Can anyone help me? D:

Viruses and worms
1

I was offline for like 2 days when I came back on my PC. That day my skype started to act weird. So I logoff and then it didn’t let me log in. It said I was already log in. So I opened my other skype account and it worked weird and same happened here too. The whole pc was slow so I decided to check it with avast. It said there’re some infected files in system32 and it was JS:addlyrics-BD [adw]. I googled it but I felt quite lost with those random file name. So if anyone could help me right now.

Thanks!

Also. I’m writing from my 2nd pc so I left my infected one closed.

2

follow instructions and attach logs (not copy and paste) from Malwarebytes / OTL http://forum.avast.com/index.php?topic=53253.0

3

Malwarebytes log attached

4

Wait! Sorry. I forgot it’s in foreign language now. I’ll upload it again!

5

no problem as any malware is international ;D

and nothing dagerous seen there …only PUP
PUP = not virus / Possible Unwanted Program

6

Really?
I was searching about this virus and it said that it duplicates itself or something and renames so the avast doesnt recognise it and heard that it might come back after scanning and restarting your pc too :o
It looks like I got rid of that already in avast then…
I guess I was just panicking too much. :smiley:

7

not over yet…we need the OTL log first

8

Here! Btw there was a cmd window that opened while scanning. it typed something like C:/[some directory]/[some directory]/ cmd.txt
Did it have to do anything with scan?

9

Yes…

Log experts are notified…should be here soon

10

Hi,

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

[*]Click on the Scan button.
[*]After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

[*]After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
[*]Post logfile will also be saved in the C:\AdwCleaner folder.

====================================================

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

11

Did the scan really got that quick?
I’m on the pending part. “Please uncheck elements you don’t want to remove.”
Is that the “press the clean button” part?

12

Yeah, press Clean.

Then post that log (After Reboot)

13

Here.

14

I accidently unchecked one file. Here’s the log with that one if it helps. :confused:

15

And here’s the FRST log.

16

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Reja\AppData\Roaming\CamLayout.ini
C:\Users\Reja\AppData\Roaming\CamShapes.ini
C:\Users\Reja\jagex_cl_runescape_LIVE.dat
C:\Users\Reja\random.dat
C:\Users\Reja\AppData\Local\Temp
cmd: ipconfig /flushdns

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Your PC seems clean, tell me how are the things now?

17

Everything seems normal now as always but after my PC restarted a random map named with japanese symbols (maybe because i set the language so I could read some foreign programs normally) And I’m pretty sure it wasn’t there before. (untitled picture shows it) And those folders on the picture have nothing inside at all… (33 folders, 0 bytes)

18

I think it is related to FRST, we’ll clean that tool…

You can delete that strange simbols folder :slight_smile:

Final check:

Please download aswMBR and save it to your desktop.

Double click aswMBR.exe to start the tool.

[*]Select Yes if prompted to download the Avast database.
[*]Click Scan
[*]Upon completion of the scan ( Scan finished successfully ) click Save log and save it to your desktop, and post that log in your next reply for review.
Note: do NOT attempt any Fix yet.

19

In the middle of the scan it stops working (it freezes).
I tried that thrice already and it still happens.đ

Everything seems okay…
until service scanning appears
and scanning: service windefend c:\program files [long gap] sys

and then it freezes

20

have you tried to run it from safe mode…