I'm infected - What do I do now? - Trojan.Clicker.FMS

[amtk52]

As per the previous post: "

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply as well or if needed you can attach the logs.

• Then post a new topic here."

I have attached the two files as requested

 

Thanks for any advice / help.

 

Amtk52

 

P.S. The above instruction continued on to say when posting here to check for "Follow this topic button and choose Immediate Email Notification". I was able to check "Follow this topic button", but did not find anything about the email notification.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 
 
 
 
How is your issue manifesting?

[amtk52]

The only things I have noticed is slowing down and frequent pop-ups notifying me of unresponsive scripts while using Firefox (doesn't seem to happen on other of my browsers) - one of them that occurred while replying here was:

 

**************************************************************************************************************************************************

Warning: Unresponsive Script.

 

A script on this page may be busy, or it may have stopped responding. You can stop the script now, open the script in the debugger, or let the script continue.

 

Script: resource://gre/modules/addons/XPIProvider.jsm -> jar:file:///C:/Users/Warcraft/AppData/Roaming/Mozilla/Firefox/Profiles/3c2bphvg.default/extensions/jid1-MnnxcxisBPnSXQ@jetpack.xpi!/bootstrap.js -> resource://gre/modules/commonjs/toolkit/loader.js -> resource://gre/modules/commonjs/sdk/loader/sandbox.js -> resource://skype_ff_extension-at-jetpack/skype_ff_extension/data/jquery-2.1.0.min.js:26

 

**************************************************************************************************************************************************

 

I found the Trojan.Clicker.FMS by a full scan with Malwarebytes. When I researched the repeated finds by the Malwarebytes, I found this thread about the persistent of the Trojan.Clicker.FMS and realized that the repeated cleanings by the Malwarebytes had not solved the problem because of this same thing. So, I followed the instructions about using the FRST64.exe and attached both of the resultant files.

 

Thanks for any advice / help.

 

Amtk52

 

 

[TwinHeadedEagle]

Scan with TDSSKiller
 
Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on
• icon and select Run as Administrator to start the tool.

• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.
• If anything will be found follow this guidelines:
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    If Cure is not available, please choose Skip instead.
  • Do not choose Delete unless instructed!
  A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.

 

 

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply.

[amtk52]

I was doing as instructed, but when I click on the 'Change parameters' -> 'Loaded modules', it does NOT do a reboot. So, I tried doing a manual reboot and started TDSSKiller again, the 'Loaded modules' is unchecked again. I checked it again and started the scan anyway. It says, "no threats found". Since it did not act as you instructed, I tend to not completely trust that result. Do you have any suggestion?

 

Thanks,

 

Amtk52

[TwinHeadedEagle]

If there are no threats found, proceed with FRST tool.

[amtk52]

Hello,

 

          I have attached the next run's files from the FRST program.

 

          I really appreciate your help. I am on a limited income - a disability pension - and cannot afford taking my computer in, so your help is invaluable.

 

Thanks,

 

Amtk52

Addition #2.txt

FRST #2.txt

[TwinHeadedEagle]

Multiple Resident Protection warning!
 
Always have one (and no more than one!) AntiVirus program! In this case having more of them will not provide you with better protection - instead they may cause slowness, lock-ups and even mark another ones as harmful, leading to leave your system unstable and even damaged. Please choose only one from the listed below to stay with and uninstall the others:

• Microsoft Security Essentials
• Norton Security Suite

Uninstallation procedure:

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for each uninstalled entry, right-click it and select Uninstall.

This should be done until any other steps will be taken.

 

 

 

 

How is your PC now?

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!