noob with img.virus-analytics.com problem.

I’ve been reading up on the other threads with this issue.
Malewarebytes has been running for about 50 minutes now (163 detected objects, :-), will post logs when it’s done.
Appreciate any help you magic workers can give me.

instructions https://forum.avast.com/index.php?topic=53253.0
we need Malwarebytes and Farbar Recovery Scan Tool logs

Noted.
I’m following everything in the information topic step by step.
But this is a very old computer so I’m afraid it’s going to take all evening :stuck_out_tongue:

that is not a problem for us, you are the one that need to be patient :wink:

Step one done.
Malewarebytes log has been saved. (can’t seem to find a button to attach it to my post though)

Next step
download Farbar Recovery Scan Tool and run that.

Yep… this is going to be a looooooooooooooong night.

This isn’t funny :frowning:
Avast is telling me there’s a suspected Win32:Evo-gen infection in the recommended FRTS download.
So it will not download the file.

Can someone please hand this computer illiterate dumdum a magic wand?

OK temporarily disable webshield for the download

Also if you have YAC and winzipper uninstall them

Didn’t even know I had winzipper on this computer (note to self: kick husband)

FRTS finally downloaded and running. Time for the next cup of coffee.

Wow that FRTS already done. (and I haven’t even finished my coffee yet)

3 files attached as I have just spotted the “Attachments and other options” link faceplam

This should shut Avast up :slight_smile:

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM\...\Run: [TQ566808] => "D:\Setup.exe" CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION URLSearchHook: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 - (No Name) - {87775fdb-6972-41f9-ae51-8326e38cb206} - No File SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1418204098&from=wpm12103&uid=WDCXWD800JD-08LSA0_WD-WMAM9993939839398&q={searchTerms} SearchScopes: HKLM -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms} SearchScopes: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3318522&octid=EB_ORIGINAL_CTID&ISID=M175C56E1-FEC8-46F8-A782-583BE33B9F41&SearchSource=58&CUI=&UM=6&UP=SP19CCE90B-0A90-4C2D-B7FD-A508C31DCF78&q={searchTerms}&SSPV= SearchScopes: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&affID=119776&babsrc=SP_ss_din2g&mntrId=CCB8001125F62A3A SearchScopes: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=9FD68ED3-947A-4E91-9659-386D5CEC25E1&apn_sauid=22209C5E-0E18-4381-A023-9F467995AAD4 SearchScopes: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1418207308&from=wpm12103&uid=WDCXWD800JD-08LSA0_WD-WMAM9993939839398&q={searchTerms} SearchScopes: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms} BHO: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> No File BHO: No Name -> {30F9B915-B755-4826-820B-08FBA6BD249D} -> No File BHO: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> No File Toolbar: HKLM - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File Toolbar: HKU\S-1-5-21-1031799237-3048246782-3081559175-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\delta-homes.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\omiga-plus.xml R1 iSafeKrnl; C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys [215336 2015-01-15] (Elex do Brasil Participações Ltda) S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [40744 2015-01-15] (Elex do Brasil Participações Ltda) R1 iSafeKrnlKit; C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys [83112 2015-01-15] (Elex do Brasil Participações Ltda) R1 iSafeKrnlMon; C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [34856 2015-01-15] (Elex do Brasil Participações Ltda) R1 iSafeKrnlR3; C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys [63400 2015-01-15] (Elex do Brasil Participações Ltda) R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [44712 2015-01-03] (Elex do Brasil Participações Ltda) 2015-01-15 15:21 - 2015-01-15 07:51 - 00040744 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys 2015-01-15 15:21 - 2015-01-03 09:56 - 00044712 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys 2015-01-15 15:20 - 2015-01-15 15:20 - 00000000 ____D () C:\Users\ERIK\AppData\Roaming\Elex-tech 2015-01-15 15:20 - 2015-01-15 15:20 - 00000000 ____D () C:\Program Files\Elex-tech 2015-01-15 15:17 - 2015-01-15 15:17 - 00000000 ____D () C:\Users\ERIK\AppData\Local\Temp{E4902334-66CF-40A8-900B-FCB27255EA09} 2015-01-19 22:14 - 2014-12-10 10:36 - 00000000 ____D () C:\Program Files\WinZipper 2015-01-19 20:27 - 2014-07-03 12:31 - 00000000 ____D () C:\Program Files\SupTab 2011-12-17 12:54 - 2011-12-17 12:54 - 0003584 _____ () C:\Users\ERIK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-05-19 10:43 - 2014-05-19 10:43 - 0000000 _____ () C:\Users\ERIK\AppData\Local\{1423F22B-73EE-4540-B182-A7C00E0607D3} Task: {37BEC0A2-891A-47A4-BFD0-29B7DEF39D19} - System32\Tasks\EPUpdater => C:\Users\ERIK\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION C:\Program Files\Elex-tech C:\Users\ERIK\zylomgamesplayer.dll EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

Run FRST and press Fix On completion a log will be generated please post that

Finally done with that one.
log is attached.

Can it hurt if I wait with the rest of the proses until tomorrow?
I’ve been up for about 20 hours and I really would like to get some sleep.

AdwCleaner downloaded en run without problems.
Apparently it found a whole lot of stuff I didn’t even know was there.

How is the computer behaving now ?

Can’t remember the last time it ran this smoothly.
Not a single problem all day.

Thank you so very much :-*

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

I’ll implement the suggested programs and keep an eye on things.
Thanks again for all the great help.

This dumbdumb is now smart enough to come straight here if she gets into trouble again ;D

Glad I could help :slight_smile: