Infection by: pup.optional.terraclicks.shrtcln

[Fred37]

Hi Folks,

I'm infected with 'pup.optional.terraclicks.shrtcln' and have followed the advice posted here to download and use Farbar.  However, when I try to run the programme, the main user screen of Farbar flashes up on my screen, but before I can do anything it disappears from my screen and and the downloaded file also vanishes!!

Any thoughts /assistance appreciated.

BTW I'm running Windows 7 Home Premium, 64 bit (and I am downloading the 64 bit file).

Thanks,

Fred

 

P.S.  FYI, I also just re-ran the malwarebytes scanner it picked up SpigotA....I did a 'Delete' and re-ran MWB and it now seems to be gone 

[TwinHeadedEagle]

Hello and

Can you rename FRST to something random and then try to run it?

 

[Fred37]

Ok, just tried it and the same thing happens.  After it disappears from my screen, I can still see the 'logo' in my system tray for a few seconds before that disappears as well. 

[TwinHeadedEagle]

Can you try to run FRST from Safe Mode?

[Fred37]

Ok tried that and managed to get it to run.  I performed the scan and it gives me the scan report, but when I select 'fix' it says:

"nofixlist.txt found.  The fixlist.txt should be in the same folder/directory the tool is located."  

However, the text file does appear in the same download folder as the FRST programme and so what do I do next?

[TwinHeadedEagle]

You're not supposed to click Fix button until I provide fixlist for you.

I need you to attach FRST.txt and Addition.txt report for my review.

 

[Fred37]

Oops, sorry.

Here are the two files as requested:

 

Note I had to rerun the scan as I managed to delete it!

FRST.txt

Addition.txt

[Fred37]

BTW, I really appreciate the help on this 

[TwinHeadedEagle]

Can you disable your Antivirus while trying to run FRST from normal mode?

Can you reboot your computer and let me know if MalwareBytes still detects infection?

[Fred37]

Disabled anti-virus and ran FRST OK from Normal mode...do you want a copy of the new text report?

I'm just re-running MWB.

[Fred37]

Yes, MWB still finds the same infection after a restart :-(

[TwinHeadedEagle]

Yes, please I would like to see FRST report from normal mode.

 

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition.txt option is checked. option is checked.

  

• Press Scan button and wait.

• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach report into your next reply.

---

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  chrdefaults;

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Upload it in your next reply.

Edited September 20, 2016 by TwinHeadedEagle

[Fred37]

Ok, so find attached:

 

1) 2 files from the new FRST scan with anti-virus disabled.

2) 1 Zoek file results - I had to run this in Safe mode as I had the same problem as reported earlier with FRST. 

Addition.txt

FRST.txt

zoek-results.txt

[TwinHeadedEagle]

Uninstall some programs
 
We need to uninstall some unwanted/unneeded programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time
  

The list of programs to uninstall:

• YTD Video Downloader 4.9
  

 
Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.

---

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finishes FRST will generate a log on the Desktop, called Fixlog.txt.
  

Please attach it to your reply.

---

After reboot, tell me is everything okay now.

---

fixlist.txt

[Fred37]

hmmmm I have no 'Fixlog.txt' file after FRST ran.  Do I need to rerun FRST in SAFE mode again?

[TwinHeadedEagle]

Yes, try it please. 

[Fred37]

Hi, Find attached the 'Fixlog' file.  I've just re-run MWB and my PC now seems to be clear.  Not sure what happened to the other threat that was found...haven't seen that since.  

What do you think?

Fixlog.txt

[TwinHeadedEagle]

Yes, your PC is clean now.

[Fred37]

That's brilliant, thanks so much for your help.