Hi!
I feel bad because this got resolved for someone else, but I dont understand how they did it. My avast shield has been going nuts with 6 - 8 pop ups every 5 - 10 minutes about some clickered malware. It’s getting annoying.
I’ve attached all the logs. Any help is appreciated. Thank you!
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
HKU\.DEFAULT\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
HKU\S-1-5-21-597601674-2576478195-4259146022-1000\...\MountPoints2: {fdd1e7b8-bd5b-11e0-9949-a4badba7232c} - F:\LaunchU3.exe -a
HKU\S-1-5-21-597601674-2576478195-4259146022-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {fdd1e7b8-bd5b-11e0-9949-a4badba7232c} - F:\LaunchU3.exe -a
Startup: C:\Users\Caitlynn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk
ShortcutTarget: TornTvDownloader.lnk -> C:\Users\Caitlynn\AppData\Roaming\TornTV.com\Torntv Downloader.exe (No File)
C:\Users\Caitlynn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
SearchScopes: HKCU - {1D429FF7-3076-410E-8CFF-9F990B174AC1} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN41418311916563123&UM=2
CHR DefaultSearchKeyword: Default -> F982E4587FD0BE6AB7F759601817399E379C8B9E9BEF6B13A57B3A4693DE06B5
CHR DefaultSearchProvider: Default -> 53526CC1864CBE3A8A5C5FAFF63081B81071F8917A4E481F7715B493B0E922AC
CHR DefaultSearchURL: Default -> 14B3FBBD119CC274252172CAD4165CBEB9917531903162E46E7F2FD81759D579
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S2 trntv; C:\Users\Caitlynn\AppData\Roaming\TornTV.com\TornTVSvc.exe [X]
EmptyTemp:
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
.
Next
Please download Zoek tool by Smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here and save it to your Desktop.
Unpack the archive…
[*]Close any open browsers and temporarily disable your AntiVirus program. (if it is necessary)
If you are unsure how to do this please read this or this Instruction.
[*]Double click on zoek.exe to run the tool. Please wait while the tool does not start…
[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:
filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;
[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)
[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
I’ve tried several times to run the FRST script and it stops working after 3 - 4 hours.
Regardless I checked and there is a log.
I also ran the zoek and attached the results of that.
Re-run zoek as you did before but with this script:
kifbifhcmjgogbdlmblmjemdlincicmb;chr
emptyalltemp;
autoclean;
emptyclsid;
ipconfig /flushdns >> %temp%\log.txt;b
ipconfig /flushdns;b
.
Please download AdwCleaner by Xplode and save to your Desktop.
Double click on AdwCleaner.exe to run the tool.
[*]Click on the Scan button.
[*]After the scan has finished click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
[*]After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
[*]Post logfile will also be saved in the C:\AdwCleaner folder.
Thank You
whether the problem is solved?
It’s down to about 3 pop ups. Which is better than the 6+ it was before.
I need a new computer anyway…
Caitlynn,
Keep working with Argus. He may be able to fix the problem whether you need a new machine or not.
I see no present or active malware.
It’s still coming about 6 times every 5 minutes. Is there any other tests I can run?
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Task: {258B73E6-209C-4A6D-A596-BEF6115C5E04} - System32\Tasks\Updater21804.exe => C:\Users\Caitlynn\AppData\Local\Updater21804\Updater21804.exe <==== ATTENTION
Task: {4B405390-EB52-448B-A327-8F1D2BD24827} - System32\Tasks\Microsoft\Windows\Maintenance\Idle~_~Crawler Update => %LOCALAPPDATA%\Idle~_~Crawler\Idle~_~Crawler.exe
Task: {596BF523-9592-4F3B-BE27-A2932DBD1F38} - System32\Tasks\{AF1B071F-CA74-42C0-97BD-200A0AB4D916} => G:\AutoRun.exe
Task: {8D17D977-04FE-41DB-8E1B-CF6C0F50A398} - System32\Tasks\Idle~_~Crawler Runner => %LOCALAPPDATA%\Idle~_~Crawler\Idle~_~Crawler.exe
C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Idle~_~Crawler.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
(The Chromium Authors) C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler\Chrome-bin\chrome.exe
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011-07-23]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-07-18]
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF Extension: No Name - C:\Users\Caitlynn\AppData\Roaming\Mozilla\Firefox\Profiles\y91qhouk.default\extensions\firebug@software.joehewitt.com.xpi []
C:\Users\Caitlynn\AppData\Roaming\Mozilla\Firefox\Profiles\y91qhouk.default\extensions\firebug@software.joehewitt.com.xpi
CHR DefaultSearchKeyword: Default -> F982E4587FD0BE6AB7F759601817399E379C8B9E9BEF6B13A57B3A4693DE06B5
CHR DefaultSearchProvider: Default -> 53526CC1864CBE3A8A5C5FAFF63081B81071F8917A4E481F7715B493B0E922AC
CHR DefaultSearchURL: Default -> 14B3FBBD119CC274252172CAD4165CBEB9917531903162E46E7F2FD81759D579
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-01-10]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S2 trntv; C:\Users\Caitlynn\AppData\Roaming\TornTV.com\TornTVSvc.exe [X]
2014-08-26 21:43 - 2014-08-26 21:45 - 00000000 ____D () C:\Users\Caitlynn\AppData\Local\Idle~_~Crawler
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKU\.DEFAULT\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
HKU\S-1-5-21-597601674-2576478195-4259146022-1000\...\MountPoints2: {fdd1e7b8-bd5b-11e0-9949-a4badba7232c} - F:\LaunchU3.exe -a
Startup: C:\Users\Caitlynn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk
ShortcutTarget: TornTvDownloader.lnk -> C:\Users\Caitlynn\AppData\Roaming\TornTV.com\Torntv Downloader.exe (No File)
C:\Users\Caitlynn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TornTvDownloader.lnk
EmptyTemp:
CMD: bitsadmin /reset /allusers
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
.
Step 2
Re-run zoek and run this script:
FFdefaults;
chrdefaults;
iedefaults;
autoclean;
omg I love you…
Thank you so much! No more pop ups! 
• The following will implement some post-cleanup procedures:
=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.