Still having problems
yesterday had multiple instances of chrome.exe (when not running chrome) in task manger
thye popped up & when away when vieing youtube w/IE as I recall
I disabled all google add-ins/EXT & removed all tasks except avast emergency updater- and then I could not repeat the issue
but it seems I saw some other odd process- which I have not seen again as I ran browers & retested
updated and re-ran malwarebytes- it reports nothing
_ i am currently using other PC
_thought I saw pop-ups again- but cannot repeat it
_Avast seem to be having difficulty running scan- very slow - not completing as expected
_ have downloaded all tools from instructions page to prep for more agressive troubleshooting
_most recent net framework updates will not install (attempted twice w/reboot in between- but net framework updates often an issue for this PC)
_ I have restore points back to early Nov & backup of data prior to issues
_ is it time, most effective use of time to restore from restore point or restore partitian?
is this AvastEMUpdate.exe - a valid task?
i do not see it on my other PC - both running Avast Free
i see a lot of speculation about it on the web
“C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe”
Avast reported last definition update on the 9th
_allowed me to update manually- current version 1/10/2013 8:22 am 130110-0
definitions show as current 10th
_ allowed me to run manual program update
prgram shows as current 7.0.1474
RE: Chrome.exe per info on web i am running a search for chrome.exe and so far
C:\Program Files\Google\Chrome\Application
Chrome.exe
old_chrome.exe
C:\Windows\perfech
CHROME.EXE-06157C0F.pf
CHROME.EXE-06157C12.pf
CHROME.EXE-06157C13.pf
CHROME.EXE-06157C16.pf
the pop-ups are on my lpatop also
I have not being using it much, not downloaded vaudix or ANYTHNG else
HOWEVER the PC’s are on the same router/ISP connection & i have used logmein to control one through the other at times
both PC had a homepage of marketplaceleaders.org which did get infected and Avast reported a Blocked threat, which i reported to the site owner… and it may have been itrjmp.com-n they cleaned it & then got reinfected
I niotce from new OLT report (60 day period) I installed Vaudix in mid Nov vs mid Dec and it was mid-lae Dec when I noticed pop-ups on the desktop
now i think this is a drive by infection… unless it is smart enought to infect one PC from the other via shared connection & collected login
seems to me… more likely that Avast blocked a known threat and anohter unknown got through- esp since marketplaceleaders seemed to have a devil of time ridding it form their site. had it a number of days… then clean… then back… then clean… or not.
I am going to contact them to see what they know.
I am renning new set of logs.
Please advise iit you have given up on me due to what you consider a violation of not following directions.
Thank you… I am at the end of my rope this infection is simply icing on my current life cake which is and has been almost impossible since May 2012.
I left a voicemail & email/contact w/marketplaceleaders.org explaining the issue (they were closed for the day), tht their site is hte common denominator for my PC’s, and asking for any info from them or their webmaster that may help in cleaning this off… and come to think of it… if an unknown driveby how Avast can update to defend users.
LOL… the contact form replies with “Please find a free download on “Hearing God” as a thank you gift to you for your interest and support of Marketplace Leaders.” Umm LMAO… I think I will pass on that download & just tune in to God w/o extra help
LOL. at least i still have my sense of humor- a small miracle… with that and God’s grace… and your help … this too will pass and hopefully others will benefit from our experience… and my apologies if you are not of a similar world view… i.e. God etc has a way of annoying many and i respect that many feel that way… to each his own said the old lady as she kissed the cow
OK - Back later with reports - I will do desktop first, since I am in progress there… but will as advised note which is which.
ok… maybe PC2 is not infected but seeing legitimate 3rd party advertisements
this is (so far) the only page where i see them …and i opened various pages & refreshed to try to inspire them to appear http://hit-country-music-lyrics.com/brooks-and-dunn-believe-lyrics.html
firebug exam of the code shows
“porch swing”
very different form the i.trkjmp.com coding & link that I saw on the other PC…and on the other PC is affected many pages - every page it think, not just one.
can you (LOL) do you dare… check out the brooks & dunn page (one i had in my favorites from years ago)
LOL i went there for a little injection of faith… 9vs malware) & saw the pop-ups and assumed the worst
i pray i was wrong and PC2 is clean
but i am going to proceed to run the tools & upload the logs… invoke murphy’s law that if i invest all that time… it will turn out to be unneeded waste of time to troubleshoot a clean PC!
so is that their own handi-work or have they been hacked… do i let them know?
how strange that i pick one old link out of hundreds? in my favorites and it is infected?
man God’s people are really under attack!
the brroks & dunn song & marketplaceleaders.org are both “Christain” resources
LOL. so it is not just me… looks like Satan’s hackers are making the rounds… God’s people must be cutting into his business! Gee… given the state of the world i thought Satan was way ahead!
LOL… they say the more one is attacked… the greater good difference one is making in the world.
LOL… maybe i need to takea break and do a little sinning
thanks for the site check
please advise if I should let them know that they are infected.
PC-1 seemed to bog down on 2nd attempt w/ aswMBr - i could not fully clear the screen saver and forced a reboot
took it offline
then set Avast boot time scan of C & D (recovery partition)
it is now runing boot scan
tomorrow once complete i will check report & re-attempt aswMBR
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
:OTL
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKU\S-1-5-21-424000380-4067286613-1435711853-1006..\Run: [Rohos] E:\agent.exe File not found
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
PC-1 still running boot time scan D: completed, C: @ 25%
PC2 after OTL fix log attached
cannot tell yet if it is running any better or worse
it is older under resoourced machine & I have not been using it much over the last 6 weeks due to bad backlight requiring shifting monitor between PCs or logmein connection (which is slow)
PC-2
yes i will run defrag.
i ran checkdisk, defrag and i thought disk cleanup & marcrium back-up full image earlier this week on this pc
any signs it was compromised by malware- need for password changes or was it only junk?
i thought it was clean (slow but ran properly, as expected) until i saw pop-ups on the Brooks & dunn page.
