Help: malware infection or virus

system · 2015-05-12T21:20:19.000Z

I have some kind of malware or virus infection in which the network shield pops up every 20 seconds or so telling me that firefox or chrome are trying to access particular objects (websites). I ran a full scan and came up with nothing. I ran malwarebytes and spybot - search and destroy, and they also came up with nothing. I would include the network shield record… but I don’t know how to access it. I was able to before in an earlier version of the program, but now I can’t find it.

Please advise.

Thank you!

system · 2015-05-12T21:23:10.000Z

Hello,

Please follow this topic and attach required reports

https://forum.avast.com/index.php?topic=53253.0

system · 2015-05-12T21:51:58.000Z

Here are the logs you requested. I should also note that the malware/virus only attempts to open a webpage (which is always blocked by network shield) when I already have a browser open.

system · 2015-05-13T03:08:13.000Z

Quick update: For some reason the malware/virus only spams me when Chrome is open rather than Chrome AND firefox, as was the case before I send all the logs. I’ve had firefox open for a few hours now and not one notification from avasts network shield. Just thought this information might be relevant.

system · 2015-05-13T04:11:24.000Z

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b
bitsadmin /reset /allusers;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

system · 2015-05-13T06:13:45.000Z

Results log-file is attached. Thanks!

system · 2015-05-13T07:33:58.000Z

Re-run zoek and run this script:

createsrpoint;
autoclean;
jfmjfhklogoienhpfnppmbcbjfjnkonk;chr
gighmmpiobklfepjocnamgkkbiglidom;chr
emptyalltemp;
ipconfig /flushdns;b

Post its content into your next reply.

Step 2

CHR dev: Chrome dev build detected! <======= ATTENTION

Chrome installation is altered by malware. Reinstall is needed.

Close all Chrome windows and tabs.
Go to the Start menu > Control Panel.
Click Programs and Features.
Double-click Google Chrome.
Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the “Also delete your browsing data” checkbox.

Step 3

Reinstall your Flash player

https://helpx.adobe.com/flash-player/kb/uninstall-flash-player-windows.html

system · 2015-05-13T16:33:45.000Z

Attached is the zoek log. Chrome was uninstalled and flash was reinstalled. Any idea why firefox stopped spamming me? Is it not able to be converted to developer mode or something?
Thanks!

system · 2015-05-13T16:42:37.000Z

Any idea why firefox stopped spamming me? Is it not able to be converted to developer mode or something?

You probably downloaded some application.

Is everything ok now?

system · 2015-05-13T17:42:52.000Z

I reinstalled chrome, started it, and no pop-ups… No pop-ups from firefox either Thank you so much for your help! I hope my paltry donation pays back at least a fraction of the help you gave me. Sorry I couldn’t give more. I’ll try to be more careful with downloading things in the future.

system · 2015-05-13T18:19:46.000Z

The following will implement some post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

[SIZE=1]The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Announcements