Malware that won't go away.

[Quinnwg]

Hi,

Malwarebytes has picked up a number of infections which keep coming back even when I run in safe mode.

I have attached the log files from Farbar.

Please help with the removal of these.

 

Thanks you!

FRST.txt

Addition.txt

[Android8888]

Hello Quinnwg and  Forums.

I'm Android8888 and I'll be helping you with your malware issues. Please ask questions if anything is unclear.

I suggest printing out each set of instructions or copy them to a Notepad file and reading the entire post before proceeding. It will make following them easier.

Please DO NOT run any tools on your own and follow the directions in the order listed.

Make sure to run all the tools from the Desktop and with Administrator privileges.

Going over your logs I noticed that you have Torrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
  

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall Torrent, however that choice is up to you. If you choose to remove these programs, you can do so via righ-click on Start > Control Panel > Programs and Features.
If you wish to keep it, please do not use it until your computer is cleaned.

I noticed that you have a malicious program installed on your system. I'll ask you to uninstall it since uninstalling such program before running malware removal tools will ensure a better clean-up.

• WinSnare
  

If you have an issue when uninstalling this program, please let me know.

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST64.exe executable is located); DO NOT open that file!
• Right-click on the FRST64 executable and select Run as Administrator;
• Click on the Fix button;
  
  Credits: Aura
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Please attach the fixlog.txt in your next reply;
  

• Download Junkware Removal Tool (JRT) and move it to your Desktop;
• Right-click on JRT.exe and select Run as Administrator;
• Press on any key to launch the scan and let it complete;
  
  Credits: Bleeping Computer and Aura
• Once the scan is complete, a log will open. Please attach the log in your next reply;
  

• Download AdwCleaner and move it to your Desktop;
• Right-click on AdwCleaner.exe and select Run as Administrator;
• Accept the EULA (I accept), let the database update, then click on Scan;
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Cleaning button. This will kill all the active processes;
  
  Credits: Aura
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it;
• After the restart, a log will open when logging in. Please attach that log in your next reply;
  

Please read the instructions below and make a clean install of Malwarebytes from version 2 to version 3. Note: Your current licence will activate new version of Malwarebytes to current status.

Download MBAM-clean and save it to your computer Desktop.
 
Right-click on mbam-clean.exe icon and select Run as administrator to start the tool.
It will ask you to reboot the machine - please do so.
Run the MBAM-clean tool again and reboot when complete. NOTE: DO NOT miss this step.

If you have lost the activation licence key information it can be located here

Download Malwarebytes version 3 from here and save it to your Desktop or anywhere else on your system since you know where is located.

Double click on the installer and follow the prompts to install the program. If necessary select the blue Help tab for video instructions.

When the install completes and is updated do the following:

• Open Malwarebytes;
• On the left pane select Settings;
• Then select the Protection tab;
• Scroll down to Scan Options and ensure Scan for Rootkits and Scan within Archives are both on.
• Go back to DashBoard and select the blue Scan Now tab.
• When the scan complete, if potential threats are detected, ensure to checkmark all the listed items, and click the Quarantine Selected button.
• Select Export Summary and then Text File (*.txt). Give a name to the log and save it;
• Please attach that log in your next reply.

To summarize please post in your next reply:
The fixlog.txt produced by FRST;
The JRT.txt log;
The AdwCleaner clean log;
The Malwarebytes log.

Let me know how is the computer running at this point.

Thank you.

 

fixlist.txt

[Quinnwg]

Thank you - that worked perfectly!

I understand your point about using Torrent but I have been using that safely for many years with no problems and I do not download executables in any form. I know exactly where my problem cam from - I inadvertently downloaded from a site that was not the original source.

Thank you again for all your help!

 

 

Malwarebytes Log.txt

AdwCleaner[C2].txt

Fixlog.txt

JRT.txt

[Android8888]

Hello Quinnwg.

Thank you for those logs.

1 hour ago, Quinnwg said:

Thank you again for all your help!

You're very welcome!

Malwarebytes detected and deleted many Adware threats. Now you can safely delete all the quarantined items.

Open Malwarebytes;
On the left pane select Quarantine;
Check-mark (tick) the first checkbox on the top to select all the items and then click the Delete button on the bottom right.
Close Malwarebytes.

Next,
Please download the attached fixlist.txt and saved it to your Downloads folder (the same folder where FRST64 is placed);
Right-click on FRST64 and select "Run as administrator" to start the tool;
Click the Fix button and wait. It will produce a new fixlog.txt.
Please attach that log in your next reply.

Next,
Please download Zemana AntiMalware and save it to your Desktop.

• Right-click on the icon and select Run as administrator to install the program.
• Click Yes to accept the security warning.
• Once the installation is complete it will start automatically.
• Without changing any options, press Scan to begin.
• After the short scan is finished, if threats are detected press Next to remove them.
  Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.
• Click on the Back button.
• On the top right corner click on Reports icon (the one with three bars) and double click on the latest report.
• Now click File > Save As, then choose your Desktop and click the Save button.
• Please attach the saved report in your next reply.

Next,
Please download Sophos Virus Removal Tool and save it to your computer's Desktop.

• Right-click the icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Next button.
• Select 'I accept the terms in the license agreement', then click Next twice.
• Click the Install button and wait until the installation is complete.
• Click the Finish button. The tool created a shortcut icon on the Desktop of your computer.
• Now, double-click the Sophos Virus Removal Tool shortcut icon to run the tool.
• Click Yes to accept any security warnings that may appear.
• After it updates and a "Start Scanning" button appears in the lower right:
  
  • Disconnect from the Internet or physically unplug your Internet cable connection.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.

• Click the "Start Scanning" button in the lower right to start the scan.
• After starting the scan, do not use the computer until the scan has completed.
• When finished, if it detected anything there will be a "Start Clean-up" button, click it and allow it to finish.
• When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.
• If any threats are found click Details, then View Log file (bottom left-hand corner).
• Copy and paste its contents in your next reply and note any errors encountered.
• Close the Notepad document, close the Threat Details screen, then click Start cleanup.
• Click Exit to close the program.
• If no threats were found, please confirm that result.
  

Note: Whenever necessary, the log will be in the following location:

C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs\SophosVirusRemovalTool.log

Please attach the following logs in your next reply for my review:
The fixlog.txt produced by FRST64;
Zemana log;
SVRT log.

Let me know what issues or concerns do you still have with your computer.

Thank you.

fixlist.txt

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!