ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆ Anvilpoint CyberOps - Hacker for Hire ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Parent's Computer Infected with adware, Still Infected

New Reply 
Infected 

Parent's Computer Infected with adware, Still Infected
Sennheiser
Guest
 
Jul 22, 2015 01:59 PM
does bleeping computer get ads normally?

If so, I think it is all good now
Knautschtabak
Knautschtabak Offline
I eat malware for breakfast
***
HF Ub3r
Posts:
2,459
Threads:
3
Credibility:
000
Popularity:
127
βytes:
β 0
Game XP:
5
Jul 22, 2015 02:02 PM
(Jul 22, 2015 01:59 PM)Sennheiser Wrote:  does bleeping computer get ads normally?

If so, I think it is all good now

It should not show ads. And as I said, we are not done.
Sennheiser
Guest
 
Jul 22, 2015 02:10 PM
(Jul 22, 2015 02:02 PM)Knautschtabak Wrote:  It should not show ads. And as I said, we are not done.

ok

ill run another frst scan so we can have updated logs

Additions: http://pastebin.com/RSCsCtxH

FRST: http://pastebin.com/H3tNwFHg

sorry, here is the fixlog as well http://pastebin.com/jwZLEajM
Knautschtabak
Knautschtabak Offline
I eat malware for breakfast
***
HF Ub3r
Posts:
2,459
Threads:
3
Credibility:
000
Popularity:
127
βytes:
β 0
Game XP:
5
Jul 22, 2015 10:55 PM (This post was last modified: Jul 22, 2015 10:56 PM by Knautschtabak.)
Sennheiser, this what normal advertisment on bleepingcomputer looks like:

[Image: E2d5S9V.png]

While I was searching for ads yesterday, I did not find any, but these sponsored advertisments are in the download section.
If it is just that, you are fine.

You can now reinstall Chrome from here: http://www.google.com/chrome/

There is still something left.

Step 1: Farbar Recovery Scan Tool (FRST) Script
  • Press the Windows Key [Image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.

  • Copy the entire contents of the codebox below and paste into the Notepad document.
    Code
    start
    CreateRestorePoint:
    Task: C:\Windows\Tasks\FileInspect.job => c:\programdata\{e1bdf08d-aacb-44f9-e1bd-df08daacc236}\7924848117679966134b.exe <==== ATTENTION
    c:\programdata\{e1bdf08d-aacb-44f9-e1bd-df08daacc236}
    Task: {CF44606A-D4C5-418E-97A8-B51BF8D3328B} - System32\Tasks\{D8290197-B144-4D7C-81D6-D35E27297515} => pcalua.exe -a C:\PROGRA~2\Yahoo!\Common\UNATT_~1.EXE
    end

  • Click File, Save As and type fixlist.txt as the File Name.

  • Important: The file must be saved in the same location as FRST.exe.


NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.
  • Right-Click FRST.exe and select Run as administrator to run the program.

  • Click Fix.

  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log to pastebin.com and paste the link to it in your next reply.



Step 2: RogueKiller
  • Download RogueKiller (x64) and save the file to your Desktop.

  • Close any running programs.

  • Right-Click RogueKiller.exe and select Run as administrator to run the program.

  • Allow the Prescan to complete. Upon completion, a window will open. Click Accept.

  • A browser window may open. Close the browser window.

  • Click [Image: jpgUwzp.png]. Upon completion, click [Image: phPvmc6.png].

  • Close the program. Do not fix anything!

  • A log (RKreport.txt) will be open. Copy the contents of the log to pastebin.com, click Submit and paste the link to it in your next reply.


Sennheiser
Guest
 
Jul 23, 2015 02:51 PM
rougekiller log: http://pastebin.com/ytV9srT2

fixlog: http://pastebin.com/PUHZyxAf
Black_Georg
Guest
 
Jul 23, 2015 02:54 PM
The only way to get rid of that malware is to FORMAT HDD! Do a clean system installation, it'll take you less time then searching for good anti-malware software.
Sennheiser
Guest
 
Jul 23, 2015 02:57 PM
(Jul 23, 2015 02:54 PM)Black_Georg Wrote:  The only way to get rid of that malware is to FORMAT HDD! Do a clean system installation, it'll take you less time then searching for good anti-malware software.

https://hackforums.net/showthread.php?tid=4557247

[Image: c2b198de369bc3064cfec9a7792a4189.png]
focuss
focuss Offline
[user@HF:]
*
Registered
Posts:
443
Threads:
28
Credibility:
000
Popularity:
0
βytes:
β 71.2
Game XP:
0
Jul 23, 2015 06:56 PM
These are the steps I would follow:
1. Go through Add/Remove program and remove any programs that look dodgy.

2. Do a full Malwarebytes Scan.

3. Go to start-->run and type in msconfig and click on the start-up tab and see if there is anything that doesn't look like a legit program there.

4. Right-click on your browser and go to properties and check the Target field.
If your using Firefox it should be something like this:
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

Sometimes the path is modified with a spammy website.

5. Do a complete browser reset (recommend that you to save your bookmarks if you need them)
Depending on the browser your using the steps for this is different. Do a quick Google search on how to restore settings to default on your browser.

6. If you are still having issues it may be that Adobe Flash has been infected. Reinstall it.

Let me know if this did not fix the issues.
Knautschtabak
Knautschtabak Offline
I eat malware for breakfast
***
HF Ub3r
Posts:
2,459
Threads:
3
Credibility:
000
Popularity:
127
βytes:
β 0
Game XP:
5
Jul 24, 2015 08:05 AM
RogueKiller Fix
  • Close any running programmes.

  • Right-Click RogueKiller.exe and select [Image: AVOiBNU.jpg] Run as administrator to run the programme.

  • Allow the Prescan to complete.

  • A browser window may open. Close the browser window.

  • Click [Image: jpgUwzp.png].

  • Upon completion, do the following:


  • Click [Image: 5UKuIKl.png] and place a checkmark next to the following items. Ensure any other items are unchecked.
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1255986293-1186383839-1666926913-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1255986293-1186383839-1666926913-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

    • [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\FlashBeat\FlashBeat64.dll [x] -> Found





  • Click [Image: QEIRkTE.png].

  • Click [Image: phPvmc6.png].

  • Copy the contents of the log and paste in your next reply.


Sennheiser
Guest
 
Jul 26, 2015 03:40 PM
(Jul 24, 2015 08:05 AM)Knautschtabak Wrote:  RogueKiller Fix
  • Close any running programmes.

  • Right-Click RogueKiller.exe and select [Image: AVOiBNU.jpg] Run as administrator to run the programme.

  • Allow the Prescan to complete.

  • A browser window may open. Close the browser window.

  • Click [Image: jpgUwzp.png].

  • Upon completion, do the following:


  • Click [Image: 5UKuIKl.png] and place a checkmark next to the following items. Ensure any other items are unchecked.
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1255986293-1186383839-1666926913-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1255986293-1186383839-1666926913-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

    • [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\FlashBeat\FlashBeat64.dll [x] -> Found





  • Click [Image: QEIRkTE.png].

  • Click [Image: phPvmc6.png].

  • Copy the contents of the log and paste in your next reply.



done

http://pastebin.com/1aK1D43t
Knautschtabak
Knautschtabak Offline
I eat malware for breakfast
***
HF Ub3r
Posts:
2,459
Threads:
3
Credibility:
000
Popularity:
127
βytes:
β 0
Game XP:
5
Jul 26, 2015 11:14 PM
Well done.
Are there any outstanding issues with your computer?

You may re-run the adware cleaning tools now to get rid of leftovers.

Junkware Removal Tool (JRT)
  • Please download Junkware Removal Tool and save the file to your Desktop.

  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.

  • Right-Click JRT.exe and select Run as administrator to run the program.

  • Follow the prompts and allow the scan to run uninterrupted.

  • Upon completion, a log (JRT.txt) will open on your desktop.

  • Re-enable your anti-virus software

  • Copy the contents of JRT.txt to pastebin.com and paste the link in your next reply.



AdwCleaner
  • Please download AdwCleaner and save the file to your Desktop.

  • Right-Click AdwCleaner.exe and select Run as administrator to run the program.

  • Follow the prompts.

  • Click Scan.

  • Upon completion, click Logfile. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.

  • Ensure anything you know to be legitimate does not have a checkmark, and click Clean.

  • Follow the prompts and allow your computer to reboot.

  • After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log to pastebin.com and paste the links in your next reply.


-- File and folder backups are made for items removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.
Sleeping With Sirens
Guest
 
Jul 26, 2015 11:15 PM
(Jul 23, 2015 02:54 PM)Black_Georg Wrote:  The only way to get rid of that malware is to FORMAT HDD! Do a clean system installation, it'll take you less time then searching for good anti-malware software.

I really suggest you leave this forum, bud.
Sennheiser
Guest
 
Jul 27, 2015 01:38 AM
JRT Logs: http://pastebin.com/CzTYCgxV

adwcleaner: http://pastebin.com/Uav4rw6T

I think it may be gone now, hasn't come up from what i've seen yet
Knautschtabak
Knautschtabak Offline
I eat malware for breakfast
***
HF Ub3r
Posts:
2,459
Threads:
3
Credibility:
000
Popularity:
127
βytes:
β 0
Game XP:
5
Jul 27, 2015 01:44 AM (This post was last modified: Jul 27, 2015 01:44 AM by Knautschtabak.)
Looks good to me too. I think your computer is clean.
Let's wrap this up.

You have no AV installed. I suggest you get one.

Your current version of Flash Player is vulnerable. Update it to avoid infections via recent Flash exploits: https://get.adobe.com/flashplayer/

DelFix
  • Please download DelFix and save the file to your Desktop.

  • Double-click DelFix.exe to run the programme.

  • Place a checkmark next to the following items:
    • Remove disinfection tools



  • Click the Run button.



-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
Sennheiser
Guest
 
Jul 31, 2015 07:57 PM
Ok, so after a few days.

The ads still keep popping up, however at a very small rate and random

meaning it is not as obtrusive as it was originally.

Any way to remove these ads?

They occur on sites they never did before

School site and aol
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Infected] by flygonDec 17, 2023 04:58 PM 3 179 Dec 17, 2023 04:58 PM
Last Post: DramaKing
[Infected] by CryptMay 22, 2021 11:13 AM 3 185 May 22, 2021 11:13 AM
Last Post: Laylo
by itzgameNov 21, 2019 08:41 AM 14 551 Nov 21, 2019 08:41 AM
Last Post: itzgame