system
September 5, 2014, 2:54am
1
I obviously have this really annoying virus on my laptop and have no idea how to remove it. I got so frustrated and deleted google chrome bc the popup says- C:/Users/Owner/…/chrome.exe I’ve also done a full scan using Malware twice. I really need to get rid of it, it’s slowing everything down and using a lot of memory.
Do people pay computer techs to remove these viruses? Is there any way to remove it myself without making it worse? I’ve never had to deal with this before.
Any help or advice would be great! I attached a pic of the popup I keep getting.
Thanks!
Asyn
September 5, 2014, 4:28am
2
Attach your basic logs. (MBAM, FRST and aswMBR…!!)https://forum.avast.com/index.php?topic=53253.0
system
September 6, 2014, 9:55pm
3
Here are all the logs you requested. I ran all 3, Malwarebyte, Farbar and aswMBR
OK lets get at it
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKLM-x32\...\Run: [ospd_us_64] => [X]
HKLM-x32\...\RunOnce: [upospd_us_64.exe] => C:\Users\Owner\AppData\Local\ospd_us_64\upospd_us_64.exe [3341304 2014-08-26] ()
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://www.searchqu.com/web?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://www.searchqu.com/web?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL =
SearchScopes: HKLM-x32 - DefaultScope {96F5FAF9-A35D-4A22-A398-EF7AE664EAC0} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://www.searchqu.com/web?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A59} URL = http://search.imesh.com/webResults.html?src=ieb&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKCU - {70BA3E6B-1059-2266-0B2C-40E4A85231B8} URL = http://www.ddlstart.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=750&product_id=872&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.5.0&install_country=US&install_date=20120817&user_guid=846954C9441147C2AE9C318A617C730E&machine_id=abcb7f740fbb3c59b7f39aad63c5b0d1&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source}
SearchScopes: HKCU - {70DA5742-A299-4109-A915-B0D20983A4B4} URL = http://searchya.com/?chnl=ft-106&s=1&cr=1407669560&cd=2XzutAtN2Y1L1QzuzytDyE0C0EyDtBtBzy0A0EyD0B0B0Bzy0CtN0D0TzutBtDtCtBtDtAtDtC&q={searchTerms}
SearchScopes: HKCU - {96F5FAF9-A35D-4A22-A398-EF7AE664EAC0} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298580&CUI=UN18709078055864317&UM=2&UP=SPD5B9E287-7460-4779-BFC6-50AD593423FE&SSPV=
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://www.searchqu.com/web?src=ieb&appid=101&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A59} URL = http://search.imesh.com/webResults.html?src=ieb&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKCU - {A09AAC21-A171-4894-A7D7-0FF38BA8BF95} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_tuto7_14_31&cd=2XzuyEtN2Y1L1QzuzytDyE0C0EyDtBtBzy0A0EyD0B0Bzy0CtN0D0Tzu0SzyyByDtN1L2XzutAtFtBtFtCtFtDtN1L1Czu1N1C2X1V2Z2Y2Z1FyB1VtCyE1VtAtCtN1L1G1B1V1N2Y1L1Qzu2SyEyE0AtBtCtD0D0CtG0A0DzzyBtGyC0ByDyCtGyD0DyEyCtGyBtBtBzy0EyB0D0A0D0AyC0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0BtB0F0C0B0CzyzztG0CyC0DyCtGyEyCtAtAtG0B0A0CyBtGtDtCyDtC0DyE0CtByDyDzzyE2Q&cr=1875530785&ir=
SearchScopes: HKCU - {A531D99C-5A22-449b-83DA-872725C6D0ED} URL = http://search.alot.com/web?q={searchTerms}
SearchScopes: HKCU - {B5D51704-5854-4304-B4F4-D39888C72968} URL = http://nova.rambler.ru/search?query={searchTerms}&utm_source=r33&utm_medium=distribution&utm_content=e09&utm_campaign=c01
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80117&lng=en
SearchScopes: HKCU - {D07A2116-FEA3-4EDD-89D2-EDDBACA8DA5D} URL = http://www.mysearchresults.com/search?c=4003&t=01&q={searchTerms}
SearchScopes: HKCU - {E3F09922-816A-44DF-AA2A-5DD093205CCD} URL =
BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
BHO-x32: No Name -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File
BHO-x32: Yealt Class -> {40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} -> C:\Windows\SysWow64\yealt.dll (Yealt)
BHO-x32: No Name -> {474597C5-AB09-49d6-A4D5-2E8D7341384E} -> No File
BHO-x32: No Name -> {85F5CF95-EC8F-49fc-BB3F-38C79455CBA2} -> No File
Toolbar: HKLM - No Name - !{61539ecd-cc67-4437-a03c-9aaccbd14326} - No File
Toolbar: HKLM - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM - No Name - !{A531D99C-5A22-449b-83DA-872725C6D0ED} - No File
Toolbar: HKLM - No Name - !{D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - !{61539ecd-cc67-4437-a03c-9aaccbd14326} - No File
Toolbar: HKLM-x32 - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM-x32 - No Name - !{A531D99C-5A22-449b-83DA-872725C6D0ED} - No File
Toolbar: HKLM-x32 - No Name - !{D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Toolbar: HKCU - No Name - {981E53BA-6DF4-4D99-8C33-6C398F5C139E} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF Extension: Babylon - C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2012-10-28]
FF Extension: DealPly - C:\Program Files (x86)\Mozilla Firefox\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2013-02-14]
FF HKLM-x32\...\Firefox\Extensions: [{3C5F0F00-683D-4847-89C8-E7AF64FD1CFB}] - C:\Program Files (x86)\RelevantKnowledge
FF HKLM-x32\...\Firefox\Extensions: [ntfdsaftsfdfdxx@mozilla.org] - C:\Users\Owner\AppData\Roaming\iPumper\extension_firefox.xpi
CHR HKLM\...\Chrome\Extension: [geggofhlfbcmanadhknllmlajiafopoh] - C:\Program Files\PrivacySafeGuard\pschrome_bunndle-c1_1_0.crx [2012-05-03]
CHR HKCU\...\Chrome\Extension: [ahilkiibpgjnonbhdfkkgjddddmapala] - C:\Users\Owner\AppData\Local\CRE\ahilkiibpgjnonbhdfkkgjddddmapala.crx [2012-05-03]
CHR HKCU\...\Chrome\Extension: [bpfboklmeiefoedekjeigdcnfbpjeaii] - C:\Users\Owner\AppData\Local\CRE\bpfboklmeiefoedekjeigdcnfbpjeaii.crx [2013-08-28]
CHR HKCU\...\Chrome\Extension: [gelpfbcidpeeelkmkjbofkcpihkcachn] - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\yealt.crx [2013-08-28]
CHR HKCU\...\Chrome\Extension: [ggamifejnddpoocdmadhjdbgaijnphdi] - C:\Users\Owner\AppData\Local\CRE\ggamifejnddpoocdmadhjdbgaijnphdi.crx [2013-08-28]
CHR HKLM-x32\...\Chrome\Extension: [ahilkiibpgjnonbhdfkkgjddddmapala] - C:\Users\Owner\AppData\Local\CRE\ahilkiibpgjnonbhdfkkgjddddmapala.crx [2013-08-28]
CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\Owner\AppData\Local\Temp\ccex.crx [2013-08-28]
CHR HKLM-x32\...\Chrome\Extension: [bpfboklmeiefoedekjeigdcnfbpjeaii] - C:\Users\Owner\AppData\Local\CRE\bpfboklmeiefoedekjeigdcnfbpjeaii.crx [2013-08-28]
CHR HKLM-x32\...\Chrome\Extension: [geggofhlfbcmanadhknllmlajiafopoh] - C:\Program Files\PrivacySafeGuard\pschrome_bunndle-c1_1_0.crx [2012-05-03]
CHR HKLM-x32\...\Chrome\Extension: [ggamifejnddpoocdmadhjdbgaijnphdi] - C:\Users\Owner\AppData\Local\CRE\ggamifejnddpoocdmadhjdbgaijnphdi.crx [2012-05-03]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-06]
CHR HKLM-x32\...\Chrome\Extension: [hjakmojkcnhgipgkkbiempkfdndcnlah] - C:\ProgramData\wxDfast\hjakmojkcnhgipgkkbiempkfdndcnlah.crx [2014-09-06]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-05-29]
CHR HKLM-x32\...\Chrome\Extension: [kekfoodhbhpjhjcdecjngamojfhknooc] - C:\Users\Owner\AppData\Roaming\iPumper\extension_chrome.crx [2012-05-29]
CHR HKLM-x32\...\Chrome\Extension: [koalekbhpbggkcfhkkbolikjoaobbppi] - C:\Program Files (x86)\PutLockerDownloader\PutLockerDownloader10.crx [2012-05-29]
CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\Owner\AppData\Local\Temp\crx1AF2.tmp [2012-05-29]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup 3.0\SymcPCCULaunchSvc.exe [132504 2013-03-28] (Symantec Corporation)
2014-09-05 18:32 - 2014-09-05 18:32 - 00000000 ____D () C:\Users\Owner\AppData\Local\Google
2014-09-02 15:07 - 2014-09-02 15:07 - 00000000 ____D () C:\Program Files (x86)\predm
2014-09-01 11:00 - 2014-09-06 16:43 - 00000000 ____D () C:\Users\Owner\AppData\Local\ospd_us_64
2014-09-01 10:59 - 2014-09-01 11:04 - 00000000 ____D () C:\Users\Owner\AppData\Local\Idle~_~Crawler
2014-09-01 10:59 - 2014-09-01 10:59 - 00004586 _____ () C:\Windows\System32\Tasks\Idle~_~Crawler Runner
2014-09-06 16:40 - 2011-11-08 16:40 - 00000410 _____ () C:\Windows\Tasks\PC Optimizer Pro64 startups.job
2014-09-06 16:40 - 2011-03-13 12:06 - 00000440 _____ () C:\Windows\Tasks\PCConfidential.job
2014-09-06 16:40 - 2010-03-21 21:58 - 00000000 ____D () C:\Users\Owner\AppData\Local\SoftThinks
2014-09-06 16:40 - 2010-03-21 21:58 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-09-06 16:40 - 2010-03-21 21:58 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
Task: {0A99481D-6DDB-40BE-87A5-6E9D8F9081EC} - System32\Tasks\PCConfidential => C:\Program Files (x86)\Winferno\PC Confidential\PCConfidential.exe
Task: {16213882-A0A6-42EA-A96F-C75A80F2B29B} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-4130820766-3150040946-1314965248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {2161EEFC-59A6-4E62-9375-AEE6A1687D83} - \BitGuard No Task File <==== ATTENTION
Task: {221C9210-8CFB-4F1B-881A-0B0E9549F7B9} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4130820766-3150040946-1314965248-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {2B228F57-6995-4BD2-BF00-B974597542AE} - System32\Tasks\DSite => C:\Users\Owner\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {2C956258-838D-46F8-8298-3204F73AA08E} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {36D5C9E5-AA06-4DE7-8289-7BE3CB117ED6} - System32\Tasks\Idle~_~Crawler Runner => %LOCALAPPDATA%\Idle~_~Crawler\Idle~_~Crawler.exe <==== ATTENTION
Task: {3D170138-C9A9-44FC-A106-B545DE6B6F7E} - System32\Tasks\PC Optimizer Pro64 startups => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: {5311C0F6-D973-402A-8F05-48D994BBCCD8} - System32\Tasks\{2423EB41-C1D0-4AA4-8A06-01AE7AF5C939} => \\localhost\C$\@GMT-2011.02.07-00.09.52\Users\Owner\AppData\Local\Google\Chrome\Application\9.0.597.84\Installer\setup.exe
Task: {8339358D-AF7F-4172-BA9B-7F8C9CEA8269} - System32\Tasks\Escolade => C:\Users\Owner\AppData\Roaming\iPumper\Updater.exe <==== ATTENTION
Task: {9D58C179-17A4-4497-817D-000807297F45} - \DealPlyUpdate No Task File <==== ATTENTION
Task: {A6777070-AA0D-4212-B396-C22A265EF390} - \Groovorio No Task File <==== ATTENTION
Task: {B3C66F9F-E3B4-483F-BC7E-647924F33252} - \DealPly No Task File <==== ATTENTION
Task: {BCAFF4BE-9051-4FA3-A881-6D274A8D73F2} - System32\Tasks\Microsoft\Windows\Maintenance\Idle~_~Crawler Update => %LOCALAPPDATA%\Idle~_~Crawler\Idle~_~Crawler.exe <==== ATTENTION
Task: {D6D0B10E-3FBE-4630-BB84-E661F0C8E5BF} - \ProgramRefresh-ATFST No Task File <==== ATTENTION
Task: {ED4D1D28-D747-4A08-B5F2-82C0DF79EFAA} - \Microsoft\Windows Defender\MpIdleTask No Task File <==== ATTENTION
Task: {F2D87918-1F99-44EA-A95A-237C8A8647AC} - System32\Tasks\Your File Updater => C:\Program Files (x86)\YourFileDownloader\YourFileUpdater.exe <==== ATTENTION
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\PCConfidential.job => C:\Program Files (x86)\Winferno\PC Confidential\PCConfidential.exe
C:\Program Files (x86)\Winferno
C:\Program Files (x86)\YourFileDownloader
C:\Users\Owner\AppData\Roaming\iPumper
C:\Program Files\PC Optimizer Pro
C:\Users\Owner\AppData\Roaming\DSite
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
THEN
Please download AdwCleaner
[*]Close all open programs and internet browsers.AdwCleaner.exe to run the tool.Scan .Ok .C:\AdwCleaner[S1].txt as well.
FINALLY
Run a fresh FRST scan and include the additions
system
September 7, 2014, 5:54pm
5
I completed those steps so here are the new logs. I really appreciate your help. How many more steps until it’s completely removed?
Are you still getting the alerts ?
system
September 8, 2014, 2:30am
7
No I haven’t got any since I finished those last steps this morning.
In that case methinks I will send you on your merry way
Subject to no further problems
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Download and run Delfix
https://dl.dropboxusercontent.com/u/73555776/delfix.JPG
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java this article
I would recommend that you completely uninstall Java unless you need it to run an important software.disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser How to unplug Java from the browser
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent install this programme to lock down and prevent crypto ransome ware
https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG
Malwarebytes
Update and run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe
