Author Topic: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!  (Read 16363 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #15 on: October 10, 2012, 07:35:32 PM »
You could have attached it  ;D

OK let me know if this cures it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:OTL
IE - HKU\S-1-5-21-299502267-261478967-725345543-63272\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-299502267-261478967-725345543-63272\..\SearchScopes,DefaultScope = $currentSearchProvider
IE - HKU\S-1-5-21-299502267-261478967-725345543-63272\..\SearchScopes\{8A244612-A1F7-11E0-95C0-E71F4824019B}: "URL" = http://badoo.com/startpage/?source=bsb&q={searchTerms}
FF - prefs.js..browser.search.selectedEngine: "blekko"
[2012/10/08 14:10:57 | 000,000,000 | ---D | M] ("Vid-Saver") -- C:\Users\M1\AppData\Roaming\mozilla\Firefox\Profiles\9p3j86vm.default\extensions\crossriderapp3491@crossrider.com
[2011/09/12 17:35:20 | 000,002,023 | ---- | M] () -- C:\Users\M1\AppData\Roaming\mozilla\firefox\profiles\9p3j86vm.default\searchplugins\badoo.xml
O2 - BHO: (no name) - {000F18F2-09EB-4A59-82B2-5AE4184C39C3} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {9E131A93-EED7-4BEB-B015-A0ADB30B5646} - No CLSID value found.
O3 - HKU\S-1-5-21-299502267-261478967-725345543-63272\..\Toolbar\WebBrowser: (no name) - {1D03A978-AC0C-4004-B9FD-9CF361C7BD3F} - No CLSID value found.
[2012/10/10 11:12:38 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars

:Files
C:\Users\M1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #16 on: October 11, 2012, 10:18:04 AM »
Here I am.....
:)
thank you in advance for your support !
« Last Edit: October 11, 2012, 10:34:07 AM by lore581 »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 36755
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #17 on: October 11, 2012, 10:22:53 AM »
as essexboy already stated....it is easyer if you attach the logs here...not copy and paste

just below the box you write in here you will see "attachment and other options"  click that to attach

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #18 on: October 11, 2012, 07:33:43 PM »
Are you still getting the alerts ?

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #19 on: October 12, 2012, 08:16:56 AM »
Are you still getting the alerts ?


Well.... after pasting the script into OTL editor I clicked OK to reboot the computer and the alerts disappeared !
Now, I've just turn on my pc and I've still found the alerts..... mmmmhh :(


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #20 on: October 12, 2012, 11:29:52 AM »
Lets see if this can find the remnants

Download AdwCleaner from here to your desktop
Run AdwCleaner and select Delete



Once done it will ask to reboot, allow this
On reboot a log will be produced please attach that

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #21 on: October 12, 2012, 12:07:16 PM »
I clicked on Delete button , then I reboot pc but no log file was created.
I tried 4 times.

I also tried to click on search button but it says
T:\AdwCleaner[R2].txt

The system cannot find the drive specified

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #22 on: October 12, 2012, 02:50:56 PM »
Did you download it to your desktop and run it from there ?

Also do you have Firefox set to synch when you go online ?

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #23 on: October 12, 2012, 03:14:35 PM »
1) Yes
2) I unistalled Firefox ...

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #24 on: October 12, 2012, 03:20:43 PM »
Could you attach a screenshot of the alert please as it will show me more information

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #25 on: October 12, 2012, 03:38:49 PM »
Here they are :)

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #26 on: October 12, 2012, 03:40:38 PM »
Could you run a fresh OTL log please and attach that ...  Do the alerts only occur in IE now ?

Offline lore581

  • Jr. Member
  • **
  • Posts: 20
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #27 on: October 12, 2012, 05:11:21 PM »
I've just realized the alerts appear only with Chrome.
I use both IE and Chrome. It depends.
And if I use IE and Chrome at the same time, the alerts appear.


Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40631
  • Dragons by Sasha
    • Malware fixes
Re: virus http://i.trkjmp.com/crossdomain.xml !! help me !!!!
« Reply #28 on: October 12, 2012, 07:53:53 PM »
OK it is Vidsaver in Chrome, if this does not cure it then delete that addon from Chrome

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Files
C:\Users\M1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.