Malware/Adware attack...logs attached

[REDACTED]

Following the instructions in the Cleaning Malware sticky, I've run the tools recommended and I'm attaching the logs.

I was doing a Google search this afternoon and avast! warned me that it had blocked an attack (I didn't catch a screenshot of it). Right after that I began getting flooded with emails from one sender, same email, one after the other. Amazingly I've had this happen before (!!!!), but don't recall what was done to clean it up - except that I came here.

Also, I haven't changed anything since this attack, but I did notice that my avast! firewall is off. Windows firewall is on, but I thought that I usually had avast! on. I looked at avast's firewall log and it was frightening. But I also don't know what I am looking at... May be fine but thought it worth mentioning.
Thanks!

[essexboy]

Avast has a few temp files pending install so mayhap a reboot will fix the firewall.  Re the Spam it appears that some one has harvested your e-mail address.  Did you enter it on that website ?

After FRST reboots could you let me know if the firewall has started



CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - No Name - {724d43a0-0d85-11d4-9908-00400523e39a} -  No File
CHR StartupUrls: Default -> "hxxp://www.google.com/", "hxxp://www.google.com", "https://gmail.com/", "hxxp://torrentz.eu/", "https://www.suntrust.com/portal/server.pt?open=space&name=Login&control=Login&doLogout=&clearsession=true&in_hi_userid=4761300&cached=true", "hxxp://search.conduit.com/?ctid=CT3323878&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP801FCE35-DA1F-452D-BF1F-6E135655B0BD&SSPV=", "hxxp://us.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}"
S2 MCSTRM; No ImagePath
2015-02-12 18:47 - 2014-07-23 14:20 - 00003132 _____ () C:\Windows\System32\Tasks\{32C03748-0A9E-452A-AF9D-CAB82AC19E44}
2015-02-12 18:47 - 2014-02-01 18:18 - 00003132 _____ () C:\Windows\System32\Tasks\{4ACA8325-E9CF-4929-B054-F3E76FC0C4E4}
2015-02-12 18:47 - 2014-02-01 18:12 - 00003132 _____ () C:\Windows\System32\Tasks\{836A4CA2-1838-4A4B-BA0C-CD571AC5EE10}
2015-02-12 18:47 - 2014-02-01 16:10 - 00003132 _____ () C:\Windows\System32\Tasks\{7683C17E-C853-4107-B35B-BC88AB53C150}
2014-03-20 18:19 - 2014-12-16 15:09 - 0000004 _____ () C:\Users\Pat1\AppData\Roaming\E2E667
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
CustomCLSID: HKU\S-1-5-21-299275500-1266714273-1661499401-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Pat1\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll No File
Task: {1C6437BE-D6F0-4A19-810A-EFEDB2780075} - System32\Tasks\{E89D5A31-A697-45E3-BD2E-2B990502BFBF} => pcalua.exe -a C:\Users\Pat1\Downloads\converter.exe -d C:\Users\Pat1\Downloads
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Hi Essexboy,
avast! requested a reboot first thing this morning, so I did that. avast's firewall is now on and set to Public(?), Windows Firewall is also on - private and public are both on, saying private is connected and public is not. I have a home office with wifi. I guess I'm not sure which way it should be set but I did think Windows OR avast! should be on but not both.

As to the spam, the company is an industry name. I think I probably sent an 'Unsubscribe' although I've recently stopped doing even that. So not sure.

Fixlog.txt is attached.

Thanks so much for your help!

[essexboy]

Turn off windows firewall as it is not required.  How is the computer behaving.

You may need to reset Chrome homepage as I had to reset it to default when I found conduit hiding in it

[REDACTED]

Ok, I've turned Windows Firewall off. avast! firewall is on, set to Public. I'm confused by that. I thought that was for airport, coffee shop, etc. Since I'm home office, I would think that should be set to Private. Or does Public protect it from 'drive-bys' and such hacking in?

I did need to re-set Chrome but no biggie. Probably a good thing anyway, did a little housekeeping.

Computer is running fine. Thanks!

[essexboy]

Set the firewall to private as public is very restricted

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Remove tools

Download and run Delfix



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme 

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide  Best security practices Keep safe  :wave:

[REDACTED]

Hi Essexboy,
Just popping in to say all is well and running smoothly. I've loaded all three programs you suggested. My firewall is set to Private.

Can't thank you enough for all of your help.  I'll try to stay out of the forum! (but it is nice to know you're here )

Thank You!!!

[essexboy]

My pleasure