DanteAlihieri Posted January 8, 2015 ID:927517 Share Posted January 8, 2015 Hello, Fist a bit of background: I've tried basically every tool around (even purchased Malwarebytes premium but still no avail) and got to the point where i lost all hope. Did a full format and reinstalled Windows just to see, to my dismay, that this infection wouldn't go away. After the first format everything went ok, until i tried to access my 2 favorite pages: 9gag.com and the steam store page. Not sure if this is what really triggers the infection, but im baffled and at a loss here. I got to the point where i tried to use my laptop to work around this problem just to be greeted by the same popups and iframe injections than in the pc (even after doing a full format and reinstalling windows too!!) So, this is my last hope to try to defeat this dammed infection, hopefully there would be a cure. -A very stressed out guy.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 8, 2015 ID:927519 Share Posted January 8, 2015 Hello, They call me TwinHeadedEagle around here, and I'll be working with you. Before we start please read and note the following:Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.Note that we may live in totally different time zones, what may cause some delays between answers.Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything unexpected happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Rules and policies We won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding! Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Scan with ZOEK Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)Temporary disable your AntiVirus and AntiSpyware protection - instructions here.createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns;bRight-click on icon and select Run as Administrator to start the tool.Wait patiently until the main console will appear, it may take a minute or two.In the main box please paste in the following script:Make sure that Scan All Users option is checked.Push Run Script and wait patiently. The scan may take a couple of minutes.When the scan completes, a zoek-results logfile should open in notepad.If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)Post its content into your next reply. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 9, 2015 Author ID:927772 Share Posted January 9, 2015 Hello there, and thanks for the reply. Did run the zoek and i'm attaching the result file.zoek-results.log Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 9, 2015 ID:927855 Share Posted January 9, 2015 How is your PC behaving now? Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 10, 2015 Author ID:928088 Share Posted January 10, 2015 It still shows ads and iframes all over the place. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 10, 2015 ID:928141 Share Posted January 10, 2015 Does it happen in all browsers? Scan with Malwarebytes' Anti-Malware Please re-run Malwarebytes' Anti-Malware.First of all, select update.Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.Click the Scan tab, choose Threat Scan is checked and click Scan Now.If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.Upon completion of the scan (or after the reboot), click the History tab.Click Application Logs and double-click the newest Scan Log.At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please upload them into your next reply. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 11, 2015 Author ID:928346 Share Posted January 11, 2015 Yep, in Chrome and in IE11. But now seems to be kind of intermittent. Here are the logs. Addition.txtFRST.txtmb-scan.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 11, 2015 ID:928347 Share Posted January 11, 2015 I want you to reset your home router to factory settings. Tell me did this fix your problem. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 11, 2015 Author ID:928363 Share Posted January 11, 2015 Well, seems like its ok now, but im not 100% sure since when i did the system format it waited about a day to reappear. I'll let you know if it reappears tomorrow. BTW, thanks for all the help. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 11, 2015 Author ID:928364 Share Posted January 11, 2015 Nevermind, its back. Now the iframes are there but blank, still it messes up the distribution of pages. And some of the iframes show the legend "powered by cloudscout" or "by DealFinder" and those are not blank. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 11, 2015 ID:928394 Share Posted January 11, 2015 Does it happen in all browsers? On all websites? Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 11, 2015 Author ID:928564 Share Posted January 11, 2015 Not all websites but it does happen on both browsers i have installed. Anyway, tried again a full format using a different version of win 7, and seems to be ok, although i did saw that when i tried to access Steam (http://store.steampowered.com) it was waiting for a conection to dns.cloudscout.com or something like that, but i terminated the connection before the page was fully loaded just in case this is the reason for the infection persisting. I'll give you another update this evening. Thanks again. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 12, 2015 Author ID:928674 Share Posted January 12, 2015 Well, back to square 1 i guess... it still pops up and it does on several websites (and both chrome and ie11) Guess i'll have to keep searching for the cause. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 12, 2015 ID:928722 Share Posted January 12, 2015 Can you make a picture of pop-up? Does it pop-up on all websites? Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please upload them into your next reply. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 14, 2015 Author ID:929343 Share Posted January 14, 2015 It happens mostly on the page in screenshot, but so far i saw that it happens on other pages like bestbuy.com or amazon (basically every page with a div to inject). I tried something else and got it to stop, using the settings on chrome i blocked content and javascript for the following hostnames:[*.]cloudguard.me[*.]superfish.comwww.superfish.com[*.]cloudscout.moko24.com[*.]cloudscoutAnd by doing this, it stopped. But the moment i allow this content or remove the blocking settings, it comes back, so i suppose there must be a registry injecting code to my pages or something like that.Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 14, 2015 ID:929380 Share Posted January 14, 2015 Try to reset your router to factory settings. Also try to reinstall your Google Chrome. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 15, 2015 Author ID:929570 Share Posted January 15, 2015 Well, its done, and after trying to access the page it looked like everything was ok, but after clicking a link and going back to the home page, it came back. I did the router reset and the uninstalling of chrome a couple of times and it still does the same thing. i'm quite baffled with this. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 15, 2015 ID:929598 Share Posted January 15, 2015 Are you sure you did restore your router to factory settings properly? Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 17, 2015 Author ID:930143 Share Posted January 17, 2015 Quite sure, and did it several times. And i also think i found the culprit: the only common things between the laptop and the Pc when i did the full reinstall were the antivirus, the updates and the steam client. At one point i was able to get rid of the malware, hence the "i think its ok now" but to see it come back after some hours. On the course of past couple of days (and after getting a corrupted hard drive tables or something like that because of my fumbling around the registry) did a new reinstall but now abstaining of installing steam. Well, it worked, no more superfish. After some reasoning i figured that there was something within steam that was driving the malware into my system, the posibilities were that (since its a program that syncs data between systems) somehow the malware was bouncing between Pc and laptop at some point, ruled that one out after full formats and erasing all data. Still the malware came back. Then it occurred to me that maybe the server data was infected, and syncing with my account was the way in. So i tried to erase the data from server, and still was no good. After some more thought and searching around other forums for hacked accounts, and did something that i should've done since the beginning: changing my password. By doing that, every other site i've visited and logged in was signed out and effectively cut off all data transmission, which did the trick. Not sure which site could have done the infection, but so far so good for me since i don't have that nasty malware anymore. I'm still testing and monitoring the cookies and traffic from my system and if there are any news i'll give this thread another update. I'm writing all this in hope that maybe it would help you help someone else in the future and spare him the frustration i went through with this. Anyway, thanks again for all the help and keep up the good work. Cheers. (Mexican Beer, mexican style) Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 17, 2015 Author ID:930144 Share Posted January 17, 2015 Well... i guess i spoke too soon... it's back... Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 17, 2015 ID:930184 Share Posted January 17, 2015 Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please upload them into your next reply. Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 17, 2015 Author ID:930270 Share Posted January 17, 2015 Here ya go. i'm getting some info on web atacks by norton, here it is: Category: Intrusion PreventionDate & Time17/01/2015 12:30:10 p.m.RiskHighActivityAn intrusion attempt by 50.97.54.226 was blocked.StatusBlockedRecommended ActionNo Action RequiredIPS Alert NameWeb Attack:PUP/Adware/Fake Application Download 4Default ActionNo Action RequiredAction TakenNo Action RequiredAttacking Computer"50.97.54.226, 80"Attacker URL"t.cttsrv.com/jstex.js?callback=jQuery19102709830154849294_1421519410431&d=DP3070NTAAAA&i=&p=0&s=1024x768&u=http://www.majorgeeks.com/files/details/farbar_recovery_scan_tool_(frst)_64_bit.html&_=1421519410433"Destination Address"DANTE-PC (192.168.0.2, 51711)"Source Address50.97.54.226Traffic Description"TCP, www-http"Network traffic from <b>t.cttsrv.com/jstex.js?callback=jQuery19102709830154849294_1421519410431&d=DP3070NTAAAA&i=&p=0&s=1024x768&u=http://www.majorgeeks.com/files/details/farbar_recovery_scan_tool_(frst)_64_bit.html&_=1421519410433</b>matches the signature of a known attack. The attack was resulted from \DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE. Addition.txtFRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 17, 2015 ID:930294 Share Posted January 17, 2015 Multiple Resident Protection warning! Always have one (and no more than one!) AntiVirus program! In this case having more of them will not provide you with better protection - instead they may cause slowness, lock-ups and even mark another ones as harmful, leading to leave your system unstable and even damaged. Please choose only one from the listed below to stay with and uninstall the others:avast Free AntivirusNorton Internet SecurityUninstallation procedure:Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.Search for each uninstalled entry, right-click it and select Uninstall.This should be done until any other steps will be taken. Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please post it to your reply.fixlist.txt Link to post Share on other sites More sharing options...
DanteAlihieri Posted January 18, 2015 Author ID:930445 Share Posted January 18, 2015 Did as requested... the infection is still there. Tried accessing the pages where i saw the adware acting up with another computer from the same wifi network, it was fine, so i suppose that its something inside my computer. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted January 18, 2015 ID:930482 Share Posted January 18, 2015 Does it happen in all browsers? Can you attach the picture how it looks like? Link to post Share on other sites More sharing options...
Recommended Posts