Dealing with Adware.5Hax (AKA Trojan Clicker)

[dragonscones]

Hi, I'm new to this forum, but I"ve scanned and quarantined/ deleted a trojan clicker using malwarebytes multiple times. It never actually goes away. I've tried to manually delete it and it just says it's running in another process. I've uninstalled every program that may be connected I could, delete any extension that didn't come with my google browser, end task all processes that i thought were suspect, gone into regedit to look for it, and none of this has worked. It seems to go by the name Adware.5Hex which seems to be a relatively new virus. All it noticeably does is redirect my search to yahoo search instead of google and run processes like Jadenode. Any help I can get would be greatly appreciated and I will follow whatever advice I can get, but I'd really like to get help soon, as I don't like just letting a trojan clicker sit on my computer

[kevinf80]

Hello dragonscones and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

[dragonscones]

Posting this as  A response to Kevinf80 on my last new topic. Any help with dealing with this virus would be appreciated

Malwarebytes Threat Scan Log.txt

Addition.txt

FRST.txt

[kevinf80]

Yes now I see what you have, follow instructions from this link:

When done, please post the two produced logs they will be in the MBAR folder... mbar-log.txt and system-log.txt

 

Edited September 20, 2017 by kevinf80

[dragonscones]

mbar-log-2017-09-20 (13-53-57).txt

system-log.txt

[kevinf80]

Can you run  threat scan with Malwarebytes... post the produced log...

[dragonscones]

I didn't do a custom scan, but I'll do it when I go to sleep incase

Malwarebytes Threat Scan Log.txt

[kevinf80]

That log shows "no action taken" why have you not quarantined those entries...? There is no need for a custom scan, only Threat scan is needed, but all found entries must be quarantined....

[dragonscones]

I quarantined them, should I leave them alone and not delete? I was basically just trying to consult you on each step

 

[kevinf80]

You can leave them in quarantine for now, or delete them. As long as they are gone from your system is good outcome....

Continue with the following:

Download Sophos Free Virus Removal Tool and save it to your desktop. If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete..... Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...   Double click the icon and select Run Click Next Select I accept the terms in this license agreement, then click Next twice Click Install Click Finish to launch the program Once the virus database has been updated click Start Scanning If any threats are found click Details, then View log file... (bottom left hand corner) Copy and paste the results in your reply Close the Notepad document, close the Threat Details screen, then click Start cleanup Click Exit to close the program If no threats were found please confirm that result.... The Virus Removal Tool scans the following areas of your computer: Memory, including system memory on 32-bit (x86) versions of Windows The Windows registry All local hard drives, fixed and removable Mapped network drives are not scanned. Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan. Let me see that log in your reply... Thank you, Kevin

 

[dragonscones]

I restarted and scanned again and all the viruses are gone now, thank you for the help!

 

[kevinf80]

Thanks for the update, I assume by your reply you are wanting to close out...

Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[kevinf80]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!