I'm Infected! please help! Ads

[Danieliis2]

I installed a program but i didn't know there was a program called 

 

"Search Manager"

"Chromium"

"bytefence" 

:yahoo search"

comes with it

i quickly scanned with malwarebytes and they removed them removed all the chromium files and bytefence files

i just want to make sure im safe what do i do please guide me

Edited October 30, 2017 by Danieliis2

[kevinf80]

Hello Danieliis2 and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

[Danieliis2]

19 minutes ago, kevinf80 said:

Hello Danieliis2 and welcome to Malwarebytes, Follow the instructions at this link and post the requested logs: https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/ Thank you, Kevin

 

Added i got no threats recieved in malware bytes

 

FRST.txt

Addition.txt

Edited October 30, 2017 by Danieliis2

[kevinf80]

Thanks for theose logs, continue with the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... 32 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en 64 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Post those logs, also let me know if you have any remaining issues or concerns.... Thank you, Kevin...

fixlist.txt

[Danieliis2]

13 minutes ago, kevinf80 said:

Thanks for theose logs, continue with the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... 32 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en 64 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Post those logs, also let me know if you have any remaining issues or concerns.... Thank you, Kevin...

fixlist.txt

 

i can't run adware cleaner the application was unable to start correctly please help omg

i tried cleanboot still doesnt work

Edited October 30, 2017 by Danieliis2

[Danieliis2]

the application was unable to start correctly 0xc0000142 

[kevinf80]

Did you run FRST fix....?

[Danieliis2]

1 minute ago, kevinf80 said:

Did you run FRST fix....?

adware cleaner worked after selecting compatibility weird. posting logs and yes. i attached the logs. of 

FRST

Addition

 

Here is the adwarecleaner log

 

# AdwCleaner 7.0.4.0 - Logfile created on Mon Oct 30 13:25:13 2017
# Updated on 2017/27/10 by Malwarebytes 
# Database: 10-28-2017.1
# Running on Windows 10 Pro (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

[Danieliis2]

NVM i misread your post.

Edited October 30, 2017 by Danieliis2

[Danieliis2]

@kevinf80 here is the fixlog 

Fixlog.txt

[Danieliis2]

MSRT Log 

 

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.53, October 2017 (build 5.53.14306.0)
Started On Mon Oct 30 21:38:04 2017

Engine: 1.1.14104.0
Signatures: 1.251.1312.0
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Mon Oct 30 21:39:45 2017

Return code: 0 (0x0)
 

 

AM i clean now? nothing suspicous?

[Danieliis2]

Am i clean now?

Edited October 30, 2017 by Danieliis2

[kevinf80]

Hello Danieliis2,

Is your PC responding as expected, is your browser ok, no odd behaviour or redirects....?

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

let me see those logs...

Thank you,

Kevin

[Danieliis2]

11 minutes ago, kevinf80 said:

Hello Danieliis2,

Is your PC responding as expected, is your browser ok, no odd behaviour or redirects....?

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

let me see those logs...

Thank you,

Kevin

Yeah its okay. The 4 adwares got installed i didn't know. but is it all okay now?? 

BTW i have more question. Why didn't the adware cleaner worked on my PC it shows that error "the application was unable to start correctly 0xc0000142" I'm kinda scared. It worked after putting in compatibility mode. Weird.

Addition.txt

FRST.txt

Edited October 30, 2017 by Danieliis2

[Danieliis2]

Sorry can't edit, i mean is there anything else hiding that would steal information in my pc or like a bitcoin miner? sorry i'm a newbie

[kevinf80]

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Post that log, also tell me if you have any remaining issues or concerns...

 

fixlist.txt

[Danieliis2]

14 minutes ago, kevinf80 said:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Post that log, also tell me if you have any remaining issues or concerns...

 

fixlist.txt

Fix result of Farbar Recovery Scan Tool (x64) Version: 26-10-2017
Ran by Daniel (31-10-2017 01:09:22) Run:2
Running from C:\Users\Daniel\Desktop\asd
Loaded Profiles: Daniel (Available Profiles: Daniel)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
Task: C:\WINDOWS\Tasks\{5655ADB6-0DF5-A9D8-5039-12F7E14D4ADE}.job => C:\PROGRA~2\COMMON~1\Kimucebe\Sync.exe
C:\PROGRA~2\COMMON~1\Kimucebe
end

*****************

C:\WINDOWS\Tasks\{5655ADB6-0DF5-A9D8-5039-12F7E14D4ADE}.job => moved successfully
"C:\PROGRA~2\COMMON~1\Kimucebe" => not found.

==== End of Fixlog 01:09:22 ====

 

it says not found. OMG i fixed the 0x0000142 something i downloaded the adwcleaner_7.0.4.0 version  

 

last question there is nothing else hiding in my PC right???

Edited October 30, 2017 by Danieliis2

[kevinf80]

AdwCleaner is an application that runs direct, it does not install. The error code you listed can mean corrupt executable or software on your system maybe interferring somehow, or possibly your security stops it from running...

I assume "Kimucebe" is showing not found because it was moved with the first command that shifted the Task...

How do you believe your system is responding, ok or not ok...?

[Danieliis2]

7 hours ago, kevinf80 said:

AdwCleaner is an application that runs direct, it does not install. The error code you listed can mean corrupt executable or software on your system maybe interferring somehow, or possibly your security stops it from running...

I assume "Kimucebe" is showing not found because it was moved with the first command that shifted the Task...

How do you believe your system is responding, ok or not ok...?

Yes i tried somethign and it appears again. 

[kevinf80]

What exactly were you doing when that alert popped up... I assume you selected to remove that extension...?

Lets have another look at your system:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

 

[Danieliis2]

16 minutes ago, kevinf80 said:

What exactly were you doing when that alert popped up... I assume you selected to remove that extension...?

Lets have another look at your system:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

 

 

16 minutes ago, kevinf80 said:

What exactly were you doing when that alert popped up... I assume you selected to remove that extension...?

Lets have another look at your system:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

 

i did this. from another forum

 

Start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

FF HKU\S-1-5-21-1415395603-2619486847-3890213405-1001\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi => not found
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSearchKeyword: Default -> lp
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
DeleteKey: HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
DeleteKey: HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <not found>
DeleteKey: HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CustomCLSID: HKU\S-1-5-21-1415395603-2619486847-3890213405-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-170F5F5A3E94}

End

 

After restarting and opening chrome. i got that popped up and i clicked remove from chrome and deleted all the folders extensions in the Local/appdata extensions location

ok i will do another scan.

[kevinf80]

Are you being helped at another forum....?

[Danieliis2]

Here is the latest

Addition.txt

FRST.txt

[Danieliis2]

1 minute ago, kevinf80 said:

Are you being helped at another forum....?

yes but. i still want other peoples help

[kevinf80]

Being helped at two different forums is counterproductive, I`m closing your thread here, continue with the help at the other forum... If you are unhappy with my action feel free to contact one of the admin guys.....

Thank you,

Kevin...

Edited October 31, 2017 by kevinf80