Roaming\ShopAtHomeHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://search.coupons.com/StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.safesear.ch/?type=20140818-155-ie-smSearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}BHO-x32: Perk Prize Panel -> {47F3EB15-C230-4A0B-BE4B-D527FF483B48} -> C:\Program Files (x86)\Perk Prize Panel\pp.dll No FileC:\Program Files (x86)\Perk Prize PanelToolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No FileFF HKLM-x32\...\Firefox\Extensions: [{jid1-eFRcA0eiPxecTQ@jetpack}] - 6590440\extensions\{jid1-eFRcA0eiPxecTQ@jetpack}FF HKLM-x32\...\Firefox\Extensions: [{jid1-vS7biDmom8YxhA@jetpack}] - 1\extensions\{jid1-vS7biDmom8YxhA@jetpack}FF HKCU\...\Firefox\Extensions: [pp@perk.com] - C:\Program Files (x86)\Perk Prize Panel\FFFF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.safesear.ch/?type=20140818-155-ff-smS2 Update ClearThink; "C:\Program Files (x86)\ClearThink\updateClearThink.exe" [X]S2 Util ClearThink; "C:\Program Files (x86)\ClearThink\bin\utilClearThink.exe" [X]2014-08-18 10:10 - 2014-08-18 12:23 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\Fast Browser2014-08-21 11:33 - 2014-04-17 17:01 - 00000430 _____ () C:\WINDOWS\Tasks\PassShow_wd.job2014-08-18 15:52 - 2014-08-18 12:37 - 00000000 ____D () C:\Program Files (x86)\ClearThink2014-08-18 12:38 - 2014-08-18 12:38 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\IsolatedStorage2014-08-18 12:38 - 2014-08-18 12:33 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\fastcleanpro2014-08-18 12:32 - 2014-08-18 12:33 - 25755448 _____ (Microsoft Corporation) C:\Users\Cody & LaGina\Downloads\Windows Media Player-Installer.exeTask: {76965A4D-6334-418B-955E-F2A2996B8DF3} - \PassShow_wd No Task File <==== ATTENTIONTask: C:\WINDOWS\Tasks\PassShow_wd.job => C:\Program Files (x86)\PassShow-soft\PassShowZTwzBw.exe <==== ATTENTIONC:\Program Files (x86)\PassShow-softend
  • Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    > XP users click run after receipt of Windows Security Warning - Open File.

    > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.

  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please include it in your reply.

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • First of all, select update.
  • Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
  • Click the Scan tab, choose Threat Scan is checked and click Scan Now.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the newest Scan Log.
  • At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

panda-av.jpg Scan with Panda Cloud Cleaner

This type of scan often produces false positives. In any case do not remove on your own any of its findings! Removal will be made after the careful analysis of the scan results.

Please download Panda Cloud Cleaner and save the file to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Install the scanner by right-click on panda-av.jpg icon and select RunAsAdmin.jpg Run as Administrator.
  • It should start itself automaticaly after the installation.
  • In the main console click Accept and Scan.
  • This scan won't take long, about several minutes (depending on your system specs). Let it run uninterrupted.
  • At the last stage you will see a couple of messages about veryfying & analyzing results. Wait patiently.
  • Upon completion you will see detections window. Enter one of them and click there View Report at the bottom right side.
  • A notepad window named PCloudCleaner.log will open. Save it to your desktop.
  • Please include the contents of that file in your next reply.

    Don't forget to re-enable your switched-off protection software!

    After that you may uninstall Panda Cloud Cleaner from your machine, if you wish to.

Link to post
Share on other sites

Good.


FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    > XP users click run after receipt of Windows Security Warning - Open File.
    > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

Link to post
Share on other sites

Please update me about any other issues :)

 

 

5204fb054866c-TFC_nieuw_25x25.png Clean Temporary Files with TFC

Please download TFC by OldTimer and save it to your desktop.

  • Right-click on 5204fb054866c-TFC_nieuw_25x25.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Close any open programs and save your current work.
  • Click the Start button to begin. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a couple of minutes.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

This tool doesn't generate any report. Instead I recommend to keep it for good maintenance of your machine.

 

 

51c9d14017fa0-SecurityCheck.PNG Scan with Security Check

Please download Security Check by Screen317 and save it to your desktop.

  • Right-click on 51c9d14017fa0-SecurityCheck.PNG icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Follow onscreen instructions inside the black box. This scan won't take long.
  • Soon a notepad document called checkup.txt will open automaticaly.

Please include the content of that document.

Link to post
Share on other sites

Uh...well.. ok so the black box popped open and all the words went flying by pretty fast but I saw it said file not found-process.txt and file not found-install.txt several times followed by "the system could not find the specified path" and the checkup notepad that opened is completely empty...there is absolutely no text what so ever in that document.

Link to post
Share on other sites

OK, means that I will have to collect the info manually. No worries :)

51a612a8b27e2-Zoek.png Scan with ZOEK
Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    createsrpoint;process;services-list;systemspecs;startupall;skipfix-iedefaults;firefoxlook;chromelook;filesrcm;installedprogs;
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.
Don't forget to re-enable your switched-off protection software!

Link to post
Share on other sites

well it claims its running....its said the same thing for the past couple hours....it's not frozen it just isn't doing anything..and it has not given me a log or closed out. it says create environment variables, create system restore point, checking input and installed progams with the military version of the time when I started the scan....but has not changed at all. It probably shouldn't take this long right?? I ran it as administrator, made sure my anti malware was disabled and everything you had said to do. I tried to close out and restart it but it wouldn't let me, as soon as I hit the X another box came up and had the exact same text.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.