Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: JanetB on December 24, 2013, 12:42:22 AM

Title: Virus "symptoms" still present after removal
Post by: JanetB on December 24, 2013, 12:42:22 AM
Hello!

My husband was getting virus detected messages when he tried to download files. During a boot scan of his laptop, Avast (free version 2014, just installed yesterday-- I had to put it on via flash drive from my pc since I couldn't download it) found PUP:win32:installer-L, a virus that prevents downloads. I chose option 2, "fix all automatically." Nothing else was detected and the scan completed. I looked at the log and saw that it was successfully moved to chest.

Afterwards, I tried to download an exe file to test it, and I couldn't download the file. I received an error message because of a virus detected. I ran another boot scan, which came up clean.

Is there some sort of patch or fix for this? There must be something still hanging around from the installer-L. Any ideas of what to do, if not?

PS--I hope this post is not a duplicate. I had a problem the first time--didn't realize I had to verify again before posting. Then when I did, it said the message was posted.... but it wasn't.... ???

Thanks,
JB
Title: Re: Virus "symptoms" still present after removal
Post by: Pondus on December 24, 2013, 12:52:37 AM
Quote
PUP:win32:installer-L
PUP = not virus / Possible Unwanted Program     usually adware/toolbar browser crap you get when downloading free software

if you want a check.....

follow instructions and attach logs (not copy and paste)  http://forum.avast.com/index.php?topic=53253.0

we need Malwarebytes / OTL  Logs


Title: Re: Virus "symptoms" still present after removal
Post by: Pondus on December 24, 2013, 12:54:32 AM
Quote
I had to put it on via flash drive from my pc since I couldn't download it
if you use lots of removable drives among many computers, i recomend installing this.....

MCShield USB protector   www.mcshield.net     

Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on December 24, 2013, 05:14:00 AM
Thanks Pondus.

Ok, so I stand corrected on PUP vs. virus. Sorry! I thought since the program was preventing me from doing something it was automatically a virus!

I will have to do the same thing with Malwarebytes, e.g., download it to a flash drive in order to install it on his machine, though I'm not sure it will be able to update. I hope so!

And, I see that I need to post the results of everything in a different topic area. I'll work on that in the next day or two, including running a scan with Malwarebytes. Perhaps that will solve the issue and I won't need to do all the rest (she said, hopefully)....

Janet B
Title: Re: Virus "symptoms" still present after removal
Post by: Pondus on December 24, 2013, 07:36:54 AM
Quote
And, I see that I need to post the results of everything in a different topic area. I'll work on that in the next day or two, including running a scan with Malwarebytes. Perhaps that will solve the issue and I won't need to do all the rest (she said, hopefully)....
since you have already started this topic here, you can attach those logs here.....
and you should also attach OTL log after you have run Malwarebytes as there may be additional files that need removal ... the removal expert will see this from that log

Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 02, 2014, 10:22:43 PM
Hello-

I replied to this today (Feb2) but keep getting error messages. This is my last try in this thread.

I've done the malwarebytes scan and have attached it. Now working on OTL.

JB
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 02, 2014, 10:44:48 PM
Hi when you have run the OTL scan here are the instructions for MCShield

Download MCShield (http://amf.mycity.rs/mcshield/downloads.html) to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives
(https://dl.dropbox.com/u/73555776/mcshield%20unhide.JPG)
Plug in the drive and McShield will start a scan

Then get the log which will be here :

Start > all programs > MCShield > logs > all scans

And post that
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 02, 2014, 11:04:31 PM
I'm running OTL now. But I'm not sure why I need McShield at this time?

We don't use flash drives in general, with this laptop. The only reason I've used one recently is to be able to download the necessary Malwarebytes and OTL exe files to my flash drive so that I can copy them to the laptop to run them.  You're probably thinking: "well how does he do backups."  Well.... that particular "he" is very lax on this sort of thing, despite constant nagging!!!

Right now I cannot download *any* file on to that laptop!!!! >:(

My understanding is that MCShield is to check the flash drive, correct?

It doesn't seem like I need that yet--unless I've misunderstood what it does.

JB
Title: Re: Virus "symptoms" still present after removal
Post by: Pondus on February 02, 2014, 11:07:11 PM
Quote
   Then get the log which will be here :

Start > all programs > MCShield > logs > all scans

And post that   
Or ..... use the new Log button on left side of MCShield     ;)



Quote
  It doesn't seem like I need that yet--unless I've misunderstood what it does.
Essexboy usually have good reasons .....


Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 02, 2014, 11:14:26 PM
No problem there!  I just like to understand what I'm putting on my machine and why, before I do it.

Thanks again-
JB
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 03, 2014, 12:18:03 AM
No problem there!  I just like to understand what I'm putting on my machine and why, before I do it.

Thanks again-
JB
Trust Essexboy.......he is an expert......do a search on him if you want.....not just here but on other Forums.
He has saved me in the past several times.....in fact folks try to get his time on items....he is busy guy. :)
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 03, 2014, 12:25:19 AM
Quote
I had to put it on via flash drive from my pc since I couldn't download it
if you use lots of removable drives among many computers, i recomend installing this.....

MCShield USB protector   www.mcshield.net   

Pondus, don't want to hijack this thread but very curious about this "mchsield".
How well does it work ?
Does Avast not cover me with connecting USB drives ?
Does it play well with Avast ?
I also have MBAM Pro (active protection) on.....does it play well with Avast + MBAM Pro ?

Thx.

....UPDATE.........
Never mind....I answered my own question....did not realize MCShield was by McAfee.....I would never use their products...complete garage stuff.  Ton's of threads out there on problems with MCShield and I understand why now...McAfee
https://forums.malwarebytes.org/index.php?showtopic=94224
I'll stick with Avast + MBAM Pro + CryptoPrevent.....I know everyone has their own experience and beauty is in eye of beholder thing.  I would have deleted this post but cannot find that option...do not want to de-rail thread...I apologize.
Title: Re: Virus "symptoms" still present after removal
Post by: iroc9555 on February 03, 2014, 01:29:04 AM
... did not realize MCShield was by McAfee...

It is not by McAfee. It is a Serb group specialized in security. Two of its contributors lend their time here at the virus and worms Forum, argus and magna86. Many of us has adopted the use of this application because its usefulness and detection of worms and other kind of malware related to USB flash devises to complement avast!
http://www.mcshield.net/
http://www.mycity.rs/
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 03, 2014, 02:06:20 AM
... did not realize MCShield was by McAfee...

It is not by McAfee. It is a Serb group specialized in security. Two of its contributors lend their time here at the virus and worms Forum, argus and magna86. Many of us has adopted the use of this application because its usefulness and detection of worms and other kind of malware related to USB flash devises to complement avast!
http://www.mcshield.net/
http://www.mycity.rs/

Thx for clarifying.....I see you also use MBAM Pro.....with active protection ?
Any conflicts with MCShield ?
.....also, guess MBAM does not cover the same as MCShield ?
...perhaps I should start own thread on subject.....hate to hijack this one.
Title: Re: OTL file attached. (not fileS !)Virus "symptoms" still present after removal
Post by: JanetB on February 03, 2014, 04:58:13 AM
Hello,

I ran OTL. I configured the settings as per the example, as far as I can tell, and only one file was generated, not two. When the scan finished, only OTL.txt was open on my screen. No sign of OTL extras. I searched the computer for OTL*.* and only found the exe and the txt file, which is attached.

Please advise, before I go to the next download required.
Title: MCSHield 404...Re: Virus "symptoms" still present after removal
Post by: JanetB on February 03, 2014, 05:12:38 AM
FYI, the link to MCShield in this thread referenced within this link (posted in Pondus's reply on Dec 23) http://forum.avast.com/index.php?topic=53253.0  gives a 404.
Likewise for the one posted by Essexboy.

For reference:
The requested URL /downloads.html was not found on this server.

Apache/2.2.16 (Debian) Server at www.mcshield.net Port 80

I'll try tomorrow.

JB
Title: ASWMBR ...re Virus "symptoms" still present after removal
Post by: JanetB on February 03, 2014, 06:24:28 AM
Here is the last file you asked me to attach (other than MCShield, which can't be done at the moment).

I await your review and any further instructions.

Thanks so much.

Janet B.
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 03, 2014, 03:38:59 PM
OK I believe I can see the problem.  I will also attach the OTL fix as a text file if you are unable to copy it on the sick system

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
SRV - [2014/01/14 21:04:29 | 001,771,544 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe -- (vToolbarUpdater17.3.0)
SRV - [2013/09/06 12:29:38 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe -- (McComponentHostService)
DRV - [2013/11/20 15:43:41 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=F4Ohn6C-M-oPlcU5DzTcfMvYbJw?q={searchTerms}
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={49C36A2B-0AA1-47D5-A431-23EC18CED411}&mid=95ac9ede46df74924f9140b1d0a2b11e-4e74e30fd1940bb5905c7101d2faeb3f67145431&lang=&ds=&coid=&cmpid=&pr=&d=&v=17.3.0.49&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1002\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=wp4geEaPqFbgGrkkgy2vaDNcg6A?q={searchTerms}
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
[2009/12/22 08:35:06 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG8\FIREFOX
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\17.3.0.49\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\17.3.0.49\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
[2010/03/10 17:28:54 | 002,495,592 | ---- | C] (Amazon.com) -- C:\Users\Vic\AmazonMP3Downloader.exe
[2013/04/15 20:13:03 | 000,000,000 | ---D | M] -- C:\Users\Vic\AppData\Roaming\AVG2013
[2013/11/16 17:24:36 | 000,000,000 | ---D | M] -- C:\Users\Vic B\AppData\Roaming\AVG2013

:Files
C:\Program Files\AVG Secure Search
C:\Program Files\Common Files\AVG Secure Search
C:\Program Files\McAfee Security Scan
C:\Program Files\AVG

:Commands
[resethosts]
[emptytemp]
[Reboot]
If you need to copy the text file across then copy fix.txt to the desktop of the sick computer
Run OTL and press fix, a dialogue will appear asking for the location of fix.txt
Navigate to the copy on the desktop and select it
Press run fix again to execute

On completion of the fix then try to download MCShield, it should now work
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 03, 2014, 04:44:40 PM
Thanks--I'll do this in just a bit. One question... While the fix is running, "unhindered" if the screen goes dark for lack of user activity, will that hinder progress, or is it ok? 

JB
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 03, 2014, 04:52:10 PM
Thanks--I'll do this in just a bit. One question... While the fix is running, "unhindered" if the screen goes dark for lack of user activity, will that hinder progress, or is it ok? 

JB

....in case Essexboy is busy.............
I've run OTL fix many times.....with scripts from the experts.
Some machines you do not see any slow down....some there is.
However, trying to do anything on the machine will definitely freeze things up....in my experience.
Thus, it is best to run it and leave it alone....be patient.....leave it alone....no mouse moves, nothing. :)
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 03, 2014, 05:10:46 PM
Hi--That was my plan... to just let it run without anyone touching it... but when we do that, the screen goes dark (asleep?). I think everything keeps running in the background, but I just wasn't sure.

J
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 03, 2014, 07:21:34 PM
The fix should not taker longer than 10 minutes to run (unless the temp files are full)  You can move the mouse to keep the screen active and monitor the bar at the bottom as it progresses through the fix
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 03:37:31 AM
Hi-Just checking in.

The fix is still running. Started it about 40 minutes ago. The first part went quickly--it's been sitting at the last two lines (emptytemp and reboot) for about 20 minutes so far. Is that normal? I'll just let it keep going.....

JB
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 03:44:35 AM
Hi-Just checking in.

The fix is still running. Started it about 40 minutes ago. The first part went quickly--it's been sitting at the last two lines (emptytemp and reboot) for about 20 minutes so far. Is that normal? I'll just let it keep going.....

JB

Hmmmmmm..........Essexboy is UK so not sure if he is a sleep.
If you've never emptied your TEMP then perhaps.......I'd wait a good 30 minutes more.
If nothing happens then I'd hold off for Essexboy in morning to post.
Title: OTL fix stuck? Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 05:15:05 AM
Reporting back again. So two hours later, the Run Fix is stopped in the same place.

I'll just leave it as is, until I hear back.
Title: MCSHield 404...Re: Virus "symptoms" still present after removal
Post by: Eddy on February 04, 2014, 05:39:26 AM
Please do not change the topic of a thread.
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 05:50:54 AM
I'm sorry--do you mean in the subject line? The original subject is always there--"Re: Virus "symptoms" still present after removal. I was just trying to focus the subject line further  for those helping....I didn't think the subject line would matter much once the thread was established (otherwise, why would there still be a subject line), since everything is contained in this thread..... but perhaps this is not good practice.

The topic hasn't changed (other than the people who asked questions about the MCShield product (not the 404) I was instructed in this thread to run MCShield, and it came up 404. It seemed to me to be important.......

So, if the comment was meant for me--and you mean the subject line--...... it won't happen again.  :-[
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 06:34:38 AM
Essexboy:

After three hours of being stuck on those last two lines, something happened, albeit accidentally. The screen had gone dark, I touched the power to reactivate. The same screen was still there (run fix), but then it suddenly disappeared, and the laptop shutdown. On reboot, there was a log opened on the screen. I've attached. It.

So, to be clear, this is the log that appeared at the end of the OTL Run Fix.

I'll wait until I hear from you before I do anything else, as I don't know if the "fix" completed successfully.

Thanks,
JB
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 02:39:00 PM
Essexboy:

I'll wait until I hear from you before I do anything else, as I don't know if the "fix" completed successfully.

Thanks,
JB

While we wait for Essexboy how does the laptop work ?
I think one of the initial problems was downloading files......can you now ?
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 04, 2014, 03:25:44 PM
It was the size of the temp files plus the removal of AVG that caused the delay, sorry about that it is unusual for it to take that long.   Can you now download ?

Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from  here (http://www.malwarebytes.org/)

Double Click mbam-setup.exe to install the application.If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 03:33:53 PM
One more question -- I did just install Malwarebytes, as part of this whole cleaning process--about 30 days ago, and it is updated.

Do I need to uninstall, and reinstall a clean version--or is it ok as is?

No problems with the delay. Thanks for letting me know the "why."

Will check the download and report back.

J.
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 03:49:15 PM
One more question -- I did just install Malwarebytes, as part of this whole cleaning process--about 30 days ago, and it is updated.

Do I need to uninstall, and reinstall a clean version--or is it ok as is?

No problems with the delay. Thanks for letting me know the "why."

Will check the download and report back.

J.

If you already have it just make sure to update the database before you run.
It should do this when you launch but if not go to the update tab within MBAM.

Also, as a FYI....I am by far no expert but I have both Avast & MBAM Pro on my PCs.
The MBAM Pro is one time charge (~$24) for lifetime.
MBAM & A/Vs (eg. Avast) play nice with each other and you can have both real-time shields running.
I schedule a system scan from each once a night (different times).
You'll have tons of folks with tons of different opinions on what to use.....some are too light, some overkill.
It really depends on type of user you are (what you do with PC) and techy sophistication (for tweaking).
I've personally found the middle road of ease of use + safety is Avast + MBAM Pro.
Again, my disclaimer is I'm no expert....especially on security software.....just a techy been around PCs for 20+ years.
I only mention since you have MBAM loaded.
You do have the choice of running MBAM from time to time without paying....like you are now.....but you have to do this manually....the paid version has the scheduler.
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 04, 2014, 04:00:48 PM
No use the current copy but ensure it is updated.  The main thing is to check whether or not you can download any programmes/files
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 04:22:58 PM
Essexboy, I saw in your OTL fix where you removed old AVG Search.
This rang a bell with me: http://forum.avast.com/index.php?topic=81045.15 ........see last post of thread.
Seems that this does not get uninstalled with their uninstaller.
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 04, 2014, 04:24:03 PM
SUCCESS!! On downloading an exe file. Thank you!

Now... I think I have two tasks remaining:
1) Run Malwarebytes Quick Scan
2) Download and run MCShield.

Essexboy--Is the MCShield scan still needed/advisable?  And, is it possible to tell me in a sentence or two, what the problem was? A file that just refused to be removed by Avast or Malwarebytes? Something else?

thekochs--thank you for the suggestion. The investment is small, and the autoscheduler is worth it, especially for said spouse in question, who does almost zero to safeguard anything!! (I have scheduled scans to run when he's at work.)

JB
Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 04:34:43 PM
I'll let Essexboy comment on your questions but I think the culprit is you had AVG (A/V) on this machine prior and not all its items were uninstalled.  Not your fault (or spouse).....these A/Vs don't always uninstall cleanly so when you change over you really need to clean these old items....Avast has a FAQ on it: http://www.avast.com/faq.php?article=AVKB11#artTitle
Most typically people "uninstall" thru the Windows Programs or via Windows where the program has an uninstaller.....makes sense.....of course..........but for A/Vs there are "remover" utils to get rid of all remnants.  For most software this is a don't care....for A/Vs a different story.
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 04, 2014, 05:09:01 PM
This was the problem :

Quote
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=F4Ohn6C-M-oPlcU5DzTcfMvYbJw?q={searchTerms}
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1002\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=wp4geEaPqFbgGrkkgy2vaDNcg6A?q={searchTerms}
A proxy had been inserted to redirect all your searches and they would only allow you to use their DNS server, hence no tools are able to download

I would use MCShield if you use USB drives in the computer or you insert camera SD cards

Title: Re: Virus "symptoms" still present after removal
Post by: thekochs on February 04, 2014, 10:06:38 PM
This was the problem :

Quote
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1000\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=F4Ohn6C-M-oPlcU5DzTcfMvYbJw?q={searchTerms}
IE - HKU\S-1-5-21-3334157229-1843940417-2705372315-1002\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=wp4geEaPqFbgGrkkgy2vaDNcg6A?q={searchTerms}
A proxy had been inserted to redirect all your searches and they would only allow you to use their DNS server, hence no tools are able to download


Essexboy, thx for the explanation.....I'm in learning mode out of curiosity.
I saw your OTL script and the AVG & McAfee items.....did not see nor clue in with the SearchScopes item with IP address.
Of course, that is why you are the expert and I'm not. :)
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 04, 2014, 10:25:36 PM
Unfortunately this is one area that very few tools look at so it does need the human eye :)
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 05, 2014, 03:47:17 AM
Log from the Malwarebytes Quick Scan, as requested.  Attached.
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 05, 2014, 03:03:06 PM
Nice :)  Any outstanding problems before I tidy up ?
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 05, 2014, 06:01:45 PM
No--everything seems to be fine at the moment. Please tidy up!

And thanks to everyone for their assistance and advice. You all have been great.

Janet B
P.S. Not directly related, but still important--I still get 404 when I click on the MCShield link provided in this thread. It's in Reply #6.
Title: Re: Virus "symptoms" still present after removal
Post by: Charyb-0 on February 05, 2014, 06:14:08 PM
I receive the same error.

Try here
http://www.mcshield.net/index.html
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 05, 2014, 06:52:51 PM
Yep mea culpa... The download link changed for version 3, I have amended it in the main thread detailing tools and logs

The proper link:
 Download MCShield (http://www.mcshield.net/) to your desktop and install



Subject to no further problems   :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Download and run Delfix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix)

Clear Restore Points

Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
When it pops up at the first prompt select OK after it has done some calculations the tabs will appear
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button



: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article (http://www.forbes.com/sites/eliseackerman/2013/01/11/us-department-of-homeland-security-calls-on-computer-users-to-disable-java/) and this article (http://www.nbcnews.com/technology/technolog/us-warns-java-software-security-concerns-escalate-1B7938755).
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser (http://www.geekstogo.com/2600/how-to-disable-java-in-your-web-browser/) and How to unplug Java from the browser (http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/))

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent (http://www.foolishit.com/vb6-projects/cryptoprevent/) install this programme to lock down and prevent crypto ransome ware

(https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG)

Malwarebytes (http://www.malwarebytes.org/mbam-download.php).

Update and run weekly to keep your system clean


It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)Keep safe  :wave:
Title: Re: Virus "symptoms" still present after removal
Post by: JanetB on February 05, 2014, 08:24:49 PM
Thanks for all this info. I'll clean-up later this evening.

I'm beginning to long for the days of DOS...... though I'm sure people were able to hack that, too.

J.
Title: Re: Virus "symptoms" still present after removal
Post by: essexboy on February 05, 2014, 08:30:27 PM
Quote
I'm beginning to long for the days of DOS
That was where the first virus started :)