M51.dnsqa.me problem

Optimus · December 25, 2015

Hi guys,

I have an issue (a quite common one it seems) with the m51.dnsqa.me malware. The issue is exactly the same as in this post (https://forums.malwarebytes.org/index.php?/topic/175951-dns-unblocker-m51dnsqame-problems/). I am running Chrome and Win 7 (64 bit)

I have also run the FRST64 and attach here the Addition.txt and FRST.txt files. It would be really, really great if you help me with the fixlist.txt file. This nasty little virus is getting on my nerves indeed.

Thanks very much in advance and have a great Christmas!

Best regards,Emil

Addition.txt

FRST.txt

AdvancedSetup · December 25, 2015

2015-09-29 13:27 - 2015-09-29 13:27 - 00049564 _____ C:\Users\New User\Documents\[kat.cr]the.muppets.s01e02.720p.hdtv.x264.killers.torrent

2015-12-25 10:21 - 2015-12-25 10:21 - 00095786 _____ C:\Users\New User\Downloads\[kat.cr]the.intern.2015.1080p.web.dl.dd5.1.h264.rarbg.torrent
2015-12-25 10:14 - 2015-12-25 10:14 - 00073557 _____ C:\Users\New User\Downloads\[kat.cr]the.bridge.2011.s01.720p.bluray.x264.nodlabs.publichd.torrent
2015-12-24 19:20 - 2015-12-24 19:20 - 00180266 _____ C:\Users\New User\Documents\[kat.cr]minions.2015.1080p.bluray.x264.geckos.rarbg.torrent
2015-12-24 18:53 - 2015-12-24 18:53 - 00011531 _____ C:\Users\New User\Documents\[kat.cr]focus.2015.1080p.web.dl.dd5.1.h264.rarbg.torrent
2015-12-23 23:27 - 2015-12-23 23:27 - 00019518 _____ C:\Users\New User\Downloads\[ArenaBG.ch]-Miss Bulgaria 2006 Slavena Vatova.torrent
2015-12-23 23:25 - 2015-12-23 23:25 - 00000932 _____ C:\Users\New User\Downloads\[ArenaBG.ch]-Awesome Russian Homemade Girlfriend Sex Tape.torrent
2015-12-23 23:23 - 2015-12-23 23:23 - 00019826 _____ C:\Users\New User\Downloads\[ArenaBG.ch]-[indianPornQueens] Jyoti (Happy 18th Birthday To Me) SD -=NEW APRIL 15,2015=-.wmv.torrent
2015-12-22 20:18 - 2015-12-22 20:19 - 179254104 _____ C:\Users\New User\Downloads\qn0w4uth.exe
2015-12-22 18:10 - 2015-12-22 18:10 - 00090012 _____ C:\Users\New User\Downloads\[kat.cr]homeland.s05e12.a.false.glimmer.1080p.web.dl.dd5.1.h264.ntb.rartv.torrent

AdvancedSetup · December 25, 2015

This topic will now be closed due to evidence of cracked or pirated software on this system.

Piracy Policy

AdvancedSetup · December 25, 2015

Topic reopened per request

Optimus · December 26, 2015

Can somebody help with this issue? FRST.txt and Addition.txt files are attached. Thanks very much in advance!

FRST.txt

Addition.txt

Optimus · December 28, 2015

Help...anybody?!?

AdvancedSetup · December 28, 2015

Please uninstall either Webroot antivirus or Avast antivirus. Then run the following.

Please go ahead and run through the following steps and post back the logs when ready.

STEP 04
Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next reply message
When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

STEP 06
Please open Malwarebytes Anti-Malware and from the Dashboard please Check for Updates by clicking the Update Now... link
Open up Malwarebytes > Settings > Detection and Protection > Enable Scan for rootkits, Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. Remove any threats found
Once completed please click on the History > Application Logs and find your scan log and open it and then click on the "copy to clipboard" button and post back the results on your next reply.

STEP 07

Please go here to run the online antivirus scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 08
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Optimus · December 29, 2015

Hi Ron,

Thanks a lot for the very detailed instructions. I did all this and here are the results (the FRST and Addition file are attached as otherwise the message content becomes too long). Thanks for taking a look and letting me know what the next steps would be.

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.1 (11.24.2015)

Operating System: Windows 7 Professional x64

Ran by New User (Administrator) on 29/12/2015 at 21:30:16.53

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 6

Successfully deleted: C:\Users\New User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsfreak.com_0.localstorage-journal (File)

Successfully deleted: C:\Users\New User\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.lyricsfreak.com_0.localstorage (File)

Successfully deleted: C:\Users\New User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\goodgame empire.lnk (Shortcut)

Successfully deleted: C:\Users\New User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\goodgame empire.lnk (Shortcut)

Successfully deleted: C:\Users\New User\AppData\Roaming\tencent (Folder)

Successfully deleted: C:\Program Files (x86)\tencent (Folder)

Registry: 1

Successfully deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_DAC62E1DF9428531B98EE6591C69814E (Registry Value)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 29/12/2015 at 21:34:53.14

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ADWCleaner.txt

# AdwCleaner v5.026 - Logfile created 29/12/2015 at 21:59:38

# Updated 21/12/2015 by Xplode

# Database : 2015-12-29.1 [server]

# Operating system : Windows 7 Professional Service Pack 1 (x64)

# Username : New User - X230

# Running from : C:\Users\New User\Desktop\AdwCleaner.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Wechat]

[-] Key Deleted : HKLM\System\CurrentControlSet\Services\Eventlog\Application\Update Fortunitas

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]

[-] Key Deleted : HKCU\Software\OCS

[-] Key Deleted : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\MediaPlayerplus

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1361 bytes] ##########

Malwarebytes Log

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 29/12/2015

Scan Time: 22:04

Logfile: Malwarebytes log.txt

Administrator: Yes

Version: 2.2.0.1024

Malware Database: v2015.12.29.06

Rootkit Database: v2015.12.26.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: New User

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 550516

Time Elapsed: 30 min, 5 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 2

PUP.Optional.OpenCandy, C:\Users\New User\AppData\Local\Temp\HYDD163.tmp.1451420740\HTA\install.1451420740.zip, Quarantined, [83571a90b2d91026b09b89948a78fd03],

PUP.Optional.OpenCandy, C:\Users\New User\AppData\Local\Temp\HYDD163.tmp.1451420740\HTA\3rdparty\OCSetupHlp.dll, Quarantined, [57831e8cc1ca46f039b20e9ff311867a],

Physical Sectors: 0

(No malicious items detected)

(end)

ESET Log

C:\Users\New User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EGUBYDVP\KMPConnectSetup[1].exe a variant of Win32/MiniUPnP.C potentially unsafe application

C:\Users\New User\AppData\LocalLow\Sun\Java\jre1.7.0_60\java_sp.dll a variant of Win32/Bundled.Toolbar.Ask.M potentially unsafe application

C:\Users\New User\AppData\LocalLow\Sun\Java\jre1.7.0_67\java_sp.dll a variant of Win32/Bundled.Toolbar.Ask.M potentially unsafe application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja--southern-baja.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja-directory-transport.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja-health.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja-language.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja-los-cabos-planning-information.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Documents\Books\Travel Guides\Baja & Los Cabos 7th Edition, August 2007 [PDF]\baja-los-cabos.pdf JS/Trackware.ReadNotify.A potentially unwanted application

C:\Users\New User\Downloads\saa_setup.exe Win32/BundleLoader.B potentially unwanted application

C:\Users\New User\Downloads\Wondershare\mobilego_full818.exe Android/Exploit.Lotoor.EZ trojan

Addition.txt

FRST.txt

AdvancedSetup · December 30, 2015

The logs still show that you're running both Webroot antivirus and Avast antivirus. You need to remove one of them.

Please visit each of the following sites and lets reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Firefox
Click on Help / Troubleshooting Information then click on the Reset Firefox button.

Chrome
Start by disabling Sync
How To Delete Your Google Chrome Browser Sync Data
Chrome - Reset browser settings
If that fails then Uninstall Google Chrome and do not reinstall until sure the system is clean.

Next,

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following.

Please download JavaRa-1.16 and save it to your computer.

Double click to open the zip file and then select all and choose Copy.
Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
Quit all browsers and other running applications.
Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it in your next reply.

Next:

Please Run TFC by OldTimer to clear temporary files:

Download TFC from here and save it to your desktop.
http://oldtimer.geekstogo.com/TFC.exe
Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

Thanks

Optimus · December 30, 2015

Hi Ron,

I don't know why Avast data appears-I uninstalled the software before I started.

I executed all steps as instructed. Here is the log file from JavaRa:

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Dec 30 18:46:38 2015

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0001-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0002-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0003-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0004-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0005-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0006-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0007-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0008-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0009-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0010-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0011-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0012-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0013-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0014-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0015-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0016-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0017-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0018-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0019-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0020-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0021-ABCDEFFDCBA}. The error returned was 124.

There was an error removing C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0022-ABCDEFFDCBA}. The error returned was 124.

Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}

Found and removed: SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}

Found and removed: SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}

Found and removed: SOFTWARE\Classes\Interface\{5852F5EC-8BF4-11D4-A245-0080C6F74284}

Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit

Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-applet

Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/x-java-jnlp-file

Found and removed: SOFTWARE\Classes\TypeLib\{5852F5E0-8BF4-11D4-A245-0080C6F74284}

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.7.0.0

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Found and removed: SOFTWARE\JavaSoft

Found and removed: SOFTWARE\JreMetrics

------------------------------------

Finished reporting.

What are the next steps (if any) to be done?

Thanks,Emil

AdvancedSetup · December 31, 2015

Please confirm that the "M51.dnsqa.me" entry issue is now gone.

Next,

Remove Avast antivirus WMI Registration

Click on the Start menu.
Select Run...
Type wbemtest and click OK
Click Connect
Type (or copy/paste) root/SecurityCenter in the NameSpace box
Click Connect
Click on Query
Type in or copy / paste SELECT * FROM AntiVirusProduct and click on Apply

If there is more than one result, it means there is more than one Antivirus program installed.
Double click on each result to view the properties for that Antivirus product.
Identify the product(s) installed and DELETE any records for avast! antivirus

Optimus · December 31, 2015

Hi Ron,

Indeed the M51 issue has not appeared after I took the steps you advised. There is no trace of Avast in the procedure you described in the last post.

AdvancedSetup · December 31, 2015

Not a big with the WMI - we can look at ensuring avast is fully removed with some other methods. Please restart the computer 2 more times and then run a new FRST scan and make sure to place a check mark in the Additions.txt check box and attach both NEW logs on your next reply.

Thanks

Optimus · December 31, 2015

Hi Ron,

I did the double restart and the scan - attached please find the results.

FRST.txt

Addition.txt

AdvancedSetup · December 31, 2015

Great, I'll try to check them later tonight or if not then tomorrow. Please run MBAM again and check for updates and do a Threat Scan and post back that log too.

Thanks and Happy New Year to you and yours

Ron

Optimus · January 1, 2016

Hi Ron,

I ran the MBAM - no issues found (see attachment).

I wish you too a very healthy and successful 2016!

Best,Emil

MBAM Log.txt

AdvancedSetup · January 2, 2016

Please visit the following site and download their tool and save it to your computer. Then quit your browser and go locate the tool and run it via Safe Mode as they've requested.

https://www.avast.com/uninstall-utility

The after the restart please run the following.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Optimus · January 2, 2016

Hi Ron,

Did both steps. Here is the log:

Fix result of Farbar Recovery Scan Tool (x64) Version:23-12-2015

Ran by New User (2016-01-02 11:51:54) Run:1

Running from C:\Users\New User\Desktop

Loaded Profiles: New User & MSSQL$SQLEXPRESS2012 & MSSQLFDLauncher$SQLEXPRESS2012 (Available Profiles: New User & MSSQL$SQLEXPRESS2012 & MSSQLFDLauncher$SQLEXPRESS2012 & Classic .NET AppPool & DefaultAppPool & MelonLMS_50)

Boot Mode: Normal

==============================================

fixlist content:

*****************

Task: {5ECB1D9F-5D27-4255-9DB0-86A77162EA3B} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-17] (AVAST Software)

Task: {9FEFDA85-8598-479F-B6F6-8412D21DFB45} - System32\Tasks\{A62D43AD-15DA-4275-84A9-A0966A9CC799} => pcalua.exe -a "C:\Users\New User\AppData\Roaming\webssearches\UninstallManager.exe" -c -ptid=tugs <==== ATTENTION

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File

C:\Users\New User\Downloads\avast-browser-cleanup.exe

C:\Windows\System32\Tasks\AVAST Software

C:\ProgramData\AVAST Software

EmptyTemp:

Reboot:

*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{5ECB1D9F-5D27-4255-9DB0-86A77162EA3B}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5ECB1D9F-5D27-4255-9DB0-86A77162EA3B}" => key removed successfully

C:\Windows\System32\Tasks\AVAST Software\Avast settings backup => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVAST Software\Avast settings backup" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9FEFDA85-8598-479F-B6F6-8412D21DFB45}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9FEFDA85-8598-479F-B6F6-8412D21DFB45}" => key removed successfully

C:\Windows\System32\Tasks\{A62D43AD-15DA-4275-84A9-A0966A9CC799} => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A62D43AD-15DA-4275-84A9-A0966A9CC799}" => key removed successfully

"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => key removed successfully

HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found.

C:\Users\New User\Downloads\avast-browser-cleanup.exe => moved successfully

C:\Windows\System32\Tasks\AVAST Software => moved successfully

"C:\ProgramData\AVAST Software" => not found.

EmptyTemp: => 1000.7 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 11:52:33 ====

AdvancedSetup · January 3, 2016

How is the computer running now?

Are there still any signs of an infection?

Please download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
If you get Unsupported operating system. Aborting now, just reboot and try again.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

Optimus · January 3, 2016

Hi Ron,

Computer is running great now. Here is the log:

Results of screen317's Security Check version 1.009

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 11

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Webroot SecureAnywhere

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Adobe Reader XI

Google Chrome (47.0.2526.106)

Google Chrome (47.0.2526.80)

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbam.exe

Malwarebytes Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

Do you think the issue is solved now?

Thanks,Emil

AdvancedSetup · January 3, 2016

Hi Emil

Everything looks pretty good at this time.

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.

Download Delfix from here and save it to your desktop. (you may already have this)

Ensure Remove disinfection tools is checked.
Click the Run button.
Reboot

Any other programs or logs that are still remaining, you can manually delete. (right click.....Delete)
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.

If there are any other left over Folders, Files, Logs then you can delete them on your own.

Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP

As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.

If you're not currently using Malwarebytes Premium then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.

exile360 · June 23, 2016

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

M51.dnsqa.me problem

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information