Author Topic: Am i infected with anything?  (Read 5530 times)

0 Members and 1 Guest are viewing this topic.

Zyla

  • Guest
Am i infected with anything?
« on: July 24, 2013, 12:17:26 AM »
Been a little sluggish on computer, so wondering if there is anything:


Offline mikaelrask

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1557
Re: Am i infected with anything?
« Reply #1 on: July 24, 2013, 08:43:59 AM »
hey and welcome to the forum. please also attach the logs from adwclener and mbam from this log.

http://forum.avast.com/index.php?topic=53253.0

a malware expert will help you from there  ;)
Windows 8.1 amd a10-5700 64 bit
12 GB ram 1 tb hard drive. Avast 18, MBAM

jeffce

  • Guest
Re: Am i infected with anything?
« Reply #2 on: July 24, 2013, 01:31:14 PM »
Hi and Welcome!!   

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
  • Please be sure to subscribe to the topic if you have not already done so.
IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.


Having said that....      Let's get going!! 
----------

AdwCleaner
  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • You will be prompted to restart your computer. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
----------

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #3 on: July 24, 2013, 08:00:18 PM »
Here are the MBAM and adwcleaner logs

jeffce

  • Guest
Re: Am i infected with anything?
« Reply #4 on: July 25, 2013, 02:01:47 AM »
  Download CKScanner by askey127 from Here & save it to your Desktop.
  • Right-click and Run as Administrator CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #5 on: July 25, 2013, 02:43:39 AM »
This is what it had:

CKScanner 2.3 - Additional Security Risks - These are not necessarily bad
scanner sequence 3.MN.11.UJAPRG
 ----- EOF -----

jeffce

  • Guest
Re: Am i infected with anything?
« Reply #6 on: July 26, 2013, 03:45:01 AM »
Sorry for any delay...I had a long work day and also my son's football practice to coach. 

Tweaking.com Registry Backup
  • Download the tool found here to your Desktop so it is easy to find.
  • Double click on the file you just downloaded to install it to your system.
  • Once the tool is installed, double-click on the Tweaking.com Registry Backup icon
    **Note** The tool should automatically open to the Backup Registry tab.



  • Press Backup Now
  • When the back up is complete, the tool will tell you that Successful */* Files Backed Up
  • You have now successfully backed up your Registry.
------------------------

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code: [Select]
:Services

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKU\S-1-5-21-3473907442-2693749499-135434744-1000\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O15 - HKU\S-1-5-21-3473907442-2693749499-135434744-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3473907442-2693749499-135434744-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3473907442-2693749499-135434744-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3473907442-2693749499-135434744-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O33 - MountPoints2\{dff56e7e-6b22-11e2-a1a3-7071bc1112d5}\Shell - "" = AutoRun
O33 - MountPoints2\{dff56e7e-6b22-11e2-a1a3-7071bc1112d5}\Shell\AutoRun\command - "" = F:\ToolLauncher-Bootstrap.exe
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[emptytemp]
[resethosts]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )
Attach the new OTL log and let me know how your system is running now.  :)

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #7 on: July 26, 2013, 10:17:17 AM »
Actually i dont think anything else is needed to be done, things seem to be running fine.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37134
  • Not a avast user
Re: Am i infected with anything?
« Reply #8 on: July 26, 2013, 01:17:26 PM »
Actually i dont think anything else is needed to be done, things seem to be running fine.
one more thing....when all is ok, jeffce will remove the tools used


jeffce

  • Guest
Re: Am i infected with anything?
« Reply #9 on: July 26, 2013, 01:40:08 PM »
Glad to hear that things seems to be running well now.  Is that before or after you ran the last set of instructions with OTL?  If it was before, please run the last set of instructions.  An absence of symptoms does not mean an absence of the infection.  :)

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #10 on: July 26, 2013, 08:23:15 PM »
Here is the new OTL log

jeffce

  • Guest
Re: Am i infected with anything?
« Reply #11 on: July 26, 2013, 09:14:05 PM »
Good...when you ran OTL the first time did it create a log named Extras.txt?  If so could you attach that please?  If not please do the following...

Please open OTL.

  • Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, click the None button near the top (it may looked greyed out)
  • In the Extra Registry section change it to All
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open 2 notepad windows, OTL.Txt and Extra.txt. Please attach the Extra.txt.
----------

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #12 on: July 26, 2013, 09:38:41 PM »
This is the extras it made when i first ran it:

jeffce

  • Guest
Re: Am i infected with anything?
« Reply #13 on: July 26, 2013, 09:41:19 PM »
Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan.  Save the log that is created for your next reply.
----------

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.
----------

Zyla

  • Guest
Re: Am i infected with anything?
« Reply #14 on: July 26, 2013, 11:21:16 PM »
Here they are, dont know if ESET uninstalled correctly though (still have the ESET folder with only the uninstall in it)