patkane Posted November 27, 2016 ID:1075056 Share Posted November 27, 2016 I stupidly followed a link for a user manual download and was immediately infected with software that redirects links in Chrome to sites such as honestbeauty.com and liveadexchanger.com I own the paid-for version of Malwarebytes and it is not detecting the issue. Unfortunately, I've already tried multiple tools to remove the infection without success. Thanks for any and all assistance. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 27, 2016 ID:1075065 Share Posted November 27, 2016 (edited) Hello and Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Download attached fixlist.txt file and save it to the Desktop: Both files, FRST and fixlist.txt have to be in the same location or the fix will not work! Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File). Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finishes FRST will generate a log on the Desktop, called Fixlog.txt. Please attach it to your reply. fixlist.txt Edited November 27, 2016 by TwinHeadedEagle Link to post Share on other sites More sharing options...
patkane Posted November 27, 2016 Author ID:1075072 Share Posted November 27, 2016 Thanks for the quick response. I saved the txt file to the desktop, which is where FRST64 was saved. The tool started, but stopped responding part way through, requiring a hard reboot. I ran it again with the same result. Both log files are attached. FYI, I had the same issue with adwcleaner, i.e., it would run the scan but lock up the computer during the cleaning phase. Fixlog 1.txt Fixlog 2.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 27, 2016 ID:1075073 Share Posted November 27, 2016 Hmm. Not good. Can you try again? If impossible, try from Safe Mode. Link to post Share on other sites More sharing options...
patkane Posted November 27, 2016 Author ID:1075074 Share Posted November 27, 2016 It is running now in safe mode. I will post the log once it finishes. It is deleting temporary files from c:\windows\temp and it looks like it is going to take a while. Thanks. Link to post Share on other sites More sharing options...
patkane Posted November 27, 2016 Author ID:1075079 Share Posted November 27, 2016 It finished running. Please find attached the log. Thanks. Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 27, 2016 ID:1075086 Share Posted November 27, 2016 How is your PC behaving now? Link to post Share on other sites More sharing options...
patkane Posted November 28, 2016 Author ID:1075089 Share Posted November 28, 2016 I believe the issue has been resolved, but am still clicking away in Chrome to make sure. I do have one anomaly though--I can't type anything into the "Ask me anything" Cortana box. It's as if the keyboard doesn't work there, though there is no problem typing anywhere else. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 29, 2016 ID:1075421 Share Posted November 29, 2016 Huh, not sure about that issue with Cortana. When this started to happen? Link to post Share on other sites More sharing options...
patkane Posted November 30, 2016 Author ID:1075644 Share Posted November 30, 2016 It started immediately after running Farbar fix. I use the box all the time to find programs on the computer vice navigating the menu system. I've noticed I also can't type into Edge or the search menus within control panel. I greatly appreciate the help eradicating the malware, and am hopeful we can find quick resolution on this as it is debilitating. Thanks. Link to post Share on other sites More sharing options...
patkane Posted November 30, 2016 Author ID:1075646 Share Posted November 30, 2016 another data point -- I can type in the Cortana box if I start Windows in safe mode Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted November 30, 2016 ID:1075762 Share Posted November 30, 2016 Let's scan your PC again: Scan with Farbar Recovery Scan Tool Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system. Right-click on icon and select Run as Administrator to start the tool. (XP users click run after receipt of Windows Security Warning - Open File). Make sure that Addition.txt option is checked. option is checked. Press Scan button and wait. The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt. Please attach report into your next reply. Link to post Share on other sites More sharing options...
patkane Posted December 1, 2016 Author ID:1075984 Share Posted December 1, 2016 Thanks for the persistence. Attached are the requested files. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted December 1, 2016 ID:1076082 Share Posted December 1, 2016 Can you use a Restore Point to restore your system to the time before we used FRST? I see you have three of them: 09-11-2016 19:02:52 Windows Update 17-11-2016 20:07:08 Scheduled Checkpoint26-11-2016 11:41:48 Scheduled Checkpoint Link to post Share on other sites More sharing options...
Recommended Posts