Adware Elex , Adware Ghokswa

[DukeTa]

Hi there ,

Adware Elex and Adware Ghokswa keeps coming back . I Removed them couple times with Malwarebytes Free and Adw Cleaner but they keep coming back . Plz help.

 

 

Addition.txt

FRST.txt

Edited May 23, 2017 by DukeTa

[Android8888]

Hello DukeTa and  Forums.

My screen name is Android8888 but if you wish you can call me Rui which is my real name. I will be helping you with your malware issues. Please ask questions if anything is unclear.

I suggest printing out each set of instructions or copy them to a Notepad file and reading the entire post before proceeding. It will make following them easier.

Read all of my instructions very carefully and bear in mind that any mistakes during the cleaning process may have serious consequences such as leaving the computer unbootable.

Please DO NOT run any tools on your own or make any other changes to your computer and follow the directions in the order listed during the malware removal process, otherwise you can worsen the situation rather than solve it.

Make sure to run all tools from the computer's Desktop and with Administrator privileges (i.e. right-click the tool icon and select Run as administrator).

Please run one scan at a time.

Once started the malware removal process has to be completed. Even if your computer appears to be running better, it may still be infected as some infections are difficult to remove and can leave remnants on the System.

That being said let's start cleaning up your computer.

Going over your logs I noticed that you have Torrent installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
  

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall Torrent, however that choice is up to you. If you choose to remove these programs, you can do so via right-click on Start > Control Panel > Programs and Features.
If you wish to keep it, please do not use it until your computer is cleaned.

 

Next,

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST64.exe executable is located); DO NOT open or modify that file!
• Right-click on the FRST64 executable and select Run as Administrator;
• Click on the Fix button;
  
  Credits: Aura
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Please attach the fixlog.txt in your next reply;
  

Next,

• Download Junkware Removal Tool (JRT) and move it to your Desktop;
• Right-click on JRT.exe and select Run as Administrator;
• Press on any key to launch the scan and let it complete;
  
  Credits: Bleeping Computer and Aura
• Once the scan is complete, a log will open. Please attach that log in your next reply;
  

Next,

• Download AdwCleaner and move it to your Desktop;
• Right-click on AdwCleaner.exe and select Run as Administrator;
• Accept the EULA (I accept), let the database update, then click on Scan;
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Cleaning button. This will kill all the active processes;
  
  Credits: Aura
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it;
• After the restart, a log will open when logging in. Please attach that log in your next reply;
  

Next, download and install the latest version of Malwarebytes from here

• Open Malwarebytes;
• On the left pane select Settings;
• Select the Protection tab;
• Scroll down to Scan Options and ensure Scan for Rootkits and Scan within Archives are both on and leave all other settings to default.
• Go back to DashBoard and select the blue Scan Now tab; Note: The scan may take some time to finish, so please be patient.
• When the scan completes if potential threats are detected, ensure to check-mark all the listed items, and click the Quarantine Selectedbutton.
• While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), give it a name and save it to your Desktop.
• The log can also be viewed by clicking the log to select it, then clicking the View Report button.
• Please attach the log in your next reply.

In your next reply please attach:
The fixlog.txt;
The JRT.txt log;
The AdwCleaner clean log;
The Malwarebytes log.

How is the computer running? Do the adwares reappeared?

fixlist.txt

[DukeTa]

mbytes1.txtHi Rui ,

I just did a malwarebytes scan right before i read your reply . I will attach that scanlog too , calling it mbytes1 . The new scanlog you requested will be called mbytes2 .

Thanks for the help.

AdwCleaner[C13].txt

Fixlog.txt

JRT.txt

mbytes2.txt

mbytes1.txt

 

Edited May 27, 2017 by DukeTa

[Android8888]

Hello DukeTa.

The logs looks great. The tools removed lots of entries of adware.

Now let's check further to see if there is anything left. Please proceed as follow:

Please download Zemana AntiMalware and save it to your Desktop.

• Right-click on the icon and select Run as administrator to install the program.
• Click Yes to accept the security warning.
• Once the installation is complete it will start automatically.
• Without changing any options, press Scan to begin.
• After the short scan is finished, if threats are detected press Next to remove them.
  Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please re-boot your computer manually.
• Click on the Back button.
• On the top right corner click on Reports icon (the one with three bars) and double click on the latest report.
• Now click File > Save As, then choose your Desktop and click the Save button.
• Please attach the saved report in your next reply.

 

Please scan your computer with ESET Online Scanner.

• Click on this link to open ESET Online Scanner in a new window.
  
  1. Click on the Scan Now button to download the esetonlinescanner_enu.exe file. Save it to your Desktop.
  2. Close all your programs and browsers.
  3. Please disable your antivirus program to avoid potential conflicts, improve the performance and speed up the scan.
  4. Double click on esetonlinescanner_enu.exe to start ESET Online Scanner. It will open a window with the Terms of Use.

• Check mark Download latest version of ESET Online Scanner and click the Accept button.
• Click Yes to accept any security warnings that may appear.
• Under Computer scan settings, check mark Enable detection of potentially unwanted applications.
• Then click Advanced settings and check mark the following options:
  
  • Enable detection of potentially unsafe applications
  • Clean threats automatically
    
• Click the Scan button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, click List Threats.
• Click Export, and save the file to your Desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Click the Back button.
• Click the Finish button.
  

Note: If nothing is found, it will not produce a log.

Please re-enable your antivirus program.

Please attach the Zemana log and the ESET log and tell me how is the computer behavior at this point. Are there any symptoms of adware remaining?

Thank you.

[DukeTa]

Hi Rui ,

The computer seems to be running fine . But i still guess that the adware will reapear .

And here are the requested logs.

Thank you for your help.

2017.05.28-14.28.31-i0-t92-d0.txt

ESETScan.txt

[Android8888]

Hello DukeTa.

Thank you for the logs. From what I can see your computer appears to be clean and free of malware.

However, I would give it a day or two to see how it will behave.

For now let's check for outdated programs. Outdated programs contains security vulnerabilities that are exploited by malware in order to infect the computer without the user's knowledge. Usually this is one of the ways that more contributes to malware infections.

Please download Security Analysis by Rocket Grannie from here

• Save it to your Desktop.
• Close your security software to avoid potential conflicts.
• Double click RGSA.exe
• Click OK on the copyright-disclaimer
• When finished, a Notepad window will open with the results of the scan.
• The log named SALog.txt can also be found on the Desktop or in the same folder from where the tool is run if installed elsewhere.
• Please copy and paste the contents of that log in this topic.
  

Note: If you get a Warning from Windows about running the program, click on More info and then click Run Anyway to run it even though Windows says it might put your PC at risk.

Thank you.

Rui

[DukeTa]

Hi Rui ,

Result of Security Analysis by Rocket Grannie (x86) Updated: 22nd May, 2017
Running from:C:\Users\Ronin\Desktop (22:33:31 - 05/28/2017)
***---------------------------------------------------------***
Microsoft Windows 10 Home X64
UAC is Enabled
Internet Explorer 11
Default Browser:
***------------Antivirus - Antispyware - Firewall-----------***
Avast Antivirus (Enabled - up to Date)
Windows Defender (Disabled - up to Date)
Spybot - Search and Destroy (Disabled - Not up to Date)
Windows Defender (Disabled - up to Date)
Avast Antivirus (Enabled - up to Date)
Windows Firewall (Enabled)
No other Firewall Installed
***-------Security Programs - Browsers - Miscellaneous------***
Adobe Flash Player 25 NPAPI (25.0.0.171)
CCleaner (5.30)
Java (8.0.1310.11)
Malwarebytes (3.1.2.1733)
Mozilla Firefox (53.0.3)

***----------------Analysis Complete-------------------------***

Should i scan my computer with malwarebytes again to see if the adware reapeared?

Edited May 28, 2017 by DukeTa

[Android8888]

2 hours ago, DukeTa said:

Should i scan my computer with malwarebytes again to see if the adware reapeared?

Yes please, do that twice with several hours difference between each scan and attach the logs for my review.

Thank you.

 

[DukeTa]

Hi rui ,

Here r two scan logs.

 

mbytes7.txt

mbytes6.txt

[Android8888]

Hello DukeTa and thank you for those logs.

Malwarebytes flagged and removed some threats in the first scan. The second scan is clean.

You default browser is Edge but what browser do you often use to navigate on Internet?

Please perform the following scan but DO NOT remove anything it find. The entries it may find may not be all bad.

Please download RogueKiller 32/64 Bits Installer (RogueKiller_setup.exe) by Tigzy and save it to your computer's Desktop.

• Right click on the file RogueKiller_setup.exe and select Run as administrator to install the tool.
• Click Yes to accept any security warnings that may appear.
• Choose the installation language and click OK.
• Checkmark "Install 32 and 64 bits versions" and click Next. Follow the steps to install the tool.
• Now close all programs and browsers.
• Please disconnect any USB or external drives from the computer before you run this scan!
• Right-click on the RogueKiller icon and select Run as administrator.
• Click Yes to accept any security warnings that may appear.
• Click the Scan tab and then click the Start Scan button.
• Wait until the scan has finished. This may take some time consuming.
• Once finished click on Open Report. It will open a new window.
• Click Export TXT to export the report as a text file, give a name to the file such as RKlog.txt and save it to your Desktop.
• Close RogueKiller.
  

Please copy and paste the contents of RKlog.txt to your next reply.

Thank you.

Rui

[DukeTa]

Hi Rui ,

I use mozilla firefox to browse the internet.

And here is the requested log.

RogueKiller V12.11.0.0 (x64) [May 29 2017] (Free) von Adlice Software
Mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Betriebssystem : Windows 10 (10.0.14393) 64 bits version
Gestartet in : Normalmodus
User : Ronin [Administrator]
Gestartet von : C:\Program Files\RogueKiller\RogueKiller64.exe
Modus : Scannen -- Datum : 06/01/2017 13:13:31 (Dauer : 00:37:53)

¤¤¤ Prozesse : 0 ¤¤¤

¤¤¤ Registry : 25 ¤¤¤
[Adw.Elex] (X64) HKEY_LOCAL_MACHINE\Software\InterSect Alliance -> Gefunden
[Adw.FakeBro] (X86) HKEY_LOCAL_MACHINE\Software\Antanna -> Gefunden
[PUP.Ghokswa] (X86) HKEY_LOCAL_MACHINE\Software\Firefox -> Gefunden
[Adw.FakeBro] (X86) HKEY_LOCAL_MACHINE\Software\Jamper -> Gefunden
[PUP.Gen1] (X64) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\FoxyDeal -> Gefunden
[PUP.MailRU|PUP.Gen1] (X64) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\Mail.Ru -> Gefunden
[PUP.Gen1] (X64) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\PriceMeterLiveUpdate -> Gefunden
[PUP.Gen1] (X64) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\PriceMeterUpdater -> Gefunden
[PUP.Gen1] (X86) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\FoxyDeal -> Gefunden
[PUP.MailRU|PUP.Gen1] (X86) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\Mail.Ru -> Gefunden
[PUP.Gen1] (X86) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\PriceMeterLiveUpdate -> Gefunden
[PUP.Gen1] (X86) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\PriceMeterUpdater -> Gefunden
[Adw.FakeBro] (X64) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Antanna -> Gefunden
[PUP.Ghokswa] (X64) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Firefox -> Gefunden
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\IM -> Gefunden
[Adw.FakeBro] (X86) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Antanna -> Gefunden
[PUP.Ghokswa] (X86) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Firefox -> Gefunden
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\IM -> Gefunden
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UnlockerDriver5 (\??\C:\Users\Ronin\AppData\Local\Temp\Rar$EXa0.103\x64\UnlockerDriver5.sys) -> Gefunden
[PUP.Gen1] (X64) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\Microsoft\Internet Explorer\Main | Search Page : http://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} -> Gefunden
[PUP.Gen1] (X86) HKEY_USERS\RK_Nutzer_ON_D_CA94\Software\Microsoft\Internet Explorer\Main | Search Page : http://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms} -> Gefunden
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve  -> Gefunden
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2708046539-3441841237-3858742213-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve  -> Gefunden
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Gefunden
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> Gefunden

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Dateien : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts-Datei : 0 ¤¤¤

¤¤¤ Anti-Rootkit : 0 (Driver: Geladen) ¤¤¤

¤¤¤ Webbrowser : 0 ¤¤¤

¤¤¤ MBR-Übeprüfung : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-9YN162 ATA Device +++++
--- User ---
[MBR] 2c590162886d9954deecd23f406e5be8
[BSP] 9a845b5a23ba99d149438be0cd9dcf80 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 163289 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 334622720 | Size: 450 MB
3 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 335544320 | Size: 790028 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

 

 

 

Thanks for your help.

Rogue.txt

Edited June 1, 2017 by DukeTa

[Android8888]

Hello DukeTa.

It seems that there must be some kind of dropper on your system causing reinfection.

Please proceed with the following instructions:

Run RogueKiller again and delete all the entries found.

Next,

Reset your router.
Instructions on how to do it are available at the following link:
How to Reset your Router

 

Next,

Download and unzip DNSJumper to your Desktop, the tool is portable no installation necessary.
http://www.sordum.org/downloads/?dns-jumper

Right click on Dnsjumper.exe and select "Run as Administrator" to start the tool.
From the left hand pane select "Flush DNS"
From the main interface select the dropdown under "Choose a DNS Server"
From the list select either "Google Public DNS" or "Open DNS"
From the left hand pane select "Apply DNS"

Restart the computer.

 

In any case don't remove on your own anything that Hitman Pro detects! This scanner is really good for checking, it has however been known for deleting files instead of curing them, in some cases this may render the machine unbootable.
Any removals will be done manually after careful analysis of the scan results!

Please download HitmanPro by SurfRight and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• If the program won't run please run it while holding down the left CTRL key until it's loaded!
• Click on the Next button. You must agree with the terms of EULA (if asked).
• Check the box beside No, I only want to perform a one-time scan to check this computer.
• Click on the Next button.
• The program will start to scan the computer. It would only take several minutes.
• When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore.
• If there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro!Navigate to C:\ProgramData\HitmanPro\Logs, open the report and include it it your next reply.
• Click on the Next button.
• Click on the Save Log button.
• Save that file to your computer's Desktop.
  

Please include that file in your next reply.

Please re-enable your security programs.

Next,

• Open Malwarebytes;
• On the left pane select Settings;
• Select the Protection tab;
• Scroll down to Scan Options and ensure Scan for Rootkits and Scan within Archives are both on and leave all other settings to default.
• Go back to DashBoard and select the blue Scan Now tab; Note: The scan may take some time to finish, so please be patient.
• When the scan completes if potential threats are detected, ensure to checkmark all the listed items, and click the Quarantine Selectedbutton.
• While still on the Scan tab, click the View Report button, and in the window that opens click the Export button, select Text file (*.txt), give it a name and save it to your Desktop.
• The log can also be viewed by clicking the log to select it, then clicking the View Report button.
• Please attach the log in your next reply.

Please attach the Hitman Pro scan log and Malwarebytes quarantine log and let me know if the infection returns.

[DukeTa]

hi rui ,

i did the first step of your instructions but i cant reset my router because i dont have my internet account data at hand.

Should i continue with the next step?

Thanks for helping.

Edited June 1, 2017 by DukeTa

[Android8888]

Hello DukeTa.

You're welcome.

Yes please proceed with the next steps.

p.s.: Don't forget to run RogueKiller in first place and delete all the entries it found.

[DukeTa]

Hi Riu,

Here are the requested logs.

 

 

HitmanPro_20170602_0223.log

mbytes.txt

[Android8888]

Hello DukeTa and thank you for the logs.

I apologize for the delay.

Malwarebytes log is clean which is great. The HitmanPro log shows two adwares on Registry Keys and also some cookies on Internet Explorer and Firefox.

We need to eliminate these Registry Keys by running a fix with FRST:

HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)
HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)

CouponBar is considered adware and also a PUP (Potentially Unwanted Program).

Next,

Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located); DO NOT open or modify that file!
• Right-click on the FRST executable and select Run as Administrator;
• Click on the Fix button;
  
  Credits: Aura
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad;
• Please attach the fixlog.txt in your next reply;

 

Next, let's clear the cache and cookies and perform a reset on all browsers.

Clear cache and cookies of Internet Explorer:
https://kb.wisc.edu/page.php?id=15141

Reset Internet Explorer settings:
https://support.microsoft.com/en-us/help/923737/how-to-reset-internet-explorer-settings

Clear cache and cookies of Mozilla Firefox:
https://kb.wisc.edu/helpdesk/page.php?id=17504

Reset Mozilla Firefox settings:
https://support.mozilla.org/en-US/kb/reset-preferences-fix-problems

Clear cache and cookies of Google Chrome:
https://kb.wisc.edu/helpdesk/page.php?id=24629

Reset Google Chrome settings:
https://support.google.com/chromebook/answer/3296214?hl=en

 

Next,

• Download Junkware Removal Tool (JRT) and move it to your Desktop;
• Right-click on JRT.exe and select Run as Administrator;
• Press on any key to launch the scan and let it complete;
  
  Credits: Bleeping Computer and Aura
• Once the scan is complete, a log will open. Please attach the JRT.txt file in your next reply;

 

Next,

• Download AdwCleaner and move it to your Desktop;
• Right-click on AdwCleaner.exe and select Run as Administrator;
• Accept the EULA (I accept), let the database update, then click on Scan;
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes;
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it;
• After the restart, a log will open when logging in. Please attach that log in your next reply;

In your reply please attach:
fixlog.txt;
JRT.txt log;
AdwCleaner clean log.

Are there any signs or visible evidence of the adware reappearing when you are browsing the Internet?

fixlist.txt

Edited June 2, 2017 by Android8888
To add fixlist.txt

[DukeTa]

Hi Rui,

Mozilla Firefox seemed to slow down while browsing the internet and there were "rightcoupon" adds on some sites but since we deleted the cache and reseted firefox all seems to run fine.

And here are the requested logs.

Thanks for help.

AdwCleaner[C14].txt

Fixlog.txt

JRTlog.txt

Edited June 2, 2017 by DukeTa

[DukeTa]

Hi Rui ,

The rightcoupon ads are back.

 

[DukeTa]

21 hours ago, DukeTa said:

Hi Rui ,

The rightcoupon ads are back.

 

But they didnt appear today.

[Android8888]

Hello DukeTa.

I apologize for the delay.

Please open FRST again and make sure the "Addition.txt" box is checked.

Then click the Scan button and when finished attach the two logs for my review in your next reply.

Are you still receiving the "rightcoupon" ads when browsing the Internet?

Thank you.

[DukeTa]

Hi Rui ,

I didnt notice any rightcoupon ads today.

Here are the two requested logs

Addition.txt

FRST.txt

[Android8888]

Hello DukeTa.

12 hours ago, DukeTa said:

I didnt notice any rightcoupon ads today.

This is good. Please keep testing it.

 

I do not see any signs of malware in your logs. Both logs are clean.

As a precaution please run Malwarebytes and RogueKiller again and post both logs.

Please DO NOT remove anything if something is found, just post the scan logs.

 

Thank you.

Rui

[DukeTa]

Hi rui ,

Here are the requested logs.

Maybe its not important but my lag while playing league of legends decreased a lot since our cleanup. But it still sometimes appears.

Thanks for your help.

HitmanPro_20170606_0042.log

mbytes.txt

[Android8888]

Okay, if the ads problem persist, you can make a clean uninstall of Firefox and then reinstall it. But first you need to backup your Firefox bookmarks and then stop Sync (synchronization).

Please proceed as follow:

How to save bookmarks in Firefox
Open Firefox browser;
On the top menu click the Bookmarks button and select Show All Bookmarks to open the 'Library' window;
In the 'Library' window, click the Import and Backup button and then select Backup;
In the Bookmarks backup filename window that opens, choose a location to save the file, which is named bookmarks-"date".json by default. The computer's Desktop is usually a good spot, but any place that is easy to remember will work;
Save the bookmarks .json file. The Bookmarks backup filename window will close and then you can close the 'Library' window.

How to stop Sync in Firefox
Open Firefox browser;
Click on the "Open menu" icon located at the top right corner of the browser (the one with three horizontal lines);
Click on "Options" and then select "Sync" on the left pane;
Under 'Firefox Account' click on the "Disconnect" button to stop synchronization.
Close Firefox.

Now completely uninstall Mozilla Firefox using the Revo Uninstaller. This program is free and will completely remove Firefox and every leftovers of it.

Please download and install the free version of Revo Uninstaller
Right-click on the icon of Revo Uninstaller and select Run as administrator to run the tool.
Click Yes to accept any security warnings that may appear.
Select Mozilla Firefox and click Uninstall. Follow the instructions to complete the removal process.
In 'Search Mode' set it to 'Advanced' and click on the Scan button. The tool will search for leftovers.
Click on Delete and then click Next. You may have to repeat this to delete all the leftovers (Registry items, files and folders).
Click on the Finish button.
Restart the computer.

NOTE: DO NOT reinstall Firefox yet. We need to ensure the system is completely clean and there are no traces of adware on it. In the meanwhile you can use another browser to access the Internet.

Next,

Please re-run Junkware Removal Tool (JRT), AdwCleaner, RogueKiller and attach the new logs for my review, then please wait for further instructions. DO NOT remove anything found.

Thank you.

Rui

[DukeTa]

Hi rui ,

I uninstalled Firefox and ran the programs u requested .

Here are the logs.

Thanks for your help.

AdwCleaner[S21].txt

JRT.txt

roguekiller_E82E.txt