Author Topic: please help http;//atomictrivia.ru/atomic.php and http://differentia.ru/diff.php  (Read 4303 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
I've got  http;//atomictrivia.ru/atomic.php and http://differentia.ru/diff.php from flash drive. Avast Antivirus popping up a warning every few minutes

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37629
  • Not a avast user
follow instructions here  https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and Farbar Recovery Scan Tool logs ... 3 logs total

see below the box you write in ... Attachments and other options


then scoll down to ... SPECIFIC INFECTIONS LOGS ... follow MCShield instructions
this log you copy and paste

« Last Edit: September 02, 2015, 07:08:17 AM by Pondus »

REDACTED

  • Guest
aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2015-09-03 11:37:21
-----------------------------
11:37:21.794    OS Version: Windows x64 6.1.7601 Service Pack 1
11:37:21.794    Number of processors: 4 586 0x2A07
11:37:21.794    ComputerName: KAMOL-PC  UserName: kamol
11:37:23.374    Initialize success
11:37:23.454    VM: initialized successfully
11:37:23.464    VM: Intel CPU BiosDisabled
11:37:27.494    AVAST engine defs: 15090201
11:37:40.079    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
11:37:40.089    Disk 0 Vendor: Hitachi_HTS547564A9E384 JEDOA50A Size: 610480MB BusType: 11
11:37:40.239    Disk 0 MBR read successfully
11:37:40.249    Disk 0 MBR scan
11:37:40.259    Disk 0 Windows 7 default MBR code
11:37:40.259    Disk 0 Partition 1 80 (A) 07      HPFS/NTFS NTFS          100 MB offset 2048
11:37:40.289    Disk 0 default boot code
11:37:40.299    Disk 0 Partition 2 00     07      HPFS/NTFS NTFS       149900 MB offset 206848
11:37:40.339    Disk 0 Partition 3 00     07      HPFS/NTFS NTFS       460478 MB offset 307202048
11:37:40.469    Disk 0 scanning C:\Windows\system32\drivers
11:37:51.484    Service scanning
11:38:20.061    Modules scanning
11:38:20.081    Disk 0 trace - called modules:
11:38:20.111    ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
11:38:20.111    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004f37060]
11:38:20.121    3 CLASSPNP.SYS[fffff8800199c43f] -> nt!IofCallDriver -> [0xfffffa8005098b10]
11:38:20.131    5 hpdskflt.sys[fffff88001943189] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004f63060]
11:38:20.661    AVAST engine scan C:\Windows
11:38:22.341    AVAST engine scan C:\Windows\system32
11:41:38.418    AVAST engine scan C:\Windows\system32\drivers
11:41:52.134    AVAST engine scan C:\Users\kamol
11:42:58.089    Disk 0 MBR has been saved successfully to "C:\Users\kamol\Desktop\MBR.dat"
11:42:58.199    The log file has been saved successfully to "C:\Users\kamol\Desktop\aswMBR.txt"


Offline dbrisendine

  • Malware Fighter
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1258
Need the other three logs please.
Win7 x32 Ult. SP1, Brain 2.0 / Win10 x64, Brain2.5
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

REDACTED

  • Guest
Sorry, Here you are.

Offline dbrisendine

  • Malware Fighter
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1258
Please check and see if there is a complete FRST.txt file either on the desktop or in the C:\FRST\logs directory.  The file attached is not complete.

Also, did you not scan with Malwarebytes Antimalware?
Win7 x32 Ult. SP1, Brain 2.0 / Win10 x64, Brain2.5
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

REDACTED

  • Guest
Please help, i'm do it again.

Offline dbrisendine

  • Malware Fighter
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1258
Thanks for the fresh logs!

First, Reset Chrome Start URLS

If Chrome was giving you problems then the best thing to do is to manually check the settings and adjust them if you find anything you did not install or use any more.  Our scanners / script programs can fix Chrome but by removing some things from outside of Chrome's own settings, there is a chance of corrupting the user profile and making Chrome not start up properly.

Home Page - The Home Page is the page that the browser will open whenever you tell it start up.  When you first open the browser, it loads your Home Page that is set in the browser's properties.  To change the Home Page for Google Chrome, follow these directions:
 
1) Open Chrome and click on the menu button in the upper right corner of the browser.  The Menu Button looks like three bars (see below).


 
2) On the Menu that opens down, click on Settings to open the Settings page in Chrome.


 
3) Look for the Appearance section in the Settings page and make sure the Show Home button box is checked.  Then click on the blue Change next to New Tab Page.


 
4)  A box will pop up and allow you to either set a New Tab Page as your home page or type a URL address for a Home Page ( for example, you could enter www.google.com there to set Google as your home page).  Click OK when you have made the setting you want and the box will close.  Close the Settings page when you are done making the changes to the Home Page.



Second, Run a FRST Fixlist script
Fix with Farbar Recovery Scan Tool
This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on icon and select Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.


Third, An AdwCleaner scan


AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.


NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

  • Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
    You will see the following console:

  • Click the Scan button and wait for the scan to finish.
  • After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.
  • Click the Clean button.
  • Everything checked will be deleted.
  • When the program has finished cleaning a report appears.
  • Once done it will ask to reboot, allow this

  • On reboot a log will be produced; please attach that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

    Optional:

    NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.
Win7 x32 Ult. SP1, Brain 2.0 / Win10 x64, Brain2.5
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

REDACTED

  • Guest
every things seem to be clear, Thank you very much.

Offline dbrisendine

  • Malware Fighter
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1258
If your system is fine with you now, let's clean the tools off of it and get you going again ....


Clean up of Malware Removal Tools
Now that we are through using these tools, let's clean them off your system so that should you ever need to have malware removed again (we hope not) fresh, updated copies will be downloaded.

  • Download Delfix from here to your desktop and double click it to start the program
  • Ensure Remove disinfection tools is ticked
    Also tick:
  • Activate UAC
  • Create registry backup
  • Purge system restore
  • Reset system settings

  • Click Run
  • The program will run for a few moments and then notepad will open with a log. Please attach the log in your next reply.
You can delete any log files left on your desktop as these are no longer needed.
Win7 x32 Ult. SP1, Brain 2.0 / Win10 x64, Brain2.5
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

REDACTED

  • Guest
Thanks for tour help.