Infected with PUP.Yelload

[ClarenceBC]

Hello,

 

Two days ago, I started noticing an ad tab popping up on my Chrome  browser. So I suspected it was an adware and used the Adware Removal Tool by TSA to get rid of it and it did, or so I thought. I also noticed that my PC was slowing down and I could hear my fan running harder than usual. I typed in "adware" on my search bar and Chrome just froze. I tried to run the Adware Removal Tool by TSA and it froze at 22%.

 

Yesterday, I downloaded both the Malwarebytes and Malwarebytes AdwCleaner, ran them, and quarantined the threats. I thought it was over but the ads still keep popping up and my memory use was still so high. A few minutes ago, I tried opening the Malwarebytes forum and it still crashed.

 

So now I'm here on Safe Mode because this is the only way I can access the forum. All of the scans done were all done in Safe Mode. All the logs attached were the first scans ever done after they were installed.

 

Any help would be very much appreciated.

Malware bytes first log.txt

Addition.txt

FRST.txt

AdwCleaner[S00].txt

[Aura]

Hi ClarenceBC

My name is Aura and I'll be assisting you with your malware issue. Since we'll be working together, you can call me Aura or Yoan, which is my real name, it's up to you! Now that we've broke the ice, I'll just ask you a few things during the time we'll be working together to clean your system and get it back to an operational state.

• As you'll notice, the logs we are asking for here are quite lenghty, so it's normal for me to not reply exactly after you post them. This is because I need some time to analyse them and then act accordingly. However, I'll always reply within 24 hours, 48 hours at most if something unexpected happens
• As long as I'm assisting you on Malwarebytes Forums, in this thread, I'll ask you to not seek assistance anywhere else for any issue related to the system we are working on. If you have an issue, question, etc. about your computer, please ask it in this thread and I'll assist you
• The same principle applies to any modifications you make to your system, I would like you to ask me before you do any manipulations that aren't in the instructions I posted. This is to ensure that we are operating in sync and I know exactly what's happening on your system
• If you aren't sure about an instruction I'm giving you, ask me about it. This is to ensure that the clean-up process goes without any issue. I'll answer you and even give you more precise instructions/explanations if you need. There's no shame in asking questions here, better be safe than sorry!
• If you don't reply to your thread within 3 days, I'll bump this thread to let you know that I'm waiting for you. If you don't reply after 5 days, it'll be closed. If you return after that period, you can send me a PM to get it unlocked and we'll continue where we left off;
• Since malware can work quickly, we want to get rid of them as fast as we can, before they make unknown changes to the system. This being said, I would appreciate if you could reply to this thread within 24 hours of me posting. This way, we'll have a good clean-up rhythm and the chances of complications will be reduced
• I'm against any form of pirated, illegal and counterfeit software and material. So if you have any installed on your system, I'll ask you to uninstall them right now. You don't have to tell me if you indeed had some or not, I'll give you the benefit of the doubt. Plus, this would be against Malwarebytes Forums's rules
• In the end, you are the one asking for assistance here. So if you wish to go a different way during the clean-up, like format and reinstall Windows, you are free to do so. I would appreciate you to let me know about it first, and if you need, I can also assist you in the process
• I would appreciate if you were to stay with me until the end, which means, until I declare your system clean. Just because your system isn't behaving weirdly anymore, or is running better than before, it doesn't mean that the infection is completely gone
  This being said, I have a full time job so sometimes it'll take longer for me to reply to you. Don't worry, you'll be my first priority as soon as I get home and have time to look at your thread
  

This being said, it's time to clean-up some malware, so let's get started, shall we?

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Fix button
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
• Copy and paste its content in your next reply
  

fixlist.txt

[ClarenceBC]

Hello, You can call me Clarence. I had done as you instructed. Attached is the content of the log after the reboot.

Fixlog.txt

[Aura]

Good! Can you do me a favor? Can you .zip the C:\FRST\Quarantine folder and attach it here?

[ClarenceBC]

Good day, I don't have an FRST Quarantine folder.

[Aura]

You should have a folder called FRST on your C:\ drive, and in it, the Quarantine one. Did you delete it?

[ClarenceBC]

Oh, I'm sorry, I was assuming that the Quarantine folder was in the same directory as the FRST.exe. Here it is:

Quarantine.rar

[Aura]

Thank you. Moving on.

AdwCleaner - Fix Mode

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply
  

RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply
  

Your next reply(ies) should therefore contain:

• Copy/pasted AdwCleaner clean log
• Copy/pasted RogueKiller clean log
  

[ClarenceBC]

There was no log from Malwarebytes displayed after the reboot but here it is: The RogueKiller scan is still about a third of the way through.

 

# -------------------------------
# Malwarebytes AdwCleaner 7.2.3.1
# -------------------------------
# Build:    09-03-2018
# Database:  (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    09-20-2018
# Duration: 00:00:24
# OS:       Windows 7 Ultimate
# Scanned:  41929
# Detected: 2

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

PUP.Optional.Legacy             Ask
PUP.Optional.Legacy             AOL

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

AdwCleaner[S00].txt - [4341 octets] - [17/09/2018 10:44:18]
AdwCleaner[C00].txt - [3923 octets] - [17/09/2018 10:44:36]
AdwCleaner[S01].txt - [1375 octets] - [17/09/2018 10:53:20]
AdwCleaner[S02].txt - [1436 octets] - [17/09/2018 11:31:16]
AdwCleaner[S03].txt - [1497 octets] - [17/09/2018 20:07:19]
AdwCleaner[S04].txt - [1558 octets] - [17/09/2018 20:10:40]
AdwCleaner[S05].txt - [1619 octets] - [17/09/2018 21:21:05]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S06].txt ##########
 

 

[ClarenceBC]

Good day, I was having problems with posting in the forum. There was a pop-up from the forums stating that they detected spam on my posts. 

Anyway, I just came from the school so I had to turn the PC off and just turned it on. I'm still in safe mode at the moment. 

When I tried to post the Rogue Killer log just a few minutes ago, I couldn't access the forums. The internet is pretty slow at the moment so I'm currently using my data. I'm not sure if it's related but it might be worth mentioning. 

RoughKiller.txt

[ClarenceBC]

Also, terribly sorry about the huge delay. I was rushing to go to school this morning and just got back. I thought I had sent you a private message, Aura, but it seems that it wasn't sent. I had trouble earlier because I couldn't post because the forum kept marking my posts as spam.

Thank you for your patience.

RoughKiller log.txt

After deletion.txt

RoughKiller .txt

After deletion.txt

After deletion.txt

After deletion.txt

[ClarenceBC]

Also, excuse the multiple attachments. I thought I had deleted them already. This forums kind of confuses me.

[ClarenceBC]

Good day, I turned on my PC and allowed to boot on normal mode and accidentally left it on for a while. Doe it change anything? Do I need to rescan?

 

Thank you

[Aura]

Sorry, I was sick in the last few days and didn't have time to check the forums.

From what I can see, your system looks fine now. How's your computer behaving?

[ClarenceBC]

Good day, I'll restart the computer and boot on normal mode. Might take half an hour to know if there's anything going on.

[ClarenceBC]

Good day (once again)

I am now able to access this forum on normal boot mode. I can search adware and malware without Chrome freezing on me and my fan is not running like crazy. All Malwarebytes features are now on. I checked my Malwarebytes quarantine and then this came up:

Should I delete the all the Yelloader items? I'm on free trial at the moment.

 

Thanks,

Clarence

[ClarenceBC]

No ads popping up and PC is faster than it was before. Thank you so much, Aura. You saved my a week or two in file recovery and quite a lot of money. You really helped me a lot.

Hope you get well soon.

 

Cheers,

Clarence.

[ClarenceBC]

Good day, I had just run a Malwarebytes scan, rebooted and ran another Malwarebytes scan (2), then a Rogue Killer scan and still found Yelloader. Is this a concern? (Also attached are new FRST scan logs.)

Malwarebytes log.txt

Malwarebytes log 2.txt

RogueKiller log.txt

Addition.txt

FRST.txt

[Aura]

You can delete everything in Malwarebytes' quarantine, yes. The tracing keys are remnants. If you restart your computer and run a new scan, are they still detected?

 

[ClarenceBC]

Yes, they do. I did the scan-and-restart twice, and they still do appear. Computer has been behaving normally, though. No pop-ups or sudden surge in power use. Should I be worried?

[Aura]

Alright, restart your computer and run the FRST fix below.

Farbar Recovery Scan Tool (FRST) - Fix mode
Follow the instructions below to execute a fix on your system using FRST, and provide the log in your next reply.

• Download the attached fixlist.txt file, and save it on your Desktop (or wherever your FRST.exe/FRST64.exe executable is located)
• Right-click on the FRST executable and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Fix button
  
• On completion, a message will come up saying that the fix has been completed and it'll open a log in Notepad
• Copy and paste its content in your next reply
  

fixlist.txt

[ClarenceBC]

Good day, here's the FRST fixlog

[ClarenceBC]

Sorry, here it is.

Fixlog.txt

[Aura]

Looks like these entries are related to:

Simple Sticky Notes 4.3 (HKLM-x32\...\Simple Sticky Notes_is1) (Version:  - Simnet Ltd.)

Did you install that program, and if so, are you using it?

[ClarenceBC]

I did install that program and I'm still using it