Jump to content

Torpig Infection


Celo
 Share

Recommended Posts

My Hotmail was hijacked. After contacting Microsoft they told me my computer was infected with torpig. I run Norton but it did not detect anything. This forum was the only place I found that has recorded solution from other users that were infected with the same virus. I appreciate if someone could help me removing it from my computer.

Thank you very much!

Marcelo

Link to post
Share on other sites

  • Replies 58
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Posted Images

Malwarebytes log. It did not ask for it but I thought it may be a good idea to show. I did quarantine the items and restarted the computer.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 1/2/18
Scan Time: 6:51 PM
Log File: ffbbc72c-f030-11e7-b472-0025647b4fad.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3610
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Marcelo-PC\Marcelo

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 264273
Threats Detected: 101
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 8 min, 1 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.DriverTuner, HKU\S-1-5-21-379400296-1464391431-3024311811-1000\SOFTWARE\DriverTuner, No Action By User, [2066], [469705],1.0.3610
PUP.Optional.DriverTuner, HKU\S-1-5-21-379400296-1464391431-3024311811-1000\SOFTWARE\DriverTuner_Init, No Action By User, [2066], [469705],1.0.3610
PUP.Optional.DriverTuner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{520C1D80-935C-42B9-9340-E883849D804F}_is1, No Action By User, [2066], [469700],1.0.3610

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 21
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Solvusoft Suite\Logs, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\SOLVUSOFT SUITE, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Solvusoft Suite\Logs, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\SOLVUSOFT SUITE, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Tray\Logs, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\TRAY, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\Logs, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\TRAY, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\WinThruster, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\Backup, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\LOGS, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\WinThruster64, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\download, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\backup, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\PROGRAM FILES (X86)\DRIVERTUNER, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\DRIVERTUNER, No Action By User, [2066], [469701],1.0.3610

File: 77
PUP.Optional.WinThruster, C:\USERS\MARCELO\APPDATA\ROAMING\SOLVUSOFT\SOLVUSOFT SUITE\LOGS\Client.log.txt, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.DriverTuner.TskLnk, C:\PROGRAM FILES (X86)\DRIVERTUNER\DRIVERTUNER.EXE, No Action By User, [2206], [469703],1.0.3610
PUP.Optional.WinThruster, C:\PROGRAMDATA\SOLVUSOFT\SOLVUSOFT SUITE\LOGS\MachineId.log.txt, No Action By User, [8056], [461214],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\Tray\Logs\CommonTrayInstaller.log.txt, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DLPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DM.exe, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\DVPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\FDPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\lang.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\PWPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\RCPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SFPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\SWPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO.xml, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_01-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_02-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\AutoInstall\VFPRO_DL_03-825x338-72dpi.jpg, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\Users\Marcelo\AppData\Roaming\Solvusoft\Tray\Logs\Tray.log.txt, No Action By User, [8056], [461215],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}\1033.MST, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster\InstallCache\{DC9009F8-98BE-4E75-B77D-B839CA8C8EC3}\WinThruster.msi, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\Backup\Backup_December_17_17_13_44_04.reg, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\LOGS\LOGS_12_17_2017_13_27_53_PM.log, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\TipofDay_EN-US.xml, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.WinThruster, C:\ProgramData\Solvusoft\WinThruster64\wxfdata.wxf, No Action By User, [8056], [461216],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_de.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_en.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_es.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_fr.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_it.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_jp.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_btn_pt.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_de.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_en.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_es.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_fr.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_it.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_jp.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\image\uninstall_main_pt.bmp, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\update.EXE, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\update.URS, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\update\UpdateLang.ini, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DPInst32.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DPInst64.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\DriverTuner.url, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\language.ini, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\libcurlds.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\license.txt, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\msvcp100.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\msvcr100.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\unins000.dat, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\unins000.exe, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\Program Files (x86)\DriverTuner\zlibwapi.dll, No Action By User, [2066], [469700],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\DriverTuner on the Web.url, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\DriverTuner.lnk, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\Uninstall DriverTuner.lnk, No Action By User, [2066], [469701],1.0.3610
PUP.Optional.DriverTuner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverTuner\update.lnk, No Action By User, [2066], [469701],1.0.3610

Physical Sector: 0
(No malicious items detected)


(end)

Link to post
Share on other sites

Yes you can delete the quarantined entries in Malwarebytes...

Next,

Open Malwarebytes Anti-Malware.

  • On the Settings tab > Protection Scroll to and make sure the following are selected: Scroll to and make sure the following are selected:

    Scan for Rootkits
    Scan within Archives

  • Scroll further to Potential Threat Protection make sure the following are set as follows:

    Potentially Unwanted Programs (PUP`s)         set as :- Always detect PUP`s (recommended)
    Potentially Unwanted Modifications (PUM`s)  set as :- Alwaysdetect PUM`s (recommended)

  • Click on the Scan make sure Threat Scan is selected,

  • A Threat Scan will begin.

  • When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab

  • If asked to restart your computer to complete the removal, please do so

  • When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard.

  • Wait for the prompt to restart the computer to appear, then click on Yes.

  • After the restart once you are back at your desktop, open MBAM once more to retrieve the log.

To get the log from Malwarebytes do the following:

  • Click on the Reports tab > from main interface.
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options: > From export you have two options:

      Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
      Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
     

  • Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply


Next,

Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...
 
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
  • If no threats were found please confirm that result....



The Virus Removal Tool scans the following areas of your computer:
  • Memory, including system memory on 32-bit (x86) versions of Windows
  • The Windows registry
  • All local hard drives, fixed and removable
  • Mapped network drives are not scanned.



Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs

Let me see those logs in your next reply... Also do you know and trust software belong to the following:

Caixa Economica Federal
GAS Tecnologia

Thank you,

Kevin,,

 

 

 

Link to post
Share on other sites

I deleted the quarantined entries in Malwarebytes.

I know and trust Caixa Economica Federal and GAS Tecnologia, but they could definitely be removed. No longer use them. I did not see them as an option to be removed in control panel \ programs.

Now I will do the above as instructed. 

 

Link to post
Share on other sites

Thanks for that log, i`m going offline very shortly so will not be about when you post logs from AdwCleaner and Sophos... The FRST fix follows, run that after Sophos has completed..

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix"
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Open FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.


Thanks,

Kevin

fixlist.txt

Link to post
Share on other sites

I will not be around tomorrow, Thursday, responses from me will be delayed to later in the day when I get back from work or Friday morning.

Meanwhile, a couple of questions related to the fixlist script:

  1. Why do I see many references to Sys32 if my Sys is 64?
  2.  What do the firewall rules at the end do? both of them but more specifically allowing port 5357.

Thanks

Link to post
Share on other sites

Thanks for the update, will catch up later for frst fix...

Your system is 64 bit, now for the confusion. All 64 bit entries run from System32 folder,  your system can still run X86 (32 bit) software, all of those entries run from Syswow64 folder.

Firewall rules are created by software you may install, your security or yourself. Malware/Infection is also capable of creating FW rules. The entries I listed for removal were not needed, the latter (port 5357) was just an open port with no obvious link or reason....

Link to post
Share on other sites

Select start, in the search box type services.msc hit enter, in the new window check these entries are running and set to automatic:

DHCP Client
DNS Client

Go to Start > All Programs > Accessories > Right click on "Command Prompt" select "Run As Administrator"

Type or copy/paste the following commands hit the enter key after each one,

netsh winsock reset catalog
netsh int ipv4 reset reset.log
netsh int ipv6 reset reset.log
ipconfig /flushdns
ipconfig /release
ipconfig /renew
ipconfig /registerdns


Then reboot.

Is connection now ok?
Link to post
Share on other sites

Can you run this and post the produced log:

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.

Make sure the following options are checked:
 
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
 
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.
Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.