supersonicelric Posted August 29, 2017 ID:1158069 Share Posted August 29, 2017 I have been using Malware Bytes for a little bit now, and i noticed i had a PUP, which is basically an unwanted pop up. Mine in particular is one that asks me to do an "automatic download" which will download more viruses in the process if I click it. I ran Malware Bytes and it located this virus. It quarantined it and then i deleted it. Every scan it says there is nothing wrong, but every now and then i still get that pop up asking for the automatic download. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 29, 2017 Root Admin ID:1158129 Share Posted August 29, 2017 Hello @supersonicelric and Please run the following steps and post back the logs as an attachment when ready.STEP 01 If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. If you don't have Malwarebytes 3 installed yet please download it from here and install it. Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button. Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply. If Malwarebytes won't run then please skip to the next step and let me know on your next reply. STEP 02 Please download AdwCleaner by Malwarebytes and save the file to your Desktop. Right-click on the program and select Run as Administrator to start the tool. Accept the Terms of use. Wait until the database is updated. Click Scan. When finished, please click Clean. Your PC should reboot now if any items were found. After reboot, a log file will be opened. Copy its content into your next reply. STEP 03 Please download the Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Double-click to run it. When the tool opens, click Yes to disclaimer. Press the Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply. The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here. Please attach the Additions.txt log to your reply as well. Thanks Ron Link to post Share on other sites More sharing options...
supersonicelric Posted August 29, 2017 Author ID:1158193 Share Posted August 29, 2017 Malware Bytes report 1.txt Here is the report. Link to post Share on other sites More sharing options...
supersonicelric Posted August 29, 2017 Author ID:1158194 Share Posted August 29, 2017 I ran AdwCleaner and it discovered 3 PUP files. I cleaned them as stated in step two. # AdwCleaner 7.0.1.0 - Logfile created on Tue Aug 29 12:17:02 2017 # Updated on 2017/05/08 by Malwarebytes # Running on Windows 10 Home (X64) # Mode: clean # Support: https://www.malwarebytes.com/support ***** [ Services ] ***** No malicious services deleted. ***** [ Folders ] ***** Deleted: C:\ProgramData\{7B0BBE68-F149-34AE-778F-AAECEDCD2122} ***** [ Files ] ***** No malicious files deleted. ***** [ DLL ] ***** No malicious DLLs cleaned. ***** [ WMI ] ***** No malicious WMI cleaned. ***** [ Shortcuts ] ***** No malicious shortcuts cleaned. ***** [ Tasks ] ***** No malicious tasks deleted. ***** [ Registry ] ***** Deleted: [Key] - HKLM\SOFTWARE\WebBar Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\free-rar-extract-frog.en.softonic.com Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\softonic.com Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\free-rar-extract-frog.en.softonic.com Deleted: [Key] - HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\softonic.com ***** [ Firefox (and derivatives) ] ***** No malicious Firefox entries deleted. ***** [ Chromium (and derivatives) ] ***** No malicious Chromium entries deleted. ************************* ::Tracing keys deleted ::Winsock settings cleared ::Additional Actions: 0 ************************* C:/AdwCleaner/AdwCleaner[S0].txt - [2002 B] - [2017/8/29 12:13:57] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt ########## Link to post Share on other sites More sharing options...
supersonicelric Posted August 29, 2017 Author ID:1158212 Share Posted August 29, 2017 These are the two files that Farbar made after I followed the steps in step 3. FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 30, 2017 Root Admin ID:1158539 Share Posted August 30, 2017 Let's start out by resetting your browsers Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues. If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in. Internet ExplorerHow to reset Internet Explorer settings Microsoft EdgeHow to Reset Microsoft Edge in Windows 10 Firefox Click on Help / Troubleshooting Information then click on the Refresh Firefox button. ChromeReset Chrome back to defaults to completely clear out issues with Chrome. First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser. Scroll down until you see the "reset sync" button to clear your data from the server and remove your passphrase. Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information. Press the Windows key + R at the same time, to bring up the run dialog box. Type in (or copy/paste) the following and press Enter: %localappdata%\Google\Chrome\User Data\Default\ Press Ctrl + A to select all the files and folders. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders. Example of all files and folders selected, except Bookmarks Next, Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Restart your computer now and make sure there are no longer any redirects or other browser issues. Thanks Ron Link to post Share on other sites More sharing options...
Recommended Posts