LisaJ Posted May 13, 2017 ID:1124421 Share Posted May 13, 2017 (edited) Hello, my pc has been running sluggishly pages loading slowly, unable to attach pics to fb posts,etc for a few days. Yesterday near full size windows began popping up promoting video programs for download and various video games. Cannot close those windows without clicking "leave" to a pop up prompt warning that my "changes will not be saved". I'm finding now that I cannot open (read) emails in my gmail account - I can open the account and see them, but they will not open. Also notice upon navigating back to web pages that have been opened for a while, I find an error page, "site can't be reached", but the pages refresh on their own and are fine. Ran Malwarebytes, which quarintined several PUP files. My Farbar Recovery Scan Tool files are attached below. Thanks a million in advance! addition.txt FRST.txt Edited May 13, 2017 by LisaJ Link to post Share on other sites More sharing options...
kevinf80 Posted May 13, 2017 ID:1124429 Share Posted May 13, 2017 (edited) Hello LisaJ and welcome to Malwarebytes, Continue with the following: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes deal with any found entries... Then select "Export Summary" then "Text File (*.txt)" name that log and save , you can copy or attach that to your reply... Next, Download AdwCleaner by Xplode onto your Desktop. Or from this Mirror Double click on Adwcleaner.exe to run the tool Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed... Next,Emsisoft Emergency Kit Click Here to download Emsisoft Emergency Kit. The download will automatically start after a moment. Save EmsisoftEmergencyKit.exe to your Desktop. Double click on EmsisoftEmergencyKit.exe (Windows Vista/7/8/10 users: Accept UAC warning if it is enabled). A screen like this will appear: Leave everything as it is, then click Extract. This will unpack Emsisoft Emergency Kit to the EEK folder located in the root drive (usually C:\). Once the extraction is done, an icon will appear on your Desktop. Double click it to start Emsisoft Emergency Kit. Wait for Emsisoft Emergency Kit to finish loading signatures. A screen like this should appear: Choose Yes, then wait for EEK to finish updating. Choose Malware Scan under the Scan button. When EEK asks to activate PUP detection, choose Yes. Wait for the scan to finish. If EEK detects something, all detected items will be displayed. Place a checkmark before everything, then choose Quarantine Selected. If Emsisoft Emergency Kit asks to reboot, please do so immediately. The scan log is located in Logs -> Scan Logs. Click on the entry of the latest scan, choose Export and save the report on your Desktop. Please Copy and Paste the contents of the scan log in your next reply. Let me see those logs, also tell me if there are any remaining issues or concerns.... Thank you, Kevin... fixlist.txt Edited May 13, 2017 by kevinf80 Link to post Share on other sites More sharing options...
LisaJ Posted May 13, 2017 Author ID:1124584 Share Posted May 13, 2017 Hey Kevin, thanks so much for your fast reply! I'm having a bit of trouble following your instructions; I don't find a fix button in the FRST file. It's in notepad format. Am I overlooking it? Link to post Share on other sites More sharing options...
kevinf80 Posted May 13, 2017 ID:1124589 Share Posted May 13, 2017 The file I attached fixlist.txt has to be saved to the same folder as the tool FRST... So you have FRST and fixlist.txt together. Double click on FRST to run the tool, when it opens select the Fix tab once... FRST will create a log fixlog.txt when complete.. Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124754 Share Posted May 14, 2017 Hi Kevin, thanks for your further explanation. I've attached the files below, no EEK file because it found nothing. My computer is still sluggish, things are slow to open and facebook actions (attaching photos, opening reply links, etc) is very slow or doesn't complete and the intrusive ad pages are opening in tabs now, whereas previously they were opening in new windows. Malawarebytes continues to block many outbound connection threats. Thanks again for your help. AdwCleaner[C05].txt Scan results.txt Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124769 Share Posted May 14, 2017 Can i see the log from FRST fix... Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124840 Share Posted May 14, 2017 I hope this is what you're wanting; it was created on the 12th; it's the only FRST file I have. FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124872 Share Posted May 14, 2017 That is the primary log from first FRST scan.. I want to see the log from FRST fix, is named Fixlog.txt logs are saved here: C:\FRST\Logs Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124874 Share Posted May 14, 2017 Got it Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124898 Share Posted May 14, 2017 How does your PC respond now, do you have any remaining issues or concerns...? Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124903 Share Posted May 14, 2017 Yes, I'm still getting frequent outbound block notices and I still get the unwanted tabs for games and programs to download. Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124907 Share Posted May 14, 2017 Can you upload a couple of block logs, Open Malwarebytes, select > Reports > then checkmark (tick) most recent "Website Block" entry > then select "View Report" > "Export" > Text File (*.txt) name and save that file to Desktop or somewhere of your choice, attach to your reply... Which browser has tab issues...? Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124918 Share Posted May 14, 2017 Here are three from today. The browser is Chrome. Thanks again for your continued help. Report 2.txt Report 3.txt report 1.txt Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124924 Share Posted May 14, 2017 Blocks are from Chrome also, let make clean install.... If your Chrome Bookmarks are important do this first: Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks..... Continue for a clean install: Download Chrome installer and save to install later: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.html Remove all synced data from Chrome go here: https://support.google.com/chrome/answer/6386691?hl=en-GB follow those instructions... It is essntial that any/all synced data is removed when the browser is hijacked or exploited in anyway... Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!! Navigate to C:\Users\Your user name\Appdata\Local from that folder delete the folder named Google (you will need to show hidden files/folders to see the folder Appdata) For XP that will be My Computer > C:\ Documents and Settings\Your User Name\Application Data\Roaming How to show hidden files and folders for windows: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Install Google Chrome : Install Adblock Plus to Chrome: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb Install DrWeb Link Ant-virus Link Checker: https://chrome.google.com/webstore/detail/drweb-anti-virus-link-che/aleggpabliehgbeagmfhnodcijcmbonb?hl=en Does that help..? Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124947 Share Posted May 14, 2017 I uninstalled Chrome and all C/ files deleted, but I note the link you provided for reinstall is a UK link and I'm in the U.S. Will that cause any issues? Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124950 Share Posted May 14, 2017 Never noticed that link.... try this one: https://www.google.com/intl/en_usa/chrome/browser/desktop/index.html Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124959 Share Posted May 14, 2017 The installation fails due to "unspecified error". *sigh* Link to post Share on other sites More sharing options...
kevinf80 Posted May 14, 2017 ID:1124962 Share Posted May 14, 2017 Try the uk link... Link to post Share on other sites More sharing options...
LisaJ Posted May 14, 2017 Author ID:1124968 Share Posted May 14, 2017 Reboot did the trick. Duh, should have tried that first off. I'll give a shout by the end of the day whether I see more problems or not. Thanks a million for all your help. Link to post Share on other sites More sharing options...
LisaJ Posted May 15, 2017 Author ID:1124993 Share Posted May 15, 2017 All is well. Thank you so much for all your help! You've been great!! My donation is on the way! Link to post Share on other sites More sharing options...
kevinf80 Posted May 15, 2017 ID:1125017 Share Posted May 15, 2017 Thanks for the update, good to hear all is now OK. Continue with the following to clean up.. Navigate to and delete the following: C:\ProgramData\Emsisoft C:\Users\Andrew\Desktop\start emergency kit scanner - Shortcut.lnk C:\EEK C:\Users\{your user name}\Desktop\EmsisoftEmergencyKit.exe Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down:"Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
LisaJ Posted May 16, 2017 Author ID:1125288 Share Posted May 16, 2017 Hi Kevin, I was able to delete C:\ProgramData\Emsisoft and C:\EEK but using the search funcction, no C:\Users\{your user name}\Desktop\EmsisoftEmergencyKit.exe or C:\Users\Andrew\Desktop\start emergency kit scanner - Shortcut.lnk were found. Link to post Share on other sites More sharing options...
kevinf80 Posted May 18, 2017 ID:1126168 Share Posted May 18, 2017 Apologies for the late reply, been locked out of Malwarebytes until now... If those entries do not show on the Desktop they are already gone... Regards, Kevin. Link to post Share on other sites More sharing options...
LisaJ Posted May 19, 2017 Author ID:1126468 Share Posted May 19, 2017 No worries, I figured the same and moved on to complete your other recommended tasks. Thanks so much for all your help. Truly appreciated. Link to post Share on other sites More sharing options...
kevinf80 Posted May 19, 2017 ID:1126470 Share Posted May 19, 2017 Thanks for the update LisaJ, good to here tasks are completed... Regards, Kevin Link to post Share on other sites More sharing options...
Recommended Posts