malicious websites blocked + other issues

[rccpk]

keep seeing popups blocking:

195.2.241.99

195.2.241.100

195.2.240.78

slow computer; IE running poorly; firefox seems ok

thoughts?

[TwinHeadedEagle]

 

[rccpk]

Thank you.

Addition.txt

FRST.txt

[TwinHeadedEagle]

Do you know when it started to happen?

[rccpk]

this unit been bad for awhile (maybe one year or little bit more?).  i've started using it only recently again after i gave daughter my good/newer cpu.  malwarebytes got it functioning, but was hoping  to get it close to 100% when i learned about your service, which i thank you for.

[TwinHeadedEagle]

Unfortunately this PC is infected with CryptoWall ransomware and possibly your files and documents are encrypted. More info here:

http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

There is no way to restore encrypted files to working condition.

[rccpk]

Punks.  Never got a ransom note.  Was time for upgrade anyway. 

Is it okay to upload my pictures to Dropbox?  This unit still limping along.

Will get you something for paypal.  But will do from another CPU.  Thank you again.

[TwinHeadedEagle]

I am not sure if you're pictures are in working condition.

[rccpk]

they still show fine on the infected computer; everything seems to still work to  some degree.  put some up in drop box and pix seem okay when viewed from another cpu..

[TwinHeadedEagle]

Okay, then infection probably didn't execute properly. We can clean it then if files are not encrypted.

Scan with Malwarebytes' Anti-Malware

Please re-run Malwarebytes' Anti-Malware.

• First of all, select update.
• Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
• In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the newest Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and upload your next reply.

 

 

Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
  

Please upload them into your next reply.

[rccpk]

Thank you for looking into this deeper.  Still getting constant pop-up blocking malicious websites (and some new ones):

195.2.240.78

195.2.241.100

195.2.241.99

91.229.79.91

Attached are reports.

FRST.txt

Addition.txt

MWB.Hx.16.0418.txt

MWB.Threats.16.0418.txt

[TwinHeadedEagle]

If you go to this folder, do you see encrypted files:

C:\Documents and Settings\Owner\My Documents

Beyond this point, I think it is not wise spending time cleaning this computer because it is never ending. This machine is running Windows XP that isn't supported and patched by Microsoft for two years and there are more security holes and exploits from day to day. Other vendors are also abandoning this sinking ship and last of them is Google. My honest opinion is to grab documents that you can and to completely wipe this machine and install newer operating system if possible.

[rccpk]

Thanks for your input.  WIll do.  You have been very kind.

Do you have recommendation on how to wipe machine?

How about recommendation for a inexpensive OS?  All I do is surf net, some emails and use the Open Office Word program.

[rccpk]

NVM.  I think I found everything I need right here.

Will go with UBUNTU and the LibreOffice based on this guy.

Excited.  May do some other old machines as well. 

Thanks again. Once I clean, I hit you up on the paypal.

[TwinHeadedEagle]

Yes, you should wipe all content from your hard drive. Ubuntu is very good for beginners and if you're using your PC for simple task like browsing and office.

Let me know if you need more help.

[rccpk]

Thank will circle back once I take care of that.  Any chance you can help me with my cpu at work?  It using 7 Pro.   I posted reports here.

[TwinHeadedEagle]

Quickly looking through reports I didn't spot anything suspicious.

[AdvancedSetup]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!