Need help removing searchnet.blinkxcore.com on 2 computers

[russelray]

I appear to have picked up this malware while listening to music at Grooveshark.com and need help removing it. Thanks.

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Scan with Malwarebytes' Anti-Malware
 
Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

[russelray]

Thanks, TwinHeadedEagle.
I was following your help on some other threads but didn't go past the point where you warned about specific machines.

Here's the text:

 

I am unable to paste anything here.

[russelray]

And I don't find an "upload files" option anywhere.

[TwinHeadedEagle]

First click More Reply Options and then you will find upload option.

[russelray]

Thanks.

 

Log attached.

91514 log.txt

[TwinHeadedEagle]

Okay, we will run deeper scan:
 
 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[russelray]

If I try to use my computer between the hours of about 2:00 a.m. and 5:00 a.m. Pacific Standard Time (San Diego, California), about 5-10 minutes after I wake it up, the monitor goes haywire for 2-5 seconds. I have learned to stay here at the computer and watch the monitor. As soon as it goes haywire, if I use the power button to shut the computer down, leave it off for about 15 minutes, and then turn it back on. I'm okay for the rest of the day except that I get Malwarebytes constantly blocking searchnet.blinkxcord.com outbound attempts, but only when I log on to my WordPress blog (http://russelrayphotos2.com).

 

If I don't catch the computer in time, the malware gets control of the computer, sometimes shutting it down and other times causing the computer to run slow, not run at all, hang, Internet settings changed (Internet Explorer 11), etc. Using Windows 7 Restore sometimes work, but other times the restore points have been deleted, Malwarebytes has been deleted, etc.

 

This morning I shut the computer down but I was a little late, allowing the computer haywire to go on for a few seconds. when I restarted it 15 minutes later, the attached graphic shows the Malwarebytes message I got.

 

I'm going to attempt to accomplish the tasks you outlined in your immediately preceding response. Thanks.

 

[russelray]

Resulting files.

FRST.txt

Addition.txt

[TwinHeadedEagle]

You should click Yes on that windows.
 
 
 
Uninstall some programs
 
We need to uninstall some programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• Codec Package Packages
• Update for Codec Package

After completing uninstalls, please manually reboot your machine!
 
Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.
 
 
 
 

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[russelray]

Right-clicking on that icon doesn't provide me with an option to run as administrator.

[russelray]

I still had FRST64 on my desktop so I downloaded fixlist.txt and ran FRST64. Attached is the fixlog.txt.

Fixlog.txt

[russelray]

Malwarebytes is back and appears to be fully functional again, and I visited my WordPress blog with no blinkxcore.com outbound attempts being blocked by Malwarebytes, so this computer appears to be back fully functional. Faster, too. So thank you very much. I believe you have a couple of beers coming your way shortly.

 

For my other computer, should I started a new topic or continue here? I think it's worth another couple of beers. Might be able to get you a six pack! Thanks again.

[TwinHeadedEagle]

No problem, I am going to need two FRST reports from your other PC

[russelray]

The malware is in control now of my second computer and it has shut down internet access. I done system restores all the way back to August 16, and I've done safe mode and safe mode with networking. Nothing I do allows Internet access. What should I do?

[TwinHeadedEagle]

Can you transfer FRST tool to second PC via USB Flash device?

[russelray]

Yes.

 

working................. BRB

[russelray]

Two files.

FRST.txt

Addition.txt

[TwinHeadedEagle]

First, open Control Panel and remove Search Protect
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
• Include that log in your next reply.
  If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
  If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[russelray]

Got Internet access back. Had to uninstall and reinstall Malwarebytes but everything seems to be working.

 

Here are the files.

Fixlog.txt

ComboFix.txt

[TwinHeadedEagle]

This PC seems more infected than previous. We have few more steps to do:
 
 
 
 
Scan with Malwarebytes' Anti-Malware
 
Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.
 
 
 
 

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

• Type wuauclt.exe into the Search: field in FRST then click the Search Files button.
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
• Please attach it to your reply.

 

 

 

 

• Scan with Farbar Recovery Scan Tool
   
  Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Please include their content into your next reply.
  • Right-click on icon and select Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

[TwinHeadedEagle]

Just to inform you, it is late here, so I'll be back after I get some sleep.

[russelray]

Files attached.

MWB scan log.txt

Search.txt

FRST.txt

Addition.txt

[TwinHeadedEagle]

Okay, this will probably be our last step. How is your PC now?
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 
Please go to: VirusTotal

•  Click the Choose File button.
•  Please copy/paste the following text into the 'File name:' box:
   
  

  C:\Windows\SysWOW64\lsass.exe

•  Click Open then click the Scan it! button just below.
•  This will scan the file. Please be patient.
•  If you get a message saying File already analyzed: click Reanalyse
•  Once scanned, copy and paste the URL from your browser address bar in your next reply.

fixlist.txt

[russelray]

Both computers seem to be okay. Both running fast, both with malwayrebytes on them, and no inbound or outbound blocks. The only other thing I noticed is that malwarebytes used to show as running at the upper right side of the task bar. It no longer resides there.

 

The link to virustotal.com doesn't work. Malwarebytes.com reports that the page cannot be found.

 

 

Fixlog.txt