HELP WITH A.marketsnets.com VIRUS!!! 

system · 2015-05-16T16:49:13.000Z

How is the situation now?

system · 2015-05-16T16:52:17.000Z

Still happening… http://a.marketsnets.com/b

system · 2015-05-16T16:54:39.000Z

Google Chrome is problem?

system · 2015-05-16T17:04:43.000Z

Yes, that is what I use most of the time. IE was also having the problem, but I have not checked it. Running zoek now as you specified.

system · 2015-05-16T17:07:24.000Z

Re-run zoek and run this script:

createsrpoint;
autoclean;
C:\Users\Kendyl\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
C:\Users\Kobe\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
emptyalltemp;

system · 2015-05-16T17:10:03.000Z

Ok…it is still running from your last post. When finished I will post that text and then start it again with the new script and post that text.

system · 2015-05-16T17:13:04.000Z

Loaded Profiles: Kevin (Available profiles: Kevin & Kobe & Helen & Kendyl & UpdatusUser)

There is a lot of profiles, they all have to get fix.

system · 2015-05-16T17:21:18.000Z

oK…here is the txt after the first script. Will run it again now with the last script you sent.

system · 2015-05-16T17:24:21.000Z

Yes. I think that it will solve the problem.

system · 2015-05-16T17:47:56.000Z

Ok…here is the last text file

system · 2015-05-16T17:49:19.000Z

Is everything ok now?

system · 2015-05-16T17:52:24.000Z

No…same thing. I’m under chrome and my profile…Kevin. Haven’t checked the others

system · 2015-05-16T17:58:56.000Z

There was probably some malware that hijacks your browsers.

Export your bookmarks
https://support.google.com/chrome/answer/96816?hl=en

Close all Chrome windows and tabs.
Go to the Start menu > Control Panel.
Click Programs and Features.
Double-click Google Chrome.
Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the “Also delete your browsing data” checkbox.

Click Start, copy in search [B]%LOCALAPPDATA%[/B] and remove folder Google

Download Chrome
https://www.google.com/intl/en/chrome/browser/desktop/

Install Adblock Plus
https://adblockplus.org/

system · 2015-05-16T18:53:59.000Z

oK…with all of that and I also installed adblock for IE since I use that occasionally. Not sure what the other family members use for sure.

system · 2015-05-16T18:56:43.000Z

Very good.

The following will implement some post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

system · 2015-05-16T19:05:20.000Z

Ok…that is done. Have not tried chrome or IE to see if either is working yet. Should I do that at this point?

system · 2015-05-16T19:06:46.000Z

kevbaxter23 post:32:

Ok…that is done. Have not tried chrome or IE to see if either is working yet. Should I do that at this point?

Yes.

system · 2015-05-16T19:15:29.000Z

So far looking good at least on my profile! I’m getting notifications to turn ADVAST back on which I will do. It’s also telling me to turn on Windows Defender and update definitions. Should I do that or uninstall it? Should I install any other Malware protection software?

system · 2015-05-16T19:24:56.000Z

You have Microsoft Security Essentials, it’s Antivirus softver. Windows Defender is not Antivirus but also may be turned.
I recommended to use Malwarebytes if you will.
http://www.malwarebytes.org/downloads/

polonus · 2015-05-16T20:04:51.000Z

Read here: http://www.freefixer.com/b/tag/54-244-235-229/
Also here: https://www.virustotal.com/nl/ip-address/54.244.235.229/information/
Server IPs:
54.244.235.229
50.112.103.124

polonus

Announcements