Malwarebytes found about 22 infections about a week or two ago… I cleaned them off and rechecked and there was nothing. I checked again today and it found about 40. I can’t think what I’ve been doing other than normal to get these kind of results other than I downloaded Hotspot Shield but I don’t know if that would cause it.
hey and welcome to avast forum.
please follow this guide and attach your logs
http://forum.avast.com/index.php?topic=53253.0
we need the logs from adwclener,mbam,otl and aswmbr.
Monitoring… I see you download a lot of “free” programmes. If you do this always select custom install and untick everything except the main programme
Adw log.
An example of what I mean is shown here http://blog.avast.com/2013/07/09/shady-practices-of-free-download-servers/
Oh f**k, I know exactly what’s causing it now and why its only just started recently… I’m having a heart attack though - it suggests its likely been stealing my personal details. Is there anyway of knowing that from the logs I’m uploading? Irritating malware is one thing but if they’ve stolen my bank details etc its totally another.
Another thing that’s happened recently is my task manager has gone weird - it now only shows this when I press ctrl+alt+del - see below.
OTL log - can’t find an extras.txt one.
Why do you feel you have a data stealer ?
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:OTL
SRV - [2013/05/14 22:57:58 | 000,101,888 | ---- | M] (Freemake) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
IE - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\SearchScopes\{8329A13E-52BC-435A-973E-3F941A20C25B}: "URL" = http://www.mysearchresults.com/search?c=2402&t=01&q={searchTerms}
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ytfmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
2013/05/18 16:51:27 | 000,000,000 | ---D | M] (MixiDJ Toolbar) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\ffxtlbr@mixidj.com
[2013/02/17 11:04:43 | 000,093,072 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\canitbecheaper@trafficbroker.co.uk.xpi
[2013/06/09 20:52:54 | 000,004,525 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2013/07/23 21:37:45 | 000,014,938 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
[2013/07/19 21:57:46 | 000,223,750 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013/07/31 10:01:06 | 000,824,302 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/06/14 11:24:57 | 000,000,000 | ---D | M] (TS Magic Player) -- C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\APPLICATION DATA\TORRENTSTREAM\EXTENSIONS\FIREFOX\MAGICPLAYER@TORRENTSTREAM.ORG
[2013/05/16 15:48:16 | 000,000,000 | ---D | M] (Freemake Youtube Download Button) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX\YTFMDOWNLOADER@GMAIL.COM
O2 - BHO: (no name) - {7825CFB6-490A-436B-9F26-4A7B5CFC01A9} - No CLSID value found.
O3 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O15 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..Trusted Domains: vizzed.com ([www] * in Trusted sites)
[2012/06/08 22:03:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_019
[2013/01/05 20:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_031
[2012/06/08 21:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\Complitly
[2013/01/05 20:54:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\PriceGong
:Files
C:\Documents and Settings\All Users\Application Data\Freemake
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
I only feel I could have a data stealer because that article you linked to suggests these sites you’ve been telling me about steal data. Its not that I think I have, I’m just concerned about the possibility. I have no evidence or reason for feeling it other than the article.
Aswmbr log attached.
Here’s the log from the fix you told me to do :).
How is the computer behaving now ?
Not to be rude but it was ok before and its ok now (it does seem quicker though), it was just that I happened to find loads of malware during a scan.
I also ran an avast scan which showed up nothing except it couldn’t scan some files - flashplayer ones - but that is quite typical.
My biggest problem is task manager is still weird. See the attached picture - when I press ctrl+alt+del I don’t get the usual screen. - Sorry fixed that now - saw how to do it on a youtube video. The computer seems much quicker btw.
No problem, speed and internet should increase not that all the adware stuff has gone. Otherwise it was clean
I wasn’t quite sure what you meant before about task manager, but I now realise you were in minimal mode
Hopefully bitmeter should normalise a bit too. I had noticed it was a bit high lately, maybe due to the adware.
I ran a new Malwarebytes scan - it reported clean.
Thanks for your help.
Subject to no further problems
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands [resethosts] [emptytemp] [CLEARALLRESTOREPOINTS] [Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
Run AdwCleaner and press uninstall
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
If you use on-line banking then as an added layer of protection install Trusteer Rapport
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe
Is there any way of getting rid of these rubbish files - I have no idea what they contain but there’s loads of them (see attached picture).
The OTL folder should disappear once you run the OTL cleanup. All the others are related to windows updates and can be safely deleted
The _OTL folder didn’t delete?
I ran filohippo and I’ve been able to update everything except for NVIDIA - when it goes to checking system compatibility it says it couldn’t find compatible graphics hardware.
Also filohippo can’t find Flash Player 11.8.800.129 Beta (IE) nor Flash Player 11.8.800.129 Beta (Non-IE) to update those.
The flash players are beta versions so it will only find RTM versions
Delete the _OTL folder manually
What should I do about NVIDIA - when I right click on certain files - videos etc - I get a NVIDIA error message - see picture below.
Also I have a problem with windows update - see second picture.