sdorr0 Posted January 12, 2015 ID:928929 Share Posted January 12, 2015 just ran frst64FRST.txtAddition.txt Link to post Share on other sites More sharing options...
_argus Posted January 12, 2015 ID:928943 Share Posted January 12, 2015 Helllo,My name is Argus and and I will be helping you with your computer problems.Before we begin, please note the following:I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.The logs can take some time to research, so please be patient with me.Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.Instructions that I give are for your system only!Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Please perform all steps in the order received. If you can't understand something don't hesitate to ask.Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions. Rules and policiesWe won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. FRST searchOnce again we shall use FRST for additional checks. Re-run FRST/FRST64 the same way:Copy Proxy into the Search: field in FRST then click the Search Files button.FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.Please attach it to your reply. Link to post Share on other sites More sharing options...
sdorr0 Posted January 13, 2015 Author ID:928981 Share Posted January 13, 2015 here's the new file Search.txt Link to post Share on other sites More sharing options...
_argus Posted January 13, 2015 ID:929062 Share Posted January 13, 2015 ... Link to post Share on other sites More sharing options...
_argus Posted January 13, 2015 ID:929112 Share Posted January 13, 2015 Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop:Both files, FRST and fixlist.txt have to be in the same location or the fix will not work! Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File).Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please attach it to your reply. fixlist.txt Link to post Share on other sites More sharing options...
sdorr0 Posted January 13, 2015 Author ID:929127 Share Posted January 13, 2015 here's the new fileFixlog.txt Link to post Share on other sites More sharing options...
_argus Posted January 13, 2015 ID:929129 Share Posted January 13, 2015 How is the situation now? Link to post Share on other sites More sharing options...
sdorr0 Posted January 13, 2015 Author ID:929257 Share Posted January 13, 2015 after following all instruction and sending fixlog file and doing a new hyper scan with malwarezbytes it seems clean but i'll do full scan now to be sure Link to post Share on other sites More sharing options...
sdorr0 Posted January 13, 2015 Author ID:929277 Share Posted January 13, 2015 threat scan complete pum.proxy.server gone thank you Link to post Share on other sites More sharing options...
_argus Posted January 14, 2015 ID:929357 Share Posted January 14, 2015 Download DelFix by Xplode and save it to your desktop.Run the tool by right click on the icon and Run as administrator option. Make sure that these ones are checked:Remove disinfection tools Purge system restore Reset system settings [*]Push Run and wait until the tool completes his work. [*]All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFixTool deletes old system restore points and create a fresh system restore point after cleaning. Link to post Share on other sites More sharing options...
sdorr0 Posted January 15, 2015 Author ID:929560 Share Posted January 15, 2015 followed all instructions and now i'm still getting malewarezbytes telling me I have pum.bad.proxy hku/s-1-5-18 ...software/microsoft/windows/currentversion/internet settings proxyserver Link to post Share on other sites More sharing options...
_argus Posted January 15, 2015 ID:929584 Share Posted January 15, 2015 Scan with Farbar Recovery Scan ToolPlease re-run Farbar Recovery Scan Tool to give me a fresh look at your system.Right-click on icon and select Run as Administrator to start the tool.(XP users click run after receipt of Windows Security Warning - Open File). Make sure that Addition option is checked. Press Scan button and wait. The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content into your next reply. Link to post Share on other sites More sharing options...
sdorr0 Posted January 15, 2015 Author ID:929748 Share Posted January 15, 2015 here are the new filesAddition.txtFRST.txt Link to post Share on other sites More sharing options...
sdorr0 Posted January 17, 2015 Author ID:930288 Share Posted January 17, 2015 any updates malewarezbytes informs me every 4 hours about the registry error i don't want to do any web surfing on this computer Link to post Share on other sites More sharing options...
sdorr0 Posted January 17, 2015 Author ID:930331 Share Posted January 17, 2015 PUM.Bad.Proxy, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:13081, , [8ac749ae4643ed495d30234e8f74847c] this is the error i get Link to post Share on other sites More sharing options...
_argus Posted January 18, 2015 ID:930499 Share Posted January 18, 2015 Scan with RogueKillerPlease download RogueKiller and save the file to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool. Wait patiently until the pre-scan will be done. It shouldn't take more than 2-3 minutes. Accept the Terms of use. When the Scan button becomes available, please click it. RogueKiller will start a full scan. Let this process run uninterrupted!. When finished, a Report button will become available. Click it. You will be presented with a logfile.Please include the content of this logfile in your next reply. Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved to your desktop and will automatically open. Post the contents of JRT.txt into your next message. Scan with Malwarebytes' Anti-MalwarePlease download Malwarebytes Anti-Malware and save it to your desktop.Install the progam and select update. Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits. Click the Scan tab, choose Threat Scan is checked and click Scan Now. If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes. Upon completion of the scan (or after the reboot), click the History tab. Click Application Logs and double-click the Scan Log. At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Link to post Share on other sites More sharing options...
sdorr0 Posted January 18, 2015 Author ID:930528 Share Posted January 18, 2015 all 3 programs run with Nortons off JRT.txtmalwarezscanlog.txtRKreport_SCN_01182015_103926.log Link to post Share on other sites More sharing options...
_argus Posted January 18, 2015 ID:930545 Share Posted January 18, 2015 Run RogueKiller again and click ScanWhen the scan completes > click on the Registry tabPut a check next to all of these and uncheck the rest: (if found)[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:13081 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FoundNow click Delete on the right hand column under Options Link to post Share on other sites More sharing options...
sdorr0 Posted January 18, 2015 Author ID:930560 Share Posted January 18, 2015 deleted Link to post Share on other sites More sharing options...
_argus Posted January 18, 2015 ID:930566 Share Posted January 18, 2015 Is everything ok now? Link to post Share on other sites More sharing options...
sdorr0 Posted January 18, 2015 Author ID:930574 Share Posted January 18, 2015 I'll let you know I plan on restarting cpu and running malwarezbytes again Link to post Share on other sites More sharing options...
sdorr0 Posted January 18, 2015 Author ID:930575 Share Posted January 18, 2015 Its right back in results something keeps adding it to registry after each time its deleted Link to post Share on other sites More sharing options...
_argus Posted January 18, 2015 ID:930580 Share Posted January 18, 2015 Download rar file, unpack.Double click, Yes, OK, reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Delete the key "DefaultConnectionSettings" Delete the key "SavedLegacySettings" Re-run MBAM fix.zip Link to post Share on other sites More sharing options...
sdorr0 Posted January 18, 2015 Author ID:930582 Share Posted January 18, 2015 getting registry editor error cannot import Link to post Share on other sites More sharing options...
_argus Posted January 18, 2015 ID:930583 Share Posted January 18, 2015 Try nowfix.zip Link to post Share on other sites More sharing options...
Recommended Posts