Help me pls

[REDACTED]

So I made a topic in the wrong place under a different name, but I was told it was ok and I could continue.
But now I think the topic was deleted or something. I'll post the logs again. Please help I need this computer healthy.

[REDACTED]

Also the last think I was told was to run farbar with this fixlist.txt and attach the log, but I don't remember what I was told to do after that.

[DavidR]

If you can post some general information about the problem you are experiencing. Please don't do anything further until one of the specialists can take a look.

I will try to have one of the malware removal specialists take a look at your logs.

[essexboy]

Is this your thread https://forum.avast.com/index.php?topic=154514.msg1124192#msg1124192

Are the alerts still appearing

[REDACTED]

yes I'm pretty sure thats my old thread, but I cant go to it I get an error. Yes I'm still getting alerts and I'm starting to get these random advertisements and stuff that I've never had before.
I'm getting alerts from avast with these urls in formats like this
http://puu.sh/aAsnk/379f250a33.png
http://puu.sh/aAspW/eb3b6f05ea.png

and i can post the long list of urls if you need me to.
When I scan I usually don't find anything and when I do it still happens when I quarantine or remove.

[REDACTED]

the ads are popping up all over my browser and turning random words into hyperlinks. and everytime I click on a normal link it sends me to something like mavoo.net before going to what I actually intended.

[essexboy]

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

HKU\S-1-5-21-1057524887-1116411116-517451733-1000\...\MountPoints2: {58ec0046-5f54-11e3-ae9f-806e6f6e6963} - D:\Run.exe 
CHR Extension: (save on) - C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki [2014-06-15]
CHR Extension: (save on) - C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki\2.14 [2014-06-15]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S3 X6va021; \??\C:\Windows\SysWOW64\Drivers\X6va021 [X]
S3 X6va022; \??\C:\Windows\SysWOW64\Drivers\X6va022 [X]
2014-09-10 07:53 - 2014-06-15 23:14 - 00000000 ____D () C:\Program Files (x86)\SaaVe! on
2014-09-09 18:56 - 2014-06-19 01:07 - 00000000 ____D () C:\Program Files (x86)\osu!
EmptyTemp:
2014-08-14 14:05 - 2014-08-14 14:04 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
C:\Users\Truong\jagex_cl_oldschool_LIVE.dat
C:\Users\Truong\jagex_cl_runescape_LIVE.dat
C:\Users\Truong\random.dat
C:\Users\Truong\AppData\Local\Temp\CD50.tmp
C:\Users\Truong\AppData\Roaming\Curse Client\Bin\Curse.SocketMessages.dll
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.
  

[REDACTED]

this is the one I got after the fix thing

[REDACTED]

# AdwCleaner v3.310 - Report created 13/09/2014 at 12:25:41
# Updated 12/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Truong - TRUONG-PC
# Running from : C:\Users\Truong\Desktop\Wormkilling\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Adblocker
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\Truong\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Truong\AppData\Local\torch
Folder Deleted : C:\Users\Truong\AppData\Roaming\1H1Q
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbkgnpnhfcgkbcbjdcmbalijalplechk
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgbkaokckgmhoefenegnlbmbniifckb
[!] Folder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki
[!] Folder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgnlkodlamnapglkdgihhboejhbfciki

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatewebget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\utilwebget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\webget_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\RegisteredApplicationsEx
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{993EA8F6-6E55-7E4E-39DE-5796E3226DB9}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17280


-\\ Google Chrome v37.0.2062.120

[ File : C:\Users\Truong\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Extension] : cbkgnpnhfcgkbcbjdcmbalijalplechk
Deleted [Extension] : ghgbkaokckgmhoefenegnlbmbniifckb
Deleted [Extension] : jgnlkodlamnapglkdgihhboejhbfciki

*************************

AdwCleaner[R0].txt - [4437 octets] - [13/09/2014 12:24:48]
AdwCleaner[S0].txt - [4359 octets] - [13/09/2014 12:25:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4419 octets] ##########

[REDACTED]

Is that what you needed?

[REDACTED]

And the advertisements are getting worse and worse

[essexboy]

Could you screenshot the Avast alert please as there is a lot more information there

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[REDACTED]

well this is the log and this is a puush of what the alert looked like, but that alert doesn't pop up anymore, the ads are gone,
but all my extensions and bookmarks are gone too. I think this might have fixed it.
http://puu.sh/aAspW/eb3b6f05ea.png


How do I know for sure if my computer is ok now?

[REDACTED]

Also, my ad blocker is gone. Does that mean ad blocker was the problem? I shouldn't get ad blocker anymore?

[essexboy]

Comodo dragon was the problem

The alert I was after was the one that pops up on your desktop as that tells me what programme was causing the alert

Adblocker should be OK

How is the computer now ?