Author Topic: Essexboy I need your help again please  (Read 75520 times)

0 Members and 1 Guest are viewing this topic.

DoeZ

  • Guest
Essexboy I need your help again please
« on: July 14, 2013, 05:25:45 PM »
 :-[ Essexboy I'm not sure if you want me to post this in here or in a private message but I need your help again please. I was going thru my laptop trying to remove some old files and old programs I no longer needed or used and I found a virus that attached itself and I believe I removed it...I have 1 item I just can't figure out how to find the root of it to get rid of it and I ran Avast last night the full scan and there was a bunch that couldn't be scanned because it was pw protected but I wrote it all down for you. But when I was trying to organize my folders and get rid of a bunch of duplicated downloads I must have somehow deleted my good Avast that you had helped me with...so I had to go back and use that aswcleaner that you had me install and I did all that again and I came back here to install the correct version you posted here for me...only it's pulling up my Google Chrome now. So I don't know what I did :-\ and I need your help please. Thanks so much in advance.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89033
  • No support PMs thanks
Re: Essexboy I need your help again please
« Reply #1 on: July 14, 2013, 05:57:49 PM »
Personally I feel that any help should be within the confines of the forums.  PMs are a one to one medium (and doesn't potentially help others with a similar problem) and can be hard to follow. Whereas in the forum everything (information) is all in the topic and easily referenced.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Essexboy I need your help again please
« Reply #2 on: July 14, 2013, 05:59:40 PM »
Quote
...only it's pulling up my Google Chrome now
What exactly do you mean by this ?

Quote
I have 1 item I just can't figure out how to find the root of it to get rid of it
Do you have a file name and location for that

Quote
Avast last night the full scan and there was a bunch that couldn't be scanned because it was pw protected
These are not a problem as they are harmless until opened, at which time Avast will then look at them

Concur David

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #3 on: July 14, 2013, 07:12:23 PM »
I'm sorry I'm meant the new Avast I downloaded again last night isn't pulling up my Google Chrome like it did for me the last time. And I don't have any other files on my laptop anymore of Avast not sure if that makes a difference or not but how do I get it to work with my Google Chrome again.

The item I can't seem to find I found it in the AppData Roaming files called IObit...And I don't have any folders for it anywhere.

And the last problem was while I was in my one remove program that I really trust because I believe it really removes all the hidden extra files...Revo Uninstaller I saw this item Privacy Safeguard and I wondered what it was so in another window I googled it and learned it was a virus etc. So I had Revo Uninstaller remove it but these files I found in Avast are PW protected from this Privacy Safeguard and I don't know how to get rid of it now. Here's the file # for it.

C:\ProgramData\Spybot-Search\Destroy\Recovery\Wilqfraud.Zip|>sbRecovery.reg

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Essexboy I need your help again please
« Reply #4 on: July 14, 2013, 07:50:12 PM »
Quote
C:\ProgramData\Spybot-Search\Destroy\Recovery\Wilqfraud.Zip|>sbRecovery.reg
This is part of Spybot not a virus :)

Is it the webrep that is not working in chrome ?  If so it may be because it has not been updated to be compliant with the latest chrome version

Quote
The item I can't seem to find I found it in the AppData Roaming files called IObit
If that was uninstalled then it will not be present

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #5 on: July 14, 2013, 09:09:07 PM »
Quote
C:\ProgramData\Spybot-Search\Destroy\Recovery\Wilqfraud.Zip|>sbRecovery.reg
This is part of Spybot not a virus :)
But there are probably around 30 of these that can't be opened because their PW protected and I don't have that on my PC anymore. How do I remove them?
Is it the webrep that is not working in chrome ?  If so it may be because it has not been updated to be compliant with the latest chrome version
My Chrome itself is working fine but when I uninstalled the Avast and then deleted all the duplicated Avasts items I had in my downloads folder and went to install the one you had here for me that's when I couldn't get my Chrome in there like it was last time when you helped me.
Quote
The item I can't seem to find I found it in the AppData Roaming files called IObit
If that was uninstalled then it will not be present
  But I was trying to delete this file and it won't let me. I'm not understanding why it won't let me delete it.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Essexboy I need your help again please
« Reply #6 on: July 14, 2013, 09:10:09 PM »
That is because Spybot has set protections on it, would you like me to delete it ?

Download OTL  to your Desktop
Secondary link
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.


  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
dir "%systemdrive%\*" /S /A:L /C
CREATERESTOREPOINT


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post  both logs

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #7 on: July 15, 2013, 09:28:56 PM »
I apologize essexboy for running out on you yesterday...I was sorta kidnapped in a sense lol...it was my "BIG" birthday yesterday and apparently I was oblivious to what was going on around me outside until my daughter actually blindfolded me and took me away for the rest of the day so I'm very sorry to have run out like that. I actually woke up this morning thinking I was 51 already :-[ 

I need to go back to this quote here first where you said that it's not a virus.. Ok that's cool...I'm going to follow those instructions you posted to get rid of all those that are PW protected and I can't get rid of.

C:\ProgramData\Spybot-Search\Destroy\Recovery\Wilqfraud.Zip|>sbRecovery.reg[/quote] This is part of Spybot not a virus :)


"Is it the webrep that is not working in chrome ?  If so it may be because it has not been updated to be compliant with the latest chrome version"
 
My Chrome itself is working fine but when I uninstalled the Avast and then deleted all the duplicated Avasts items I had in my downloads folder and went to install the one you had here for me that's when I couldn't get my Chrome in there like it was last time when you helped me.

The item I can't seem to find I found it in the AppData Roaming files called IObit

[/quote]If that was uninstalled then it will not be present[/quote]

 But I was trying to delete this file and it won't let me. I'm not understanding why it won't let me delete it. When I click on that folder it says Advance system care...and I can't find that anywhere on my PC..That's what I was trying to say...

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #8 on: July 15, 2013, 09:42:55 PM »
Just a quick question before I run this...It said do not change any buttons unless told to do so...when looking at all the buttons I don't have the all the same ones...like include 64-bit scans I do not have that...Where it says  "Extra Registry" in the pix here that you posted its on NONEand in the mine is one Use Safe Listshould I change this?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Essexboy I need your help again please
« Reply #9 on: July 15, 2013, 11:14:10 PM »
No leave as is please

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #10 on: July 15, 2013, 11:44:36 PM »
Ok

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #11 on: July 16, 2013, 01:07:16 AM »
Essexboy I tried posting both logs and I got an error that the message exceeds the maximum allowed length 10000 characters... Not sure what you what me to do now...

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #12 on: July 16, 2013, 02:18:04 AM »
Well I saved everything for you hopefully we can catch each other tomorrow or something.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89033
  • No support PMs thanks
Re: Essexboy I need your help again please
« Reply #13 on: July 16, 2013, 02:40:27 AM »
Use the attachment function to attach the logs, see image, click to expand.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

DoeZ

  • Guest
Re: Essexboy I need your help again please
« Reply #14 on: July 16, 2013, 02:58:55 AM »
What if I have to split them in half? Will they be understood?