Jump to content

MWB blocking n65adserv.com61104 constantly

achacra
 Share

Recommended Posts

achacra

achacra

Posted
Posted (edited)

Can someone help me remove this annoying thing? I started getting it when I installed Minion, a gaming add on program for Elder Scrolls Online. I deleted Minion but it still pops up a lot. Any help would be appreciated, thanks.

Edited by achacra
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted
Hello achacra and welcome to Malwarebytes,

My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please:

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Change the download folder setting in the Default Browser only. so all of the tools we may use are saved to the Desktop:

user posted imageGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. user posted image
Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

user posted imageMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. user posted image Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

user posted imageInternet Explorer - Click the Tools menu in the upper right-corner of the browser. user posted image Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

user posted imageChange default download folder location in Edge -Boot to a user account with admin status, select start > file explorer > right click on "Downloads" folder and select "Properties"

In the new window select "Location" tab > clear the text field box and type in or copy/paste %userprofile%\Desktop > select "Apply" then "OK"

Be aware you are not changing the Browser download folder location, you are changing the user’s download directory location.....

Next,

Follow the instructions in the following link to show hidden files:

http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs...

Thank you,

Kevin..
Link to post
Share on other sites
achacra

achacra

Posted
  • Author
Posted

I'm sorry but this isn't going as smoothly as I thought it would. First, I am having a hard time trying to even scan my system with this tool since it keeps closing when I open it. Then I look for this addition.txt file EVERYWHERE and cant find it. I have it clicked on the tool when I actually made it work after reclogging 3x so it should have generated it. Again, I don't know why this is so difficult...  Your instructions are fine but the system is not cooperating with them. Please advise...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

I just noted that the primary log you posted FRST,txt is not complete. You will need to run the tool again and post both produced logs in their entirety:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

Thank you,

Kevin

Link to post
Share on other sites
achacra

achacra

Posted
  • Author
Posted

Kevin,

I am having an issue with FRST.exe. When I click on it, it disappears. When I restart my system, it works ONCE but doesn't finish. No addition.txt to be found. I tried both versions. I thought I typed this before but you seemed to ignore that fact. Please tell me why this may be happening so I can get you these two files you're requesting. 

 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

I never ignored you, I simply asked that you run the scan again. Unfortunately it will not complete on your system, we need to find out why not.... Lets try a couple of other scans, post the produced logs in your reply..

Download and save RogueKiller to your Desktop from this link:

https://www.fosshub.com/RogueKiller.html/setup.exe

Right click setup.exe and select Run as Administrator to start installing RogueKiller.

At the next window Checkmark "Install 32 and 64 bit versions, then select "Next"

user posted image

In the next window skip Licence I.D. and Licence Key, select "Next"

user posted image

In the next window make no changes and select "Next"

user posted image

In the next window leave both "Additional Shortcuts" checkmarked, then select "Next"

user posted image

In the next window make no changes and select "Install"

user posted image

RogueKiller will extract and complete installation, in the new window leave "Launch Roguekiller" checkmarked, then select finish.

user posted image

RogueKiller will launch. Accept UAC, then read and accept "User Agreements"

user posted image

In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan"

user posted image

When the scan completes select "Open Report"

user posted image

In the new Window select "Export text" name that file RK.txt, save to your Desktop and attach to your reply

user posted image

Let me see that log in your reply...

Next,

user posted imageScan with HitmanPro

In any case don't remove on your own anything that Hitman Pro detects! This scanner is really good for checking, it has however been known for deleting files instead of curing them, in some cases this may render the machine unbootable.
Any removals will be done manually after careful analysis of the scan results!

Please download HitmanPro by SurfRight and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
 
  • Right-click on user posted image icon and select user posted imageRun as Administrator to start the tool.
  • If the program won't run please run it while holding down the left CTRL key until it's loaded!
  • Click on the Next button. You must agree with the terms of EULA (if asked).
  • Check the box beside No, I only want to perform a one-time scan to check this computer.
  • Click on the Next button.
  • The program will start to scan the computer. It would only take several minutes.
  • When the scan is done click on drop-down menu of the found entries (if any) and choose - Apply to all => Ignore.
  • If there isn't a dropdown menu when the scan is done then please don't delete anything and close HitmanPro!Navigate to C:\ProgramData\HitmanPro\Logs, open the report and include it it your next reply.
  • Click on the Next button.
  • Click on the Save Log button.
  • Save that file to your desktop.


Please include that logfile in your next reply.

Don't forget to re-enable your security!

Thank you,

Kevin....
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Thanks for those logs, continue with the following:

Right click on RogueKiller.exe and select "Run as Administrator" to start the tool, accept UAC..

In the new window the "Home" tab should already be selected, Change by selecting "Scan" tab, then select "Start Scan"

user posted image

When the scan completes checkmark (tick) the following against Process entries, ensure that all other entries are not Checkmarked.

[Proc.Injected|Proc.RunPE] regsvr32.exe(12856) -- C:\Windows\SysWOW64\regsvr32.exe[-] -> Found
[Proc.Injected|Proc.RunPE] regsvr32.exe(4124) -- C:\Windows\SysWOW64\regsvr32.exe[-] -> Found
[Proc.Injected|Proc.RunPE] regsvr32.exe(9220) -- C:\Windows\SysWOW64\regsvr32.exe[-] -> Found
[Proc.Injected|Proc.RunPE] regsvr32.exe(13916) -- C:\Windows\SysWOW64\regsvr32.exe[-] -> Found
[Proc.Injected|Proc.RunPE] regsvr32.exe(14884) -- C:\Windows\SysWOW64\regsvr32.exe[-] -> Found
[Suspicious.Path] libcef.dll(9220) -- C:\Users\Abraham Chacra\AppData\Local\8f158b\libcef.dll[-] -> Found
[Suspicious.Path] libcef.dll(13916) -- C:\Users\Abraham Chacra\AppData\Local\8f158b\libcef.dll[-] -> Found
[Suspicious.Path] libcef.dll(14884) -- C:\Users\Abraham Chacra\AppData\Local\8f158b\libcef.dll[-] -> Found

Checkmark (tick) the following against Registry entries, ensure that all other entries are not Checkmarked

[PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet -> Found

Checkmark (tick) the following against File entries, ensure that all other entries are not Checkmarked

[Tr.Kovter|Suspicious.Path|VT.Unknown][File] C:\Users\Abraham Chacra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4099.lnk [LNK@] C:\Users\ABRAHA~1\AppData\Local\8636\60B6~1.4B5 -> Found
[Tr.Kovter][File] C:\Users\Abraham Chacra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4099.lnk [LNK@] C:\Users\ABRAHA~1\AppData\Local\8636\60B6~1.4B5 -> Found
[PUP.Gen1][Folder] C:\Users\Abraham Chacra\AppData\Local\YSearchUtil -> Found
[PUP.Gen1][Folder] C:\Program Files (x86)\Yahoo!\yset -> Found
[Tr.Kovter][File] C:\Users\Abraham Chacra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4099.lnk [LNK@] C:\Users\ABRAHA~1\AppData\Local\8636\60B6~1.4B5 -> Found

Hit the Delete button, when complete select "Open Report" in the next window select "Export txt" the log will open. Save to your Desktop for reference, also attach to next reply.

Next,

user posted imageEmsisoft Emergency Kit
  • Click Here to download Emsisoft Emergency Kit. The download will automatically start after a moment.
  • Save EmsisoftEmergencyKit.exe to your Desktop.
  • Double click on EmsisoftEmergencyKit.exe (Windows Vista/7/8/10 users: Accept UAC warning if it is enabled). A screen like this will appear:
    user posted image
     
  • Leave everything as it is, then click Extract. This will unpack Emsisoft Emergency Kit to the EEK folder located in the root drive (usually C:\).
  • Once the extraction is done, an icon will appear on your Desktop. Double click it to start Emsisoft Emergency Kit.
    user posted image
     
  • Wait for Emsisoft Emergency Kit to finish loading signatures. A screen like this should appear:
    user posted image
     
  • Choose Yes, then wait for EEK to finish updating.
  • Choose Malware Scan under the Scan button. When EEK asks to activate PUP detection, choose Yes.
  • Wait for the scan to finish.
    user posted image
     
  • If EEK detects something, all detected items will be displayed. Place a checkmark before everything, then choose Quarantine Selected.
  • If Emsisoft Emergency Kit asks to reboot, please do so immediately.
  • The scan log is located in Logs -> Scan Logs. Click on the entry of the latest scan, choose Export and save the report on your Desktop.
    user posted image
     
  • Please Copy and Paste the contents of the scan log in your next reply.


Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

Be aware FRST must be run from an account with Administrator status...
 
  • Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
  • Make sure Addition.txt is checkmarked under "Optional scans"
  • Press Scan button to run the tool....
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The tool will also make a log named (Addition.txt) Please attach that log to your reply.


Let me see those logs in your reply..

Thank you,

Kevin.
Link to post
Share on other sites
achacra

achacra

Posted
  • Author
Posted

I didn't do anything but what you have asked. I'm telling you, this has been strange. I am not trying to be difficult towards you but to what is happening. I decided to rerun it anyways since it wouldn't hurt and it takes forever to run. It is half way through. I will post the results in about 30 mins. Thanks for all the help so far.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.