Following the instructions in the Cleaning Malware sticky, I’ve run the tools recommended and I’m attaching the logs.
I was doing a Google search this afternoon and avast! warned me that it had blocked an attack (I didn’t catch a screenshot of it). Right after that I began getting flooded with emails from one sender, same email, one after the other. Amazingly I’ve had this happen before (!!!), but don’t recall what was done to clean it up - except that I came here.
Also, I haven’t changed anything since this attack, but I did notice that my avast! firewall is off. Windows firewall is on, but I thought that I usually had avast! on. I looked at avast’s firewall log and it was frightening. But I also don’t know what I am looking at… May be fine but thought it worth mentioning.
Thanks!
Avast has a few temp files pending install so mayhap a reboot will fix the firewall. Re the Spam it appears that some one has harvested your e-mail address. Did you enter it on that website ?
After FRST reboots could you let me know if the firewall has started
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {724d43a0-0d85-11d4-9908-00400523e39a} - No File
CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://www.google.com", "https://gmail.com/", "hxxp://torrentz.eu/", "https://www.suntrust.com/portal/server.pt?open=space&name=Login&control=Login&doLogout=&clearsession=true&in_hi_userid=4761300&cached=true", "hxxp://search.conduit.com/?ctid=CT3323878&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP801FCE35-DA1F-452D-BF1F-6E135655B0BD&SSPV=", "hxxp://us.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}"
S2 MCSTRM; No ImagePath
2015-02-12 18:47 - 2014-07-23 14:20 - 00003132 _____ () C:\Windows\System32\Tasks\{32C03748-0A9E-452A-AF9D-CAB82AC19E44}
2015-02-12 18:47 - 2014-02-01 18:18 - 00003132 _____ () C:\Windows\System32\Tasks\{4ACA8325-E9CF-4929-B054-F3E76FC0C4E4}
2015-02-12 18:47 - 2014-02-01 18:12 - 00003132 _____ () C:\Windows\System32\Tasks\{836A4CA2-1838-4A4B-BA0C-CD571AC5EE10}
2015-02-12 18:47 - 2014-02-01 16:10 - 00003132 _____ () C:\Windows\System32\Tasks\{7683C17E-C853-4107-B35B-BC88AB53C150}
2014-03-20 18:19 - 2014-12-16 15:09 - 0000004 _____ () C:\Users\Pat1\AppData\Roaming\E2E667
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
Task: {1C6437BE-D6F0-4A19-810A-EFEDB2780075} - System32\Tasks\{E89D5A31-A697-45E3-BD2E-2B990502BFBF} => pcalua.exe -a C:\Users\Pat1\Downloads\converter.exe -d C:\Users\Pat1\Downloads
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Hi Essexboy,
avast! requested a reboot first thing this morning, so I did that. avast’s firewall is now on and set to Public(?), Windows Firewall is also on - private and public are both on, saying private is connected and public is not. I have a home office with wifi. I guess I’m not sure which way it should be set but I did think Windows OR avast! should be on but not both.
As to the spam, the company is an industry name. I think I probably sent an ‘Unsubscribe’ although I’ve recently stopped doing even that. So not sure.
Ok, I’ve turned Windows Firewall off. avast! firewall is on, set to Public. I’m confused by that. I thought that was for airport, coffee shop, etc. Since I’m home office, I would think that should be set to Private. Or does Public protect it from ‘drive-bys’ and such hacking in?
I did need to re-set Chrome but no biggie. Probably a good thing anyway, did a little housekeeping.
Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe
