Avast WEBforum
Other => Viruses and worms => Topic started by: REDACTED on November 13, 2014, 11:09:52 AM
-
it keeps popping up everytime i am connected to the internet (i noticed that at least). i suppose it started after i downloaded the software YTD Video downloader. Please Help! i am quite troubled :'(
Thank YOU very much :)
i already downloaded the malwarebytes anti malware a while ago and currently scanning my pc now though.
any response would be greatly appreciated. i"ll wait :)
-
Attach your basic logs. (MBAM, FRST and aswMBR..!!)
Instructions: https://forum.avast.com/index.php?topic=53253.0
-
Attach your basic logs. (MBAM, FRST and aswMBR..!!)
Instructions: https://forum.avast.com/index.php?topic=53253.0
ok ill do that. thanks :)
-
You're welcome, awaiting your logs...
-
here are from malwarebytes
-
here are from malwarebytes
It doesn't look complete. ;) Anyway, the most important ones are your FRST logs.
-
any more? :D let me know if i missed any thing.
-
Now you've to wait a bit...
-
ok ;D
-
Your other thread @ https://forum.avast.com/index.php?topic=160147.0
Desktop.ini is normal. Don't delete it. FRST automatically un hides these files for scanning. They will be re-hidden at the end.
-
Your other thread @ https://forum.avast.com/index.php?topic=160147.0
Desktop.ini is normal. Don't delete it. FRST automatically un hides these files for scanning. They will be re-hidden at the end.
many thanks, now i know. i thought it was done by a virus avast coudn't detect. thanks again
-
You're very welcome.
Wait until someone arrives. I presume Asyn PM'd the removal team. I hope.
-
Now you've to wait a bit...
Just message me anytime you're done yes? I'll catch it up as soon as I can. Thank you ;D
-
Hi there, the first thing you must do is uninstall Chrome as it has been changed to the developer version, this means there are no safeguards and security restrictions in place
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
Startup: C:\Users\jbmalunao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO: GOSave -> {0563d5ef-f5fd-43fe-94ce-75c30f5c7527} -> C:\Program Files (x86)\GOSave\KSgOcUwXYnL1Cu.x64.dll ()
BHO: No Name -> {40ac3779-0203-46fd-b63a-89149d6e0bdf} -> No File
BHO-x32: GOSave -> {0563d5ef-f5fd-43fe-94ce-75c30f5c7527} -> C:\Program Files (x86)\GOSave\KSgOcUwXYnL1Cu.dll ()
BHO-x32: No Name -> {40ac3779-0203-46fd-b63a-89149d6e0bdf} -> No File
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [36936 2014-09-10] (Just Develop It) <==== ATTENTION
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
Task: {0E60A852-52D4-4588-84BD-CC447371A323} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {E0FB9B8E-B82E-4657-AF09-CE9475B63A97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Users\jbmalunao\AppData\Local\Google\Chrome\User Data\Default
C:\Program Files (x86)\MyPC Backup
C:\Program Files (x86)\GOSave
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
-
Hi there, the first thing you must do is uninstall Chrome as it has been changed to the developer version, this means there are no safeguards and security restrictions in place
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
Startup: C:\Users\jbmalunao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
BHO: GOSave -> {0563d5ef-f5fd-43fe-94ce-75c30f5c7527} -> C:\Program Files (x86)\GOSave\KSgOcUwXYnL1Cu.x64.dll ()
BHO: No Name -> {40ac3779-0203-46fd-b63a-89149d6e0bdf} -> No File
BHO-x32: GOSave -> {0563d5ef-f5fd-43fe-94ce-75c30f5c7527} -> C:\Program Files (x86)\GOSave\KSgOcUwXYnL1Cu.dll ()
BHO-x32: No Name -> {40ac3779-0203-46fd-b63a-89149d6e0bdf} -> No File
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [36936 2014-09-10] (Just Develop It) <==== ATTENTION
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
Task: {0E60A852-52D4-4588-84BD-CC447371A323} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {E0FB9B8E-B82E-4657-AF09-CE9475B63A97} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Users\jbmalunao\AppData\Local\Google\Chrome\User Data\Default
C:\Program Files (x86)\MyPC Backup
C:\Program Files (x86)\GOSave
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
here is the first log :)
kindly check if something might be wrong because I forgot to uninstall first my chrome before I ran the FRST and fixed it. I did the fixing with FRST twice though. :-\
-
Not a major problem. Did you run adwcleaner ? If so could you now run a fresh FRST scan please
-
i apologize for not attending you this week I was quite busy then. But anyways,
Not a major problem. Did you run adwcleaner ? If so could you now run a fresh FRST scan please
here are my recent the logs of FRST and Adwcleaner, respectively :)
hope I can still receive a response from you ;) . Thanks a lot!
-
Can you attach a Fresh FRST log as well.
Not a major problem. Did you run adwcleaner ? If so could you now run a fresh FRST scan please
You attached fixlog and Adwcleaner, both of which were needed, so don't take those down.
-
Can you attach a Fresh FRST log as well.
Not a major problem. Did you run adwcleaner ? If so could you now run a fresh FRST scan please
You attached fixlog and Adwcleaner, both of which were needed, so don't take those down.
here it is FRST log. is this it? this was scanned a second ago :)
-
Could you uninstall Chrome please as it has been changed to developer build and that is unsafe..
How is the computer behaving now ?
-
Uninstall Chrome done., those multiple things popping up all of a sudden seemed to stop ,though just recently it happened once again when I visited a site using internet explorer, I think that was the cause; the site I visited .but Just one,unlike before multiple and continuous.
Thank you so much. It appears to have quite reduce those annoying web shield blocks this website and that.,
I hope it won't get worse again
Furthermore, are there any more malwares or viruses my computer happen to have? Like right until now?
God bless :D ;D
-
The logs look good now, are you experiencing any problems ?
-
There aint any so far :) my pc looks better now
Thnk you very much
More power to AVAST :)
-
In that case methinks I will send you on your merry way :)
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Remove tools
Download and run Delfix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix)
(https://dl.dropboxusercontent.com/u/73555776/delfix.JPG)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent (http://www.foolishit.com/vb6-projects/cryptoprevent/) install this programme to lock down and prevent crypto ransome ware
(https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG)
Malwarebytes (http://www.malwarebytes.org/mbam-download.php).
Update and run weekly to keep your system clean
Unchecky (http://unchecky.com/)
Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme ;)
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/)Keep safe :wave: