Ho cercato di seguire questo post: https://forum.avast.com/index.php?topic=53253.0
Ho scaricato e utilizzato Malwarebytes Anti-Malware
Ho messo in quarantena e poi eliminato 30 voci
Allego qui il log di Malwarebytes Anti-Malware.
Ho effettuato lo scan con FRST
Allego i due log generati.
Ho effettuato lo scan con aswmbr.
allego il log.
Ma il problema è rimasto! Cosa devo fare?
Aiuto!
Help me, please!
Ecco il log corretto di aswmbr
Please help me!
Please help me!post in english so we understand
Yes, thanks. My browser is full of ads and keeps launching pop up.
I tried and follow the instructions at https://forum.avast.com/index.php?topic=53253.0
I downloaded and made a scan with Malwarebytes Anti-Malware
It found 30 things, i quarantined and deleted
Then i downloaded and made a scan with FRST
Then i downloaded and made a scan with aswmbr.
I attached all the four logs on the first message of this topic.
I also downoaled and run HitmanPro and deleted some other things.
I tried restoring all the browsers (both IE and Firefox, which is the one i use actually).
Nothing seems to work.
Is there anything else i can do to remove this malware?
Let me know if this stops them
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint: DisableService: vseipcrd Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File 2015-04-02 17:39 - 2015-04-02 17:39 - 00000004 _____ () C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-04-02 16:39 - 2015-04-03 02:24 - 00001034 _____ () C:\WINDOWS\Tasks\BSkzB7ROp39QD5KXUFE4Z.job 2015-04-02 16:39 - 2015-04-02 22:19 - 00000000 ____D () C:\Program Files (x86)\fun4us 2015-04-02 16:39 - 2015-04-02 16:39 - 00004040 _____ () C:\WINDOWS\System32\Tasks\BSkzB7ROp39QD5KXUFE4Z 2015-03-31 10:14 - 2015-04-02 23:15 - 00000385 _____ () C:\Users\Roberto\AppData\Roaming\vvoRZdeVQtsNaFaDe 2015-03-31 10:14 - 2015-04-02 23:13 - 00000385 _____ () C:\Users\Roberto\AppData\Roaming\1d3emn3 2015-03-31 10:14 - 2015-03-31 10:14 - 00004387 _____ () C:\Users\Roberto\AppData\Roaming\BSkzB7ROp39QD5KXUFE4Z 2015-03-31 10:14 - 2015-03-31 10:14 - 00004387 _____ () C:\Users\Roberto\AppData\Roaming\8c8OKmEb1DWieCttSZh 2015-03-31 10:14 - 2015-04-02 23:13 - 0000385 _____ () C:\Users\Roberto\AppData\Roaming\1d3emn3 2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Roberto\AppData\Roaming\8c8OKmEb1DWieCttSZh 2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Roberto\AppData\Roaming\BSkzB7ROp39QD5KXUFE4Z 2015-03-31 10:14 - 2015-04-02 23:15 - 0000385 _____ () C:\Users\Roberto\AppData\Roaming\vvoRZdeVQtsNaFaDe 2013-02-19 05:25 - 2013-02-19 05:25 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Task: {7D311723-4C66-415A-B31F-F1CCCAD6669B} - System32\Tasks\BSkzB7ROp39QD5KXUFE4Z => C:\Users\Roberto\AppData\Roaming\BSkzB7ROp39QD5KXUFE4Z.exe Task: C:\WINDOWS\Tasks\BSkzB7ROp39QD5KXUFE4Z.job => C:\Users\Roberto\AppData\Roaming\BSkzB7ROp39QD5KXUFE4Z.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Unlock: C:\WINDOWS\System32\drivers\bwnuyj.sys C:\WINDOWS\System32\drivers\bwnuyj.sys RemoveProxy: CMD: netsh advfirewall reset CMD: netsh advfirewall set allprofiles state ON CMD: ipconfig /flushdns CMD: netsh winsock reset catalog CMD: netsh int ip reset c:\resetlog.txt CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh int ipv4 reset CMD: netsh int ipv6 reset EmptyTemp: CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner by Xplode onto your desktop.
[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.