Cleaning my PC

[Aya_Tachibana]

Hello everyone.

I was searching on Google about virus on Onedrive. Then, I clicked on 2 websites (I only go to trusted websites)

 

I clicked on these two here:

 

- http:/[/]help.overdrive[dot]com/customer/portal/articles/1481229-what-to-do-if-your-on-access-anti-virus-software-is-preventing-you-from-opening-a-title-you-ve-just-downloaded

- http:/[/]microsoft-onedrive.en.lo4d[dot]com/virus-malware-tests

 

Added the [dot] and [/] to prevent people clicking it.

 

Even if Virus Total said that those websites were safe, Google Safebrowsing website told me that the second website had some virus.

 

Just to know, are those websites safe? If not, I'm ready todo any scan.

 

 

Thank you guys for the help.

[Aya_Tachibana]

Sorry for the double post, but just to update my thoughts:

 

- The first link looks safe (since it comes from a trusted website, and I didn't know it)

- Now the second website still looks extremely suspicious.

 

PS: Is there any type of edit button? That would be useful.

 

Thank you guys for the help.

[Aya_Tachibana]

Hello everyone!

 

I know that I created another thread, about visiting some strange websites.

After some searches on Google, looks like that they're clean websites.

But, anyway, for security, I used the FRST program to test if my PC is okay.

 

So, can someone help me to test if my PC is safe? (please note that even if I'm infected now, maybe the infection came before visiting those websites, but that's really unlikely, since I only visit websites that I know that are safe (except those that I visited in the other thread, I clicked without thinking.))

 

 

Thank you guys for helping me.

 

 

 

Addition.txt

FRST.txt

[Aya_Tachibana]

Sorry for the double post.

 

But I forgot to say that I did 3 scans:

- Malwarebytes on Safe mode (no infections)

- Avast on Administrator account (no infections)

- ESET Online Scanner on Administrator account (no infections)

 

Also, before doing the ESET scan, I disabled the Avast anti-virus.

But, I forgot to turn it on (Luckly, I only visited a post on facebook and sent an e-mail).

[LiquidTension]

Hello Aya_Tachibana, welcome to Malwarebytes' Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Please backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.

======================================================
 
Your logs are clean.

Malwarebytes on Safe mode (no infections)

 
Some security tools such as anti-rootkit scanners (ARKs) and programmes with anti-rootkit technology use special drivers which are required for the scanning and removal process. These tools are designed to work in Normal Mode because the drivers will not load in Safe Mode which lessens the scan's effectiveness. Other security tools are optimized to run from Normal Mode where they are most effective. For example, Malwarebytes Anti-Malware is designed to run at full capacity when malware is running so using Safe Mode is not necessary. In fact, Malwarebytes loses effectiveness for detection and removal when used in SafeMmode. For optimal efficiency, Normal Mode is recommended so it does not limit the abilities of Malwarebytes.
 
If you wish to rerun MBAM in Normal Mode then by all means go ahead. But based on your logs so far I do not believe anything will be detected. 
 
Lets run a few more scans to double-check.
 
STEP 1
Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start2014-08-22 12:18 - 2014-09-19 18:53 - 00109056 ___SH () C:\Users\Nori-chan\Downloads\Thumbs.dbFolder: C:\tmpCMD: ipconfig /flushdns CMD: netsh winsock reset allCMD: netsh int ipv4 reset CMD: netsh int ipv6 reset CMD: bitsadmin /reset /allusers EmptyTemp: end

• Click File, Save As and type fixlist.txt as the File Name.
• Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST64.exe and select Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

STEP 2
AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-Click AdwCleaner.exe and select Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
• Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
• Follow the prompts and allow your computer to reboot.
• After rebooting, a log (AdwCleaner[s0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
 
 
STEP 3
Junkware Removal Tool (JRT)

• Please download Junkware Removal Tool and save the file to your Desktop.
• Note: If you unchecked any items in AdwCleaner, please backup the associated folders/files before running JRT.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click JRT.exe and select Run as administrator to run the programme.
• Follow the prompts and allow the scan to run uninterrupted.
• Upon completion, a log (JRT.txt) will open on your desktop.
• Re-enable your anti-virus software.
• Copy the contents of JRT.txt and paste in your next reply.
   

======================================================
 
STEP 4
Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• AdwCleaner[s0].txt
• JRT.txt

[Aya_Tachibana]

Hello, and thank you for helping me.

You can call me Aya, if you want .

 

Now, I have a question: I tried to use adwcleaner, and I got the log. But, I didn't see anything with a checkmark on the program or in the file, so I didn't cleaned anything.

 

I'm also attaching the log file.

AdwCleanerR0.txt

[LiquidTension]

Hi Aya, 

 

That's fine, the log is clean. Please proceed with JRT. 

Don't forget to post Fixlog.txt as well. 

[Aya_Tachibana]

Hello Adam.

I did all tests here, I'm attaching the logs.

Fixlog.txt

JRT.txt

[LiquidTension]

Good job, Aya. 

 

Is C:\tmp a folder you created yourself? 

[Aya_Tachibana]

I think that the program called Blender created that folder, since even Blender tells me that I used C:\tmp recently.

In that folder, there's a lot of pictures, but every picture is 100% black (because I failed on rendering)

 

I don't know if the folder was deleted before or not (because of the programs that I used, like adwcleaner), but it's still here, and I can easily remove it, if you want (deleting or not will  not make much difference here)

[LiquidTension]

Hi Aya, 
 
No, that's fine. You can leave the folder. 
Lets run one final scan to double-check. 
 
 Emsisoft Emergency Kit (Portable)

• Please download Emsisoft Emergency Kit and save the file to a your Desktop.
• Double-click EmsisoftEmergencyKit.exe.
• Click Extract.
• Upon completion, double-click the Emsisoft Emergency Kit shortcut on your Desktop to start the programme.
• Click Yes to update the programme definitions.
• Click Yes to detect Potentially Unwanted Programs (PUP's).
• Click Scan now.
• Select Full Scan and click Scan.
• Close any High Risk notification screen that may appear.
• When the scan is finished click Quarantine selected objects if malicious objects were found.
• Click View Report, and open the most recent log. 
• Copy the contents of the log and paste in your next reply.

[Aya_Tachibana]

Hello Adam.

Before running that program, do I have to be an administrator to run and update it?

[LiquidTension]

Hi Aya,

Yes, please use your Administrator account.

[LiquidTension]

.

[Aya_Tachibana]

Hello Adam.

Here is the log:

 

Emsisoft Anti-Malware Free - Versão 9.0

Última atualização 23/09/2014 18:48:24

User account: Nori-laptop\Nazuna

 

Configuração do exame:

 

Tipo de exame: Exame Profundo

arquivos: Rootkits, Memória, Rastros, C:\

 

Detect PUPs: Ligado

Análise de arquivos: Ligado

Análise de ADS: Ligado

Extensão de arquivo: Desligado

Caching avançado: Ligado

Acesso direto ao disco: Desligado

 

Início do exame: 23/09/2014 18:49:11

Value: HKEY_USERS\S-1-5-21-3515020605-1485836062-4049228841-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR detectados: Setting.DisableTaskMgr (A)

Value: HKEY_USERS\S-1-5-21-3515020605-1485836062-4049228841-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS detectados: Setting.DisableRegistryTools (A)

 

Analisados: 481675

Achado 2

 

Fim do exame: 23/09/2014 19:33:27

Duração do exame: 0:44:16

 

Value: HKEY_USERS\S-1-5-21-3515020605-1485836062-4049228841-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS Em quarentena Setting.DisableRegistryTools (A)

Value: HKEY_USERS\S-1-5-21-3515020605-1485836062-4049228841-1006\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR Em quarentena Setting.DisableTaskMgr (A)

 

Em quarentena 2

[LiquidTension]

Looks good, Aya. 

Now for the good news. 

 

All Clean!
Congratulations, your computer appears clean!  
I see no signs of malware on your computer, and feel satisfied that our work here is done. The steps below will remove the tools we have used, and reset any settings changed. I have also provided a list of resources and tools that you may find useful. 
 
My help will always be free. But if you are happy with the help provided, and would like to support my fight against malware and/or buy me a beer, please consider a donation.
 
 

STEP 1
DelFix

• Please download DelFix and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset system settings
• Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
 
======================================================
 
Below I have compiled a list of resources you may find useful. The articles document information on computer security, common infection vectors and how you can stay safe on the Internet.

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malware by quietman7, MVP
   

The following programmes come highly recommended in the security community.

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• Emsisoft Antimalware (free) acts as an additional on-demand scanner, and can be used in conjunction with your Anti-Virus.
• Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• Malwarebytes Anti-Malware Premium (MBAM) incorporates real-time protection and is designed to run alongside your Anti-Virus.
• NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• Sandboxie isolates programmes of your choice, preventing files from writing to your HDD unless you approve the file.
• Secuina PSI will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
• SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• Unchecky automatically removes checkmarks for additional software in programme installers, helping you avoid adware and PUPs.
• Web of Trust (WOT) is a browser add-on designed to alert the user before interacting with a potentially malicious website. 

-- Please feel free to ask if you have any questions or concerns on computer security or the programmes above.
 
======================================================
 
Please confirm you have no outstanding issues, and are happy with the state of your computer. Once I have confirmation things are in order, we can wrap things up and I will close this thread. 
 
Thank you for using Malwarebytes.
 
Safe Surfing.   
Adam (LiquidTension).

[Aya_Tachibana]

Hello Adam, and thank you for helping me.

 

Just to know, those files that Emsisoft Emergency Kit found are viruses or anything bad?

If the answer is yes, can i delete them?

[LiquidTension]

Hi Aya,

The items detected by Emsisoft were not files. They were registry values, and dealt with appropriately. No further action is required.

[Aya_Tachibana]

Hello Adam.

Even if theose regitry values were dealt with appropriately, should I change my passwords?

[LiquidTension]

You can if you wish, but I don't think it's necessary.

The key values are harmless. Emsisoft has simply deleted the registry values so your Task Manager and RegEdit cannot be disabled.

There is nothing to be concerned about.

[Aya_Tachibana]

Sorry for the double post (again), but can I unnistall the program  Emsisoft Emergency Kit ?

Or should I leave it here.? (I can use it as a option for scanning viruses and such).

 

Also, no idea why, But I got ~10GB of space only by using those programs, lol.

[LiquidTension]

Emsisoft Portable cannot be uninstalled; only deleted. You simply need to delete the icon (right-click + Delete) if you so wish. Or, as you say, you can keep Emsisoft and run a weekly/fortnightly scan in conjuction with an MBAM scan to maintain security.

Temporary files, browser/DNS cache, etc build up over time. We cleared these temporary files out, which is why you've seen an increase in free space.

[Aya_Tachibana]

Well, looks like that everything is fine now, thank you

 

Will install Anti-exploit, WOT and sandboxie, since they look interesting.

[LiquidTension]

Very good, I'm glad all is well.

I will go ahead and request this topic be closed.

All the best,

Adam.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!