Little help please

Viruses and worms
1

Well I was bragging about how well my AVast worked the other day then. Blam I,m hit
I attached a bunch of logs.
Thank you

2

What were you hit by URL:MAL or other malware name, etc. - e.g. do you have a screenshot of the avast alert ?
If you haven’t had another popup or rebooted then right click on the avast tray icon and select ‘Show last popup message.’

EDIT: A malware removal specialist has been informed of your topic.

3

did you also run Malwarebytes?..if you did and nothing detected, no need for the log

if you did not run it, then do so and attach the log https://forum.avast.com/index.php?topic=53253.0

4

Avast showed nothing at all.
In chrome I was getting blasted with pop ups
Ran Malware bites (see log)
Ran fix and next one came out clean
Still getting hammered Ran spyhunter
295 problems Marketsnets was the main one but lots more

5

Right clicked AVAST URL: mal marketsnets chrome

6

Here is screenshot

7

Are the alerts still appearing ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Task: {5B5AFB36-CDA5-4241-B1D3-1BA1221B7774} - System32\Tasks\Default2Check => c:\Users\All Users\dtdata\R003.exe [2014-12-07] () <==== ATTENTION Task: {6D5398F6-E5E2-49E1-A56F-06EADFE60D1F} - System32\Tasks\DefaultCheck => c:\Users\All Users\dtdata\R002.exe [2014-12-07] () <==== ATTENTION Task: {E38A6519-8353-44C5-BB73-00068E738FD7} - System32\Tasks\DefaultReg => c:\Users\All Users\dtdata\R001.exe [2014-12-07] () <==== ATTENTION C:\Users\Mike\.hemsFavorites.dat c:\Users\All Users\dtdata EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

8

Done, rebooting

9

Could you let me know if the popups still appear

10

Opened chrome
Hotmail fine
went to amazon and was blasted again.
Avast did not intervene
I have 2 extra pages open talking to me

11

Windows explorer seems fine with everything ive opened
Just chrome

12

Lets now reset chrome

1.Click the icon that looks like three stacked lines at the top right of the browser window. …
2.Select ‘Settings’ in the drop-down menu. …
3.Click on ‘Show advanced settings’ at the bottom of the Web page. …
4.Select ‘Reset browser settings’ at the bottom of the page.

13

Done
reboot
opened chrome/amazon Roll around ads (labeled) X3

14

Could you fully uninstall Chrome and then run a fresh FRST scan for me please

15

Yes…

16

Done

17

Could you now run this fix, re-install Chrome and let me know how it behaves

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] 2015-02-25 07:28 - 2015-02-25 07:28 - 00000000 _____ () C:\autoexec.bat 2015-02-06 22:49 - 2015-02-25 10:36 - 00002948 _____ () C:\Windows\System32\Tasks\ReclaimerUpdateXML_Mike 2015-02-06 22:49 - 2015-02-25 10:36 - 00000362 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_Mike.job 2015-02-06 22:49 - 2015-02-25 09:35 - 00002952 _____ () C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Mike 2015-02-06 22:49 - 2015-02-25 09:35 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_Mike.job Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

18

All seems well, no problems to report

19

If all is well tomorrow let me know and I will tidy up :slight_smile: