So I made a topic in the wrong place under a different name, but I was told it was ok and I could continue.
But now I think the topic was deleted or something. I’ll post the logs again. Please help I need this computer healthy.
Also the last think I was told was to run farbar with this fixlist.txt and attach the log, but I don’t remember what I was told to do after that.
If you can post some general information about the problem you are experiencing. Please don’t do anything further until one of the specialists can take a look.
I will try to have one of the malware removal specialists take a look at your logs.
Is this your thread https://forum.avast.com/index.php?topic=154514.msg1124192#msg1124192
Are the alerts still appearing
yes I’m pretty sure thats my old thread, but I cant go to it I get an error. Yes I’m still getting alerts and I’m starting to get these random advertisements and stuff that I’ve never had before.
I’m getting alerts from avast with these urls in formats like this
http://puu.sh/aAsnk/379f250a33.png
http://puu.sh/aAspW/eb3b6f05ea.png
and i can post the long list of urls if you need me to.
When I scan I usually don’t find anything and when I do it still happens when I quarantine or remove.
the ads are popping up all over my browser and turning random words into hyperlinks. and everytime I click on a normal link it sends me to something like mavoo.net before going to what I actually intended.
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKU\S-1-5-21-1057524887-1116411116-517451733-1000\...\MountPoints2: {58ec0046-5f54-11e3-ae9f-806e6f6e6963} - D:\Run.exe CHR Extension: (save on) - C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki [2014-06-15] CHR Extension: (save on) - C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki\2.14 [2014-06-15] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION S3 X6va021; \??\C:\Windows\SysWOW64\Drivers\X6va021 [X] S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X] 2014-09-10 07:53 - 2014-06-15 23:14 - 00000000 ____D () C:\Program Files (x86)\SaaVe! on 2014-09-09 18:56 - 2014-06-19 01:07 - 00000000 ____D () C:\Program Files (x86)\osu! EmptyTemp: 2014-08-14 14:05 - 2014-08-14 14:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 C:\Users\Truong\jagex_cl_oldschool_LIVE.dat C:\Users\Truong\jagex_cl_runescape_LIVE.dat C:\Users\Truong\random.dat C:\Users\Truong\AppData\Local\Temp\CD50.tmp C:\Users\Truong\AppData\Roaming\Curse Client\Bin\Curse.SocketMessages.dll CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.
this is the one I got after the fix thing
AdwCleaner v3.310 - Report created 13/09/2014 at 12:25:41
Updated 12/09/2014 by Xplode
Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
Username : Truong - TRUONG-PC
Running from : C:\Users\Truong\Desktop\Wormkilling\AdwCleaner.exe
Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Program Files (x86)\Adblocker
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\Truong\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Truong\AppData\Local\torch
Folder Deleted : C:\Users\Truong\AppData\Roaming\1H1Q
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\RegisteredApplicationsEx
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}
***** [ Browsers ] *****
-\ Internet Explorer v11.0.9600.17280
-\ Google Chrome v37.0.2062.120
[ File : C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Extension] : cbkgnpnhfcgkbcbjdcmbalijalplechk
Deleted [Extension] : ghgbkaokckgmhoefenegnlbmbniifckb
Deleted [Extension] : jgnlkodlamnapglkdgihhboejhbfciki
AdwCleaner[R0].txt - [4437 octets] - [13/09/2014 12:24:48]
AdwCleaner[S0].txt - [4359 octets] - [13/09/2014 12:25:41]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4419 octets] ##########
Is that what you needed?
And the advertisements are getting worse and worse
Could you screenshot the Avast alert please as there is a lot more information there
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
- IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
- Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
- Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
- If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
well this is the log and this is a puush of what the alert looked like, but that alert doesn’t pop up anymore, the ads are gone,
but all my extensions and bookmarks are gone too. I think this might have fixed it.
http://puu.sh/aAspW/eb3b6f05ea.png
How do I know for sure if my computer is ok now?
Also, my ad blocker is gone. Does that mean ad blocker was the problem? I shouldn’t get ad blocker anymore?
Comodo dragon was the problem
The alert I was after was the one that pops up on your desktop as that tells me what programme was causing the alert
Adblocker should be OK
How is the computer now ?
It seems okay. So I can get adblocker again? I don’t remember seeing anything called comodo dragon lol
So adblocker is ok to get? And everything seems ok right now. I don’t even know where comodo dragon came from
No Dragon was probably bundled with another programme and it did not show on my initial scan
Yes Adblocker should be OK to re-install
Subject to no further problems 
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Click Start then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
In the box copy/paste the following command:
ComboFix /Uninstall
Note that there is a space between " ComboFix " and " /Uninstall " .
Then click OK (or press Enter ).
Wait for the uninstall process to complete.
Download and run Delfix
https://dl.dropboxusercontent.com/u/73555776/delfix.JPG
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent install this programme to lock down and prevent crypto ransome ware
https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG
Update and run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe 