Browser Hijacked

Viruses and worms
21

I just looked in the firewall setting under friends and I`m not seeing any ips

22

Using tghe same link Asyn gave you, attach FRST, you may have an IFEO or Group policy set against avast.

23

Here is the first log…

24

Here is the second…

25

I will notify a log expert …

26

Okay thanks heaps Pondus :slight_smile:

27

BTW do I just close this scan or do u want me to wait?

28

I have same problem, earlier I had ransomware (arma di carabinieri) or FBI browser ransom. BUt I deleted it with the help of Avast free version Yesterday, but today it came back while login in to BBC.com. and since then I can only log in into avast website or MSN. nothing else and sometimes that ransomware is appearing on browser and then same alert by avast and it continues. I will try ADW now.
but still I am fed up … does anyone has any solid solution or any information about good anti malware software?

29

If you need help, start your own topic … instructions found at top in this forum section

30

Hello,

This script for FRST tool (FixList) shall target some bad entries, done some fixes, preform some additional checks, it shall remove junk … etc
We will re-check all that with ComboFix.

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Start
Folder: C:\ProgramData\iyogi-scc-528B3AD8
CloseProcesses:
HKU\S-1-5-21-2309721919-2532912108-3705383954-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2309721919-2532912108-3705383954-1001\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-2309721919-2532912108-3705383954-1001\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-2309721919-2532912108-3705383954-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
ShellExecuteHooks:  - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Hosts:
S3 tuzblana; No ImagePath
EmptyTemp:
C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

.

  1. Please download ComboFix by sUBs (
    http://www.mcshield.net/personal/magna86/Images/IconComboFix.png
    ) from here and save it to your Desktop.
    [i]If you are unsure how ComboFix works, read this guide.
  1. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
    If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:
• Right click on the avast! system tray icon (
http://www.mcshield.net/pg/images/avast5.png
) in the lower right corner of the screen and scroll up to avast! shield controls;
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.

  1. Run ComboFix. Then, on disclaimer window, click I Agree! button.

[i][size=7pt]- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.

  • ComboFix will scan your computer in stages, total of 50 stages.
    Do not mouse-click around while ComboFix is running.
  • If malware is detected, ComboFix will begin with its removal, and may need to restart Windows.
    Note:If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart your computer.
    [/i]
  1. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt)
    => Attach log report (ComboFix.txt) back to topic.

ComboFix shall also create addition log (typical location: C:\Qoobox\ComboFix-quarantined-files.txt)
=> Please attach that report (ComboFix-quarantined-files.txt) as well.

31

magna86 this morning I uninstalled the Avast programme as well as Google Chrome. I then deleted all there registry entries using regedit as well as some old firefox ones and rebooted… I then reinstalled Avast Premier with Google Chrome browser and all now seems good… Avast seem to be working beautifully and I have just finished a boot time scan and nothing was found.
Do you still want me to go ahead with your instructions?

32

Im going ahead with your instruction magna86 because wouldnt you know it… all shields have magically turned off again. :frowning: I`ll post logs on next reply

33

Im up to step 2 and Im stuck… I have no idea what this means “3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart”

34

Just open notepad and paste there the script lines in code tag. Name that notepad as FixList.txt and save that notepad next to the tool itself.

Run the tool, press Fix button and watch how magic happens. :slight_smile:

35

I`m sorry but what tool are you talking about?

36

Farbar Recovery Scan Tool shorted to FRST
save fixlist.txt at the same place that you saved FRST.exe … then run it and click FIX
FRST will then find the fix and execute the comands written in it … if not saved at same place it will not work

when done it will create a log (fixlog.txt) attach that log

37

Sorry for my confusion guy, here`s the first log

38

Here is the log from ComboFix

39

This still hasnt enabled me to connect my computer... here are two screenshots to show you what Im seeing.

40

When checking today to see if I could connect my computer to my account I got a popup which I`ve attached a screenshot of… Where are we with those logs guys, am I infected and if so, what now?