Moirty Posted April 8, 2019 ID:1307168 Share Posted April 8, 2019 AdwCleaner is finding and, presumably, cleaning TheBrightTag from my computer. However, after short periods of usage (sometimes hours; sometimes a few days), I find that my computer is again reinfected. I can usually tell because the system slows noticeably. My Win10 PC is fully up-to-date and I generally think of myself as a safe user (I use VPN on public sites and am careful about phishing and similar attacks). Nevertheless, I cannot figure out how to completely eradicate this thing. At @exile360 recommendation, I have downloaded and run FRST64. I am attaching logs from both FRST and ADW: ADW S35 Log shows infection this morning. ADW C35 Log shows log after running AdWCleaner (no infection) FRST 1 and Addition 1 logs were run (presumably no infection) ADW S36 Log shows where TheBrightTag infection returned this afternoon (I was on a plane and mostly disconnected from the internet during the ensuing 9 hours FRST2 and Addition 2 logs were run (after detection and before cleaning...therefore infected) ADWS37 Log shows log after running ADWCleaner again (no infection) I just ran ADWCleaner scan again and it did NOT find anything. Nevertheless, I have little confidence that my system is completely eradicated. Thanks much for any help. FRST 2.txt Addition 1.txt FRST 1.txt Addition 2.txt AdwCleaner[S39].txt AdwCleaner[S38].txt AdwCleaner[S37].txt AdwCleaner[C35].txt AdwCleaner[S35].txt AdwCleaner[S36].txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 8, 2019 Root Admin ID:1307172 Share Posted April 8, 2019 Hello @Moirty Please download the attached fixlist.txt file and save it to the Desktop.NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. fixlist.txt Thanks Ron Link to post Share on other sites More sharing options...
Moirty Posted April 9, 2019 Author ID:1307179 Share Posted April 9, 2019 Fixlog attached. Fixlog.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 9, 2019 Root Admin ID:1307202 Share Posted April 9, 2019 Please go ahead and restart the computer one more time and then run a new AdwCleaner scan and post back the new log Link to post Share on other sites More sharing options...
Moirty Posted April 9, 2019 Author ID:1307246 Share Posted April 9, 2019 Sadly. TheBrightTag has returned. ADWCleaner detects it again. I went ahead and cleaned it again. Log attached. My work has been very limited since running the fix (nothing that should be 'risky'). Thanks for your continued assistance. -bs AdwCleaner[S41].txt Link to post Share on other sites More sharing options...
Moirty Posted April 9, 2019 Author ID:1307270 Share Posted April 9, 2019 In the 1 hour since I posted the previous message (and completed the ADWCleaner repair), TheBrightTag has returned to my system! In that time I did the following: Yammer, Skype Bus and MS-Teams are running on my system. I responded to MS-Teams messages. I ran the following programs: Word, Acrobat Reader, Quicken, Excel Opened Edge and browsed to a single website I browsed and copied a number of files using Windows 10 File Manager UGH!🤬 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 9, 2019 Root Admin ID:1307273 Share Posted April 9, 2019 That was the Scan log for AdwCleaner. Do you have the Clean log? Please try adding an Ad Blocker Help Secure your browsers Please install uBlock Origin for your browsers to better protect your system FireFox, Chrome, Opera , Safari, Microsoft EdgeAdBlock for Internet Explorer Link to post Share on other sites More sharing options...
Moirty Posted April 9, 2019 Author ID:1307287 Share Posted April 9, 2019 The two logs from early this morning are attached. I have installed uBlock per your previous post. AdwCleaner[C41].txt AdwCleaner[S41].txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 10, 2019 Root Admin ID:1307302 Share Posted April 10, 2019 Great, go ahead and reboot and then do some web browsing and let me know if it returns or not. Ron Link to post Share on other sites More sharing options...
Moirty Posted April 12, 2019 Author ID:1307676 Share Posted April 12, 2019 I guess uBlock Origin is working. I have not seen the malware return since it was installed. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 12, 2019 Root Admin ID:1307688 Share Posted April 12, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts