Need malware removal help!

[Lmiller]

I recently downloaded media player and got an unwanted program called fast clean pro that downloaded itself on my computer. Now it has taken over, exiting out of websites, constantly freezing my computer. I have the pro version of malwarebytes but it refuses to open. I read a post in the forum and tried to redownload the free version but it froze my computer and then refused to open to. I downloaded the farbar recovery scan tool that was listed in the next step and got the text files but I don't know where to go from there...please help!!!

 

[Naathim]

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat

Before we start please note the following:

• Analysis and research take some time, also sometimes real life gets in the way, please be patient.
• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Paste the logs in your posts, attachments make my work harder and more complicated.
• Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

I downloaded the farbar recovery scan tool that was listed in the next step and got the text files but I don't know where to go from there...

Please post them here in your next reply

[Lmiller]

ok it won't let me paste the text in here at all. I tried to click more reply options and attach it as a file unfortunately it kept telling me page could not be displayed and then internet explorer froze up completely and I had to close it out and start over. What now?

[Lmiller]

I got It to load.... I really do apologize. I know you said it makes your job harder. unfortunately this was my only option it just would not let me past at all.

FRST.txt

Addition.txt

[Naathim]

Hi

No worries, if you are unable to post them, you may attach instead. It makes my work harder, but not impossible

Now let's kick some butts



Uninstall some programs

We need to uninstall some programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• Coupon Printer for Windows
• Perk Prize Panel
• ShopAtHome.com Helper
• Windows Media Player Packages

After completing uninstalls, please manually reboot your machine!



Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and let this process run uninterrupted.
• This scan can take a while, depending on your System specs.
• Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.
Do not forget to re-enable your previously switched off protection software!
Please also manually reboot your machine after this procedure.



Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.



Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

JRT starts up and says creating a registry back up but then says "the system cannot find the path specified" four times in a row. Then says checking startup and checking modules, stays like that for several minutes then closes out. Leaves not text file or anything

[Naathim]

Please proceed with AdwCleaner & FRST.

[Lmiller]

how long should it take to start? It's said "pending. please uncheck elements you don't want to remove" for almost ten minutes now....

[Naathim]

It means that scanning is over. You should choose the clean option now.

[Lmiller]

 I feel a little dumb after that comment.....                        this is the log it gave me, Still won't let me copy and paste.

 

 

 

AdwCleanerS1.txt

[Naathim]

 I feel a little dumb after that comment.....                        this is the log it gave me, Still won't let me copy and paste.

No need to feel like this. I told you - ask if unsure

And if necessary I can deal with attachments.

 

Was uninstallation succesful?

 

Please post me also fresh FRST& Addition logfiles.

[Lmiller]

No, I opened adwcleaner and clicked uninstall several times. The box opened asking if I was sure I wanted to uninstall, I clicked yes, but it is still on my desk top. Also, do you have a link where I can get the farbar again? I guess I must have accidentally uninstalled it or something, it's no longer there.

[Naathim]

I was asking about this:
 

Uninstall some programs

We need to uninstall some programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• Coupon Printer for Windows
• Perk Prize Panel
• ShopAtHome.com Helper
• Windows Media Player Packages

After completing uninstalls, please manually reboot your machine!

 

 

 

 

Leave AdwCleaner.

 

 

Here's the instruction for FRST:

 

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.
There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

 

[Lmiller]

Oh that one. Yes, they uninstalled perfectly fine. The frst and addition documents from farbar are attached

FRST.txt

Addition.txt

[Naathim]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Press the + R on your keyboard at the same time. Type Notepad and click OK.

• Copy the entire content of the codebox below and paste into the Notepad document:

  startHKU\S-1-5-21-1367087300-1485594865-1163891642-1001\...\Run: [ShopAtHomeWatcher] => C:\Users\Cody & LaGina\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exeHKU\S-1-5-21-1367087300-1485594865-1163891642-1001\...\Run: [ShopAtHomeUpdater] => C:\Users\Cody & LaGina\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exeC:\Users\Cody & LaGina\AppData\Roaming\ShopAtHomeHKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://search.coupons.com/StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.safesear.ch/?type=20140818-155-ie-smSearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}BHO-x32: Perk Prize Panel -> {47F3EB15-C230-4A0B-BE4B-D527FF483B48} -> C:\Program Files (x86)\Perk Prize Panel\pp.dll No FileC:\Program Files (x86)\Perk Prize PanelToolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No FileFF HKLM-x32\...\Firefox\Extensions: [{jid1-eFRcA0eiPxecTQ@jetpack}] - 6590440\extensions\{jid1-eFRcA0eiPxecTQ@jetpack}FF HKLM-x32\...\Firefox\Extensions: [{jid1-vS7biDmom8YxhA@jetpack}] - 1\extensions\{jid1-vS7biDmom8YxhA@jetpack}FF HKCU\...\Firefox\Extensions: [pp@perk.com] - C:\Program Files (x86)\Perk Prize Panel\FFFF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.safesear.ch/?type=20140818-155-ff-smS2 Update ClearThink; "C:\Program Files (x86)\ClearThink\updateClearThink.exe" [X]S2 Util ClearThink; "C:\Program Files (x86)\ClearThink\bin\utilClearThink.exe" [X]2014-08-18 10:10 - 2014-08-18 12:23 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\Fast Browser2014-08-21 11:33 - 2014-04-17 17:01 - 00000430 _____ () C:\WINDOWS\Tasks\PassShow_wd.job2014-08-18 15:52 - 2014-08-18 12:37 - 00000000 ____D () C:\Program Files (x86)\ClearThink2014-08-18 12:38 - 2014-08-18 12:38 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\IsolatedStorage2014-08-18 12:38 - 2014-08-18 12:33 - 00000000 ____D () C:\Users\Cody & LaGina\AppData\Local\fastcleanpro2014-08-18 12:32 - 2014-08-18 12:33 - 25755448 _____ (Microsoft Corporation) C:\Users\Cody & LaGina\Downloads\Windows Media Player-Installer.exeTask: {76965A4D-6334-418B-955E-F2A2996B8DF3} - \PassShow_wd No Task File <==== ATTENTIONTask: C:\WINDOWS\Tasks\PassShow_wd.job => C:\Program Files (x86)\PassShow-soft\PassShowZTwzBw.exe <==== ATTENTIONC:\Program Files (x86)\PassShow-softend

• Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.

  > XP users click run after receipt of Windows Security Warning - Open File.

  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.

• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please include it in your reply.

Scan with Malwarebytes' Anti-Malware

Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Scan with Panda Cloud Cleaner

This type of scan often produces false positives. In any case do not remove on your own any of its findings! Removal will be made after the careful analysis of the scan results.

Please download Panda Cloud Cleaner and save the file to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Install the scanner by right-click on icon and select Run as Administrator.
• It should start itself automaticaly after the installation.
• In the main console click Accept and Scan.
• This scan won't take long, about several minutes (depending on your system specs). Let it run uninterrupted.
• At the last stage you will see a couple of messages about veryfying & analyzing results. Wait patiently.
• Upon completion you will see detections window. Enter one of them and click there View Report at the bottom right side.
• A notepad window named PCloudCleaner.log will open. Save it to your desktop.
• Please include the contents of that file in your next reply.

  Don't forget to re-enable your switched-off protection software!

  After that you may uninstall Panda Cloud Cleaner from your machine, if you wish to.

[Lmiller]

here are the logs from farbar, malware, and panda cloud

Fixlog.txt

mbamscanlog.txt

PCloudCleaner.LOG

[Naathim]

Good.


Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

here they are

Addition.txt

FRST.txt

[Naathim]

Please update me about any other issues

 

 

Clean Temporary Files with TFC

Please download TFC by OldTimer and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Close any open programs and save your current work.
• Click the Start button to begin. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a couple of minutes.
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

This tool doesn't generate any report. Instead I recommend to keep it for good maintenance of your machine.

 

 

Scan with Security Check

Please download Security Check by Screen317 and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow onscreen instructions inside the black box. This scan won't take long.
• Soon a notepad document called checkup.txt will open automaticaly.

Please include the content of that document.

[Lmiller]

Uh...well.. ok so the black box popped open and all the words went flying by pretty fast but I saw it said file not found-process.txt and file not found-install.txt several times followed by "the system could not find the specified path" and the checkup notepad that opened is completely empty...there is absolutely no text what so ever in that document.

[Naathim]

Please reboot your machine and try again.

Also

Please update me about any other issues

[Lmiller]

It did the exact same thing.

[Naathim]

OK, means that I will have to collect the info manually. No worries

Scan with ZOEK
Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;process;services-list;systemspecs;startupall;skipfix-iedefaults;firefoxlook;chromelook;filesrcm;installedprogs;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.
Don't forget to re-enable your switched-off protection software!

[Lmiller]

well it claims its running....its said the same thing for the past couple hours....it's not frozen it just isn't doing anything..and it has not given me a log or closed out. it says create environment variables, create system restore point, checking input and installed progams with the military version of the time when I started the scan....but has not changed at all. It probably shouldn't take this long right?? I ran it as administrator, made sure my anti malware was disabled and everything you had said to do. I tried to close out and restart it but it wouldn't let me, as soon as I hit the X another box came up and had the exact same text.

[Naathim]

This shouldn't take so long, coupe of minutes approximately.

 

Please reboot your machine and try once more. Tell me the results.