« previous next »
Pages: [1] 2 3 ... 5   Go Down

Author Topic: Loads of malware!!!  (Read 25142 times)

0 Members and 1 Guest are viewing this topic.

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Loads of malware!!!
« on: August 01, 2013, 07:18:42 PM »
Malwarebytes found about 22 infections about a week or two ago... I cleaned them off and rechecked and there was nothing. I checked again today and it found about 40. I can't think what I've been doing other than normal to get these kind of results other than I downloaded Hotspot Shield but I don't know if that would cause it.
Logged

Offline mikaelrask

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1556
Re: Loads of malware!!!
« Reply #1 on: August 01, 2013, 07:24:32 PM »
hey and welcome to avast forum.

please follow this guide and attach your logs

http://forum.avast.com/index.php?topic=53253.0

we need the logs from adwclener,mbam,otl and aswmbr.
 
Logged
Windows 8.1 amd a10-5700 64 bit
12 GB ram 1 tb hard drive. Avast 18, MBAM

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #2 on: August 01, 2013, 07:34:14 PM »
Monitoring...  I see you download a lot of "free" programmes.  If you do this always select custom install and untick everything except the main programme 
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #3 on: August 01, 2013, 07:43:15 PM »
Adw log.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #4 on: August 01, 2013, 07:48:51 PM »
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #5 on: August 01, 2013, 07:55:04 PM »
Oh f**k, I know exactly what's causing it now and why its only just started recently... I'm having a heart attack though - it suggests its likely been stealing my personal details. Is there anyway of knowing that from the logs I'm uploading? Irritating malware is one thing but if they've stolen my bank details etc its totally another.

Another thing that's happened recently is my task manager has gone weird - it now only shows this when I press ctrl+alt+del - see below.
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #6 on: August 01, 2013, 08:03:39 PM »
OTL log - can't find an extras.txt one.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #7 on: August 01, 2013, 08:37:20 PM »
Why do you feel you have a data stealer ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
SRV - [2013/05/14 22:57:58 | 000,101,888 | ---- | M] (Freemake) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
IE - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\SearchScopes\{8329A13E-52BC-435A-973E-3F941A20C25B}: "URL" = http://www.mysearchresults.com/search?c=2402&t=01&q={searchTerms}
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ytfmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
2013/05/18 16:51:27 | 000,000,000 | ---D | M] (MixiDJ Toolbar) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\ffxtlbr@mixidj.com
[2013/02/17 11:04:43 | 000,093,072 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\canitbecheaper@trafficbroker.co.uk.xpi
[2013/06/09 20:52:54 | 000,004,525 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2013/07/23 21:37:45 | 000,014,938 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
[2013/07/19 21:57:46 | 000,223,750 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013/07/31 10:01:06 | 000,824,302 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/06/14 11:24:57 | 000,000,000 | ---D | M] (TS Magic Player) -- C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\APPLICATION DATA\TORRENTSTREAM\EXTENSIONS\FIREFOX\MAGICPLAYER@TORRENTSTREAM.ORG
[2013/05/16 15:48:16 | 000,000,000 | ---D | M] (Freemake Youtube Download Button) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX\YTFMDOWNLOADER@GMAIL.COM
O2 - BHO: (no name) - {7825CFB6-490A-436B-9F26-4A7B5CFC01A9} - No CLSID value found.
O3 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O15 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..Trusted Domains: vizzed.com ([www] * in Trusted sites)
[2012/06/08 22:03:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_019
[2013/01/05 20:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_031
[2012/06/08 21:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\Complitly
[2013/01/05 20:54:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\PriceGong

:Files
C:\Documents and Settings\All Users\Application Data\Freemake

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #8 on: August 01, 2013, 08:49:16 PM »
Quote from: essexboy on August 01, 2013, 08:37:20 PM
Why do you feel you have a data stealer ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:Commands
[CREATERESTOREPOINT]

:OTL
SRV - [2013/05/14 22:57:58 | 000,101,888 | ---- | M] (Freemake) [Auto | Running] -- C:\Documents and Settings\All Users\Application Data\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
IE - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\SearchScopes\{8329A13E-52BC-435A-973E-3F941A20C25B}: "URL" = http://www.mysearchresults.com/search?c=2402&t=01&q={searchTerms}
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ytfmdownloader@gmail.com: C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\ [2013/05/16 15:48:16 | 000,000,000 | ---D | M]
2013/05/18 16:51:27 | 000,000,000 | ---D | M] (MixiDJ Toolbar) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\ffxtlbr@mixidj.com
[2013/02/17 11:04:43 | 000,093,072 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\canitbecheaper@trafficbroker.co.uk.xpi
[2013/06/09 20:52:54 | 000,004,525 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2013/07/23 21:37:45 | 000,014,938 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
[2013/07/19 21:57:46 | 000,223,750 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013/07/31 10:01:06 | 000,824,302 | ---- | M] () (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\hv7zig86.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/06/14 11:24:57 | 000,000,000 | ---D | M] (TS Magic Player) -- C:\DOCUMENTS AND SETTINGS\HP_ADMINISTRATOR\APPLICATION DATA\TORRENTSTREAM\EXTENSIONS\FIREFOX\MAGICPLAYER@TORRENTSTREAM.ORG
[2013/05/16 15:48:16 | 000,000,000 | ---D | M] (Freemake Youtube Download Button) -- C:\PROGRAM FILES\FREEMAKE\FREEMAKE VIDEO DOWNLOADER\BROWSERPLUGIN\FIREFOX\YTFMDOWNLOADER@GMAIL.COM
O2 - BHO: (no name) - {7825CFB6-490A-436B-9F26-4A7B5CFC01A9} - No CLSID value found.
O3 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O15 - HKU\S-1-5-21-1978641482-424277871-33217558-1007\..Trusted Domains: vizzed.com ([www] * in Trusted sites)
[2012/06/08 22:03:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_019
[2013/01/05 20:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\blekkotb_031
[2012/06/08 21:49:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\Complitly
[2013/01/05 20:54:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Andrew\Application Data\PriceGong

:Files
C:\Documents and Settings\All Users\Application Data\Freemake

:Commands
[resethosts]
[emptytemp]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

I only feel I could have a data stealer because that article you linked to suggests these sites you've been telling me about steal data. Its not that I think I have, I'm just concerned about the possibility. I have no evidence or reason for feeling it other than the article.

Aswmbr log attached.
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #9 on: August 01, 2013, 09:01:33 PM »
Here's the log from the fix you told me to do :).
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #10 on: August 01, 2013, 09:17:09 PM »
How is the computer behaving now ?
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #11 on: August 01, 2013, 09:38:57 PM »
Not to be rude but it was ok before and its ok now (it does seem quicker though), it was just that I happened to find loads of malware during a scan.

I also ran an avast scan which showed up nothing except it couldn't scan some files - flashplayer ones - but that is quite typical.

My biggest problem is task manager is still weird. See the attached picture - when I press ctrl+alt+del I don't get the usual screen. - Sorry fixed that now - saw how to do it on a youtube video. The computer seems much quicker btw.
« Last Edit: August 01, 2013, 09:45:34 PM by Interista »
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #12 on: August 01, 2013, 11:21:00 PM »
No problem, speed and internet should increase not that all the adware stuff has gone.  Otherwise it was clean

I wasn't quite sure what you meant before about task manager, but I now realise you were in minimal mode
Logged

Offline Interista

  • Sr. Member
  • ****
  • Posts: 332
Re: Loads of malware!!!
« Reply #13 on: August 02, 2013, 12:18:25 AM »
Hopefully bitmeter should normalise a bit too. I had noticed it was a bit high lately, maybe due to the adware.

I ran a new Malwarebytes scan - it reported clean.

Thanks for your help.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Loads of malware!!!
« Reply #14 on: August 02, 2013, 03:17:03 PM »
Subject to no further problems   :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :Commands
    [resethosts]
    [emptytemp]
    [CLEARALLRESTOREPOINTS]
     [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
Run AdwCleaner and press uninstall

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

If you use on-line banking then as an added layer of protection install Trusteer Rapport

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?Keep safe  :wave:
Logged
Pages: [1] 2 3 ... 5   Go Up
« previous next »