robof
April 12, 2015, 7:01am
1
Hi, I been having problems with popups in Avast (reddie.net , blackflightinfo, etc) so have gone through the procedures in this forum but keep getting stuck as aswmbr crashes at the line
I haven’t used any fixlist.txt file from these forums as you indicate these are computer specific and I could end up in even worse trouble.
Before I reboot my computer with my foot (and then use it on my head for getting this infection) can anyone help - please !
hey and welcome to the forum. thanks for attaching the needed logs.
don’t worry about the aswmbr the expert have other tools for that, the most imported tool to attach was the first.
robof
April 12, 2015, 9:23am
3
Wow - fast reply, thankyou !
BTW, if it helps, I did copy the file to my desktop and rename it to iexplore.exe as per the other forums, - it still crashed in exactly the same place I’ve mentioned
Nice clean system just a few orphans to remove and the one bad boy
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-2476042604-107153089-4168584280-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
S2 figyvyvu; No ImagePath
S2 nesodize; No ImagePath
2015-04-01 12:09 - 2015-04-01 12:09 - 00004868 _____ () C:\ProgramData\eaapqbsg.gfr
2015-03-13 11:32 - 2015-04-09 17:53 - 00000000 ____D () C:\ProgramData\{8a7b7934-de40-b381-8a7b-b7934de4e4d3}
CustomCLSID: HKU\S-1-5-21-2476042604-107153089-4168584280-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rob Fitz\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
robof
April 12, 2015, 12:14pm
5
Wow - You must be drinking a lot of coffee to do this so fast - thankyou !
Hope I got it right - 2 logs were generated both of which I’ve posted
The popups haven’t reappeared so I’ll keep my fingers crossed and save some wear and tear on kicking myself in the head.
Presumably if all OK I now go back into the generic forum and clean up the system etc ??
Nope let me do that
Subject to no further problems
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Remove tools
Download and run Delfix
https://dl.dropboxusercontent.com/u/73555776/delfix.JPG
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe
Hi, I’m having the same problem. It gets to a specific file and then crashes. How do I fix it? Thanks!
Asyn
May 10, 2015, 8:24am
10
