Need malware removal help!

[Lmiller]

Rebooted my machine. A couple of times.. each time it does the exact same thing. It's just not doing anything. And now my webpages  automatically scroll to the bottom of the machine randomly, they just like....shoot down really fast., making it hard to read things or type or anything.

[Naathim]

OK, we'll dig deeper.



Scan with Gmer

This type of scan often produces false positives. At any point do not take any action for any suspicious entries you may see there. Instead post the log to be analyzed.

Please download GMER by Gmer and save the file to your desktop.
It will come as a randomly named file (like a6ge38b4.exe) - that's absolutely normal.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.

• Right-click on randomly named icon and select Run as Administrator to start the tool.
• It is very important that you do not use your computer while Gmer is running!
• Gmer will open to the Rootkit/Malware tab and perform an automatic quick scan.
• If you receive a warning about rootkit activity and are asked to fully scan your system click NO!

When the pre-scan is completed, please do the following:

• Please check in the Quick scan box.
• Please uncheck the IAT/EAT and Show All.
• Click Scan.
• If you see a rootkit warning window click OK.
• When the scan is finished, Save the results to your desktop as gmer.log.

Please include the content of this file in your next reply.
Don't forget to re-enable previously switched-off protection software!

If you encounter any problems, try running GMER in Safe Mode.
If GMER crashes or keeps resulting in a Blue Screen of Death, uncheck Devices on the right side before scanning.

 

 

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.
There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

ok GMER refuses to run. Malwarebytes are disabled, I tried rebooting in safe mode, and it won't let me even uncheck the "devices" box.  The message I am getting says       C:\WINDOWS\system32\config\system : the process cannot access the file because it is being used by another process     then I click the ok button and it says it has stopped working and needs to shut down.  but there are no other "processes" that I am aware of that are running on my computer. only internet explorer after I just opened it back up to tell you what happened.

[Lmiller]

and it is becoming even harder to maintain control when I am trying to read your'e posts...it keeps jumping to the bottom of the page every time I scroll back up....my computer is a touch screen I basically have to "hold" the screen there just to try and read.

[Naathim]

.my computer is a touch screen

I suspect that the wrong screen calibration may have something to do with this. Unfortunately, it's not my area of expertise.

 

Run this tool instead of GMER:

Scan with TDSSKiller

Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Make sure that Verify driver digital signatures & Detect TDLFS File System are marked and click OK.
• Click the Start Scan button and wait patiently.

If anything will be found follow this guidelines:

• If a suspicious object is detected, the default action will be Skip, click on Continue.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.

  > Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

  > If Cure is not available, please choose Skip instead.

• Do not choose Delete unless instructed!

A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.

[Lmiller]

Ok well TDDSkiller did not give me a text log....I hit report and had to copy and paste into a notepad to get a document. This situation seems to be a lot harder to correct than it should be......

TDDSKILLER.txt

Addition.txt

FRST.txt

[Naathim]

I need to see an ARK report. Two failed, so let's try another.



Scan with Malwarebytes' Anti-Rootkit

Please download Malwarebytes' Anti-Rootkit and save the file to your desktop.
Note that the tool is still in its BETA stage, therefore not all functionalities may be added.

• Right-click on icon and select Run as Administrator to start the tool.
• It will ask you for an extraction place - make sure you will unpack it to your desktop.
• After the extraction, the tool should start itself (no action required).
• On the Introduction screen click Next.
• On the Update screen click Update.
• When prompted about the succesful update, click Next.
• On the Scan System screen, make sure that all three options
  • Drivers
  • Sectors
  • System
  are checked for scanning and press Scan.

Wait patiently and don't do anything on your machine while MBAR goes through your system!

• If no infection is found, just close the tool.
• If an infection is found, make sure that Create Restore Point is checked, then select Cleanup button to remove threats. The process will start and your machine will prompt you to reboot upon completion.

When finished (either with or without cleanup), please navigate to the MBAR directory.
Search there for these two files:
> mbar-log-date(time).txt
> system-log.txt
Please include the content of both files in your reply.

[Lmiller]

here they are

mbar-log-2014-08-28 (08-42-39).txt

system-log.txt

[Naathim]

No rootkits

 

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

ok here we go

FRST.txt

Addition.txt

[Naathim]

You caught a new hijacker...

Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and let this process run uninterrupted.
• This scan can take a while, depending on your System specs.
• Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.

Do not forget to re-enable your previously switched off protection software!

Please also manually reboot your machine after this procedure.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.

[Lmiller]

ughhh....this is never ending.... ok..JRT is downloaded but it's doing the same thing it did the last time you told me to run it. Says system could not find the specified path and closes out.  Do you want me to go ahead and run adwcleaner?

[Naathim]

Yes, please do.

[Lmiller]

I noticed that it said it had deleted the safe search search plugin. Well if it was deleted shouldn't it be gone?? Because when the fast clean pro got downloaded it made safe search my home page on internet explorer. and when I had to download Mozilla for school it made it the home page for that to. and even after reading that log where it said it had deleted that plugin it is still the home page on both of my internet browsers.

AdwCleanerS2.txt

[Naathim]

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

  createsrpoint;autoclean;process;services-list;systemspecs;startupall;skipfix-iedefaults;firefoxlook;chromelook;filesrcm;installedprogs;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.

Don't forget to re-enable your switched-off protection software!

[Lmiller]

ok well it got further than it did last time...I gave it the benefit of the doubt and let it go for a while thinking maybe it would finish....and it didn't. So no text log for that either.

[LiquidTension]

Hello Lmiller,

 

Naathim will unfortunately be unavailable until tomorrow. After burning his HDD to his Home PC, he is need of a new Hard Drive and will not be able to purchase one until tomorrow.

 

Thank you for your patience. 

[Naathim]

Hi and I'm very sorry for the delay. I had a short-circuit accident which deeply fried my home PC's hard drive. As you may know, it's quite hard to run a PC without it

After some time, I'd like to see a fresh report.


Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

It's ok. Things happen. After almost 3 weeks of fighting with this I didn't expect one or two days to be the defining moment haha. I appreciate all your help though. Here are the txt files

FRST.txt

Addition.txt

[Naathim]

Fix with Farbar Recovery Scan Tool

 This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable. 

Press the + R on your keyboard at the same time. Type Notepad and click OK.

• Copy the entire content of the codebox below and paste into the Notepad document:

  startHKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}SearchScopes: HKLM-x32 - TopResultURLFallback http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}SearchScopes: HKLM-x32 - URL http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}SearchScopes: HKCU - TopResultURLFallback http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}SearchScopes: HKCU - URL http://www.safesear.ch/web/?type=20140826-yv-sshome-ie-df&q={searchTerms}FF DefaultSearchEngine: SafeSearchFF SearchEngineOrder.1: SafeSearchFF SelectedSearchEngine: SafeSearchFF Keyword.URL: hxxp://www.safesear.ch/web/?type=ss-ff-kw&q=CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTIONEmptyTemp:end

• Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.

  > XP users click run after receipt of Windows Security Warning - Open File.

  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.

• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please include it in your reply.

Scan with Shortcut Cleaner

Please download ShortcutCleaner by Grinler and save it to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• It will run for a very short time and display the report upon completion.
• The report may be also found on your desktop, named sc-cleaner.txt.

Please include its content in your post.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

• Right-click on icon and select Run as Administrator to start the tool.

  > XP users click run after receipt of Windows Security Warning - Open File.

  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.

• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

[Lmiller]

here are the text files

FRST.txt

Addition.txt

Fixlog.txt

FRST2.txt

Addition2.txt

[Lmiller]

my bad...I added the frst and addition logs from before I did the scan instead of adding the sc-cleaner log.  here is that one. Sorry about that.

sc-cleaner.txt

[Naathim]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Press the + R on your keyboard at the same time. Type Notepad and click OK.

• Copy the entire content of the codebox below and paste into the Notepad document:
  

  startC:\Users\Cody & LaGina\AppData\Local\Search ProtectC:\Users\Cody & LaGina\AppData\Local\ComponentBend

• Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  > XP users click run after receipt of Windows Security Warning - Open File.
  > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please include it in your reply.


Uninstall some programs

We need to uninstall some programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• SearchProtect
• ShopAtHome

After completing uninstalls, please manually reboot your machine!



Dowload & install Unchecky

Please download Unchecky by RaMMicHaeL and save it to your desktop.

• Install it by right-click on the downloaded file and choosing Run as Administrator.
• Follow the prompts to complete the installation.

This software runs silently in the background, trying to uncheck any unnecessary bundled additions during installations.

[Lmiller]

k

Fixlog.txt

[Naathim]

OK, let's move

Scan with Malwarebytes' Anti-Malware

Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

Scan with ESET Online Scanner

This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Please visit ESET Online Scanner website.

Click there Run ESET Online Scanner.

If using Internet Explorer:

• Accept the Terms of Use and click Start.
• Allow the running of add-on.

If using Mozilla Firefox or Google Chrome:

• Download esetsmartinstaller_enu.exe that you'll be given link to.
• Double click esetsmartinstaller_enu.exe.
• Allow the Terms of Use and click Start.

To perform the scan:

• Make sure that Enable detecion of potentially unwanted applications is checked.
• In the Advanced Settings dropdown menu:
  • Make sure that Remove found threats is unchecked.
  • Scan archives is checked.
  • Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.
  • Use custom proxy settings is unchecked.
• Click Start
• The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
• When completed, the program will begin to scan. This may take several hours. Please, be patient.
• Do not do anything on your machine as it may interrupt the scan.
• When the scan is done, click Finish.
• A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.

Please include this logfile in your next reply.

Don't forget to re-enable previously switched-off protection software!