virus

Viruses and worms
1

Hi
Very thick newbie here looking for advice.
I scanned a while ago and avast put something in the chest. I scanned again and it put the same stuff in the chest
so I left it, I’m not in the slightest computer literate, but computer is doing some minor weird things.
scanned again, in general the same thing keeps coming up (as below)
Temp internet files
appdata/local/temp
error 42127
cab archive corrupted
error 42144
ole archive corrupted

I really am hopeless when it comes to technology, computing for dummies is too complicated, I just like them when they work.
I read some of the forum messages but most went over my head. Is there an easy fix? My laptop went in for something similar about a year ago and they said they had to wipe it and re-install but I still had viruses.

2

Hi we will take this a step at a time, if you have any problems at all then stop and ask

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

3

avast is blocking it and putting win 32 in the chest when trying to download

4

right click on avast tray icon (the one by the clock in lower right corner) and pause avast shields

5

I ran farbar and got two logs in notepad but bearing in mind i’m old generation how do I attach and to what.
sorry…your working with a Neanderthal.

6

When you post a reply on the bottom left is a hyperlink (blue) called attachments and other options
Click that
Then click the browse button and select FRST.txt
Then click more attachments to add the additions.txt

7

attachments

8

OK lets now do some cleaning. Two things to do this time :slight_smile:

After both programmes have finished and the computer has rebooted could you let me know of any problems

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: URLSearchHook: HKU\S-1-5-21-1214617793-832907495-2227714228-1000 - (No Name) - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - No File BHO: No Name -> {03EB0E9C-7A91-4381-A220-9B52B641CDB1} -> No File BHO: No Name -> {34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> No File Toolbar: HKLM - No Name - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - No File CHR HKLM\...\Chrome\Extension: [gpiifgmgnfdiblgpaepbmfdkcheicgof] - C:\Program Files\Common Files\Spigot\GC\nta_1.0_0.crx [2014-04-23] CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.1.crx [2013-10-14] CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\J\AppData\Local\Slick Savings\coupons.crx [2014-05-19] CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2012-11-22] 2015-01-13 10:00 - 2015-01-13 10:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2 AlternateDataStreams: C:\Mark:zylomtest AlternateDataStreams: C:\Mark:zylomtr{00013KEU-UKQE-K6V0-70L9-2A8RJ1B4CVVG} EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

9

It was all going so well, slowly but well.
I have 3 lists/logs the two i generated ( frst and addition) and the copied fixlist all in downloads place but no FRST.exe
so i think i may have done something wrong.

10 
When you created the first logs for essexboy you downloaded and run frst.exe ...... from where did you run it?

fixlist must be located at same place as you have frst.exe

11

Hi
It was on the bottom taskbar then disappeared, I downloaded again and the new one is again on the bottom taskbar whereas my fixlist is in downloads, I’m really not very good at this.

12

I am guessing it is in your download folder

13

oh…yes it is, well the new one is, so how do i get the tool and my fixlist in the same location within downloads?
This must be so frustrating for you guys.

14

Right click the fixlist … select cut then go to download folder …right click inside the folder and select paste

Are they at same place now?

15

ok…they are in the downloads folder, when I double click FRST.exe and the box comes up I hit fix and it says it cant find fixlist.

16

fix log result I think

17

2nd attempt, this should be the fixlog.

18

You see how easy that was :smiley: … now you wait for essexboy

19

That’s the one :slight_smile:

nicely done so far

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

20

Right erm I’ll try this…